{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-576975638118d504", "name": "Possibly dead Python function: fwd_bwd_original", "shortDescription": {"text": "Possibly dead Python function: fwd_bwd_original"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f2e2192c5a726d79", "name": "Possibly dead Python function: fwd_bwd_triton", "shortDescription": {"text": "Possibly dead Python function: fwd_bwd_triton"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7dd230859f31b0ef", "name": "Possibly dead Python function: original_with_copy", "shortDescription": {"text": "Possibly dead Python function: original_with_copy"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2e1deb5ba5bcd21c", "name": "Possibly dead Python function: complex_training_step", "shortDescription": {"text": "Possibly dead Python function: complex_training_step"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-04e34ddc7b3a9c3f", "name": "Possibly dead Python function: wrap_dataset_for_tokenized_prompt", "shortDescription": {"text": "Possibly dead Python function: wrap_dataset_for_tokenized_prompt"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f1116306876469bf", "name": "Possibly dead Python function: llm_worker", "shortDescription": {"text": "Possibly dead Python function: llm_worker"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e1fd67c17b499ce9", "name": "Possibly dead Python function: http_load_weights", "shortDescription": {"text": "Possibly dead Python function: http_load_weights"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b522475366865fe2", "name": "Possibly dead Python function: http_load_weight", "shortDescription": {"text": "Possibly dead Python function: http_load_weight"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f61e8cb2fea63a66", "name": "Possibly dead Python function: safe_recv", "shortDescription": {"text": "Possibly dead Python function: safe_recv"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-88557015fba74b84", "name": "Possibly dead Python function: trainer_weighted_loss", "shortDescription": {"text": "Possibly dead Python function: trainer_weighted_loss"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2e0c264fa0385883", "name": "Possibly dead Python function: add_position_ids", "shortDescription": {"text": "Possibly dead Python function: add_position_ids"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-45d3575388f4fb29", "name": "Possibly dead Python function: add_pose_position_ids", "shortDescription": {"text": "Possibly dead Python function: add_pose_position_ids"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-da0ea27e20f5df74", "name": "Possibly dead Python function: add_length", "shortDescription": {"text": "Possibly dead Python function: add_length"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a1804c96190e331f", "name": "Possibly dead Python function: process_datasets_for_packing", "shortDescription": {"text": "Possibly dead Python function: process_datasets_for_packing"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-04d6ca07ff0ac436", "name": "Possibly dead Python function: drop_no_trainable_tokens", "shortDescription": {"text": "Possibly dead Python function: drop_no_trainable_tokens"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d4295eb23f60abcb", "name": "Possibly dead Python function: process_pretraining_datasets_for_packing", "shortDescription": {"text": "Possibly dead Python function: process_pretraining_datasets_for_packing"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8aa7a4562478af7d", "name": "Possibly dead Python function: calculate_total_num_steps", "shortDescription": {"text": "Possibly dead Python function: calculate_total_num_steps"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ac76b214c432663c", "name": "Possibly dead Python function: calc_sample_packing_eff_est", "shortDescription": {"text": "Possibly dead Python function: calc_sample_packing_eff_est"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-76c7872eb15af1c3", "name": "Possibly dead Python function: load_sharded_model", "shortDescription": {"text": "Possibly dead Python function: load_sharded_model"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5d0a4d96612f6f9d", "name": "Possibly dead Python function: load_and_quantize_parallel", "shortDescription": {"text": "Possibly dead Python function: load_and_quantize_parallel"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-984ca87eec048df1", "name": "Possibly dead Python function: deco", "shortDescription": {"text": "Possibly dead Python function: deco"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6cfa3e76899ec5d5", "name": "Possibly dead Python function: freeze_parameters_hook", "shortDescription": {"text": "Possibly dead Python function: freeze_parameters_hook"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7b9b330fed646313", "name": "Possibly dead Python function: set_epoch", "shortDescription": {"text": "Possibly dead Python function: set_epoch"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-359a9ea0828be5f6", "name": "Possibly dead Python function: gather_efficiency", "shortDescription": {"text": "Possibly dead Python function: gather_efficiency"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b5d0d2d999ac79e5", "name": "Possibly dead Python function: calc_sample_packing_eff_est", "shortDescription": {"text": "Possibly dead Python function: calc_sample_packing_eff_est"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-27c09de066d32913", "name": "Possibly dead Python function: calc_min_len", "shortDescription": {"text": "Possibly dead Python function: calc_min_len"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-47636e33caef255d", "name": "Dockerfile runs as root: docker/Dockerfile", "shortDescription": {"text": "Dockerfile runs as root: docker/Dockerfile"}, "fullDescription": {"text": "No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b862a579a97d868b", "name": "Docker base image is tag-pinned but not digest-pinned: axolotlai/axolotl-base:$BASE_TAG", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: axolotlai/axolotl-base:$BASE_TAG"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e604d68c778c9bec", "name": "Insecure pattern 'exec_used' in src/axolotl/integrations/config.py:53", "shortDescription": {"text": "Insecure pattern 'exec_used' in src/axolotl/integrations/config.py:53"}, "fullDescription": {"text": "Found a known-risky pattern (exec_used). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-e1e4a7095dbfee74", "name": "Insecure pattern 'exec_used' in src/axolotl/monkeypatch/trainer_accelerator_args.py:73", "shortDescription": {"text": "Insecure pattern 'exec_used' in src/axolotl/monkeypatch/trainer_accelerator_args.py:73"}, "fullDescription": {"text": "Found a known-risky pattern (exec_used). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-e8b7bf1338c1e699", "name": "Insecure pattern 'exec_used' in src/axolotl/monkeypatch/fsdp2_qlora.py:94", "shortDescription": {"text": "Insecure pattern 'exec_used' in src/axolotl/monkeypatch/fsdp2_qlora.py:94"}, "fullDescription": {"text": "Found a known-risky pattern (exec_used). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-6a887ceb44c772eb", "name": "Insecure pattern 'exec_used' in src/axolotl/monkeypatch/lora_kernels.py:331", "shortDescription": {"text": "Insecure pattern 'exec_used' in src/axolotl/monkeypatch/lora_kernels.py:331"}, "fullDescription": {"text": "Found a known-risky pattern (exec_used). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-a84c9e3d3f87345b", "name": "Insecure pattern 'exec_used' in src/axolotl/monkeypatch/peft/utils.py:69", "shortDescription": {"text": "Insecure pattern 'exec_used' in src/axolotl/monkeypatch/peft/utils.py:69"}, "fullDescription": {"text": "Found a known-risky pattern (exec_used). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-39f6793a18552efb", "name": "Insecure pattern 'exec_used' in src/axolotl/monkeypatch/models/mistral3/mistral_common_tokenizer.py:55", "shortDescription": {"text": "Insecure pattern 'exec_used' in src/axolotl/monkeypatch/models/mistral3/mistral_common_tokenizer.py:55"}, "fullDescription": {"text": "Found a known-risky pattern (exec_used). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-af77403a91af59a6", "name": "Insecure pattern 'exec_used' in src/axolotl/monkeypatch/transformers/trainer_loss_calc.py:88", "shortDescription": {"text": "Insecure pattern 'exec_used' in src/axolotl/monkeypatch/transformers/trainer_loss_calc.py:88"}, "fullDescription": {"text": "Found a known-risky pattern (exec_used). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-6372cebde0220094", "name": "No auth library detected", "shortDescription": {"text": "No auth library detected"}, "fullDescription": {"text": "The scanner did not find any standard auth library (JWT, OAuth, NextAuth, Auth0, etc.). The repo has auth/admin/session surface indicators, so auth may live in custom code, in a separate service, or be missing."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d5e115454487edbe", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-caf1867e209c784f", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "peter-evans/create-pull-request@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-58e7c235ccf4e75f", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-389efec94822a700", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0763d85002569570", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-14ce8614dd03f409", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1a50467f36b413ec", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1d7e834080dbebed", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-719e6e363f39d55f", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-aec74b812ddd7969", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3a423677b6b5780f", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3d1309ce707c39a5", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-974eab98d181a9fb", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e4a3344ba35d7f46", "name": "Very large file: tests/test_processing_strategies.py (1583 lines)", "shortDescription": {"text": "Very large file: tests/test_processing_strategies.py (1583 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5e4217d2dff05f19", "name": "Very large file: tests/patched/test_validation.py (1822 lines)", "shortDescription": {"text": "Very large file: tests/patched/test_validation.py (1822 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fa4469f60b42fef7", "name": "Very large file: tests/prompt_strategies/test_chat_templates_advanced.py (1906 lines)", "shortDescription": {"text": "Very large file: tests/prompt_strategies/test_chat_templates_advanced.py (1906 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fabb75b1c0f7e87a", "name": "Very large file: tests/e2e/integrations/test_scattermoe_lora_kernels.py (1860 lines)", "shortDescription": {"text": "Very large file: tests/e2e/integrations/test_scattermoe_lora_kernels.py (1860 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ccbfbf2b8fe13972", "name": "Very large file: scripts/analyze_profile.py (1518 lines)", "shortDescription": {"text": "Very large file: scripts/analyze_profile.py (1518 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7c529336f0e9a2a8", "name": "Very large file: src/axolotl/processing_strategies.py (1523 lines)", "shortDescription": {"text": "Very large file: src/axolotl/processing_strategies.py (1523 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-07ba56cb5c891a5d", "name": "Very large file: src/axolotl/utils/schemas/validation.py (1882 lines)", "shortDescription": {"text": "Very large file: src/axolotl/utils/schemas/validation.py (1882 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a311dd1d36aa67b9", "name": "Very large file: src/axolotl/utils/schemas/config.py (2043 lines)", "shortDescription": {"text": "Very large file: src/axolotl/utils/schemas/config.py (2043 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a789759fd67addb7", "name": "Very large file: src/axolotl/integrations/kernels/libs/scattermoe_lora/kernels/lora_ops.py (3312 lines)", "shortDescription": {"text": "Very large file: src/axolotl/integrations/kernels/libs/scattermoe_lora/kernels/lora_ops.py (3312 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-333cfe10d509edad", "name": "Very large file: src/axolotl/monkeypatch/models/kimi_linear/modeling_kimi.py (1361 lines)", "shortDescription": {"text": "Very large file: src/axolotl/monkeypatch/models/kimi_linear/modeling_kimi.py (1361 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1aae6d358513c305", "name": "Very large file: src/axolotl/kernels/lora.py (2037 lines)", "shortDescription": {"text": "Very large file: src/axolotl/kernels/lora.py (2037 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a61f948b72354c19", "name": "Very large file: src/axolotl/core/trainers/grpo/async_trainer.py (3257 lines)", "shortDescription": {"text": "Very large file: src/axolotl/core/trainers/grpo/async_trainer.py (3257 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1d89deef6ddcb4e7", "name": "Very large file: src/axolotl/prompt_strategies/chat_template.py (1250 lines)", "shortDescription": {"text": "Very large file: src/axolotl/prompt_strategies/chat_template.py (1250 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c1c50b392d6630c3", "name": "46 TODO/FIXME markers", "shortDescription": {"text": "46 TODO/FIXME markers"}, "fullDescription": {"text": "High count of TODO/FIXME/HACK markers \u2014 track them as issues so they're not forgotten."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 255 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-72b2a6250083a784", "name": "Placeholder or mock-heavy implementation detected", "shortDescription": {"text": "Placeholder or mock-heavy implementation detected"}, "fullDescription": {"text": "Found 52 placeholder/mock markers across 21 source files. This often means the repo looks complete while core flows still use generated scaffolding or fake data."