{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "MINED115", "name": "[MINED115] Action `mozilla-actions/sccache-action` pinned to mutable ref `@v0.0.10`: `uses: mozilla-actions/sccache-acti", "shortDescription": {"text": "[MINED115] Action `mozilla-actions/sccache-action` pinned to mutable ref `@v0.0.10`: `uses: mozilla-actions/sccache-action@v0.0.10` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-acti"}, "fullDescription": {"text": "Replace with: `uses: mozilla-actions/sccache-action@<40-char-sha>  # v0.0.10` and let Dependabot bump it on a scheduled cadence."}, "properties": {"scanner": "repobility-supply-chain", "category": "dependency", "severity": "medium", "confidence": 0.9, "cwe": "", "owasp": ""}}, {"id": "CFG006", "name": "[CFG006] Missing .gitignore: No .gitignore file. Risk of committing secrets and build artifacts.", "shortDescription": {"text": "[CFG006] Missing .gitignore: No .gitignore file. Risk of committing secrets and build artifacts."}, "fullDescription": {"text": "Add a .gitignore appropriate for your language/framework."}, "properties": {"scanner": "repobility-threat-engine", "category": "practices", "severity": "medium", "confidence": 1.0, "cwe": "", "owasp": ""}}, {"id": "MINED116", "name": "[MINED116] Workflow references `secrets.RUNNER_READ_TOKEN` in a `pull_request` workflow: `pull_request` workflows from f", "shortDescription": {"text": "[MINED116] Workflow references `secrets.RUNNER_READ_TOKEN` in a `pull_request` workflow: `pull_request` workflows from forks do not receive normal repository secrets, so `${ secrets.RUNNER_READ_TOKEN }` is usually empty for untrusted fork P"}, "fullDescription": {"text": "If fork PRs need this check, split it into an untrusted test workflow and a trusted follow-up workflow after maintainer review. If only same-repository PRs should run it, add an explicit same-repo guard."}, "properties": {"scanner": "repobility-supply-chain", "category": "dependency", "severity": "low", "confidence": 0.9, "cwe": "", "owasp": ""}}, {"id": "WEB005", "name": "robots.txt does not advertise a sitemap", "shortDescription": {"text": "robots.txt does not advertise a sitemap"}, "fullDescription": {"text": "Add `Sitemap: https://your-domain.example/sitemap.xml` to robots.txt."}, "properties": {"scanner": "repobility-web-presence", "category": "quality", "severity": "low", "confidence": 0.74, "cwe": "", "owasp": ""}}, {"id": "AIC003", "name": "Duplicated implementation block across source files", "shortDescription": {"text": "Duplicated implementation block across source files"}, "fullDescription": {"text": "Extract the shared behavior into one function/module or delete the inactive duplicate after proving which path is used."}, "properties": {"scanner": "repobility-ai-code-hygiene", "category": "quality", "severity": "low", "confidence": 0.86, "cwe": "", "owasp": ""}}, {"id": "MINED041", "name": "[MINED041] Rust Unimplemented Macro: unimplemented!() panics. Same as todo!() but conventionally used for trait stubs.", "shortDescription": {"text": "[MINED041] Rust Unimplemented Macro: unimplemented!() panics. Same as todo!() but conventionally used for trait stubs."}, "fullDescription": {"text": "Review and fix per the pattern semantics. See CWE-1188 /  for context."}, "properties": {"scanner": "repobility-threat-engine", "category": "quality", "severity": "info", "confidence": 0.1, "cwe": "", "owasp": ""}}, {"id": "MINED068", "name": "[MINED068] Rust Unsafe Block: unsafe { ... } block. Compiler safety guarantees disabled inside.", "shortDescription": {"text": "[MINED068] Rust Unsafe Block: unsafe { ... } block. Compiler safety guarantees disabled inside."}, "fullDescription": {"text": "Review and fix per the pattern semantics. See CWE-119 /  for context."}, "properties": {"scanner": "repobility-threat-engine", "category": "quality", "severity": "info", "confidence": 1.0, "cwe": "", "owasp": ""}}, {"id": "MINED043", "name": "[MINED043] Http Not Https: Hardcoded http:// (not localhost) for endpoints that handle credentials or data.", "shortDescription": {"text": "[MINED043] Http Not Https: Hardcoded http:// (not localhost) for endpoints that handle credentials or data."}, "fullDescription": {"text": "Review and fix per the pattern semantics. See CWE-319 / A02:2021 for context."}, "properties": {"scanner": "repobility-threat-engine", "category": "quality", "severity": "info", "confidence": 1.0, "cwe": "", "owasp": ""}}, {"id": "MINED059", "name": "[MINED059] Rust Expect In Prod (and 23 more): Same pattern found in 23 additional files. Review if needed.", "shortDescription": {"text": "[MINED059] Rust Expect In Prod (and 23 more): Same pattern found in 23 additional files. Review if needed."}, "fullDescription": {"text": "Review and fix per the pattern semantics. See CWE-755 /  for context."}, "properties": {"scanner": "repobility-threat-engine", "category": "quality", "severity": "info", "confidence": 0.2, "cwe": "", "owasp": ""}}, {"id": "MINED003", "name": "[MINED003] Rust Unwrap In Prod (and 14 more): Same pattern found in 14 additional files. Review if needed.", "shortDescription": {"text": "[MINED003] Rust Unwrap In Prod (and 14 more): Same pattern found in 14 additional files. Review if needed."}, "fullDescription": {"text": "Review and fix per the pattern semantics. See CWE-755 /  for context."}, "properties": {"scanner": "repobility-threat-engine", "category": "quality", "severity": "info", "confidence": 0.2, "cwe": "", "owasp": ""}}, {"id": "MINED117", "name": "[MINED117] Workflow declares `permissions: write-all`: The job's GITHUB_TOKEN gets EVERY permission scope. If the workfl", "shortDescription": {"text": "[MINED117] Workflow declares `permissions: write-all`: The job's GITHUB_TOKEN gets EVERY permission scope. If the workflow is ever compromised (mutable action, fork PR, injected step), the attacker can push to main, publish packages, alter "}, "fullDescription": {"text": "Replace with a scoped block: `permissions:\\n  contents: read\\n  issues: write` (only the scopes you need)."}, "properties": {"scanner": "repobility-supply-chain", "category": "dependency", "severity": "high", "confidence": 0.9, "cwe": "", "owasp": ""}}, {"id": "scanner-47636e33caef255d", "name": "Dockerfile runs as root: docker/Dockerfile", "shortDescription": {"text": "Dockerfile runs as root: docker/Dockerfile"}, "fullDescription": {"text": "No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f97b7f194f58845a", "name": "Docker base image is tag-pinned but not digest-pinned: rust:alpine", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: rust:alpine"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-45ac5e1963ae1bc3", "name": "Docker base image uses a mutable or implicit tag: alpine:latest", "shortDescription": {"text": "Docker base image uses a mutable or implicit tag: alpine:latest"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-098fd8d6156ecffc", "name": "Insecure pattern 'cors_wildcard' in iroh-relay/src/server.rs:1036", "shortDescription": {"text": "Insecure pattern 'cors_wildcard' in iroh-relay/src/server.rs:1036"}, "fullDescription": {"text": "Found a known-risky pattern (cors_wildcard). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6372cebde0220094", "name": "No auth library detected", "shortDescription": {"text": "No auth library detected"}, "fullDescription": {"text": "The scanner did not find any standard auth library (JWT, OAuth, NextAuth, Auth0, etc.). The repo has auth/admin/session surface indicators, so auth may live in custom code, in a separate service, or be missing."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2185a984e841166b", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "n0-computer/discord-webhook-notify@v1 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-355f0949746f07a9", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ca4d2197aaa9aa08", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d1991e564a69c32b", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/download-artifact@v8 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-27924aa79fa4a517", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-64192a3c67110d01", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-bde84117402b3e2c", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "mozilla-actions/sccache-action@v0.0.10 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4e2ead658ad414d6", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c3aec96b92b2671b", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-59275d58bed024e7", "name": "GitHub Action tracks a moving branch", "shortDescription": {"text": "GitHub Action tracks a moving branch"}, "fullDescription": {"text": "dtolnay/rust-toolchain@master can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "high", "confidence": 1.0}}, {"id": "scanner-46c644c6227e4d4a", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-30b0c8c3ed62aedd", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "taiki-e/install-action@v2 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2fe1ab26d00f7a1f", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "dtolnay/rust-toolchain@stable can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9ac01c21ea547747", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d921869e7f82d462", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9466de6abbe2c0b8", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a7613c8e09860982", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ca5f4dd0d02b4899", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "agenthunt/conventional-commit-checker-action@v2.0.1 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-aa412cb857ae5ebc", "name": "Very large file: iroh/src/address_lookup.rs (1401 lines)", "shortDescription": {"text": "Very large file: iroh/src/address_lookup.rs (1401 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0c2a4843bd0c2226", "name": "Very large file: iroh/src/socket.rs (2871 lines)", "shortDescription": {"text": "Very large file: iroh/src/socket.rs (2871 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-02a5cb8a56dafdda", "name": "Very large file: iroh/src/endpoint.rs (4036 lines)", "shortDescription": {"text": "Very large file: iroh/src/endpoint.rs (4036 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5ec908fbd2de4b52", "name": "Very large file: iroh/src/socket/transports/relay/actor.rs (1787 lines)", "shortDescription": {"text": "Very large file: iroh/src/socket/transports/relay/actor.rs (1787 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-db758c597b1cdb28", "name": "Very large file: iroh/src/socket/remote_map/remote_state.rs (1530 lines)", "shortDescription": {"text": "Very large file: iroh/src/socket/remote_map/remote_state.rs (1530 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-48b6e4427e86d586", "name": "Very large file: iroh/src/endpoint/connection.rs (1593 lines)", "shortDescription": {"text": "Very large file: iroh/src/endpoint/connection.rs (1593 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8ea6a590bfdb1afa", "name": "Very large file: iroh-relay/src/server.rs (1641 lines)", "shortDescription": {"text": "Very large file: iroh-relay/src/server.rs (1641 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-671ca28ce373ef9e", "name": "Very large file: iroh-relay/src/server/http_server.rs (1801 lines)", "shortDescription": {"text": "Very large file: iroh-relay/src/server/http_server.rs (1801 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ea3b5e389d8c9c0f", "name": "Low test-to-source ratio", "shortDescription": {"text": "Low test-to-source ratio"}, "fullDescription": {"text": "14 tests / 130 src (ratio 0.11)."