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2679282aa1c484b5", "name": "Agent authority lacks a verifier contract: AGENTS.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: AGENTS.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-73768dabc9b94ec2", "name": "Legacy-named symbol `cfg_old` in tests/test_streaming.py:22", "shortDescription": {"text": "Legacy-named symbol `cfg_old` in tests/test_streaming.py:22"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fd5819871600cdcb", "name": "Commented-code block (5 lines) in tests/conftest.py:225", "shortDescription": {"text": "Commented-code block (5 lines) in tests/conftest.py:225"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-3f272da4248017c8", "name": "Commented-code block (5 lines) in tests/integrations/monkeypatch/test_tiled_mlp_moe.py:146", "shortDescription": {"text": "Commented-code block (5 lines) in tests/integrations/monkeypatch/test_tiled_mlp_moe.py:146"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-bd07b21f744150a8", "name": "Commented-code block (6 lines) in tests/integrations/kernels/scattermoe_lora/test_mxfp4_expert_weights.py:61", "shortDescription": {"text": "Commented-code block (6 lines) in tests/integrations/kernels/scattermoe_lora/test_mxfp4_expert_weights.py:61"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-2fc66cbdfbcf0a85", "name": "Commented-code block (6 lines) in tests/integrations/kernels/scattermoe_lora/bench_mxfp4.py:195", "shortDescription": {"text": "Commented-code block (6 lines) in tests/integrations/kernels/scattermoe_lora/bench_mxfp4.py:195"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-5e21f7b61c8a22b6", "name": "Commented-code block (6 lines) in tests/monkeypatch/test_trl_vllm.py:276", "shortDescription": {"text": "Commented-code block (6 lines) in tests/monkeypatch/test_trl_vllm.py:276"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-711c74d6584a8ff7", "name": "Commented-code block (5 lines) in tests/prompt_strategies/test_chat_templates_advanced.py:1324", "shortDescription": {"text": "Commented-code block (5 lines) in tests/prompt_strategies/test_chat_templates_advanced.py:1324"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-f4611207a342be7c", "name": "Commented-code block (7 lines) in tests/e2e/test_quantization.py:97", "shortDescription": {"text": "Commented-code block (7 lines) in tests/e2e/test_quantization.py:97"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-1e934a84051416d4", "name": "Commented-code block (5 lines) in tests/e2e/test_activation_offloading.py:338", "shortDescription": {"text": "Commented-code block (5 lines) in tests/e2e/test_activation_offloading.py:338"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-8b56424fab326597", "name": "Legacy-named symbol `gate_copy` in tests/e2e/kernels/test_swiglu.py:67", "shortDescription": {"text": "Legacy-named symbol `gate_copy` in tests/e2e/kernels/test_swiglu.py:67"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7563219776f0392e", "name": "Legacy-named symbol `gate_copy` in tests/e2e/kernels/test_geglu.py:80", "shortDescription": {"text": "Legacy-named symbol `gate_copy` in tests/e2e/kernels/test_geglu.py:80"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d3517796a98c5dfc", "name": "Legacy-named symbol `_to_copy` in scripts/analyze_profile.py:70", "shortDescription": {"text": "Legacy-named symbol `_to_copy` in scripts/analyze_profile.py:70"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-05ef30194e725de2", "name": "Legacy-named symbol `original_with_copy` in benchmarks/bench_entropy.py:177", "shortDescription": {"text": "Legacy-named symbol `original_with_copy` in benchmarks/bench_entropy.py:177"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d7ea90d7c3fd6527", "name": "Commented-code block (5 lines) in src/axolotl/processing_strategies.py:118", "shortDescription": {"text": "Commented-code block (5 lines) in src/axolotl/processing_strategies.py:118"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-87e125602beea033", "name": "Stub function `wrap_dataset` (body is just `pass`/`return`) \u2014 src/axolotl/prompt_tokenizers.py:33", "shortDescription": {"text": "Stub function `wrap_dataset` (body is just `pass`/`return`) \u2014 src/axolotl/prompt_tokenizers.py:33"}, "fullDescription": {"text": "Likely an AI scaffold that was never filled in. Remove or implement."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-97e1223b297a929b", "name": "Commented-code block (7 lines) in src/axolotl/scripts/vllm_serve_lora.py:323", "shortDescription": {"text": "Commented-code block (7 lines) in src/axolotl/scripts/vllm_serve_lora.py:323"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-a14fc19f5c8bbf61", "name": "Commented-code block (5 lines) in src/axolotl/utils/model_shard_quant.py:106", "shortDescription": {"text": "Commented-code block (5 lines) in src/axolotl/utils/model_shard_quant.py:106"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-07416178d3541cdb", "name": "Legacy-named symbol `tokenizer_legacy` in src/axolotl/utils/schemas/model.py:46", "shortDescription": {"text": "Legacy-named symbol `tokenizer_legacy` in src/axolotl/utils/schemas/model.py:46"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-12ff36fd7b42cbf8", "name": "Legacy-named symbol `deepseek_v2` in src/axolotl/utils/schemas/datasets.py:80", "shortDescription": {"text": "Legacy-named symbol `deepseek_v2` in src/axolotl/utils/schemas/datasets.py:80"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b6d914ae4133fa22", "name": "Legacy-named symbol `deepseek_v2` in src/axolotl/utils/schemas/config.py:1274", "shortDescription": {"text": "Legacy-named symbol `deepseek_v2` in src/axolotl/utils/schemas/config.py:1274"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-12760599caaeb05b", "name": "Legacy-named symbol `mistral_v1` in src/axolotl/utils/schemas/enums.py:46", "shortDescription": {"text": "Legacy-named symbol `mistral_v1` in src/axolotl/utils/schemas/enums.py:46"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-703e3525f5388d0f", "name": "Stub function `chat_template` (body is just `pass`/`return`) \u2014 src/axolotl/utils/mistral/mistral_tokenizer.py:50", "shortDescription": {"text": "Stub function `chat_template` (body is just `pass`/`return`) \u2014 src/axolotl/utils/mistral/mistral_tokenizer.py:50"}, "fullDescription": {"text": "Likely an AI scaffold that was never filled in. Remove or implement."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8ca42c0f8b688034", "name": "Commented-code block (5 lines) in src/axolotl/utils/config/__init__.py:272", "shortDescription": {"text": "Commented-code block (5 lines) in src/axolotl/utils/config/__init__.py:272"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-38efefd44de0f914", "name": "Legacy-named symbol `deepseek_v2` in src/axolotl/integrations/liger/plugin.py:144", "shortDescription": {"text": "Legacy-named symbol `deepseek_v2` in src/axolotl/integrations/liger/plugin.py:144"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-623d14107291fc22", "name": "Network/subprocess call without timeout or try/except \u2014 src/axolotl/integrations/lm_eval/cli.py:139", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 src/axolotl/integrations/lm_eval/cli.py:139"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-59edab3342e91758", "name": "Network/subprocess call without timeout or try/except \u2014 src/axolotl/integrations/lm_eval/__init__.py:34", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 src/axolotl/integrations/lm_eval/__init__.py:34"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c9ea7c5889fbae42", "name": "Commented-code block (7 lines) in src/axolotl/integrations/kernels/args.py:8", "shortDescription": {"text": "Commented-code block (7 lines) in src/axolotl/integrations/kernels/args.py:8"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-18e44121c26db0bb", "name": "Commented-code block (5 lines) in src/axolotl/integrations/kernels/libs/scattermoe_lora/parallel_experts.py:1", "shortDescription": {"text": "Commented-code block (5 lines) in src/axolotl/integrations/kernels/libs/scattermoe_lora/parallel_experts.py:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-1c7e054796d0f8c0", "name": "Commented-code block (6 lines) in src/axolotl/integrations/kernels/libs/scattermoe_lora/parallel_linear_lora.py:146", "shortDescription": {"text": "Commented-code block (6 lines) in src/axolotl/integrations/kernels/libs/scattermoe_lora/parallel_linear_lora.py:146"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-99567d2a1d8c8f10", "name": "Commented-code block (5 lines) in src/axolotl/integrations/kernels/libs/scattermoe_lora/kernels/single.py:1", "shortDescription": {"text": "Commented-code block (5 lines) in src/axolotl/integrations/kernels/libs/scattermoe_lora/kernels/single.py:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-d8014715fdeecc79", "name": "Commented-code block (5 lines) in src/axolotl/integrations/kernels/libs/scattermoe_lora/kernels/lora_ops.py:2335", "shortDescription": {"text": "Commented-code block (5 lines) in src/axolotl/integrations/kernels/libs/scattermoe_lora/kernels/lora_ops.py:2335"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-b56d22783ab4b40b", "name": "Commented-code block (5 lines) in src/axolotl/integrations/kernels/libs/scattermoe_lora/kernels/ops.py:1", "shortDescription": {"text": "Commented-code block (5 lines) in src/axolotl/integrations/kernels/libs/scattermoe_lora/kernels/ops.py:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-2970dc0b52ad8abe", "name": "Commented-code block (5 lines) in src/axolotl/integrations/kernels/libs/sonicmoe/multi_lora.py:50", "shortDescription": {"text": "Commented-code block (5 lines) in src/axolotl/integrations/kernels/libs/sonicmoe/multi_lora.py:50"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-ac90fea4d5d58c46", "name": "Legacy-named symbol `load_legacy` in src/axolotl/integrations/kd/chat_template.py:334", "shortDescription": {"text": "Legacy-named symbol `load_legacy` in src/axolotl/integrations/kd/chat_template.py:334"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1f07ef950c5bad25", "name": "Commented-code block (5 lines) in src/axolotl/integrations/kd/collator_online_teacher.py:441", "shortDescription": {"text": "Commented-code block (5 lines) in src/axolotl/integrations/kd/collator_online_teacher.py:441"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-3ed27e08a2250a52", "name": "Commented-code block (6 lines) in src/axolotl/integrations/kd/kernels/liger.py:83", "shortDescription": {"text": "Commented-code block (6 lines) in src/axolotl/integrations/kd/kernels/liger.py:83"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-d802e4bbaea1ff80", "name": "Network/subprocess call without timeout or try/except \u2014 src/axolotl/integrations/nemo_gym/server.py:53", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 src/axolotl/integrations/nemo_gym/server.py:53"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d240f3d7f2f52cf9", "name": "Commented-code block (8 lines) in src/axolotl/integrations/nemo_gym/data_producer.py:113", "shortDescription": {"text": "Commented-code block (8 lines) in src/axolotl/integrations/nemo_gym/data_producer.py:113"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-44a41f0f3f1e5512", "name": "Commented-code block (5 lines) in src/axolotl/integrations/hatchery/__init__.py:21", "shortDescription": {"text": "Commented-code block (5 lines) in src/axolotl/integrations/hatchery/__init__.py:21"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-01d231bd4b1d43ba", "name": "Stub function `set_input_embeddings` (body is just `pass`/`return`) \u2014 src/axolotl/integrations/hatchery/plugin.py:80", "shortDescription": {"text": "Stub function `set_input_embeddings` (body is just `pass`/`return`) \u2014 src/axolotl/integrations/hatchery/plugin.py:80"}, "fullDescription": {"text": "Likely an AI scaffold that was never filled in. Remove or implement."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f4d22e78b4b79cca", "name": "Legacy-named symbol `_to_copy` in src/axolotl/monkeypatch/torchao_optim.py:12", "shortDescription": {"text": "Legacy-named symbol `_to_copy` in src/axolotl/monkeypatch/torchao_optim.py:12"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7dac64a85a822ff5", "name": "Commented-code block (5 lines) in src/axolotl/monkeypatch/fsdp2_qlora.py:118", "shortDescription": {"text": "Commented-code block (5 lines) in src/axolotl/monkeypatch/fsdp2_qlora.py:118"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-de4425a14729923e", "name": "Legacy-named symbol `deepseek_v2` in src/axolotl/monkeypatch/multipack.py:38", "shortDescription": {"text": "Legacy-named symbol `deepseek_v2` in src/axolotl/monkeypatch/multipack.py:38"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-29cc445eec289b53", "name": "Commented-code block (6 lines) in src/axolotl/monkeypatch/activation_offload_checkpoint.py:40", "shortDescription": {"text": "Commented-code block (6 lines) in src/axolotl/monkeypatch/activation_offload_checkpoint.py:40"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-b9851e8524f88170", "name": "Commented-code block (5 lines) in src/axolotl/monkeypatch/moe_quant.py:169", "shortDescription": {"text": "Commented-code block (5 lines) in src/axolotl/monkeypatch/moe_quant.py:169"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-685b25f046988a14", "name": "Stub function `_noop_warmup` (body is just `pass`/`return`) \u2014 src/axolotl/monkeypatch/moe_quant.py:98", "shortDescription": {"text": "Stub function `_noop_warmup` (body is just `pass`/`return`) \u2014 src/axolotl/monkeypatch/moe_quant.py:98"}, "fullDescription": {"text": "Likely an AI scaffold that was never filled in. Remove or implement."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-bb1e1c8a7647632d", "name": "Commented-code block (5 lines) in src/axolotl/monkeypatch/accelerate/fsdp2.py:279", "shortDescription": {"text": "Commented-code block (5 lines) in src/axolotl/monkeypatch/accelerate/fsdp2.py:279"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-42b836e51e28b91d", "name": "Commented-code block (7 lines) in src/axolotl/monkeypatch/models/kimi_linear/modeling_kimi.py:655", "shortDescription": {"text": "Commented-code block (7 lines) in src/axolotl/monkeypatch/models/kimi_linear/modeling_kimi.py:655"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-f64047acd63cec4a", "name": "Commented-code block (10 lines) in src/axolotl/monkeypatch/tiled_mlp/patch.py:57", "shortDescription": {"text": "Commented-code block (10 lines) in src/axolotl/monkeypatch/tiled_mlp/patch.py:57"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-393ae8297b6b43c0", "name": "Commented-code block (6 lines) in src/axolotl/monkeypatch/tiled_mlp/base.py:12", "shortDescription": {"text": "Commented-code block (6 lines) in src/axolotl/monkeypatch/tiled_mlp/base.py:12"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-98b2e1a54743acc1", "name": "Commented-code block (5 lines) in src/axolotl/kernels/lora.py:81", "shortDescription": {"text": "Commented-code block (5 lines) in src/axolotl/kernels/lora.py:81"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-099d8d3661ea8533", "name": "Commented-code block (5 lines) in src/axolotl/core/training_args_base.py:206", "shortDescription": {"text": "Commented-code block (5 lines) in src/axolotl/core/training_args_base.py:206"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-3672fc00592e2585", "name": "Stub function `build` (body is just `pass`/`return`) \u2014 src/axolotl/core/builders/base.py:111", "shortDescription": {"text": "Stub function `build` (body is just `pass`/`return`) \u2014 src/axolotl/core/builders/base.py:111"}, "fullDescription": {"text": "Likely an AI scaffold that was never filled in. Remove or implement."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8ba590856059ce18", "name": "Commented-code block (6 lines) in src/axolotl/core/trainers/base.py:112", "shortDescription": {"text": "Commented-code block (6 lines) in src/axolotl/core/trainers/base.py:112"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-2e5936a0bc8c1a27", "name": "Commented-code block (5 lines) in src/axolotl/core/trainers/ebft/strided.py:840", "shortDescription": {"text": "Commented-code block (5 lines) in src/axolotl/core/trainers/ebft/strided.py:840"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-e3608b64a206f5de", "name": "Stub function `get_collator` (body is just `pass`/`return`) \u2014 src/axolotl/core/trainers/ebft/__init__.py:228", "shortDescription": {"text": "Stub function `get_collator` (body is just `pass`/`return`) \u2014 src/axolotl/core/trainers/ebft/__init__.py:228"}, "fullDescription": {"text": "Likely an AI scaffold that was never filled in. Remove or implement."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-97559ecb1edbc7b1", "name": "Commented-code block (6 lines) in src/axolotl/core/trainers/grpo/async_trainer.py:638", "shortDescription": {"text": "Commented-code block (6 lines) in src/axolotl/core/trainers/grpo/async_trainer.py:638"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-fddf987c61ce0493", "name": "Network/subprocess call without timeout or try/except \u2014 src/axolotl/cli/main.py:176", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 src/axolotl/cli/main.py:176"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-fe9b24e9ff83db3f", "name": "Legacy-named symbol `_do_merge_lora_legacy` in src/axolotl/cli/merge_lora.py:30", "shortDescription": {"text": "Legacy-named symbol `_do_merge_lora_legacy` in src/axolotl/cli/merge_lora.py:30"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8fe43bc1ca66bf78", "name": "Network/subprocess call without timeout or try/except \u2014 src/axolotl/cli/utils/train.py:192", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 src/axolotl/cli/utils/train.py:192"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-707d5508b9b9bf15", "name": "Commented-code block (5 lines) in src/axolotl/cli/utils/lora_merge.py:948", "shortDescription": {"text": "Commented-code block (5 lines) in src/axolotl/cli/utils/lora_merge.py:948"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-afa0abea505a0aed", "name": "Stub function `preprocess` (body is just `pass`/`return`) \u2014 src/axolotl/cli/cloud/base.py:15", "shortDescription": {"text": "Stub function `preprocess` (body is just `pass`/`return`) \u2014 src/axolotl/cli/cloud/base.py:15"}, "fullDescription": {"text": "Likely an AI scaffold that was never filled in. Remove or implement."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-268297f705123924", "name": "Network/subprocess call without timeout or try/except \u2014 src/axolotl/cli/cloud/baseten/__init__.py:46", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 src/axolotl/cli/cloud/baseten/__init__.py:46"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b90ff984ef791cd7", "name": "Legacy-named symbol `deepseek_v2` in src/axolotl/common/architectures.py:17", "shortDescription": {"text": "Legacy-named symbol `deepseek_v2` in src/axolotl/common/architectures.py:17"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2aed058a7940012e", "name": "Legacy-named symbol `load_v2` in src/axolotl/prompt_strategies/context_qa.py:28", "shortDescription": {"text": "Legacy-named symbol `load_v2` in src/axolotl/prompt_strategies/context_qa.py:28"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c4ea028f6990cb0b", "name": "Commented-code block (8 lines) in src/axolotl/loaders/patch_manager.py:154", "shortDescription": {"text": "Commented-code block (8 lines) in src/axolotl/loaders/patch_manager.py:154"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-c1020118303f0948", "name": "Commented-code block (6 lines) in src/axolotl/loaders/model.py:334", "shortDescription": {"text": "Commented-code block (6 lines) in src/axolotl/loaders/model.py:334"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-8a967f0e1ff8d0df", "name": "Legacy-named symbol `tokenizer_legacy` in src/axolotl/loaders/tokenizer.py:159", "shortDescription": {"text": "Legacy-named symbol `tokenizer_legacy` in src/axolotl/loaders/tokenizer.py:159"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2c04133e54348533", "name": "Near-duplicate function bodies in 2 places", "shortDescription": {"text": "Near-duplicate function bodies in 2 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\ncicd/e2e_tests.py:main, cicd/multigpu.py:main\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-46969939caf8120b", "name": "Near-duplicate function bodies in 9 places", "shortDescription": {"text": "Near-duplicate function bodies in 9 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nsrc/axolotl/processing_strategies.py:process_labels, src/axolotl/processing_strategies.py:process_labels, src/axolotl/processing_strategies.py:process_labels, src/axolotl/processing_strategies.py:process_labels\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-be46ea126aa5d8dc", "name": "Near-duplicate function bodies in 3 places", "shortDescription": {"text": "Near-duplicate function bodies in 3 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nsrc/axolotl/prompt_tokenizers.py:tokenize_prompt, src/axolotl/prompt_tokenizers.py:tokenize_prompt, src/axolotl/prompt_tokenizers.py:tokenize_prompt\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9dad557909b86499", "name": "Near-duplicate function bodies in 10 places", "shortDescription": {"text": "Near-duplicate function bodies in 10 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nsrc/axolotl/prompt_tokenizers.py:parse_instruction_fields, src/axolotl/prompt_tokenizers.py:parse_instruction_fields, src/axolotl/prompt_tokenizers.py:parse_instruction_fields, src/axolotl/prompt_tokenizers.py:parse_instruction_fields\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-49c98f7cedd9c977", "name": "Near-duplicate function bodies in 4 places", "shortDescription": {"text": "Near-duplicate function bodies in 4 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nsrc/axolotl/prompters.py:match_prompt_style, src/axolotl/prompters.py:match_prompt_style, src/axolotl/prompters.py:match_prompt_style, src/axolotl/prompters.py:match_prompt_style\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-00730914cd6ee517", "name": "FastAPI POST `set_lora_adapter` without auth dependency \u2014 src/axolotl/scripts/vllm_serve_lora.py:342", "shortDescription": {"text": "FastAPI POST `set_lora_adapter` without auth dependency \u2014 src/axolotl/scripts/vllm_serve_lora.py:342"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-1f344b585c770ab4", "name": "FastAPI POST `clear_lora_adapter` without auth dependency \u2014 src/axolotl/scripts/vllm_serve_lora.py:359", "shortDescription": {"text": "FastAPI POST `clear_lora_adapter` without auth dependency \u2014 src/axolotl/scripts/vllm_serve_lora.py:359"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-97e1d11db0efcb9d", "name": "FastAPI POST `generate` without auth dependency \u2014 src/axolotl/scripts/vllm_serve_lora.py:385", "shortDescription": {"text": "FastAPI POST `generate` without auth dependency \u2014 src/axolotl/scripts/vllm_serve_lora.py:385"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-ae9f471f57f187ad", "name": "FastAPI POST `chat` without auth dependency \u2014 src/axolotl/scripts/vllm_serve_lora.py:491", "shortDescription": {"text": "FastAPI POST `chat` without auth dependency \u2014 src/axolotl/scripts/vllm_serve_lora.py:491"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-f44d3aed02e26eaf", "name": "FastAPI POST `openai_chat_completions` without auth dependency \u2014 src/axolotl/scripts/vllm_serve_lora.py:547", "shortDescription": {"text": "FastAPI POST `openai_chat_completions` without auth dependency \u2014 src/axolotl/scripts/vllm_serve_lora.py:547"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-998f4657a63de0c0", "name": "FastAPI POST `openai_completions` without auth dependency \u2014 src/axolotl/scripts/vllm_serve_lora.py:643", "shortDescription": {"text": "FastAPI POST `openai_completions` without auth dependency \u2014 src/axolotl/scripts/vllm_serve_lora.py:643"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-7a3b251764fe1e3d", "name": "FastAPI POST `init_communicator` without auth dependency \u2014 src/axolotl/scripts/vllm_serve_lora.py:789", "shortDescription": {"text": "FastAPI POST `init_communicator` without auth dependency \u2014 src/axolotl/scripts/vllm_serve_lora.py:789"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-795a0859d071ce4a", "name": "FastAPI POST `update_named_param` without auth dependency \u2014 src/axolotl/scripts/vllm_serve_lora.py:815", "shortDescription": {"text": "FastAPI POST `update_named_param` without auth dependency \u2014 src/axolotl/scripts/vllm_serve_lora.py:815"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-590c272cd547fa0d", "name": "FastAPI POST `batch_update_named_params` without auth dependency \u2014 src/axolotl/scripts/vllm_serve_lora.py:831", "shortDescription": {"text": "FastAPI POST `batch_update_named_params` without auth dependency \u2014 src/axolotl/scripts/vllm_serve_lora.py:831"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-a0377c02616d4b09", "name": "FastAPI POST `http_update_weights` without auth dependency \u2014 src/axolotl/scripts/vllm_serve_lora.py:851", "shortDescription": {"text": "FastAPI POST `http_update_weights` without auth dependency \u2014 src/axolotl/scripts/vllm_serve_lora.py:851"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-1035234c6b63fa4f", "name": "FastAPI POST `reset_prefix_cache` without auth dependency \u2014 src/axolotl/scripts/vllm_serve_lora.py:881", "shortDescription": {"text": "FastAPI POST `reset_prefix_cache` without auth dependency \u2014 src/axolotl/scripts/vllm_serve_lora.py:881"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-7198634871e59e7a", "name": "FastAPI POST `close_communicator` without auth dependency \u2014 src/axolotl/scripts/vllm_serve_lora.py:891", "shortDescription": {"text": "FastAPI POST `close_communicator` without auth dependency \u2014 src/axolotl/scripts/vllm_serve_lora.py:891"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/24423"}, "properties": {"repository": "axolotl-ai-cloud/axolotl", "repoUrl": "https://github.com/axolotl-ai-cloud/axolotl", "branch": "main"}, "results": [{"ruleId": "scanner-576975638118d504", "level": "note", "message": {"text": "Possibly dead Python function: fwd_bwd_original"}, "properties": {"repobilityId": "ef37b66e93532553", "scanner": "scanner-primary", "fingerprint": "576975638118d504", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "benchmarks/bench_selective_logsoftmax.py:137"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f2e2192c5a726d79", "level": "note", "message": {"text": "Possibly dead Python function: fwd_bwd_triton"}, "properties": {"repobilityId": "72db12ccb340e12e", "scanner": "scanner-primary", "fingerprint": "f2e2192c5a726d79", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "benchmarks/bench_selective_logsoftmax.py:142"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-7dd230859f31b0ef", "level": "note", "message": {"text": "Possibly dead Python function: original_with_copy"}, "properties": {"repobilityId": "1b0b714e5cdfc686", "scanner": "scanner-primary", "fingerprint": "7dd230859f31b0ef", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "benchmarks/bench_entropy.py:177"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-2e1deb5ba5bcd21c", "level": "note", "message": {"text": "Possibly