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-141b30a41e03817b", "name": "No license file detected", "shortDescription": {"text": "No license file detected"}, "fullDescription": {"text": "No LICENSE/COPYING/NOTICE file was found. Generated repositories often omit licensing, which blocks reuse and automated intake."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-72b2a6250083a784", "name": "Placeholder or mock-heavy implementation detected", "shortDescription": {"text": "Placeholder or mock-heavy implementation detected"}, "fullDescription": {"text": "Found 16 placeholder/mock markers across 8 source files. This often means the repo looks complete while core flows still use generated scaffolding or fake data."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/30721"}, "properties": {"repository": "n0-computer/iroh", "repoUrl": "https://github.com/n0-computer/iroh", "branch": "main"}, "results": [{"ruleId": "MINED115", "level": "warning", "message": {"text": "[MINED115] Action `mozilla-actions/sccache-action` pinned to mutable ref `@v0.0.10`: `uses: mozilla-actions/sccache-action@v0.0.10` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-actions/changed-files compromise (2025) instantly affect many repos. Treat official first-party action tags as lower risk, but pin security-sensitive third-party actions to a 40-char commit SHA + lock with Dependabot or renovate."}, "properties": {"repobilityId": 467918, "scanner": "repobility-supply-chain", "fingerprint": "81c9f9fab953326ffca62b96711fd24fd8ec56fd3c718be16ca510a4af9fe1de", "category": "dependency", "severity": "medium", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "gha-mutable-ref", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|81c9f9fab953326ffca62b96711fd24fd8ec56fd3c718be16ca510a4af9fe1de"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 335}}}]}, {"ruleId": "MINED115", "level": "warning", "message": {"text": "[MINED115] Action `bytecodealliance/actions/wasm-tools/setup` pinned to mutable ref `@v1`: `uses: bytecodealliance/actions/wasm-tools/setup@v1` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-actions/changed-files compromise (2025) instantly affect many repos. Treat official first-party action tags as lower risk, but pin security-sensitive third-party actions to a 40-char commit SHA + lock with Dependabot or renovate."}, "properties": {"repobilityId": 467916, "scanner": "repobility-supply-chain", "fingerprint": "ec647b976d3760a7772e73ac6288b108885c26acd696a2e41074f6b27000b48c", "category": "dependency", "severity": "medium", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "gha-mutable-ref", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|ec647b976d3760a7772e73ac6288b108885c26acd696a2e41074f6b27000b48c"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 299}}}]}, {"ruleId": "MINED115", "level": "warning", "message": {"text": "[MINED115] Action `taiki-e/install-action` pinned to mutable ref `@v2`: `uses: taiki-e/install-action@v2` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-actions/changed-files compromise (2025) instantly affect many repos. Treat official first-party action tags as lower risk, but pin security-sensitive third-party actions to a 40-char commit SHA + lock with Dependabot or renovate."}, "properties": {"repobilityId": 467915, "scanner": "repobility-supply-chain", "fingerprint": "92829f7e11a26a7bb480358352b3fac0166c8237837475867b4cd6b10dbc0866", "category": "dependency", "severity": "medium", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "gha-mutable-ref", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|92829f7e11a26a7bb480358352b3fac0166c8237837475867b4cd6b10dbc0866"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 293}}}]}, {"ruleId": "MINED115", "level": "warning", "message": {"text": "[MINED115] Action `dtolnay/rust-toolchain` pinned to mutable ref `@stable`: `uses: dtolnay/rust-toolchain@stable` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-actions/changed-files compromise (2025) instantly affect many repos. Treat official first-party action tags as lower risk, but pin security-sensitive third-party actions to a 40-char commit SHA + lock with Dependabot or renovate."}, "properties": {"repobilityId": 467914, "scanner": "repobility-supply-chain", "fingerprint": "acf437b596b65ee8550fda08f69539bd05649237f6f9408b026739ab6e8267bb", "category": "dependency", "severity": "medium", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "gha-mutable-ref", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|acf437b596b65ee8550fda08f69539bd05649237f6f9408b026739ab6e8267bb"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 287}}}]}, {"ruleId": "MINED115", "level": "warning", "message": {"text": "[MINED115] Action `taiki-e/install-action` pinned to mutable ref `@cross`: `uses: taiki-e/install-action@cross` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-actions/changed-files compromise (2025) instantly affect many repos. Treat official first-party action tags as lower risk, but pin security-sensitive third-party actions to a 40-char commit SHA + lock with Dependabot or renovate."}, "properties": {"repobilityId": 467911, "scanner": "repobility-supply-chain", "fingerprint": "a6bd26d164b19cfe7cf9e56ae1ef1dc832967c6fc71fcc1867a4df7e249eab15", "category": "dependency", "severity": "medium", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "gha-mutable-ref", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|a6bd26d164b19cfe7cf9e56ae1ef1dc832967c6fc71fcc1867a4df7e249eab15"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 262}}}]}, {"ruleId": "MINED115", "level": "warning", "message": {"text": "[MINED115] Action `dtolnay/rust-toolchain` pinned to mutable ref `@stable`: `uses: dtolnay/rust-toolchain@stable` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-actions/changed-files compromise (2025) instantly affect many repos. Treat official first-party action tags as lower risk, but pin security-sensitive third-party actions to a 40-char commit SHA + lock with Dependabot or renovate."}, "properties": {"repobilityId": 467909, "scanner": "repobility-supply-chain", "fingerprint": "49b4c58f3e1fc537fe2c8e79b9e447397f357b33bba0c96e254cf1b43c0efc24", "category": "dependency", "severity": "medium", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "gha-mutable-ref", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|49b4c58f3e1fc537fe2c8e79b9e447397f357b33bba0c96e254cf1b43c0efc24"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 245}}}]}, {"ruleId": "MINED115", "level": "warning", "message": {"text": "[MINED115] Action `reactivecircus/android-emulator-runner` pinned to mutable ref `@v2`: `uses: reactivecircus/android-emulator-runner@v2` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-actions/changed-files compromise (2025) instantly affect many repos. Treat official first-party action tags as lower risk, but pin security-sensitive third-party actions to a 40-char commit SHA + lock with Dependabot or renovate."}, "properties": {"repobilityId": 467907, "scanner": "repobility-supply-chain", "fingerprint": "c7074fbb42fa1bd1b8c8913fe7f4c7b7ce12243040ebd9a61b1f81f40677485d", "category": "dependency", "severity": "medium", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "gha-mutable-ref", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|c7074fbb42fa1bd1b8c8913fe7f4c7b7ce12243040ebd9a61b1f81f40677485d"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 185}}}]}, {"ruleId": "MINED115", "level": "warning", "message": {"text": "[MINED115] Action `nttld/setup-ndk` pinned to mutable ref `@v1`: `uses: nttld/setup-ndk@v1` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-actions/changed-files compromise (2025) instantly affect many repos. Treat official first-party action tags as lower risk, but pin security-sensitive third-party actions to a 40-char commit SHA + lock with Dependabot or renovate."}, "properties": {"repobilityId": 467906, "scanner": "repobility-supply-chain", "fingerprint": "5e7bbb4a825321cb0fd422615d02068e93c43afa2db2cfb9dba37f4a81deb839", "category": "dependency", "severity": "medium", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "gha-mutable-ref", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|5e7bbb4a825321cb0fd422615d02068e93c43afa2db2cfb9dba37f4a81deb839"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 136}}}]}, {"ruleId": "MINED115", "level": "warning", "message": {"text": "[MINED115] Action `android-actions/setup-android` pinned to mutable ref `@v4`: `uses: android-actions/setup-android@v4` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-actions/changed-files compromise (2025) instantly affect many repos. Treat official first-party action tags as lower risk, but pin security-sensitive third-party actions to a 40-char commit SHA + lock with Dependabot or renovate."}, "properties": {"repobilityId": 467905, "scanner": "repobility-supply-chain", "fingerprint": "3820fd9ffe7006bb6a9d73d26d47b86df7d25e4662d2f777a176ddcad266bcb2", "category": "dependency", "severity": "medium", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "gha-mutable-ref", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|3820fd9ffe7006bb6a9d73d26d47b86df7d25e4662d2f777a176ddcad266bcb2"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 132}}}]}, {"ruleId": "MINED115", "level": "warning", "message": {"text": "[MINED115] Action `dtolnay/rust-toolchain` pinned to mutable ref `@stable`: `uses: dtolnay/rust-toolchain@stable` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-actions/changed-files compromise (2025) instantly affect many repos. Treat official first-party action tags as lower risk, but pin security-sensitive third-party actions to a 40-char commit SHA + lock with Dependabot or renovate."}, "properties": {"repobilityId": 467903, "scanner": "repobility-supply-chain", "fingerprint": "0709d65780db037f829665a036727c2545da76a7b658302df5ebaabebdc17601", "category": "dependency", "severity": "medium", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "gha-mutable-ref", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|0709d65780db037f829665a036727c2545da76a7b658302df5ebaabebdc17601"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 121}}}]}, {"ruleId": "MINED115", "level": "warning", "message": {"text": "[MINED115] Action `taiki-e/install-action` pinned to mutable ref `@cross`: `uses: taiki-e/install-action@cross` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-actions/changed-files compromise (2025) instantly affect many repos. Treat official first-party action tags as lower risk, but pin security-sensitive third-party actions to a 40-char commit SHA + lock with Dependabot or renovate."}, "properties": {"repobilityId": 467901, "scanner": "repobility-supply-chain", "fingerprint": "c5996cafbd2024d0eb1db3217f44506e228562a2e22d8cb4f098558f18d26ca7", "category": "dependency", "severity": "medium", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "gha-mutable-ref", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|c5996cafbd2024d0eb1db3217f44506e228562a2e22d8cb4f098558f18d26ca7"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 82}}}]}, {"ruleId": "MINED115", "level": "warning", "message": {"text": "[MINED115] Action `dtolnay/rust-toolchain` pinned to mutable ref `@stable`: `uses: dtolnay/rust-toolchain@stable` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-actions/changed-files compromise (2025) instantly affect many repos. Treat official first-party action tags as lower risk, but pin security-sensitive third-party actions to a 40-char commit SHA + lock with Dependabot or renovate."}, "properties": {"repobilityId": 467899, "scanner": "repobility-supply-chain", "fingerprint": "6795308f898fdef14449ebc2c80a715bf71ca0680a908921413553344fe09089", "category": "dependency", "severity": "medium", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "gha-mutable-ref", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|6795308f898fdef14449ebc2c80a715bf71ca0680a908921413553344fe09089"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 65}}}]}, {"ruleId": "MINED115", "level": "warning", "message": {"text": "[MINED115] Action `n0-computer/discord-webhook-notify` pinned to mutable ref `@v1`: `uses: n0-computer/discord-webhook-notify@v1` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-actions/changed-files compromise (2025) instantly affect many repos. Treat official first-party action tags as lower risk, but pin security-sensitive third-party actions to a 40-char commit SHA + lock with Dependabot or renovate."}, "properties": {"repobilityId": 467896, "scanner": "repobility-supply-chain", "fingerprint": "f879ef8bff611132f7ff96f3c5beb8b848c2b787eb98b07147ffc77ad7bade1f", "category": "dependency", "severity": "medium", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "gha-mutable-ref", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|f879ef8bff611132f7ff96f3c5beb8b848c2b787eb98b07147ffc77ad7bade1f"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/flaky.yaml"}, "region": {"startLine": 93}}}]}, {"ruleId": "MINED115", "level": "warning", "message": {"text": "[MINED115] Action `n0-computer/discord-webhook-notify` pinned to mutable ref `@v1`: `uses: n0-computer/discord-webhook-notify@v1` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-actions/changed-files compromise (2025) instantly affect many repos. Treat official first-party action tags as lower risk, but pin security-sensitive third-party actions to a 40-char commit SHA + lock with Dependabot or renovate."}, "properties": {"repobilityId": 467893, "scanner": "repobility-supply-chain", "fingerprint": "f6ebbe20dd6b76ef5101d001440c8dd457bd0c2f7b2df503490e0a5a5cf100ad", "category": "dependency", "severity": "medium", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "gha-mutable-ref", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|f6ebbe20dd6b76ef5101d001440c8dd457bd0c2f7b2df503490e0a5a5cf100ad"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/beta.yaml"}, "region": {"startLine": 35}}}]}, {"ruleId": "CFG006", "level": "warning", "message": {"text": "[CFG006] Missing .gitignore: No .gitignore file. Risk of committing secrets and build artifacts."}, "properties": {"repobilityId": 467887, "scanner": "repobility-threat-engine", "fingerprint": "c65fc71ce58c37a0e07837c0fe294108b731c43ef16027a2f0971c757bbe9a16", "category": "practices", "severity": "medium", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "No .gitignore file found in repository root", "evidence": {"reason": "No .gitignore file found in repository root", "rule_id": "CFG006", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "repo|practices|cfg006"}}}, {"ruleId": "MINED116", "level": "note", "message": {"text": "[MINED116] Workflow references `secrets.RUNNER_READ_TOKEN` in a `pull_request` workflow: `pull_request` workflows from forks do not receive normal repository secrets, so `${ secrets.RUNNER_READ_TOKEN }` is usually empty for untrusted fork PRs. This is a reliability/intent signal, not direct fork-secret exfiltration. Keep high severity for pull_request_target or trusted-context jobs that run untrusted PR code with secrets."}, "properties": {"repobilityId": 467922, "scanner": "repobility-supply-chain", "fingerprint": "598a13f9cc6fe7bdb1f7f7af0e50a1f9952975e5dbe51ee1294a2864ece3d585", "category": "dependency", "severity": "low", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "gha-pull-request-secrets", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|598a13f9cc6fe7bdb1f7f7af0e50a1f9952975e5dbe51ee1294a2864ece3d585"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/wine.yaml"}, "region": {"startLine": 24}}}]}, {"ruleId": "MINED116", "level": "note", "message": {"text": "[MINED116] Workflow references `secrets.RUNNER_READ_TOKEN` in a `pull_request` workflow: `pull_request` workflows from forks do not receive normal repository secrets, so `${ secrets.RUNNER_READ_TOKEN }` is usually empty for untrusted fork PRs. This is a reliability/intent signal, not direct fork-secret exfiltration. Keep high severity for pull_request_target or trusted-context jobs that run untrusted PR code with secrets."}, "properties": {"repobilityId": 467919, "scanner": "repobility-supply-chain", "fingerprint": "0ffc1187efe21e1b34db5f14131b9a321975052be951951095e1e08f0fd1d0f0", "category": "dependency", "severity": "low", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "gha-pull-request-secrets", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|0ffc1187efe21e1b34db5f14131b9a321975052be951951095e1e08f0fd1d0f0"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 29}}}]}, {"ruleId": "MINED115", "level": "note", "message": {"text": "[MINED115] Action `actions/checkout` pinned to mutable ref `@v6`: `uses: actions/checkout@v6` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-actions/changed-files compromise (2025) instantly affect many repos. Treat official first-party action tags as lower risk, but pin security-sensitive third-party actions to a 40-char commit SHA + lock with Dependabot or renovate."}, "properties": {"repobilityId": 467917, "scanner": "repobility-supply-chain", "fingerprint": "e0941cf40c072baaf799ad8490eb9a05ef56e042d5e98aa922021e602e911006", "category": "dependency", "severity": "low", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "gha-mutable-ref", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|e0941cf40c072baaf799ad8490eb9a05ef56e042d5e98aa922021e602e911006"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 331}}}]}, {"ruleId": "MINED115", "level": "note", "message": {"text": "[MINED115] Action `actions/setup-node` pinned to mutable ref `@v6`: `uses: actions/setup-node@v6` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-actions/changed-files compromise (2025) instantly affect many repos. Treat official first-party action tags as lower risk, but pin security-sensitive third-party actions to a 40-char commit SHA + lock with Dependabot or renovate."}, "properties": {"repobilityId": 467913, "scanner": "repobility-supply-chain", "fingerprint": "21d38f04b49473bd9fa6cc6248112ffafa0fdf09d86ab74be963ebe1f3c1ec1f", "category": "dependency", "severity": "low", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "gha-mutable-ref", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|21d38f04b49473bd9fa6cc6248112ffafa0fdf09d86ab74be963ebe1f3c1ec1f"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 282}}}]}, {"ruleId": "MINED115", "level": "note", "message": {"text": "[MINED115] Action `actions/checkout` pinned to mutable ref `@v6`: `uses: actions/checkout@v6` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-actions/changed-files compromise (2025) instantly affect many repos. Treat official first-party action tags as lower risk, but pin security-sensitive third-party actions to a 40-char commit SHA + lock with Dependabot or renovate."