dead Python function: complex_training_step"}, "properties": {"repobilityId": "f3c231ac366ed20c", "scanner": "scanner-primary", "fingerprint": "2e1deb5ba5bcd21c", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "examples/swanlab/custom_trainer_profiling.py:85"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-04e34ddc7b3a9c3f", "level": "note", "message": {"text": "Possibly dead Python function: wrap_dataset_for_tokenized_prompt"}, "properties": {"repobilityId": "6e21bdf6f4fd60f4", "scanner": "scanner-primary", "fingerprint": "04e34ddc7b3a9c3f", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/axolotl/datasets.py:72"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f1116306876469bf", "level": "note", "message": {"text": "Possibly dead Python function: llm_worker"}, "properties": {"repobilityId": "d12b6410953279e7", "scanner": "scanner-primary", "fingerprint": "f1116306876469bf", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/axolotl/scripts/vllm_serve_lora.py:76"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e1fd67c17b499ce9", "level": "note", "message": {"text": "Possibly dead Python function: http_load_weights"}, "properties": {"repobilityId": "de5a1c69273694c4", "scanner": "scanner-primary", "fingerprint": "e1fd67c17b499ce9", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/axolotl/scripts/vllm_worker_ext.py:181"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b522475366865fe2", "level": "note", "message": {"text": "Possibly dead Python function: http_load_weight"}, "properties": {"repobilityId": "a738e62af97c01e0", "scanner": "scanner-primary", "fingerprint": "b522475366865fe2", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/axolotl/scripts/vllm_worker_ext.py:186"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f61e8cb2fea63a66", "level": "note", "message": {"text": "Possibly dead Python function: safe_recv"}, "properties": {"repobilityId": "9cc273d95d83f114", "scanner": "scanner-primary", "fingerprint": "f61e8cb2fea63a66", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/axolotl/scripts/process_cleanup.py:110"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-88557015fba74b84", "level": "note", "message": {"text": "Possibly dead Python function: trainer_weighted_loss"}, "properties": {"repobilityId": "55aed2d95b125af6", "scanner": "scanner-primary", "fingerprint": "88557015fba74b84", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/axolotl/utils/trainer.py:78"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-2e0c264fa0385883", "level": "note", "message": {"text": "Possibly dead Python function: add_position_ids"}, "properties": {"repobilityId": "1af5090764140a2b", "scanner": "scanner-primary", "fingerprint": "2e0c264fa0385883", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/axolotl/utils/trainer.py:99"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-45d3575388f4fb29", "level": "note", "message": {"text": "Possibly dead Python function: add_pose_position_ids"}, "properties": {"repobilityId": "3e4a4fc533b27cd7", "scanner": "scanner-primary", "fingerprint": "45d3575388f4fb29", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/axolotl/utils/trainer.py:138"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-da0ea27e20f5df74", "level": "note", "message": {"text": "Possibly dead Python function: add_length"}, "properties": {"repobilityId": "10ddbbf48fae8eb3", "scanner": "scanner-primary", "fingerprint": "da0ea27e20f5df74", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/axolotl/utils/trainer.py:203"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a1804c96190e331f", "level": "note", "message": {"text": "Possibly dead Python function: process_datasets_for_packing"}, "properties": {"repobilityId": "418efc5ca517f223", "scanner": "scanner-primary", "fingerprint": "a1804c96190e331f", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/axolotl/utils/trainer.py:252"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-04d6ca07ff0ac436", "level": "note", "message": {"text": "Possibly dead Python function: drop_no_trainable_tokens"}, "properties": {"repobilityId": "36f5d6510382af1c", "scanner": "scanner-primary", "fingerprint": "04d6ca07ff0ac436", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/axolotl/utils/trainer.py:267"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d4295eb23f60abcb", "level": "note", "message": {"text": "Possibly dead Python function: process_pretraining_datasets_for_packing"}, "properties": {"repobilityId": "69339f26740a7954", "scanner": "scanner-primary", "fingerprint": "d4295eb23f60abcb", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/axolotl/utils/trainer.py:386"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-8aa7a4562478af7d", "level": "note", "message": {"text": "Possibly dead Python function: calculate_total_num_steps"}, "properties": {"repobilityId": "e6bef8b6e7fbed68", "scanner": "scanner-primary", "fingerprint": "8aa7a4562478af7d", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/axolotl/utils/trainer.py:408"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ac76b214c432663c", "level": "note", "message": {"text": "Possibly dead Python function: calc_sample_packing_eff_est"}, "properties": {"repobilityId": "b37833ed47508345", "scanner": "scanner-primary", "fingerprint": "ac76b214c432663c", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/axolotl/utils/trainer.py:503"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-76c7872eb15af1c3", "level": "note", "message": {"text": "Possibly dead Python function: load_sharded_model"}, "properties": {"repobilityId": "82c6c41b644b14b5", "scanner": "scanner-primary", "fingerprint": "76c7872eb15af1c3", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/axolotl/utils/model_shard_quant.py:140"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-5d0a4d96612f6f9d", "level": "note", "message": {"text": "Possibly dead Python function: load_and_quantize_parallel"}, "properties": {"repobilityId": "509fcbcad35bfb45", "scanner": "scanner-primary", "fingerprint": "5d0a4d96612f6f9d", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/axolotl/utils/model_shard_quant.py:228"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-984ca87eec048df1", "level": "note", "message": {"text": "Possibly dead Python function: deco"}, "properties": {"repobilityId": "11da05572c448654", "scanner": "scanner-primary", "fingerprint": "984ca87eec048df1", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/axolotl/utils/bench.py:33"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6cfa3e76899ec5d5", "level": "note", "message": {"text": "Possibly dead Python function: freeze_parameters_hook"}, "properties": {"repobilityId": "d080ed7092039e62", "scanner": "scanner-primary", "fingerprint": "6cfa3e76899ec5d5", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/axolotl/utils/freeze.py:204"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-7b9b330fed646313", "level": "note", "message": {"text": "Possibly dead Python function: set_epoch"}, "properties": {"repobilityId": "02602e471ce28ad4", "scanner": "scanner-primary", "fingerprint": "7b9b330fed646313", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/axolotl/utils/samplers/multipack.py:305"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-359a9ea0828be5f6", "level": "note", "message": {"text": "Possibly dead Python function: gather_efficiency"}, "properties": {"repobilityId": "6c9aa08012d05773", "scanner": "scanner-primary", "fingerprint": "359a9ea0828be5f6", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/axolotl/utils/samplers/multipack.py:406"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b5d0d2d999ac79e5", "level": "note", "message": {"text": "Possibly dead Python function: calc_sample_packing_eff_est"}, "properties": {"repobilityId": "b37833ed47508345", "scanner": "scanner-primary", "fingerprint": "b5d0d2d999ac79e5", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/axolotl/utils/samplers/multipack.py:414"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-27c09de066d32913", "level": "note", "message": {"text": "Possibly dead Python function: calc_min_len"}, "properties": {"repobilityId": "81aa6c4139a0b716", "scanner": "scanner-primary", "fingerprint": "27c09de066d32913", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/axolotl/utils/samplers/multipack.py:437"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-47636e33caef255d", "level": "warning", "message": {"text": "Dockerfile runs as root: docker/Dockerfile"}, "properties": {"repobilityId": "8a345ba4198453bd", "scanner": "scanner-primary", "fingerprint": "47636e33caef255d", "layer": "hardware", "severity": "medium", "confidence": 1.0, "tags": ["security", "container"]}}, {"ruleId": "scanner-b862a579a97d868b", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: axolotlai/axolotl-base:$BASE_TAG"}, "properties": {"repobilityId": "663ca46cecdbd540", "scanner": "scanner-primary", "fingerprint": "b862a579a97d868b", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docker/Dockerfile"}, "region": {"startLine": 2}}}]}, {"ruleId": "scanner-e604d68c778c9bec", "level": "error", "message": {"text": "Insecure pattern 'exec_used' in src/axolotl/integrations/config.py:53"}, "properties": {"repobilityId": "10ae1a7ae251591e", "scanner": "scanner-primary", "fingerprint": "e604d68c778c9bec", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "exec_used"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/axolotl/integrations/config.py"}, "region": {"startLine": 53}}}]}, {"ruleId": "scanner-e1e4a7095dbfee74", "level": "error", "message": {"text": "Insecure pattern 'exec_used' in src/axolotl/monkeypatch/trainer_accelerator_args.py:73"}, "properties": {"repobilityId": "2652161d96a2c578", "scanner": "scanner-primary", "fingerprint": "e1e4a7095dbfee74", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "exec_used"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/axolotl/monkeypatch/trainer_accelerator_args.py"}, "region": {"startLine": 73}}}]}, {"ruleId": "scanner-e8b7bf1338c1e699", "level": "error", "message": {"text": "Insecure pattern 'exec_used' in src/axolotl/monkeypatch/fsdp2_qlora.py:94"}, "properties": {"repobilityId": "6c83a5726a8bc914", "scanner": "scanner-primary", "fingerprint": "e8b7bf1338c1e699", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "exec_used"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/axolotl/monkeypatch/fsdp2_qlora.py"}, "region": {"startLine": 94}}}]}, {"ruleId": "scanner-6a887ceb44c772eb", "level": "error", "message": {"text": "Insecure pattern 'exec_used' in src/axolotl/monkeypatch/lora_kernels.py:331"}, "properties": {"repobilityId": "7194befad401ba07", "scanner": "scanner-primary", "fingerprint": "6a887ceb44c772eb", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "exec_used"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/axolotl/monkeypatch/lora_kernels.py"}, "region": {"startLine": 331}}}]}, {"ruleId": "scanner-a84c9e3d3f87345b", "level": "error", "message": {"text": "Insecure pattern 'exec_used' in src/axolotl/monkeypatch/peft/utils.py:69"}, "properties": {"repobilityId": "66a8b8969d4c0525", "scanner": "scanner-primary", "fingerprint": "a84c9e3d3f87345b", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "exec_used"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/axolotl/monkeypatch/peft/utils.py"}, "region": {"startLine": 69}}}]}, {"ruleId": "scanner-39f6793a18552efb", "level": "error", "message": {"text": "Insecure pattern 'exec_used' in src/axolotl/monkeypatch/models/mistral3/mistral_common_tokenizer.py:55"}, "properties": {"repobilityId": "c36af2eb26d523c1", "scanner": "scanner-primary", "fingerprint": "39f6793a18552efb", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "exec_used"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/axolotl/monkeypatch/models/mistral3/mistral_common_tokenizer.py"}, "region": {"startLine": 55}}}]}, {"ruleId": "scanner-af77403a91af59a6", "level": "error", "message": {"text": "Insecure pattern 'exec_used' in src/axolotl/monkeypatch/transformers/trainer_loss_calc.py:88"}, "properties": {"repobilityId": "e85ad20cc6e7e8e9", "scanner": "scanner-primary", "fingerprint": "af77403a91af59a6", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "exec_used"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/axolotl/monkeypatch/transformers/trainer_loss_calc.py"}, "region": {"startLine": 88}}}]}, {"ruleId": "scanner-6372cebde0220094", "level": "warning", "message": {"text": "No auth library detected"}, "properties": {"repobilityId": "a5b6035a5bbf8054", "scanner": "scanner-primary", "fingerprint": "6372cebde0220094", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["coverage", "auth"]}}, {"ruleId": "scanner-d5e115454487edbe", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "df7468049af97ee0", "scanner": "scanner-primary", "fingerprint": "d5e115454487edbe", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/nightlies.yml"}, "region": {"startLine": 26}}}]}, {"ruleId": "scanner-d5e115454487edbe", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "c388b309bdcfcdb0", "scanner": "scanner-primary", "fingerprint": "d5e115454487edbe", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/nightlies.yml"}, "region": {"startLine": 29}}}]}, {"ruleId": "scanner-d5e115454487edbe", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "0f9ad0354b0811e7", "scanner": "scanner-primary", "fingerprint": "d5e115454487edbe", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/nightlies.yml"}, "region": {"startLine": 36}}}]}, {"ruleId": "scanner-d5e115454487edbe", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "3a27aa21c375e6e1", "scanner": "scanner-primary", "fingerprint": "d5e115454487edbe", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/nightlies.yml"}, "region": {"startLine": 38}}}]}, {"ruleId": "scanner-d5e115454487edbe", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "aab9664416fa6834", "scanner": "scanner-primary", "fingerprint": "d5e115454487edbe", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/nightlies.yml"}, "region": {"startLine": 44}}}]}, {"ruleId": "scanner-d5e115454487edbe", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "df7468049af97ee0", "scanner": "scanner-primary", "fingerprint": "d5e115454487edbe", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/nightlies.yml"}, "region": {"startLine": 73}}}]}, {"ruleId": "scanner-d5e115454487edbe", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "c388b309bdcfcdb0", "scanner": "scanner-primary", "fingerprint": "d5e115454487edbe", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/nightlies.yml"}, "region": {"startLine": 76}}}]}, {"ruleId": "scanner-d5e115454487edbe", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "3a27aa21c375e6e1", "scanner": "scanner-primary", "fingerprint": "d5e115454487edbe", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/nightlies.yml"}, "region": {"startLine": 83}}}]}, {"ruleId": "scanner-d5e115454487edbe", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "0f9ad0354b0811e7", "scanner": "scanner-primary", "fingerprint": "d5e115454487edbe", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/nightlies.yml"}, "region": {"startLine": 88}}}]}, {"ruleId": "scanner-d5e115454487edbe", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "aab9664416fa6834", "scanner": "scanner-primary", "fingerprint": "d5e115454487edbe", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/nightlies.yml"}, "region": {"startLine": 90}}}]}, {"ruleId": "scanner-caf1867e209c784f", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "84416dba12e88add", "scanner": "scanner-primary", "fingerprint": "caf1867e209c784f", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/precommit-autoupdate.yml"}, "region": {"startLine": 34}}}]}, {"ruleId": "scanner-58e7c235ccf4e75f", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "110f03158b4c935b", "scanner": "scanner-primary", "fingerprint": "58e7c235ccf4e75f", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/precommit-autoupdate.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-389efec94822a700", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "488dc94cf8485e0c", "scanner": "scanner-primary", "fingerprint": "389efec94822a700", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/preview-docs.yml"}, "region": {"startLine": 30}}}]}, {"ruleId": "scanner-389efec94822a700", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "c48e9f1131270dfd", "scanner": "scanner-primary", "fingerprint": "389efec94822a700", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/preview-docs.yml"}, "region": {"startLine": 35}}}]}, {"ruleId": "scanner-389efec94822a700", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "aa42d615b3975be6", "scanner": "scanner-primary", "fingerprint": "389efec94822a700", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/preview-docs.yml"}, "region": {"startLine": 38}}}]}, {"ruleId": "scanner-389efec94822a700", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "3c72422b50af0a30", "scanner": "scanner-primary", "fingerprint": "389efec94822a700", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/preview-docs.yml"}, "region": {"startLine": 54}}}]}, {"ruleId": "scanner-389efec94822a700", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "ab85fb14575f698e", "scanner": "scanner-primary", "fingerprint": "389efec94822a700", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/preview-docs.yml"}, "region": {"startLine": 71}}}]}, {"ruleId": "scanner-0763d85002569570", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "c111b9d6f39513c2", "scanner": "scanner-primary", "fingerprint": "0763d85002569570", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/docs.yml"}, "region": {"startLine": 19}}}]}, {"ruleId": "scanner-0763d85002569570", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "10000e6f009aa5f5", "scanner": "scanner-primary", "fingerprint": "0763d85002569570", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/docs.yml"}, "region": {"startLine": 21}}}]}, {"ruleId": "scanner-0763d85002569570", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "73acec026f584eb1", "scanner": "scanner-primary", "fingerprint": "0763d85002569570", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/docs.yml"}, "region": {"startLine": 23}}}]}, {"ruleId": "scanner-0763d85002569570", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "b0d7d3b155ad7ee1", "scanner": "scanner-primary", "fingerprint": "0763d85002569570", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/docs.yml"}, "region": {"startLine": 33}}}]}, {"ruleId": "scanner-14ce8614dd03f409", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "81c5c697653f94e8", "scanner": "scanner-primary", "fingerprint": "14ce8614dd03f409", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/docs.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-1a50467f36b413ec", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "aecc3f31ca3f42da", "scanner": "scanner-primary", "fingerprint": "1a50467f36b413ec", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/tests.yml"}, "region": {"startLine": 90}}}]}, {"ruleId": "scanner-1a50467f36b413ec", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "926b5aa2fc342af4", "scanner": "scanner-primary", "fingerprint": "1a50467f36b413ec", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/tests.yml"}, "region": {"startLine": 100}}}]}, {"ruleId": "scanner-1a50467f36b413ec", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "0cfd305f49a8f426", "scanner": "scanner-primary", "fingerprint": "1a50467f36b413ec", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/tests.yml"}, "region": {"startLine": 105}}}]}, {"ruleId": "scanner-1a50467f36b413ec", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "74c769d9cbadc721", "scanner": "scanner-primary", "fingerprint": "1a50467f36b413ec", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/tests.yml"}, "region": {"startLine": 147}}}]}, {"ruleId": "scanner-1a50467f36b413ec", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "aecc3f31ca3f42da", "scanner": "scanner-primary", "fingerprint": "1a50467f36b413ec", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/tests.yml"}, "region": {"startLine": 182}}}]}, {"ruleId": "scanner-1a50467f36b413ec", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "926b5aa2fc342af4", "scanner": "scanner-primary", "fingerprint": "1a50467f36b413ec", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/tests.yml"}, "region": {"startLine": 192}}}]}, {"ruleId": "scanner-1a50467f36b413ec", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "0cfd305f49a8f426", "scanner": "scanner-primary", "fingerprint": "1a50467f36b413ec", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/tests.yml"}, "region": {"startLine": 197}}}]}, {"ruleId": "scanner-1a50467f36b413ec", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "aecc3f31ca3f42da", "scanner": "scanner-primary", "fingerprint": "1a50467f36b413ec", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/tests.yml"}, "region": {"startLine": 297}}}]}, {"ruleId": "scanner-1a50467f36b413ec", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "926b5aa2fc342af4", "scanner": "scanner-primary", "fingerprint": "1a50467f36b413ec", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/tests.yml"}, "region": {"startLine": 299}}}]}, {"ruleId": "scanner-1a50467f36b413ec", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "aecc3f31ca3f42da", "scanner": "scanner-primary", "fingerprint": "1a50467f36b413ec", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/tests.yml"}, "region": {"startLine": 352}}}]}, {"ruleId": "scanner-1a50467f36b413ec", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "926b5aa2fc342af4", "scanner": "scanner-primary", "fingerprint": "1a50467f36b413ec", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/tests.yml"}, "region": {"startLine": 354}}}]}, {"ruleId": "scanner-1a50467f36b413ec", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "aecc3f31ca3f42da", "scanner": "scanner-primary", "fingerprint": "1a50467f36b413ec", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/tests.yml"}, "region": {"startLine": 396}}}]}, {"ruleId": "scanner-1a50467f36b413ec", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "926b5aa2fc342af4", "scanner": "scanner-primary", "fingerprint": "1a50467f36b413ec", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/tests.yml"}, "region": {"startLine": 398}}}]}, {"ruleId": "scanner-1d7e834080dbebed", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "53ca989cff78d978", "scanner": "scanner-primary", "fingerprint": "1d7e834080dbebed", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/main.yml"}, "region": {"startLine": 55}}}]}, {"ruleId": "scanner-1d7e834080dbebed", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "3a95eccfafd7ffe0", "scanner": "scanner-primary", "fingerprint": "1d7e834080dbebed", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/main.yml"}, "region": {"startLine": 58}}}]}, {"ruleId": "scanner-1d7e834080dbebed", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "1047db70e60ff7a7", "scanner": "scanner-primary", "fingerprint": "1d7e834080dbebed", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/main.yml"}, "region": {"startLine": 66}}}]}, {"ruleId": "scanner-1d7e834080dbebed", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "5fabc5cda987ab90", "scanner": "scanner-primary", "fingerprint": "1d7e834080dbebed", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/main.yml"}, "region": {"startLine": 68}}}]}, {"ruleId": "scanner-1d7e834080dbebed", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "860c6bb9f2516e9b", "scanner": "scanner-primary", "fingerprint": "1d7e834080dbebed", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/main.yml"}, "region": {"startLine": 74}}}]}, {"ruleId": "scanner-1d7e834080dbebed", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "53ca989cff78d978", "scanner": "scanner-primary", "fingerprint": "1d7e834080dbebed", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/main.yml"}, "region": {"startLine": 144}}}]}, {"ruleId": "scanner-1d7e834080dbebed", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "3a95eccfafd7ffe0", "scanner": "scanner-primary", "fingerprint": "1d7e834080dbebed", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/main.yml"}, "region": {"startLine": 147}}}]}, {"ruleId": "scanner-1d7e834080dbebed", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "1047db70e60ff7a7", "scanner": "scanner-primary", "fingerprint": "1d7e834080dbebed", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/main.yml"}, "region": {"startLine": 155}}}]}, {"ruleId": "scanner-1d7e834080dbebed", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "5fabc5cda987ab90", "scanner": "scanner-primary", "fingerprint": "1d7e834080dbebed", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/main.yml"}, "region": {"startLine": 157}}}]}, {"ruleId": "scanner-1d7e834080dbebed", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "860c6bb9f2516e9b", "scanner": "scanner-primary", "fingerprint": "1d7e834080dbebed", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/main.yml"}, "region": {"startLine": 163}}}]}, {"ruleId": "scanner-1d7e834080dbebed", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "53ca989cff78d978", "scanner": "scanner-primary", "fingerprint": "1d7e834080dbebed", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/main.yml"}, "region": {"startLine": 223}}}]}, {"ruleId": "scanner-1d7e834080dbebed", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "3a95eccfafd7ffe0", "scanner": "scanner-primary", "fingerprint": "1d7e834080dbebed", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/main.yml"}, "region": {"startLine": 226}}}]}, {"ruleId": "scanner-1d7e834080dbebed", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "5fabc5cda987ab90", "scanner": "scanner-primary", "fingerprint": "1d7e834080dbebed", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/main.yml"}, "region": {"startLine": 234}}}]}, {"ruleId": "scanner-1d7e834080dbebed", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "1047db70e60ff7a7", "scanner": "scanner-primary", "fingerprint": "1d7e834080dbebed", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/main.yml"}, "region": {"startLine": 239}}}]}, {"ruleId": "scanner-1d7e834080dbebed", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "860c6bb9f2516e9b", "scanner": "scanner-primary", "fingerprint": "1d7e834080dbebed", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/main.yml"}, "region": {"startLine": 241}}}]}, {"ruleId": "scanner-1d7e834080dbebed", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "53ca989cff78d978", "scanner": "scanner-primary", "fingerprint": "1d7e834080dbebed", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/main.yml"}, "region": {"startLine": 309}}}]}, {"ruleId": "scanner-1d7e834080dbebed", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "3a95eccfafd7ffe0", "scanner": "scanner-primary", "fingerprint": "1d7e834080dbebed", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/main.yml"}, "region": {"startLine": 312}}}]}, {"ruleId": "scanner-1d7e834080dbebed", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "5fabc5cda987ab90", "scanner": "scanner-primary", "fingerprint": "1d7e834080dbebed", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/main.yml"}, "region": {"startLine": 