}, "properties": {"repobilityId": 467912, "scanner": "repobility-supply-chain", "fingerprint": "20ec3adb6c118f86f318501fca752c1cd24833e2d54af6ca06180c8095b32fb7", "category": "dependency", "severity": "low", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "gha-mutable-ref", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|20ec3adb6c118f86f318501fca752c1cd24833e2d54af6ca06180c8095b32fb7"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 279}}}]}, {"ruleId": "MINED115", "level": "note", "message": {"text": "[MINED115] Action `actions/cache` pinned to mutable ref `@v5`: `uses: actions/cache@v5` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-actions/changed-files compromise (2025) instantly affect many repos. Treat official first-party action tags as lower risk, but pin security-sensitive third-party actions to a 40-char commit SHA + lock with Dependabot or renovate."}, "properties": {"repobilityId": 467910, "scanner": "repobility-supply-chain", "fingerprint": "18371b4f21f9a3352560129e01d01d92023dea454a8ee5d68b25272615075f3f", "category": "dependency", "severity": "low", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "gha-mutable-ref", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|18371b4f21f9a3352560129e01d01d92023dea454a8ee5d68b25272615075f3f"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 255}}}]}, {"ruleId": "MINED115", "level": "note", "message": {"text": "[MINED115] Action `actions/checkout` pinned to mutable ref `@v6`: `uses: actions/checkout@v6` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-actions/changed-files compromise (2025) instantly affect many repos. Treat official first-party action tags as lower risk, but pin security-sensitive third-party actions to a 40-char commit SHA + lock with Dependabot or renovate."}, "properties": {"repobilityId": 467908, "scanner": "repobility-supply-chain", "fingerprint": "52ad5f08825ec22165e0df9faddacfbd6f161822e2a42fa346c28c01c6acf746", "category": "dependency", "severity": "low", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "gha-mutable-ref", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|52ad5f08825ec22165e0df9faddacfbd6f161822e2a42fa346c28c01c6acf746"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 240}}}]}, {"ruleId": "MINED115", "level": "note", "message": {"text": "[MINED115] Action `actions/setup-java` pinned to mutable ref `@v5`: `uses: actions/setup-java@v5` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-actions/changed-files compromise (2025) instantly affect many repos. Treat official first-party action tags as lower risk, but pin security-sensitive third-party actions to a 40-char commit SHA + lock with Dependabot or renovate."}, "properties": {"repobilityId": 467904, "scanner": "repobility-supply-chain", "fingerprint": "633d36abc415e81a938b11069851366a7b8f36d475c9aebaffecd7ea95888392", "category": "dependency", "severity": "low", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "gha-mutable-ref", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|633d36abc415e81a938b11069851366a7b8f36d475c9aebaffecd7ea95888392"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 126}}}]}, {"ruleId": "MINED115", "level": "note", "message": {"text": "[MINED115] Action `actions/checkout` pinned to mutable ref `@v6`: `uses: actions/checkout@v6` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-actions/changed-files compromise (2025) instantly affect many repos. Treat official first-party action tags as lower risk, but pin security-sensitive third-party actions to a 40-char commit SHA + lock with Dependabot or renovate."}, "properties": {"repobilityId": 467902, "scanner": "repobility-supply-chain", "fingerprint": "c3cfd420f13437b151ce659ccb3c0bd30e5a7d8f25066d469bf39d1fc5c0071e", "category": "dependency", "severity": "low", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "gha-mutable-ref", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|c3cfd420f13437b151ce659ccb3c0bd30e5a7d8f25066d469bf39d1fc5c0071e"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 110}}}]}, {"ruleId": "MINED115", "level": "note", "message": {"text": "[MINED115] Action `actions/cache` pinned to mutable ref `@v5`: `uses: actions/cache@v5` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-actions/changed-files compromise (2025) instantly affect many repos. Treat official first-party action tags as lower risk, but pin security-sensitive third-party actions to a 40-char commit SHA + lock with Dependabot or renovate."}, "properties": {"repobilityId": 467900, "scanner": "repobility-supply-chain", "fingerprint": "8f90fbfea96ccd7539d166d74b0a21c9b0226ba58dcabcb626f689269cd32793", "category": "dependency", "severity": "low", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "gha-mutable-ref", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|8f90fbfea96ccd7539d166d74b0a21c9b0226ba58dcabcb626f689269cd32793"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 75}}}]}, {"ruleId": "MINED115", "level": "note", "message": {"text": "[MINED115] Action `actions/checkout` pinned to mutable ref `@v6`: `uses: actions/checkout@v6` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-actions/changed-files compromise (2025) instantly affect many repos. Treat official first-party action tags as lower risk, but pin security-sensitive third-party actions to a 40-char commit SHA + lock with Dependabot or renovate."}, "properties": {"repobilityId": 467898, "scanner": "repobility-supply-chain", "fingerprint": "23aee8d5f64ac1549ee285d70a0b5ee33ca950014c6d180d35bba6505033b64c", "category": "dependency", "severity": "low", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "gha-mutable-ref", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|23aee8d5f64ac1549ee285d70a0b5ee33ca950014c6d180d35bba6505033b64c"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 60}}}]}, {"ruleId": "MINED116", "level": "note", "message": {"text": "[MINED116] Workflow references `secrets.DISCORD_N0_GITHUB_CHANNEL_WEBHOOK_URL` in a `pull_request` workflow: `pull_request` workflows from forks do not receive normal repository secrets, so `${ secrets.DISCORD_N0_GITHUB_CHANNEL_WEBHOOK_URL }` is usually empty for untrusted fork PRs. This is a reliability/intent signal, not direct fork-secret exfiltration. Keep high severity for pull_request_target or trusted-context jobs that run untrusted PR code with secrets."}, "properties": {"repobilityId": 467897, "scanner": "repobility-supply-chain", "fingerprint": "e020ae6c07128fa9cbbbb6496dbf952cd7def8528cbad5b239aa4b857b46c9a1", "category": "dependency", "severity": "low", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "gha-pull-request-secrets", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|e020ae6c07128fa9cbbbb6496dbf952cd7def8528cbad5b239aa4b857b46c9a1"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/flaky.yaml"}, "region": {"startLine": 99}}}]}, {"ruleId": "MINED115", "level": "note", "message": {"text": "[MINED115] Action `actions/download-artifact` pinned to mutable ref `@v8`: `uses: actions/download-artifact@v8` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-actions/changed-files compromise (2025) instantly affect many repos. Treat official first-party action tags as lower risk, but pin security-sensitive third-party actions to a 40-char commit SHA + lock with Dependabot or renovate."}, "properties": {"repobilityId": 467895, "scanner": "repobility-supply-chain", "fingerprint": "9492bc2b7ad356d0c757f6f0bf3ef8790039e6c1b54f7da08e0fc1514c4768b9", "category": "dependency", "severity": "low", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "gha-mutable-ref", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|9492bc2b7ad356d0c757f6f0bf3ef8790039e6c1b54f7da08e0fc1514c4768b9"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/flaky.yaml"}, "region": {"startLine": 62}}}]}, {"ruleId": "MINED115", "level": "note", "message": {"text": "[MINED115] Action `actions/checkout` pinned to mutable ref `@v6`: `uses: actions/checkout@v6` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-actions/changed-files compromise (2025) instantly affect many repos. Treat official first-party action tags as lower risk, but pin security-sensitive third-party actions to a 40-char commit SHA + lock with Dependabot or renovate."}, "properties": {"repobilityId": 467894, "scanner": "repobility-supply-chain", "fingerprint": "25048306f1533fee1313f4c6be40e0e2f55df34bbe42a38de195e09341cc55c9", "category": "dependency", "severity": "low", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "gha-mutable-ref", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|25048306f1533fee1313f4c6be40e0e2f55df34bbe42a38de195e09341cc55c9"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/cleanup.yaml"}, "region": {"startLine": 26}}}]}, {"ruleId": "WEB005", "level": "note", "message": {"text": "robots.txt does not advertise a sitemap"}, "properties": {"repobilityId": 467892, "scanner": "repobility-web-presence", "fingerprint": "af56249e5bf231d57292e3487ef61f428d691ae9d034e2cb113e13c3b5df5ca1", "category": "quality", "severity": "low", "confidence": 0.74, "triageState": "open", "verdict": "likely", "isResolved": false, "reason": "Discovered robots file or route lacks a Sitemap directive.", "evidence": {"rule_id": "WEB005", "scanner": "repobility-web-presence", "references": ["https://www.rfc-editor.org/rfc/rfc9309", "https://www.sitemaps.org/protocol.html"], "correlation_key": "fp|af56249e5bf231d57292e3487ef61f428d691ae9d034e2cb113e13c3b5df5ca1"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "iroh-relay/src/server.rs"}, "region": {"startLine": 1}}}]}, {"ruleId": "AIC003", "level": "note", "message": {"text": "Duplicated implementation block across source files"}, "properties": {"repobilityId": 467891, "scanner": "repobility-ai-code-hygiene", "fingerprint": "2c88c5c9febae8f3977228c0248830f8565a517db9f6aa5f3e598c664e8cee59", "category": "quality", "severity": "low", "confidence": 0.86, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "A normalized source-code window appears in two different non-test files.", "evidence": {"lines": 12, "rule_id": "AIC003", "scanner": "repobility-ai-code-hygiene", "references": ["https://jscpd.dev/"], "duplicate_file": "iroh/src/socket/transports/ip.rs", "duplicate_line": 145, "correlation_key": "fp|2c88c5c9febae8f3977228c0248830f8565a517db9f6aa5f3e598c664e8cee59"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "iroh/src/socket/transports/relay.rs"}, "region": {"startLine": 63}}}]}, {"ruleId": "AIC003", "level": "note", "message": {"text": "Duplicated implementation block across source files"}, "properties": {"repobilityId": 467890, "scanner": "repobility-ai-code-hygiene", "fingerprint": "4b3f4960ec46673b31f5d52fec008a8bb4e3007c7cf23ca58306f3b08983bc07", "category": "quality", "severity": "low", "confidence": 0.86, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "A normalized source-code window appears in two different non-test files.", "evidence": {"lines": 12, "rule_id": "AIC003", "scanner": "repobility-ai-code-hygiene", "references": ["https://jscpd.dev/"], "duplicate_file": "iroh/bench/src/iroh.rs", "duplicate_line": 118, "correlation_key": "fp|4b3f4960ec46673b31f5d52fec008a8bb4e3007c7cf23ca58306f3b08983bc07"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "iroh/bench/src/noq.rs"}, "region": {"startLine": 98}}}]}, {"ruleId": "AIC003", "level": "note", "message": {"text": "Duplicated implementation block across source files"}, "properties": {"repobilityId": 467889, "scanner": "repobility-ai-code-hygiene", "fingerprint": "47480e9fe20f524cdeb6b89a4bbab8ce1a01d05ceb267f7814a0b0b2cb6738ae", "category": "quality", "severity": "low", "confidence": 0.86, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "A normalized source-code window appears in two different non-test files.", "evidence": {"lines": 12, "rule_id": "AIC003", "scanner": "repobility-ai-code-hygiene", "references": ["https://jscpd.dev/"], "duplicate_file": "iroh-relay/src/client/streams.rs", "duplicate_line": 95, "correlation_key": "fp|47480e9fe20f524cdeb6b89a4bbab8ce1a01d05ceb267f7814a0b0b2cb6738ae"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "iroh-relay/src/server/streams.rs"}, "region": {"startLine": 151}}}]}, {"ruleId": "AIC003", "level": "note", "message": {"text": "Duplicated implementation block across source files"}, "properties": {"repobilityId": 467888, "scanner": "repobility-ai-code-hygiene", "fingerprint": "4bb6c448e7c221ef03d11fd08e21866c2fa940f58d3697d7b4246dc4342fe86b", "category": "quality", "severity": "low", "confidence": 0.86, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "A normalized source-code window appears in two different non-test files.", "evidence": {"lines": 12, "rule_id": "AIC003", "scanner": "repobility-ai-code-hygiene", "references": ["https://jscpd.dev/"], "duplicate_file": "iroh-relay/src/server/client.rs", "duplicate_line": 380, "correlation_key": "fp|4bb6c448e7c221ef03d11fd08e21866c2fa940f58d3697d7b4246dc4342fe86b"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "iroh-relay/src/server/clients.rs"}, "region": {"startLine": 192}}}]}, {"ruleId": "MINED041", "level": "none", "message": {"text": "[MINED041] Rust Unimplemented Macro: unimplemented!() panics. Same as todo!() but conventionally used for trait stubs."}, "properties": {"repobilityId": 467886, "scanner": "repobility-threat-engine", "fingerprint": "dde02776501b4798e102d5ad63eff1c99471020957b2bfe4c01f8c3fc6001e73", "category": "quality", "severity": "info", "confidence": 0.1, "triageState": "false_positive", "verdict": "likely_fp", "isResolved": true, "reason": "Safe pattern 'test\\b' detected on same line", "evidence": {"mined": true, "mining": {"slug": "rust-unimplemented-macro", "owasp": null, "cwe_ids": ["CWE-1188"], "languages": ["rust"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.347994+00:00", "triaged_in_corpus": 15, "observations_count": 1422, "ai_coder_pattern_id": 115}, "scanner": "repobility-threat-engine", "correlation_key": "fp|dde02776501b4798e102d5ad63eff1c99471020957b2bfe4c01f8c3fc6001e73"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "iroh-relay/src/client/streams.rs"}, "region": {"startLine": 211}}}]}, {"ruleId": "MINED068", "level": "none", "message": {"text": "[MINED068] Rust Unsafe Block: unsafe { ... } block. Compiler safety guarantees disabled inside."}, "properties": {"repobilityId": 467885, "scanner": "repobility-threat-engine", "fingerprint": "f0148d597fef8e7c69e24927b2a74aee809329f5bf5dce7cb5ee3bbc45c77cd6", "category": "quality", "severity": "info", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "rust-unsafe-block", "owasp": null, "cwe_ids": ["CWE-119"], "languages": ["rust"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.348060+00:00", "triaged_in_corpus": 12, "observations_count": 42383, "ai_coder_pattern_id": 116}, "scanner": "repobility-threat-engine", "correlation_key": "fp|f0148d597fef8e7c69e24927b2a74aee809329f5bf5dce7cb5ee3bbc45c77cd6"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "iroh-dns/src/android.rs"}, "region": {"startLine": 67}}}]}, {"ruleId": "MINED043", "level": "none", "message": {"text": "[MINED043] Http Not Https: Hardcoded http:// (not localhost) for endpoints that handle credentials or data."}, "properties": {"repobilityId": 467884, "scanner": "repobility-threat-engine", "fingerprint": "6b1b136cf16079a3947c364cc12b915c916b7fbe5b3036c6525aa0c2da8f5d5e", "category": "quality", "severity": "info", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "http-not-https", "owasp": "A02:2021", "cwe_ids": ["CWE-319"], "precision": 0.917, "promoted_at": "2026-05-18T14:01:32.347999+00:00", "triaged_in_corpus": 12, "observations_count": 4113831, "ai_coder_pattern_id": 15}, "scanner": "repobility-threat-engine", "correlation_key": "fp|6b1b136cf16079a3947c364cc12b915c916b7fbe5b3036c6525aa0c2da8f5d5e"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "iroh-dns-server/src/server.rs"}, "region": {"startLine": 196}}}]}, {"ruleId": "MINED059", "level": "none", "message": {"text": "[MINED059] Rust Expect In Prod (and 23 more): Same pattern found in 23 additional files. Review if needed."}, "properties": {"repobilityId": 467883, "scanner": "repobility-threat-engine", "fingerprint": "ced9dab995b4ba716285dfea427bef7a3943d5834edc07c8533255154a8d891e", "category": "quality", "severity": "info", "confidence": 0.2, "triageState": "false_positive", "verdict": "likely_fp", "isResolved": true, "reason": "Deduplicated summary only: 23 additional occurrences found. The top occurrences remain visible as actionable findings.", "evidence": {"mined": true, "mining": {"slug": "rust-expect-in-prod", "owasp": null, "cwe_ids": ["CWE-755"], "languages": ["rust"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.348039+00:00", "triaged_in_corpus": 12, "observations_count": 175379, "ai_coder_pattern_id": 112}, "scanner": "repobility-threat-engine", "aggregated": true, "correlation_key": "fp|ced9dab995b4ba716285dfea427bef7a3943d5834edc07c8533255154a8d891e", "aggregated_count": 23}}}, {"ruleId": "MINED059", "level": "none", "message": {"text": "[MINED059] Rust Expect In Prod: .expect(...) panics same as unwrap with a custom message."}, "properties": {"repobilityId": 467882, "scanner": "repobility-threat-engine", "fingerprint": "70845ea2f993ec07dbfb6688f7352945a8d25db902d88ae7f038d9645bb19c92", "category": "quality", "severity": "info", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "rust-expect-in-prod", "owasp": null, "cwe_ids": ["CWE-755"], "languages": ["rust"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.348039+00:00", "triaged_in_corpus": 12, "observations_count": 175379, "ai_coder_pattern_id": 112}, "scanner": "repobility-threat-engine", "correlation_key": "fp|70845ea2f993ec07dbfb6688f7352945a8d25db902d88ae7f038d9645bb19c92"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "iroh-dns-server/examples/resolve.rs"}, "region": {"startLine": 60}}}]}, {"ruleId": "MINED059", "level": "none", "message": {"text": "[MINED059] Rust Expect In Prod: .expect(...) panics same as unwrap with a custom message."}, "properties": {"repobilityId": 467881, "scanner": "repobility-threat-engine", "fingerprint": "976c1157cced4027b5589215c4e66a4e9fad7621c129b9d7d1cd9225a948158e", "category": "quality", "severity": "info", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "rust-expect-in-prod", "owasp": null, "cwe_ids": ["CWE-755"], "languages": ["rust"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.348039+00:00", "triaged_in_corpus": 12, "observations_count": 175379, "ai_coder_pattern_id": 112}, "scanner": "repobility-threat-engine", "correlation_key": "fp|976c1157cced4027b5589215c4e66a4e9fad7621c129b9d7d1cd9225a948158e"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "iroh-dns-server/examples/publish.rs"}, "region": {"startLine": 82}}}]}, {"ruleId": "MINED059", "level": "none", "message": {"text": "[MINED059] Rust Expect In Prod: .expect(...) panics same as unwrap with a custom message."}, "properties": {"repobilityId": 467880, "scanner": "repobility-threat-engine", "fingerprint": "ca19d08431e96b71f96068863e8015e91529d775923b819eeb1a1533ea03064a", "category": "quality", "severity": "info", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "rust-expect-in-prod", "owasp": null, "cwe_ids": ["CWE-755"], "languages": ["rust"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.348039+00:00", "triaged_in_corpus": 12, "observations_count": 175379, "ai_coder_pattern_id": 112}, "scanner": "repobility-threat-engine", "correlation_key": "fp|ca19d08431e96b71f96068863e8015e91529d775923b819eeb1a1533ea03064a"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "iroh-dns-server/benches/write.rs"}, "region": {"startLine": 34}}}]}, {"ruleId": "MINED003", "level": "none", "message": {"text": "[MINED003] Rust Unwrap In Prod (and 14 more): Same pattern found in 14 additional files. Review if needed."}, "properties": {"repobilityId": 467879, "scanner": "repobility-threat-engine", "fingerprint": "87a995518e6b80ec572d3ec6cc4d17b264a4a743e180fe16235006f43fc55c08", "category": "quality", "severity": "info", "confidence": 0.2, "triageState": "false_positive", "verdict": "likely_fp", "isResolved": true, "reason": "Deduplicated summary only: 14 additional occurrences found. The top occurrences remain visible as actionable findings.", "evidence": {"mined": true, "mining": {"slug": "rust-unwrap-in-prod", "owasp": null, "cwe_ids": ["CWE-755"], "languages": ["rust"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.347903+00:00", "triaged_in_corpus": 15, "observations_count": 386515, "ai_coder_pattern_id": 111}, "scanner": "repobility-threat-engine", "aggregated": true, "correlation_key": "fp|87a995518e6b80ec572d3ec6cc4d17b264a4a743e180fe16235006f43fc55c08", "aggregated_count": 14}}}, {"ruleId": "MINED117", "level": "error", "message": {"text": "[MINED117] Workflow declares `permissions: write-all`: The job's GITHUB_TOKEN gets EVERY permission scope. If the workflow is ever compromised (mutable action, fork PR, injected step), the attacker can push to main, publish packages, alter releases. Use least-privilege by listing only the scopes the job actually needs."