320}}}]}, {"ruleId": "scanner-1d7e834080dbebed", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "1047db70e60ff7a7", "scanner": "scanner-primary", "fingerprint": "1d7e834080dbebed", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/main.yml"}, "region": {"startLine": 325}}}]}, {"ruleId": "scanner-1d7e834080dbebed", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "860c6bb9f2516e9b", "scanner": "scanner-primary", "fingerprint": "1d7e834080dbebed", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/main.yml"}, "region": {"startLine": 327}}}]}, {"ruleId": "scanner-719e6e363f39d55f", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "34cf761322ca73d7", "scanner": "scanner-primary", "fingerprint": "719e6e363f39d55f", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/multi-gpu-e2e.yml"}, "region": {"startLine": 58}}}]}, {"ruleId": "scanner-719e6e363f39d55f", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "9b023f5b87e1773b", "scanner": "scanner-primary", "fingerprint": "719e6e363f39d55f", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/multi-gpu-e2e.yml"}, "region": {"startLine": 60}}}]}, {"ruleId": "scanner-aec74b812ddd7969", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "e45532e40661d89f", "scanner": "scanner-primary", "fingerprint": "aec74b812ddd7969", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/tests-nightly.yml"}, "region": {"startLine": 55}}}]}, {"ruleId": "scanner-aec74b812ddd7969", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "4527a633bdef3fde", "scanner": "scanner-primary", "fingerprint": "aec74b812ddd7969", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/tests-nightly.yml"}, "region": {"startLine": 64}}}]}, {"ruleId": "scanner-aec74b812ddd7969", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "097f844f2faa0fa5", "scanner": "scanner-primary", "fingerprint": "aec74b812ddd7969", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/tests-nightly.yml"}, "region": {"startLine": 69}}}]}, {"ruleId": "scanner-aec74b812ddd7969", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "e45532e40661d89f", "scanner": "scanner-primary", "fingerprint": "aec74b812ddd7969", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/tests-nightly.yml"}, "region": {"startLine": 140}}}]}, {"ruleId": "scanner-aec74b812ddd7969", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "4527a633bdef3fde", "scanner": "scanner-primary", "fingerprint": "aec74b812ddd7969", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/tests-nightly.yml"}, "region": {"startLine": 142}}}]}, {"ruleId": "scanner-aec74b812ddd7969", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "e45532e40661d89f", "scanner": "scanner-primary", "fingerprint": "aec74b812ddd7969", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/tests-nightly.yml"}, "region": {"startLine": 184}}}]}, {"ruleId": "scanner-aec74b812ddd7969", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "4527a633bdef3fde", "scanner": "scanner-primary", "fingerprint": "aec74b812ddd7969", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/tests-nightly.yml"}, "region": {"startLine": 186}}}]}, {"ruleId": "scanner-3a423677b6b5780f", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "e75a58ee61eb5929", "scanner": "scanner-primary", "fingerprint": "3a423677b6b5780f", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/pypi.yml"}, "region": {"startLine": 19}}}]}, {"ruleId": "scanner-3a423677b6b5780f", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "e75a58ee61eb5929", "scanner": "scanner-primary", "fingerprint": "3a423677b6b5780f", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/pypi.yml"}, "region": {"startLine": 40}}}]}, {"ruleId": "scanner-3a423677b6b5780f", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "25b22bc5a6b13bc8", "scanner": "scanner-primary", "fingerprint": "3a423677b6b5780f", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/pypi.yml"}, "region": {"startLine": 43}}}]}, {"ruleId": "scanner-3a423677b6b5780f", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "d6d16a13c6ced436", "scanner": "scanner-primary", "fingerprint": "3a423677b6b5780f", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/pypi.yml"}, "region": {"startLine": 48}}}]}, {"ruleId": "scanner-3a423677b6b5780f", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "099fcf5b8966151c", "scanner": "scanner-primary", "fingerprint": "3a423677b6b5780f", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/pypi.yml"}, "region": {"startLine": 64}}}]}, {"ruleId": "scanner-3d1309ce707c39a5", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "53c58643aa676fc4", "scanner": "scanner-primary", "fingerprint": "3d1309ce707c39a5", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/pypi.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-974eab98d181a9fb", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "2330f6a0ed7c5017", "scanner": "scanner-primary", "fingerprint": "974eab98d181a9fb", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/base.yml"}, "region": {"startLine": 90}}}]}, {"ruleId": "scanner-974eab98d181a9fb", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "dad8ac1ac6d5847a", "scanner": "scanner-primary", "fingerprint": "974eab98d181a9fb", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/base.yml"}, "region": {"startLine": 93}}}]}, {"ruleId": "scanner-974eab98d181a9fb", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "8eec2671a60e3454", "scanner": "scanner-primary", "fingerprint": "974eab98d181a9fb", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/base.yml"}, "region": {"startLine": 98}}}]}, {"ruleId": "scanner-974eab98d181a9fb", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "f1396f3d83b621c0", "scanner": "scanner-primary", "fingerprint": "974eab98d181a9fb", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/base.yml"}, "region": {"startLine": 104}}}]}, {"ruleId": "scanner-974eab98d181a9fb", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "de2ef11707dce954", "scanner": "scanner-primary", "fingerprint": "974eab98d181a9fb", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/base.yml"}, "region": {"startLine": 106}}}]}, {"ruleId": "scanner-974eab98d181a9fb", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "2330f6a0ed7c5017", "scanner": "scanner-primary", "fingerprint": "974eab98d181a9fb", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/base.yml"}, "region": {"startLine": 213}}}]}, {"ruleId": "scanner-974eab98d181a9fb", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "dad8ac1ac6d5847a", "scanner": "scanner-primary", "fingerprint": "974eab98d181a9fb", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/base.yml"}, "region": {"startLine": 216}}}]}, {"ruleId": "scanner-974eab98d181a9fb", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "8eec2671a60e3454", "scanner": "scanner-primary", "fingerprint": "974eab98d181a9fb", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/base.yml"}, "region": {"startLine": 221}}}]}, {"ruleId": "scanner-974eab98d181a9fb", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "f1396f3d83b621c0", "scanner": "scanner-primary", "fingerprint": "974eab98d181a9fb", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/base.yml"}, "region": {"startLine": 227}}}]}, {"ruleId": "scanner-974eab98d181a9fb", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "de2ef11707dce954", "scanner": "scanner-primary", "fingerprint": "974eab98d181a9fb", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/base.yml"}, "region": {"startLine": 229}}}]}, {"ruleId": "scanner-e4a3344ba35d7f46", "level": "note", "message": {"text": "Very large file: tests/test_processing_strategies.py (1583 lines)"}, "properties": {"repobilityId": "8827fe2333542722", "scanner": "scanner-primary", "fingerprint": "e4a3344ba35d7f46", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-5e4217d2dff05f19", "level": "note", "message": {"text": "Very large file: tests/patched/test_validation.py (1822 lines)"}, "properties": {"repobilityId": "f9b190049dc81831", "scanner": "scanner-primary", "fingerprint": "5e4217d2dff05f19", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-fa4469f60b42fef7", "level": "note", "message": {"text": "Very large file: tests/prompt_strategies/test_chat_templates_advanced.py (1906 lines)"}, "properties": {"repobilityId": "41fe1d95cdd62651", "scanner": "scanner-primary", "fingerprint": "fa4469f60b42fef7", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-fabb75b1c0f7e87a", "level": "note", "message": {"text": "Very large file: tests/e2e/integrations/test_scattermoe_lora_kernels.py (1860 lines)"}, "properties": {"repobilityId": "8df796bc76614ec4", "scanner": "scanner-primary", "fingerprint": "fabb75b1c0f7e87a", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-ccbfbf2b8fe13972", "level": "note", "message": {"text": "Very large file: scripts/analyze_profile.py (1518 lines)"}, "properties": {"repobilityId": "35f89b4d976c9ea2", "scanner": "scanner-primary", "fingerprint": "ccbfbf2b8fe13972", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-7c529336f0e9a2a8", "level": "note", "message": {"text": "Very large file: src/axolotl/processing_strategies.py (1523 lines)"}, "properties": {"repobilityId": "33fe88fecfbcea3b", "scanner": "scanner-primary", "fingerprint": "7c529336f0e9a2a8", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-07ba56cb5c891a5d", "level": "note", "message": {"text": "Very large file: src/axolotl/utils/schemas/validation.py (1882 lines)"}, "properties": {"repobilityId": "ed9f650dccdb401d", "scanner": "scanner-primary", "fingerprint": "07ba56cb5c891a5d", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-a311dd1d36aa67b9", "level": "note", "message": {"text": "Very large file: src/axolotl/utils/schemas/config.py (2043 lines)"}, "properties": {"repobilityId": "217b875e3aee221a", "scanner": "scanner-primary", "fingerprint": "a311dd1d36aa67b9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-a789759fd67addb7", "level": "note", "message": {"text": "Very large file: src/axolotl/integrations/kernels/libs/scattermoe_lora/kernels/lora_ops.py (3312 lines)"}, "properties": {"repobilityId": "66a1833492fde5c3", "scanner": "scanner-primary", "fingerprint": "a789759fd67addb7", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-333cfe10d509edad", "level": "note", "message": {"text": "Very large file: src/axolotl/monkeypatch/models/kimi_linear/modeling_kimi.py (1361 lines)"}, "properties": {"repobilityId": "bf64196549ea92fc", "scanner": "scanner-primary", "fingerprint": "333cfe10d509edad", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-1aae6d358513c305", "level": "note", "message": {"text": "Very large file: src/axolotl/kernels/lora.py (2037 lines)"}, "properties": {"repobilityId": "3ef4591d5d45539a", "scanner": "scanner-primary", "fingerprint": "1aae6d358513c305", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-a61f948b72354c19", "level": "note", "message": {"text": "Very large file: src/axolotl/core/trainers/grpo/async_trainer.py (3257 lines)"}, "properties": {"repobilityId": "045f3d3731e2d122", "scanner": "scanner-primary", "fingerprint": "a61f948b72354c19", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-1d89deef6ddcb4e7", "level": "note", "message": {"text": "Very large file: src/axolotl/prompt_strategies/chat_template.py (1250 lines)"}, "properties": {"repobilityId": "d1aea6c2a0060245", "scanner": "scanner-primary", "fingerprint": "1d89deef6ddcb4e7", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-c1c50b392d6630c3", "level": "note", "message": {"text": "46 TODO/FIXME markers"}, "properties": {"repobilityId": "4b38c118003e07d2", "scanner": "scanner-primary", "fingerprint": "c1c50b392d6630c3", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["maintenance"]}}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "faf3499233899766", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-72b2a6250083a784", "level": "warning", "message": {"text": "Placeholder or mock-heavy implementation detected"}, "properties": {"repobilityId": "d3a413a1e62f2262", "scanner": "scanner-primary", "fingerprint": "72b2a6250083a784", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "incomplete", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "587470b4ad2dd6c7", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-2679282aa1c484b5", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: AGENTS.md"}, "properties": {"repobilityId": "27d579812e6be614", "scanner": "scanner-primary", "fingerprint": "2679282aa1c484b5", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "agents_md"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "AGENTS.