}, "properties": {"repobilityId": 467925, "scanner": "repobility-supply-chain", "fingerprint": "0961b5992c2f6ea571eb4ba1ee48cb554ed1e730b277cac86b58d5dd6f3fd5d6", "category": "dependency", "severity": "high", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "gha-write-all-permissions", "owasp": "A01:2021", "cwe_ids": ["CWE-269"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|0961b5992c2f6ea571eb4ba1ee48cb554ed1e730b277cac86b58d5dd6f3fd5d6"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/netsim.yml"}, "region": {"startLine": 53}}}]}, {"ruleId": "MINED117", "level": "error", "message": {"text": "[MINED117] Workflow declares `permissions: write-all`: The job's GITHUB_TOKEN gets EVERY permission scope. If the workflow is ever compromised (mutable action, fork PR, injected step), the attacker can push to main, publish packages, alter releases. Use least-privilege by listing only the scopes the job actually needs."}, "properties": {"repobilityId": 467924, "scanner": "repobility-supply-chain", "fingerprint": "f3389557504e571bc8343e55345305804d5d1d1daba593bbee85aea9a0d1ce34", "category": "dependency", "severity": "high", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "gha-write-all-permissions", "owasp": "A01:2021", "cwe_ids": ["CWE-269"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|f3389557504e571bc8343e55345305804d5d1d1daba593bbee85aea9a0d1ce34"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/netsim.yml"}, "region": {"startLine": 39}}}]}, {"ruleId": "MINED117", "level": "error", "message": {"text": "[MINED117] Workflow declares `permissions: write-all`: The job's GITHUB_TOKEN gets EVERY permission scope. If the workflow is ever compromised (mutable action, fork PR, injected step), the attacker can push to main, publish packages, alter releases. Use least-privilege by listing only the scopes the job actually needs."}, "properties": {"repobilityId": 467923, "scanner": "repobility-supply-chain", "fingerprint": "f6a351d99d6708b0de9006a156091fd50febc05a8aacc5d8e14d8b4061a41475", "category": "dependency", "severity": "high", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "gha-write-all-permissions", "owasp": "A01:2021", "cwe_ids": ["CWE-269"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|f6a351d99d6708b0de9006a156091fd50febc05a8aacc5d8e14d8b4061a41475"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/netsim_runner.yaml"}, "region": {"startLine": 101}}}]}, {"ruleId": "MINED117", "level": "error", "message": {"text": "[MINED117] Workflow declares `permissions: write-all`: The job's GITHUB_TOKEN gets EVERY permission scope. If the workflow is ever compromised (mutable action, fork PR, injected step), the attacker can push to main, publish packages, alter releases. Use least-privilege by listing only the scopes the job actually needs."}, "properties": {"repobilityId": 467921, "scanner": "repobility-supply-chain", "fingerprint": "c3402427c765d6d9a691c41a6ebba1c035089e569602551899dad01c12cbf445", "category": "dependency", "severity": "high", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "gha-write-all-permissions", "owasp": "A01:2021", "cwe_ids": ["CWE-269"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|c3402427c765d6d9a691c41a6ebba1c035089e569602551899dad01c12cbf445"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/docs.yaml"}, "region": {"startLine": 20}}}]}, {"ruleId": "MINED117", "level": "error", "message": {"text": "[MINED117] Workflow declares `permissions: write-all`: The job's GITHUB_TOKEN gets EVERY permission scope. If the workflow is ever compromised (mutable action, fork PR, injected step), the attacker can push to main, publish packages, alter releases. Use least-privilege by listing only the scopes the job actually needs."}, "properties": {"repobilityId": 467920, "scanner": "repobility-supply-chain", "fingerprint": "cb427dcb8c4a530919ff64fe42a19eb69445d8307ca92890eebfd59ad83b13ff", "category": "dependency", "severity": "high", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "gha-write-all-permissions", "owasp": "A01:2021", "cwe_ids": ["CWE-269"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|cb427dcb8c4a530919ff64fe42a19eb69445d8307ca92890eebfd59ad83b13ff"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 522}}}]}, {"ruleId": "MINED003", "level": "error", "message": {"text": "[MINED003] Rust Unwrap In Prod: .unwrap() panics if None/Err. Acceptable in tests; risky elsewhere."}, "properties": {"repobilityId": 467878, "scanner": "repobility-threat-engine", "fingerprint": "ece44c8ba0a8c1ffca0f471f4ad6e1d9268eef4c2b60c5a05541134bd49012fa", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "rust-unwrap-in-prod", "owasp": null, "cwe_ids": ["CWE-755"], "languages": ["rust"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.347903+00:00", "triaged_in_corpus": 15, "observations_count": 386515, "ai_coder_pattern_id": 111}, "scanner": "repobility-threat-engine", "correlation_key": "fp|ece44c8ba0a8c1ffca0f471f4ad6e1d9268eef4c2b60c5a05541134bd49012fa"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "iroh-dns-server/src/dns.rs"}, "region": {"startLine": 253}}}]}, {"ruleId": "MINED003", "level": "error", "message": {"text": "[MINED003] Rust Unwrap In Prod: .unwrap() panics if None/Err. Acceptable in tests; risky elsewhere."}, "properties": {"repobilityId": 467877, "scanner": "repobility-threat-engine", "fingerprint": "7ea4f11af1a8615dd3f86f8706ff5e2bc66a4ff2e62655c4510703c577036e6f", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "rust-unwrap-in-prod", "owasp": null, "cwe_ids": ["CWE-755"], "languages": ["rust"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.347903+00:00", "triaged_in_corpus": 15, "observations_count": 386515, "ai_coder_pattern_id": 111}, "scanner": "repobility-threat-engine", "correlation_key": "fp|7ea4f11af1a8615dd3f86f8706ff5e2bc66a4ff2e62655c4510703c577036e6f"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "iroh-dns-server/benches/write.rs"}, "region": {"startLine": 23}}}]}, {"ruleId": "MINED003", "level": "error", "message": {"text": "[MINED003] Rust Unwrap In Prod: .unwrap() panics if None/Err. Acceptable in tests; risky elsewhere."}, "properties": {"repobilityId": 467876, "scanner": "repobility-threat-engine", "fingerprint": "85ac6c3ffa45ef07b171bb1041108e32854f5ceb0f1c8ecfb4adb7849ddd483b", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "rust-unwrap-in-prod", "owasp": null, "cwe_ids": ["CWE-755"], "languages": ["rust"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.347903+00:00", "triaged_in_corpus": 15, "observations_count": 386515, "ai_coder_pattern_id": 111}, "scanner": "repobility-threat-engine", "correlation_key": "fp|85ac6c3ffa45ef07b171bb1041108e32854f5ceb0f1c8ecfb4adb7849ddd483b"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "iroh-base/src/relay_url.rs"}, "region": {"startLine": 94}}}]}, {"ruleId": "scanner-47636e33caef255d", "level": "warning", "message": {"text": "Dockerfile runs as root: docker/Dockerfile"}, "properties": {"repobilityId": "8a345ba4198453bd", "scanner": "scanner-primary", "fingerprint": "47636e33caef255d", "layer": "hardware", "severity": "medium", "confidence": 1.0, "tags": ["security", "container"]}}, {"ruleId": "scanner-f97b7f194f58845a", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: rust:alpine"}, "properties": {"repobilityId": "316dc19f825e5638", "scanner": "scanner-primary", "fingerprint": "f97b7f194f58845a", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docker/Dockerfile"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-45ac5e1963ae1bc3", "level": "warning", "message": {"text": "Docker base image uses a mutable or implicit tag: alpine:latest"}, "properties": {"repobilityId": "9479dad2924b27b6", "scanner": "scanner-primary", "fingerprint": "45ac5e1963ae1bc3", "layer": "hardware", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docker/Dockerfile"}, "region": {"startLine": 30}}}]}, {"ruleId": "scanner-45ac5e1963ae1bc3", "level": "warning", "message": {"text": "Docker base image uses a mutable or implicit tag: alpine:latest"}, "properties": {"repobilityId": "15441ed81fbc8f1e", "scanner": "scanner-primary", "fingerprint": "45ac5e1963ae1bc3", "layer": "hardware", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docker/Dockerfile"}, "region": {"startLine": 49}}}]}, {"ruleId": "scanner-098fd8d6156ecffc", "level": "warning", "message": {"text": "Insecure pattern 'cors_wildcard' in iroh-relay/src/server.rs:1036"}, "properties": {"repobilityId": "bd38497ef1e2c09c", "scanner": "scanner-primary", "fingerprint": "098fd8d6156ecffc", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "cors_wildcard"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "iroh-relay/src/server.rs"}, "region": {"startLine": 1036}}}]}, {"ruleId": "scanner-6372cebde0220094", "level": "warning", "message": {"text": "No auth library detected"}, "properties": {"repobilityId": "a5b6035a5bbf8054", "scanner": "scanner-primary", "fingerprint": "6372cebde0220094", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["coverage", "auth"]}}, {"ruleId": "scanner-2185a984e841166b", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "a883d6fe0fb6b90d", "scanner": "scanner-primary", "fingerprint": "2185a984e841166b", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/beta.yaml"}, "region": {"startLine": 35}}}]}, {"ruleId": "scanner-355f0949746f07a9", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "593b53869b1e6b1d", "scanner": "scanner-primary", "fingerprint": "355f0949746f07a9", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/cleanup.yaml"}, "region": {"startLine": 26}}}]}, {"ruleId": "scanner-ca4d2197aaa9aa08", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "2fb17c942e0a27db", "scanner": "scanner-primary", "fingerprint": "ca4d2197aaa9aa08", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/cleanup.