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-73768dabc9b94ec2", "level": "note", "message": {"text": "Legacy-named symbol `cfg_old` in tests/test_streaming.py:22"}, "properties": {"repobilityId": "9f65dc0fcf7a24bf", "scanner": "scanner-primary", "fingerprint": "73768dabc9b94ec2", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-fd5819871600cdcb", "level": "none", "message": {"text": "Commented-code block (5 lines) in tests/conftest.py:225"}, "properties": {"repobilityId": "b6828e4eb5e124d7", "scanner": "scanner-primary", "fingerprint": "fd5819871600cdcb", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-3f272da4248017c8", "level": "none", "message": {"text": "Commented-code block (5 lines) in tests/integrations/monkeypatch/test_tiled_mlp_moe.py:146"}, "properties": {"repobilityId": "191edd6de0848995", "scanner": "scanner-primary", "fingerprint": "3f272da4248017c8", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-bd07b21f744150a8", "level": "none", "message": {"text": "Commented-code block (6 lines) in tests/integrations/kernels/scattermoe_lora/test_mxfp4_expert_weights.py:61"}, "properties": {"repobilityId": "15bb6024f4dfdcbe", "scanner": "scanner-primary", "fingerprint": "bd07b21f744150a8", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-2fc66cbdfbcf0a85", "level": "none", "message": {"text": "Commented-code block (6 lines) in tests/integrations/kernels/scattermoe_lora/bench_mxfp4.py:195"}, "properties": {"repobilityId": "d683489dc39f9282", "scanner": "scanner-primary", "fingerprint": "2fc66cbdfbcf0a85", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-5e21f7b61c8a22b6", "level": "none", "message": {"text": "Commented-code block (6 lines) in tests/monkeypatch/test_trl_vllm.py:276"}, "properties": {"repobilityId": "fb0f9f8507b3d070", "scanner": "scanner-primary", "fingerprint": "5e21f7b61c8a22b6", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-711c74d6584a8ff7", "level": "none", "message": {"text": "Commented-code block (5 lines) in tests/prompt_strategies/test_chat_templates_advanced.py:1324"}, "properties": {"repobilityId": "6fbcc035641ee40f", "scanner": "scanner-primary", "fingerprint": "711c74d6584a8ff7", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-f4611207a342be7c", "level": "none", "message": {"text": "Commented-code block (7 lines) in tests/e2e/test_quantization.py:97"}, "properties": {"repobilityId": "fb0a3ddf2005290c", "scanner": "scanner-primary", "fingerprint": "f4611207a342be7c", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-1e934a84051416d4", "level": "none", "message": {"text": "Commented-code block (5 lines) in tests/e2e/test_activation_offloading.py:338"}, "properties": {"repobilityId": "21a14b3184c7505f", "scanner": "scanner-primary", "fingerprint": "1e934a84051416d4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-8b56424fab326597", "level": "note", "message": {"text": "Legacy-named symbol `gate_copy` in tests/e2e/kernels/test_swiglu.py:67"}, "properties": {"repobilityId": "a135d0c467f070fe", "scanner": "scanner-primary", "fingerprint": "8b56424fab326597", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-7563219776f0392e", "level": "note", "message": {"text": "Legacy-named symbol `gate_copy` in tests/e2e/kernels/test_geglu.py:80"}, "properties": {"repobilityId": "802c74aa99662c49", "scanner": "scanner-primary", "fingerprint": "7563219776f0392e", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-d3517796a98c5dfc", "level": "note", "message": {"text": "Legacy-named symbol `_to_copy` in scripts/analyze_profile.py:70"}, "properties": {"repobilityId": "605f0d2c33297136", "scanner": "scanner-primary", "fingerprint": "d3517796a98c5dfc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-05ef30194e725de2", "level": "note", "message": {"text": "Legacy-named symbol `original_with_copy` in benchmarks/bench_entropy.py:177"}, "properties": {"repobilityId": "61e93bb3c4d7797c", "scanner": "scanner-primary", "fingerprint": "05ef30194e725de2", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-d7ea90d7c3fd6527", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/axolotl/processing_strategies.py:118"}, "properties": {"repobilityId": "7e27963c4c8279ff", "scanner": "scanner-primary", "fingerprint": "d7ea90d7c3fd6527", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-87e125602beea033", "level": "note", "message": {"text": "Stub function `wrap_dataset` (body is just `pass`/`return`) \u2014 src/axolotl/prompt_tokenizers.py:33"}, "properties": {"repobilityId": "35833e0de9fcdee2", "scanner": "scanner-primary", "fingerprint": "87e125602beea033", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "empty-handler", "dead-code"]}}, {"ruleId": "scanner-97e1223b297a929b", "level": "none", "message": {"text": "Commented-code block (7 lines) in src/axolotl/scripts/vllm_serve_lora.py:323"}, "properties": {"repobilityId": "5fb9afdc1c3a4679", "scanner": "scanner-primary", "fingerprint": "97e1223b297a929b", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-a14fc19f5c8bbf61", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/axolotl/utils/model_shard_quant.py:106"}, "properties": {"repobilityId": "145a0b844c3d5b4d", "scanner": "scanner-primary", "fingerprint": "a14fc19f5c8bbf61", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-07416178d3541cdb", "level": "note", "message": {"text": "Legacy-named symbol `tokenizer_legacy` in src/axolotl/utils/schemas/model.py:46"}, "properties": {"repobilityId": "b9094392548348fb", "scanner": "scanner-primary", "fingerprint": "07416178d3541cdb", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-12ff36fd7b42cbf8", "level": "note", "message": {"text": "Legacy-named symbol `deepseek_v2` in src/axolotl/utils/schemas/datasets.py:80"}, "properties": {"repobilityId": "5b72d72598fc3f99", "scanner": "scanner-primary", "fingerprint": "12ff36fd7b42cbf8", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-b6d914ae4133fa22", "level": "note", "message": {"text": "Legacy-named symbol `deepseek_v2` in src/axolotl/utils/schemas/config.py:1274"}, "properties": {"repobilityId": "ecfc565456b60097", "scanner": "scanner-primary", "fingerprint": "b6d914ae4133fa22", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-12760599caaeb05b", "level": "note", "message": {"text": "Legacy-named symbol `mistral_v1` in src/axolotl/utils/schemas/enums.py:46"}, "properties": {"repobilityId": "21fb9a558c819064", "scanner": "scanner-primary", "fingerprint": "12760599caaeb05b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-703e3525f5388d0f", "level": "note", "message": {"text": "Stub function `chat_template` (body is just `pass`/`return`) \u2014 src/axolotl/utils/mistral/mistral_tokenizer.py:50"}, "properties": {"repobilityId": "ab8439ecd4f10e50", "scanner": "scanner-primary", "fingerprint": "703e3525f5388d0f", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "empty-handler", "dead-code"]}}, {"ruleId": "scanner-8ca42c0f8b688034", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/axolotl/utils/config/__init__.py:272"}, "properties": {"repobilityId": "79a2b3e217c6b410", "scanner": "scanner-primary", "fingerprint": "8ca42c0f8b688034", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-38efefd44de0f914", "level": "note", "message": {"text": "Legacy-named symbol `deepseek_v2` in src/axolotl/integrations/liger/plugin.py:144"}, "properties": {"repobilityId": "c6cc1187ba1f78a7", "scanner": "scanner-primary", "fingerprint": "38efefd44de0f914", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-623d14107291fc22", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 src/axolotl/integrations/lm_eval/cli.py:139"}, "properties": {"repobilityId": "17b0ee1a83a0e1b6", "scanner": "scanner-primary", "fingerprint": "623d14107291fc22", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-59edab3342e91758", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 src/axolotl/integrations/lm_eval/__init__.py:34"}, "properties": {"repobilityId": "d369e88f4f4ded9a", "scanner": "scanner-primary", "fingerprint": "59edab3342e91758", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-c9ea7c5889fbae42", "level": "none", "message": {"text": "Commented-code block (7 lines) in src/axolotl/integrations/kernels/args.py:8"}, "properties": {"repobilityId": "77d9adb430136509", "scanner": "scanner-primary", "fingerprint": "c9ea7c5889fbae42", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-18e44121c26db0bb", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/axolotl/integrations/kernels/libs/scattermoe_lora/parallel_experts.py:1"}, "properties": {"repobilityId": "ab226572ff9fc673", "scanner": "scanner-primary", "fingerprint": "18e44121c26db0bb", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-1c7e054796d0f8c0", "level": "none", "message": {"text": "Commented-code block (6 lines) in src/axolotl/integrations/kernels/libs/scattermoe_lora/parallel_linear_lora.py:146"}, "properties": {"repobilityId": "6eb03c3e7ec5bbda", "scanner": "scanner-primary", "fingerprint": "1c7e054796d0f8c0", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-99567d2a1d8c8f10", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/axolotl/integrations/kernels/libs/scattermoe_lora/kernels/single.py:1"}, "properties": {"repobilityId": "76a6230fa3bc2b0c", "scanner": "scanner-primary", "fingerprint": "99567d2a1d8c8f10", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-d8014715fdeecc79", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/axolotl/integrations/kernels/libs/scattermoe_lora/kernels/lora_ops.py:2335"}, "properties": {"repobilityId": "fe1fb597780f871b", "scanner": "scanner-primary", "fingerprint": "d8014715fdeecc79", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-b56d22783ab4b40b", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/axolotl/integrations/kernels/libs/scattermoe_lora/kernels/ops.py:1"}, "properties": {"repobilityId": "fc2f6fd43889b0c0", "scanner": "scanner-primary", "fingerprint": "b56d22783ab4b40b", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-2970dc0b52ad8abe", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/axolotl/integrations/kernels/libs/sonicmoe/multi_lora.py:50"}, "properties": {"repobilityId": "e39c0519ff13f013", "scanner": "scanner-primary", "fingerprint": "2970dc0b52ad8abe", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-ac90fea4d5d58c46", "level": "note", "message": {"text": "Legacy-named symbol `load_legacy` in src/axolotl/integrations/kd/chat_template.py:334"}, "properties": {"repobilityId": "a2ba1bf0d7754d09", "scanner": "scanner-primary", "fingerprint": "ac90fea4d5d58c46", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-1f07ef950c5bad25", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/axolotl/integrations/kd/collator_online_teacher.py:441"}, "properties": {"repobilityId": "2548af98542e346e", "scanner": "scanner-primary", "fingerprint": "1f07ef950c5bad25", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-3ed27e08a2250a52", "level": "none", "message": {"text": "Commented-code block (6 lines) in src/axolotl/integrations/kd/kernels/liger.py:83"}, "properties": {"repobilityId": "13e42db3ed80aa09", "scanner": "scanner-primary", "fingerprint": "3ed27e08a2250a52", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-d802e4bbaea1ff80", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 src/axolotl/integrations/nemo_gym/server.py:53"}, "properties": {"repobilityId": "5ca8ba4a378289a1", "scanner": "scanner-primary", "fingerprint": "d802e4bbaea1ff80", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-d240f3d7f2f52cf9", "level": "none", "message": {"text": "Commented-code block (8 lines) in src/axolotl/integrations/nemo_gym/data_producer.py:113"}, "properties": {"repobilityId": "b3d978516cab2431", "scanner": "scanner-primary", "fingerprint": "d240f3d7f2f52cf9", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-44a41f0f3f1e5512", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/axolotl/integrations/hatchery/__init__.py:21"}, "properties": {"repobilityId": "32907e4f022cbac0", "scanner": "scanner-primary", "fingerprint": "44a41f0f3f1e5512", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-01d231bd4b1d43ba", "level": "note", "message": {"text": "Stub function `set_input_embeddings` (body is just `pass`/`return`) \u2014 src/axolotl/integrations/hatchery/plugin.py:80"}, "properties": {"repobilityId": "d47bb66d318e26bd", "scanner": "scanner-primary", "fingerprint": "01d231bd4b1d43ba", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "empty-handler", "dead-code"]}}, {"ruleId": "scanner-f4d22e78b4b79cca", "level": "note", "message": {"text": "Legacy-named symbol `_to_copy` in src/axolotl/monkeypatch/torchao_optim.py:12"}, "properties": {"repobilityId": "fd2e3801436525ef", "scanner": "scanner-primary", "fingerprint": "f4d22e78b4b79cca", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-7dac64a85a822ff5", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/axolotl/monkeypatch/fsdp2_qlora.py:118"}, "properties": {"repobilityId": "bfc6a0da856a278c", "scanner": "scanner-primary", "fingerprint": "7dac64a85a822ff5", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-de4425a14729923e", "level": "note", "message": {"text": "Legacy-named symbol `deepseek_v2` in src/axolotl/monkeypatch/multipack.py:38"}, "properties": {"repobilityId": "5f1e660456c96ccd", "scanner": "scanner-primary", "fingerprint": "de4425a14729923e", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-29cc445eec289b53", "level": "none", "message": {"text": "Commented-code block (6 lines) in src/axolotl/monkeypatch/activation_offload_checkpoint.py:40"}, "properties": {"repobilityId": "8fbb115e080e4e5b", "scanner": "scanner-primary", "fingerprint": "29cc445eec289b53", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-b9851e8524f88170", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/axolotl/monkeypatch/moe_quant.py:169"}, "properties": {"repobilityId": "343122030953a612", "scanner": "scanner-primary", "fingerprint": "b9851e8524f88170", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-685b25f046988a14", "level": "note", "message": {"text": "Stub function `_noop_warmup` (body is just `pass`/`return`) \u2014 src/axolotl/monkeypatch/moe_quant.py:98"}, "properties": {"repobilityId": "402416495aa9e42a", "scanner": "scanner-primary", "fingerprint": "685b25f046988a14", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "empty-handler", "dead-code"]}}, {"ruleId": "scanner-bb1e1c8a7647632d", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/axolotl/monkeypatch/accelerate/fsdp2.py:279"}, "properties": {"repobilityId": "2294b22144a2c89f", "scanner": "scanner-primary", "fingerprint": "bb1e1c8a7647632d", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-42b836e51e28b91d", "level": "none", "message": {"text": "Commented-code block (7 lines) in src/axolotl/monkeypatch/models/kimi_linear/modeling_kimi.py:655"}, "properties": {"repobilityId": "115728dac33434d9", "scanner": "scanner-primary", "fingerprint": "42b836e51e28b91d", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-f64047acd63cec4a", "level": "none", "message": {"text": "Commented-code block (10 lines) in src/axolotl/monkeypatch/tiled_mlp/patch.py:57"}, "properties": {"repobilityId": "f61d115f701e83c8", "scanner": "scanner-primary", "fingerprint": "f64047acd63cec4a", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-393ae8297b6b43c0", "level": "none", "message": {"text": "Commented-code block (6 lines) in src/axolotl/monkeypatch/tiled_mlp/base.py:12"}, "properties": {"repobilityId": "37fa337bb998987c", "scanner": "scanner-primary", "fingerprint": "393ae8297b6b43c0", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-98b2e1a54743acc1", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/axolotl/kernels/lora.py:81"}, "properties": {"repobilityId": "f56e7ff7a4f72d79", "scanner": "scanner-primary", "fingerprint": "98b2e1a54743acc1", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-099d8d3661ea8533", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/axolotl/core/training_args_base.py:206"}, "properties": {"repobilityId": "8bb05e9fab657bd4", "scanner": "scanner-primary", "fingerprint": "099d8d3661ea8533", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-3672fc00592e2585", "level": "note", "message": {"text": "Stub function `build` (body is just `pass`/`return`) \u2014 src/axolotl/core/builders/base.py:111"}, "properties": {"repobilityId": "7ac066f7f52a1324", "scanner": "scanner-primary", "fingerprint": "3672fc00592e2585", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "empty-handler", "dead-code"]}}, {"ruleId": "scanner-8ba590856059ce18", "level": "none", "message": {"text": "Commented-code block (6 lines) in src/axolotl/core/trainers/base.py:112"}, "properties": {"repobilityId": "574ec1d893cf3a7b", "scanner": "scanner-primary", "fingerprint": "8ba590856059ce18", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-2e5936a0bc8c1a27", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/axolotl/core/trainers/ebft/strided.py:840"}, "properties": {"repobilityId": "f901d1542b07dac0", "scanner": "scanner-primary", "fingerprint": "2e5936a0bc8c1a27", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-e3608b64a206f5de", "level": "note", "message": {"text": "Stub function `get_collator` (body is just `pass`/`return`) \u2014 src/axolotl/core/trainers/ebft/__init__.py:228"}, "properties": {"repobilityId": "598e9321b1f5d549", "scanner": "scanner-primary", "fingerprint": "e3608b64a206f5de", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "empty-handler", "dead-code"]}}, {"ruleId": "scanner-97559ecb1edbc7b1", "level": "none", "message": {"text": "Commented-code block (6 lines) in src/axolotl/core/trainers/grpo/async_trainer.py:638"}, "properties": {"repobilityId": "ded466a2674c42aa", "scanner": "scanner-primary", "fingerprint": "97559ecb1edbc7b1", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-fddf987c61ce0493", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 src/axolotl/cli/main.py:176"}, "properties": {"repobilityId": "540991ef8e642e30", "scanner": "scanner-primary", "fingerprint": "fddf987c61ce0493", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-fe9b24e9ff83db3f", "level": "note", "message": {"text": "Legacy-named symbol `_do_merge_lora_legacy` in src/axolotl/cli/merge_lora.py:30"}, "properties": {"repobilityId": "f81abb8cf8bb9ca6", "scanner": "scanner-primary", "fingerprint": "fe9b24e9ff83db3f", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-8fe43bc1ca66bf78", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 src/axolotl/cli/utils/train.py:192"}, "properties": {"repobilityId": "5cbc6e1c26c79354", "scanner": "scanner-primary", "fingerprint": "8fe43bc1ca66bf78", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-707d5508b9b9bf15", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/axolotl/cli/utils/lora_merge.py:948"}, "properties": {"repobilityId": "5c38a023302a773f", "scanner": "scanner-primary", "fingerprint": "707d5508b9b9bf15", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-afa0abea505a0aed", "level": "note", "message": {"text": "Stub function `preprocess` (body is just `pass`/`return`) \u2014 src/axolotl/cli/cloud/base.py:15"}, "properties": {"repobilityId": "29cf02e9bef1fc5b", "scanner": "scanner-primary", "fingerprint": "afa0abea505a0aed", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "empty-handler", "dead-code"]}}, {"ruleId": "scanner-268297f705123924", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 src/axolotl/cli/cloud/baseten/__init__.py:46"}, "properties": {"repobilityId": "bdc8e9f90c6ddbe9", "scanner": "scanner-primary", "fingerprint": "268297f705123924", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-b90ff984ef791cd7", "level": "note", "message": {"text": "Legacy-named symbol `deepseek_v2` in src/axolotl/common/architectures.py:17"}, "properties": {"repobilityId": "c958007361053ed3", "scanner": "scanner-primary", "fingerprint": "b90ff984ef791cd7", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-2aed058a7940012e", "level": "note", "message": {"text": "Legacy-named symbol `load_v2` in src/axolotl/prompt_strategies/context_qa.py:28"}, "properties": {"repobilityId": "1150242276ef6798", "scanner": "scanner-primary", "fingerprint": "2aed058a7940012e", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-c4ea028f6990cb0b", "level": "none", "message": {"text": "Commented-code block (8 lines) in src/axolotl/loaders/patch_manager.py:154"}, "properties": {"repobilityId": "263d7a28d7308ca2", "scanner": "scanner-primary", "fingerprint": "c4ea028f6990cb0b", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-c1020118303f0948", "level": "none", "message": {"text": "Commented-code block (6 lines) in src/axolotl/loaders/model.py:334"}, "properties": {"repobilityId": "54e8f582bfd8dc8e", "scanner": "scanner-primary", "fingerprint": "c1020118303f0948", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-8a967f0e1ff8d0df", "level": "note", "message": {"text": "Legacy-named symbol `tokenizer_legacy` in src/axolotl/loaders/tokenizer.py:159"}, "properties": {"repobilityId": "ef6cb7ba16ab17e3", "scanner": "scanner-primary", "fingerprint": "8a967f0e1ff8d0df", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "640877ff17cdd1f7", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "101aef6c3ac2b78a", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "3f98b11cf9b2fba8", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "afbb13668d1a1fef", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "9622621a1adf014a", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "609dd1327d400c4c", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "fc999c8ef57a79c4", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "0737dc1cf2db4f1f", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "f2c6ec39d45948f9", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-46969939caf8120b", "level": "note", "message": {"text": "Near-duplicate function bodies in 9 places"}, "properties": {"repobilityId": "c42173d9c1bb271e", "scanner": "scanner-primary", "fingerprint": "46969939caf8120b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "9bb663d53878d7b6", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "1b1b4744d091a1c2", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-be46ea126aa5d8dc", "level": "note", "message": {"text": "Near-duplicate function bodies in 3 places"}, "properties": {"repobilityId": "36008b45c17db6a5", "scanner": "scanner-primary", "fingerprint": "be46ea126aa5d8dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-9dad557909b86499", "level": "note", "message": {"text": "Near-duplicate function bodies in 10 places"}, "properties": {"repobilityId": "90a79656db66f276", "scanner": "scanner-primary", "fingerprint": "9dad557909b86499", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-49c98f7cedd9c977", "level": "note", "message": {"text": "Near-duplicate function bodies in 4 places"}, "properties": {"repobilityId": "699106ee064c1383", "scanner": "scanner-primary", "fingerprint": "49c98f7cedd9c977", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-be46ea126aa5d8dc", "level": "note", "message": {"text": "Near-duplicate function bodies in 3 places"}, "properties": {"repobilityId": "53637d18e50aeecc", "scanner": "scanner-primary", "fingerprint": "be46ea126aa5d8dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "fba92bc2e41d008d", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "2d17143bcd947880", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "f6deae911b40155d", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-be46ea126aa5d8dc", "level": "note", "message": {"text": "Near-duplicate function bodies in 3 places"}, "properties": {"repobilityId": "c1db22a62b36f4ee", "scanner": "scanner-primary", "fingerprint": "be46ea126aa5d8dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-00730914cd6ee517", "level": "error", "message": {"text": "FastAPI POST `set_lora_adapter` without auth dependency \u2014 src/axolotl/scripts/vllm_serve_lora.py:342"}, "properties": {"repobilityId": "53cb5259c8616230", "scanner": "scanner-primary", "fingerprint": "00730914cd6ee517", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/axolotl/scripts/vllm_serve_lora.py"}, "region": {"startLine": 342}}}]}, {"ruleId": "scanner-1f344b585c770ab4", "level": "error", "message": {"text": "FastAPI POST `clear_lora_adapter` without auth dependency \u2014 src/axolotl/scripts/vllm_serve_lora.py:359"}, "properties": {"repobilityId": "e937531a72e2d43b", "scanner": "scanner-primary", "fingerprint": "1f344b585c770ab4", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/axolotl/scripts/vllm_serve_lora.py"}, "region": {"startLine": 359}}}]}, {"ruleId": "scanner-97e1d11db0efcb9d", "level": "error", "message": {"text": "FastAPI POST `generate` without auth dependency \u2014 src/axolotl/scripts/vllm_serve_lora.py:385"}, "properties": {"repobilityId": "111657e877d3e5e3", "scanner": "scanner-primary", "fingerprint": "97e1d11db0efcb9d", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/axolotl/scripts/vllm_serve_lora.py"}, "region": {"startLine": 385}}}]}, {"ruleId": "scanner-ae9f471f57f187ad", "level": "error", "message": {"text": "FastAPI POST `chat` without auth dependency \u2014 src/axolotl/scripts/vllm_serve_lora.py:491"}, "properties": {"repobilityId": "abe970251111118a", "scanner": "scanner-primary", "fingerprint": "ae9f471f57f187ad", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/axolotl/scripts/vllm_serve_lora.py"}, "region": {"startLine": 491}}}]}, {"ruleId": "scanner-f44d3aed02e26eaf", "level": "error", "message": {"text": "FastAPI POST `openai_chat_completions` without auth dependency \u2014 src/axolotl/scripts/vllm_serve_lora.py:547"}, "properties": {"repobilityId": "bb3b140b1faa4417", "scanner": "scanner-primary", "fingerprint": "f44d3aed02e26eaf", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/axolotl/scripts/vllm_serve_lora.py"}, "region": {"startLine": 547}}}]}, {"ruleId": "scanner-998f4657a63de0c0", "level": "error", "message": {"text": "FastAPI POST `openai_completions` without auth dependency \u2014 src/axolotl/scripts/vllm_serve_lora.py:643"}, "properties": {"repobilityId": "ffd54d13b7d5583e", "scanner": "scanner-primary", "fingerprint": "998f4657a63de0c0", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/axolotl/scripts/vllm_serve_lora.py"}, "region": {"startLine": 643}}}]}, {"ruleId": "scanner-7a3b251764fe1e3d", "level": "error", "message": {"text": "FastAPI POST `init_communicator` without auth dependency \u2014 src/axolotl/scripts/vllm_serve_lora.py:789"}, "properties": {"repobilityId": "595c1982ddf9f52b", "scanner": "scanner-primary", "fingerprint": "7a3b251764fe1e3d", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/axolotl/scripts/vllm_serve_lora.py"}, "region": {"startLine": 789}}}]}, {"ruleId": "scanner-795a0859d071ce4a", "level": "error", "message": {"text": "FastAPI POST `update_named_param` without auth dependency \u2014 src/axolotl/scripts/vllm_serve_lora.py:815"}, "properties": {"repobilityId": "d92d9f30e8c59bcc", "scanner": "scanner-primary", "fingerprint": "795a0859d071ce4a", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/axolotl/scripts/vllm_serve_lora.py"}, "region": {"startLine": 815}}}]}, {"ruleId": "scanner-590c272cd547fa0d", "level": "error", "message": {"text": "FastAPI POST `batch_update_named_params` without auth dependency \u2014 src/axolotl/scripts/vllm_serve_lora.py:831"}, "properties": {"repobilityId": "b404a368db8539be", "scanner": "scanner-primary", "fingerprint": "590c272cd547fa0d", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/axolotl/scripts/vllm_serve_lora.py"}, "region": {"startLine": 831}}}]}, {"ruleId": "scanner-a0377c02616d4b09", "level": "error", "message": {"text": "FastAPI POST `http_update_weights` without auth dependency \u2014 src/axolotl/scripts/vllm_serve_lora.py:851"}, "properties": {"repobilityId": "43644e1f9a7ecada", "scanner": "scanner-primary", "fingerprint": "a0377c02616d4b09", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/axolotl/scripts/vllm_serve_lora.py"}, "region": {"startLine": 851}}}]}, {"ruleId": "scanner-1035234c6b63fa4f", "level": "error", "message": {"text": "FastAPI POST `reset_prefix_cache` without auth dependency \u2014 src/axolotl/scripts/vllm_serve_lora.py:881"}, "properties": {"repobilityId": "313df4a957d8dda5", "scanner": "scanner-primary", "fingerprint": "1035234c6b63fa4f", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/axolotl/scripts/vllm_serve_lora.py"}, "region": {"startLine": 881}}}]}, {"ruleId": "scanner-7198634871e59e7a", "level": "error", "message": {"text": "FastAPI POST `close_communicator` without auth dependency \u2014 src/axolotl/scripts/vllm_serve_lora.py:891"}, "properties": {"repobilityId": "feb1f249a3478377", "scanner": "scanner-primary", "fingerprint": "7198634871e59e7a", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/axolotl/scripts/vllm_serve_lora.py"}, "region": {"startLine": 891}}}]}]}]}