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d1991e564a69c32b", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "753276b711cf5209", "scanner": "scanner-primary", "fingerprint": "d1991e564a69c32b", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/flaky.yaml"}, "region": {"startLine": 62}}}]}, {"ruleId": "scanner-d1991e564a69c32b", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "c1276448fcbb0459", "scanner": "scanner-primary", "fingerprint": "d1991e564a69c32b", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/flaky.yaml"}, "region": {"startLine": 93}}}]}, {"ruleId": "scanner-27924aa79fa4a517", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "97a9a5de61d82fcd", "scanner": "scanner-primary", "fingerprint": "27924aa79fa4a517", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 60}}}]}, {"ruleId": "scanner-27924aa79fa4a517", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "ae83c03bfc0a4d34", "scanner": "scanner-primary", "fingerprint": "27924aa79fa4a517", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 65}}}]}, {"ruleId": "scanner-27924aa79fa4a517", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "a22664b58dca3181", "scanner": "scanner-primary", "fingerprint": "27924aa79fa4a517", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 75}}}]}, {"ruleId": "scanner-27924aa79fa4a517", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "6a604e07854234aa", "scanner": "scanner-primary", "fingerprint": "27924aa79fa4a517", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 82}}}]}, {"ruleId": "scanner-27924aa79fa4a517", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "97a9a5de61d82fcd", "scanner": "scanner-primary", "fingerprint": "27924aa79fa4a517", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 110}}}]}, {"ruleId": "scanner-27924aa79fa4a517", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "ae83c03bfc0a4d34", "scanner": "scanner-primary", "fingerprint": "27924aa79fa4a517", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 121}}}]}, {"ruleId": "scanner-27924aa79fa4a517", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "7ea1eecadb79c262", "scanner": "scanner-primary", "fingerprint": "27924aa79fa4a517", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 126}}}]}, {"ruleId": "scanner-27924aa79fa4a517", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "6eb8db51b703ffe7", "scanner": "scanner-primary", "fingerprint": "27924aa79fa4a517", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 132}}}]}, {"ruleId": "scanner-27924aa79fa4a517", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "816d593e8bd6c328", "scanner": "scanner-primary", "fingerprint": "27924aa79fa4a517", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 136}}}]}, {"ruleId": "scanner-27924aa79fa4a517", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "bab7c266591be594", "scanner": "scanner-primary", "fingerprint": "27924aa79fa4a517", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 185}}}]}, {"ruleId": "scanner-27924aa79fa4a517", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "97a9a5de61d82fcd", "scanner": "scanner-primary", "fingerprint": "27924aa79fa4a517", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 240}}}]}, {"ruleId": "scanner-27924aa79fa4a517", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "ae83c03bfc0a4d34", "scanner": "scanner-primary", "fingerprint": "27924aa79fa4a517", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 245}}}]}, {"ruleId": "scanner-27924aa79fa4a517", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "a22664b58dca3181", "scanner": "scanner-primary", "fingerprint": "27924aa79fa4a517", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 255}}}]}, {"ruleId": "scanner-27924aa79fa4a517", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "6a604e07854234aa", "scanner": "scanner-primary", "fingerprint": "27924aa79fa4a517", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 262}}}]}, {"ruleId": "scanner-27924aa79fa4a517", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "97a9a5de61d82fcd", "scanner": "scanner-primary", "fingerprint": "27924aa79fa4a517", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 279}}}]}, {"ruleId": "scanner-27924aa79fa4a517", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "4a63b1fd6887cae9", "scanner": "scanner-primary", "fingerprint": "27924aa79fa4a517", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 282}}}]}, {"ruleId": "scanner-27924aa79fa4a517", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "ae83c03bfc0a4d34", "scanner": "scanner-primary", "fingerprint": "27924aa79fa4a517", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 287}}}]}, {"ruleId": "scanner-27924aa79fa4a517", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "d36e0bb5e789fa1f", "scanner": "scanner-primary", "fingerprint": "27924aa79fa4a517", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 293}}}]}, {"ruleId": "scanner-27924aa79fa4a517", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "125a0aecf63f47bb", "scanner": "scanner-primary", "fingerprint": "27924aa79fa4a517", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 299}}}]}, {"ruleId": "scanner-27924aa79fa4a517", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "7195a4314f751589", "scanner": "scanner-primary", "fingerprint": "27924aa79fa4a517", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 335}}}]}, {"ruleId": "scanner-64192a3c67110d01", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "87338a8bfcb6f435", "scanner": "scanner-primary", "fingerprint": "64192a3c67110d01", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-bde84117402b3e2c", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "d25dccf96cc41879", "scanner": "scanner-primary", "fingerprint": "bde84117402b3e2c", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/docs.yaml"}, "region": {"startLine": 37}}}]}, {"ruleId": "scanner-bde84117402b3e2c", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "58c7d20ecf6682b9", "scanner": "scanner-primary", "fingerprint": "bde84117402b3e2c", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/docs.yaml"}, "region": {"startLine": 47}}}]}, {"ruleId": "scanner-bde84117402b3e2c", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "bdbcf782359c1d89", "scanner": "scanner-primary", "fingerprint": "bde84117402b3e2c", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/docs.yaml"}, "region": {"startLine": 55}}}]}, {"ruleId": "scanner-bde84117402b3e2c", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "9a54344cf04161ed", "scanner": "scanner-primary", "fingerprint": "bde84117402b3e2c", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/docs.yaml"}, "region": {"startLine": 67}}}]}, {"ruleId": "scanner-4e2ead658ad414d6", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "4dae611d0fdc8e2a", "scanner": "scanner-primary", "fingerprint": "4e2ead658ad414d6", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/docs.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c3aec96b92b2671b", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "efdcb66978b4bf50", "scanner": "scanner-primary", "fingerprint": "c3aec96b92b2671b", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/tests.yaml"}, "region": {"startLine": 104}}}]}, {"ruleId": "scanner-59275d58bed024e7", "level": "error", "message": {"text": "GitHub Action tracks a moving branch"}, "properties": {"repobilityId": "a9dac8d38ffe5b9a", "scanner": "scanner-primary", "fingerprint": "59275d58bed024e7", "layer": "cicd", "severity": "high", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/tests.yaml"}, "region": {"startLine": 109}}}]}, {"ruleId": "scanner-c3aec96b92b2671b", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "65200029c84de6b1", "scanner": "scanner-primary", "fingerprint": "c3aec96b92b2671b", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/tests.yaml"}, "region": {"startLine": 114}}}]}, {"ruleId": "scanner-c3aec96b92b2671b", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "5a81a2a6873b980c", "scanner": "scanner-primary", "fingerprint": "c3aec96b92b2671b", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/tests.yaml"}, "region": {"startLine": 119}}}]}, {"ruleId": "scanner-c3aec96b92b2671b", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "97c6ae5cad1f53f8", "scanner": "scanner-primary", "fingerprint": "c3aec96b92b2671b", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/tests.yaml"}, "region": {"startLine": 170}}}]}, {"ruleId": "scanner-c3aec96b92b2671b", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "efdcb66978b4bf50", "scanner": "scanner-primary", "fingerprint": "c3aec96b92b2671b", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/tests.yaml"}, "region": {"startLine": 220}}}]}, {"ruleId": "scanner-c3aec96b92b2671b", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "cfdd01d00316897e", "scanner": "scanner-primary", "fingerprint": "c3aec96b92b2671b", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/tests.yaml"}, "region": {"startLine": 233}}}]}, {"ruleId": "scanner-c3aec96b92b2671b", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "5a81a2a6873b980c", "scanner": "scanner-primary", "fingerprint": "c3aec96b92b2671b", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/tests.yaml"}, "region": {"startLine": 266}}}]}, {"ruleId": "scanner-c3aec96b92b2671b", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "97c6ae5cad1f53f8", "scanner": "scanner-primary", "fingerprint": "c3aec96b92b2671b", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/tests.yaml"}, "region": {"startLine": 304}}}]}, {"ruleId": "scanner-c3aec96b92b2671b", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "efdcb66978b4bf50", "scanner": "scanner-primary", "fingerprint": "c3aec96b92b2671b", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/tests.yaml"}, "region": {"startLine": 357}}}]}, {"ruleId": "scanner-c3aec96b92b2671b", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "5a81a2a6873b980c", "scanner": "scanner-primary", "fingerprint": "c3aec96b92b2671b", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/tests.yaml"}, "region": {"startLine": 368}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "04f6c832d67a7838", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 69}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "099cec11fd8f1310", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 75}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "04f6c832d67a7838", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 154}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "04f6c832d67a7838", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 160}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "9e54fac6c290138e", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 182}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "03dc9a011bc73d31", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 217}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "40de0ea74eab3ee8", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 315}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "40de0ea74eab3ee8", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 324}}}]}, {"ruleId": "scanner-30b0c8c3ed62aedd", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "0ac430c1699c503a", "scanner": "scanner-primary", "fingerprint": "30b0c8c3ed62aedd", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/patchbay.yml"}, "region": {"startLine": 37}}}]}, {"ruleId": "scanner-30b0c8c3ed62aedd", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "e040b55816070dd9", "scanner": "scanner-primary", "fingerprint": "30b0c8c3ed62aedd", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/patchbay.yml"}, "region": {"startLine": 54}}}]}, {"ruleId": "scanner-2fe1ab26d00f7a1f", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "ff2c052cc61a58e0", "scanner": "scanner-primary", "fingerprint": "2fe1ab26d00f7a1f", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/wine.yaml"}, "region": {"startLine": 47}}}]}, {"ruleId": "scanner-2fe1ab26d00f7a1f", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "a74562e170c5b8bc", "scanner": "scanner-primary", "fingerprint": "2fe1ab26d00f7a1f", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/wine.yaml"}, "region": {"startLine": 55}}}]}, {"ruleId": "scanner-9ac01c21ea547747", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "13e11388b12f3bd8", "scanner": "scanner-primary", "fingerprint": "9ac01c21ea547747", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/netsim_runner.yaml"}, "region": {"startLine": 107}}}]}, {"ruleId": "scanner-9ac01c21ea547747", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "831567f3b5b1b02b", "scanner": "scanner-primary", "fingerprint": "9ac01c21ea547747", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/netsim_runner.yaml"}, "region": {"startLine": 113}}}]}, {"ruleId": "scanner-9ac01c21ea547747", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "85ccca9d6feb1efe", "scanner": "scanner-primary", "fingerprint": "9ac01c21ea547747", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/netsim_runner.yaml"}, "region": {"startLine": 116}}}]}, {"ruleId": "scanner-9ac01c21ea547747", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "ee13db4a0e231e83", "scanner": "scanner-primary", "fingerprint": "9ac01c21ea547747", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/netsim_runner.yaml"}, "region": {"startLine": 194}}}]}, {"ruleId": "scanner-9ac01c21ea547747", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "2b615175f9ab8dcc", "scanner": "scanner-primary", "fingerprint": "9ac01c21ea547747", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/netsim_runner.yaml"}, "region": {"startLine": 232}}}]}, {"ruleId": "scanner-9ac01c21ea547747", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "c2c26fe317bb0147", "scanner": "scanner-primary", "fingerprint": "9ac01c21ea547747", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/netsim_runner.yaml"}, "region": {"startLine": 253}}}]}, {"ruleId": "scanner-9ac01c21ea547747", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "27d78fd87edbe9b6", "scanner": "scanner-primary", "fingerprint": "9ac01c21ea547747", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/netsim_runner.yaml"}, "region": {"startLine": 262}}}]}, {"ruleId": "scanner-9ac01c21ea547747", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "27d78fd87edbe9b6", "scanner": "scanner-primary", "fingerprint": "9ac01c21ea547747", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/netsim_runner.yaml"}, "region": {"startLine": 284}}}]}, {"ruleId": "scanner-d921869e7f82d462", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "db3fb21e028d27be", "scanner": "scanner-primary", "fingerprint": "d921869e7f82d462", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/netsim_runner.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-9466de6abbe2c0b8", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "1165a7f757a9808a", "scanner": "scanner-primary", "fingerprint": "9466de6abbe2c0b8", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/docker.yaml"}, "region": {"startLine": 49}}}]}, {"ruleId": "scanner-9466de6abbe2c0b8", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "5b8e7382d12517dd", "scanner": "scanner-primary", "fingerprint": "9466de6abbe2c0b8", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/docker.yaml"}, "region": {"startLine": 52}}}]}, {"ruleId": "scanner-9466de6abbe2c0b8", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "f4c3f38baaca92b6", "scanner": "scanner-primary", "fingerprint": "9466de6abbe2c0b8", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/docker.yaml"}, "region": {"startLine": 55}}}]}, {"ruleId": "scanner-9466de6abbe2c0b8", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "8f18924066b02cdf", "scanner": "scanner-primary", "fingerprint": "9466de6abbe2c0b8", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/docker.yaml"}, "region": {"startLine": 67}}}]}, {"ruleId": "scanner-9466de6abbe2c0b8", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "c9613ea3abf88af2", "scanner": "scanner-primary", "fingerprint": "9466de6abbe2c0b8", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/docker.yaml"}, "region": {"startLine": 97}}}]}, {"ruleId": "scanner-9466de6abbe2c0b8", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "c9613ea3abf88af2", "scanner": "scanner-primary", "fingerprint": "9466de6abbe2c0b8", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/docker.yaml"}, "region": {"startLine": 107}}}]}, {"ruleId": "scanner-a7613c8e09860982", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "ecc9bee754008eec", "scanner": "scanner-primary", "fingerprint": "a7613c8e09860982", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/netsim.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ca5f4dd0d02b4899", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "d2cd3164653e96dd", "scanner": "scanner-primary", "fingerprint": "ca5f4dd0d02b4899", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/commit.yml"}, "region": {"startLine": 17}}}]}, {"ruleId": "scanner-aa412cb857ae5ebc", "level": "note", "message": {"text": "Very large file: iroh/src/address_lookup.rs (1401 lines)"}, "properties": {"repobilityId": "a9008748790ac164", "scanner": "scanner-primary", "fingerprint": "aa412cb857ae5ebc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-0c2a4843bd0c2226", "level": "note", "message": {"text": "Very large file: iroh/src/socket.rs (2871 lines)"}, "properties": {"repobilityId": "7fa71f0bfed58f72", "scanner": "scanner-primary", "fingerprint": "0c2a4843bd0c2226", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-02a5cb8a56dafdda", "level": "note", "message": {"text": "Very large file: iroh/src/endpoint.rs (4036 lines)"}, "properties": {"repobilityId": "38c9c471e4ad1404", "scanner": "scanner-primary", "fingerprint": "02a5cb8a56dafdda", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-5ec908fbd2de4b52", "level": "note", "message": {"text": "Very large file: iroh/src/socket/transports/relay/actor.rs (1787 lines)"}, "properties": {"repobilityId": "284cd016b6b0839e", "scanner": "scanner-primary", "fingerprint": "5ec908fbd2de4b52", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-db758c597b1cdb28", "level": "note", "message": {"text": "Very large file: iroh/src/socket/remote_map/remote_state.rs (1530 lines)"}, "properties": {"repobilityId": "bfa9e562269e1015", "scanner": "scanner-primary", "fingerprint": "db758c597b1cdb28", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-48b6e4427e86d586", "level": "note", "message": {"text": "Very large file: iroh/src/endpoint/connection.rs (1593 lines)"}, "properties": {"repobilityId": "8f5ed4db58f680b8", "scanner": "scanner-primary", "fingerprint": "48b6e4427e86d586", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-8ea6a590bfdb1afa", "level": "note", "message": {"text": "Very large file: iroh-relay/src/server.rs (1641 lines)"}, "properties": {"repobilityId": "1fec657271293c31", "scanner": "scanner-primary", "fingerprint": "8ea6a590bfdb1afa", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-671ca28ce373ef9e", "level": "note", "message": {"text": "Very large file: iroh-relay/src/server/http_server.rs (1801 lines)"}, "properties": {"repobilityId": "8ad3075c329e7880", "scanner": "scanner-primary", "fingerprint": "671ca28ce373ef9e", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-ea3b5e389d8c9c0f", "level": "note", "message": {"text": "Low test-to-source ratio"}, "properties": {"repobilityId": "ef7b2552cc00a375", "scanner": "scanner-primary", "fingerprint": "ea3b5e389d8c9c0f", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["tests"]}}, {"ruleId": "scanner-141b30a41e03817b", "level": "note", "message": {"text": "No license file detected"}, "properties": {"repobilityId": "7df84ca72bf68438", "scanner": "scanner-primary", "fingerprint": "141b30a41e03817b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["license", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-72b2a6250083a784", "level": "warning", "message": {"text": "Placeholder or mock-heavy implementation detected"}, "properties": {"repobilityId": "b12bb8f950677f11", "scanner": "scanner-primary", "fingerprint": "72b2a6250083a784", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "incomplete", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "8580540c410a5a3c", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "8a89f06a74294075", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "6c4b1947c74e5031", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}]}]}