{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-15b353c7f01a2c3d", "name": "Insecure pattern 'node_child_process' in scripts/capture-demo.mjs:12", "shortDescription": {"text": "Insecure pattern 'node_child_process' in scripts/capture-demo.mjs:12"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-db3c6843ef7270b5", "name": "Insecure pattern 'direct_innerhtml_assignment' in scripts/capture-demo.mjs:76", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in scripts/capture-demo.mjs:76"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c933f6ce6d53c4e6", "name": "Insecure pattern 'node_child_process' in scripts/capture-demo-video.mjs:15", "shortDescription": {"text": "Insecure pattern 'node_child_process' in scripts/capture-demo-video.mjs:15"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ee15f1e4893a8ef2", "name": "Insecure pattern 'direct_innerhtml_assignment' in scripts/capture-demo-video.mjs:89", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in scripts/capture-demo-video.mjs:89"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-29b3a385feb99e64", "name": "Insecure pattern 'node_child_process' in scripts/seed-demo.mjs:4", "shortDescription": {"text": "Insecure pattern 'node_child_process' in scripts/seed-demo.mjs:4"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-273259f6f4b58058", "name": "Insecure pattern 'node_child_process' in scripts/fp-replay.mjs:13", "shortDescription": {"text": "Insecure pattern 'node_child_process' in scripts/fp-replay.mjs:13"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-5eaf20b088f753bb", "name": "Insecure pattern 'node_child_process' in scripts/capture-trailer.mjs:21", "shortDescription": {"text": "Insecure pattern 'node_child_process' in scripts/capture-trailer.mjs:21"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-778a740c966a57e9", "name": "Insecure pattern 'direct_innerhtml_assignment' in scripts/capture-trailer.mjs:177", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in scripts/capture-trailer.mjs:177"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-eb60da72c0815511", "name": "Insecure pattern 'node_child_process' in eval/cases/child-process-execution.case.mjs:15", "shortDescription": {"text": "Insecure pattern 'node_child_process' in eval/cases/child-process-execution.case.mjs:15"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8d0c47bd99c3f9c5", "name": "Insecure pattern 'cors_wildcard' in eval/cases/python-cors-permissive.case.mjs:23", "shortDescription": {"text": "Insecure pattern 'cors_wildcard' in eval/cases/python-cors-permissive.case.mjs:23"}, "fullDescription": {"text": "Found a known-risky pattern (cors_wildcard). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4e0c5c662849e37e", "name": "Insecure pattern 'eval_used' in eval/cases/dynamic-code-execution.case.mjs:16", "shortDescription": {"text": "Insecure pattern 'eval_used' in eval/cases/dynamic-code-execution.case.mjs:16"}, "fullDescription": {"text": "Found a known-risky pattern (eval_used). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-932e699d4bfd52c0", "name": "Insecure pattern 'eval_used' in eval/cases/benign-eval-in-string.case.mjs:3", "shortDescription": {"text": "Insecure pattern 'eval_used' in eval/cases/benign-eval-in-string.case.mjs:3"}, "fullDescription": {"text": "Found a known-risky pattern (eval_used). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-192e02e2e3a439a7", "name": "Insecure pattern 'new_function_used' in eval/cases/benign-eval-in-string.case.mjs:16", "shortDescription": {"text": "Insecure pattern 'new_function_used' in eval/cases/benign-eval-in-string.case.mjs:16"}, "fullDescription": {"text": "Found a known-risky pattern (new_function_used). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-c68590144e32ac9a", "name": "Insecure pattern 'cors_wildcard' in eval/cases/broadened-cors.case.mjs:16", "shortDescription": {"text": "Insecure pattern 'cors_wildcard' in eval/cases/broadened-cors.case.mjs:16"}, "fullDescription": {"text": "Found a known-risky pattern (cors_wildcard). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-aef1ef0968de84c0", "name": "Insecure pattern 'dangerous_innerhtml' in eval/benchmarks/v2/answers/tsx-removed-sanitization.json:22", "shortDescription": {"text": "Insecure pattern 'dangerous_innerhtml' in eval/benchmarks/v2/answers/tsx-removed-sanitization.json:22"}, "fullDescription": {"text": "Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e5a233f979a2cdf1", "name": "Insecure pattern 'eval_used' in eval/benchmarks/v2/answers/dynamic-code-execution.json:12", "shortDescription": {"text": "Insecure pattern 'eval_used' in eval/benchmarks/v2/answers/dynamic-code-execution.json:12"}, "fullDescription": {"text": "Found a known-risky pattern (eval_used). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-fbff0646f3bc69ff", "name": "Insecure pattern 'cors_wildcard' in eval/benchmarks/v2/answers/broadened-cors.json:21", "shortDescription": {"text": "Insecure pattern 'cors_wildcard' in eval/benchmarks/v2/answers/broadened-cors.json:21"}, "fullDescription": {"text": "Found a known-risky pattern (cors_wildcard). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c8f95ebb71e1d8f9", "name": "Insecure pattern 'dangerous_innerhtml' in eval/benchmarks/v3/answers/tsx-removed-sanitization.json:15", "shortDescription": {"text": "Insecure pattern 'dangerous_innerhtml' in eval/benchmarks/v3/answers/tsx-removed-sanitization.json:15"}, "fullDescription": {"text": "Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-58551d239f4a5c03", "name": "Insecure pattern 'eval_used' in eval/benchmarks/v3/answers/dynamic-code-execution.json:11", "shortDescription": {"text": "Insecure pattern 'eval_used' in eval/benchmarks/v3/answers/dynamic-code-execution.json:11"}, "fullDescription": {"text": "Found a known-risky pattern (eval_used). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-cbecd1b60f370a73", "name": "Insecure pattern 'eval_used' in eval/benchmarks/v4/panel/panel-scorecard.html:93", "shortDescription": {"text": "Insecure pattern 'eval_used' in eval/benchmarks/v4/panel/panel-scorecard.html:93"}, "fullDescription": {"text": "Found a known-risky pattern (eval_used). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-5a513b4946b41f37", "name": "Insecure pattern 'eval_used' in eval/benchmarks/v4/panel/panel-scorecard.json:358", "shortDescription": {"text": "Insecure pattern 'eval_used' in eval/benchmarks/v4/panel/panel-scorecard.json:358"}, "fullDescription": {"text": "Found a known-risky pattern (eval_used). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-32d11b1bad58c7cd", "name": "Insecure pattern 'eval_used' in eval/benchmarks/v4/panel/sonnet-4-6/benign-eval-in-string.json:7", "shortDescription": {"text": "Insecure pattern 'eval_used' in eval/benchmarks/v4/panel/sonnet-4-6/benign-eval-in-string.json:7"}, "fullDescription": {"text": "Found a known-risky pattern (eval_used). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-e7ba0b705b7f7039", "name": "Insecure pattern 'new_function_used' in eval/benchmarks/v4/panel/sonnet-4-6/benign-eval-in-string.json:7", "shortDescription": {"text": "Insecure pattern 'new_function_used' in eval/benchmarks/v4/panel/sonnet-4-6/benign-eval-in-string.json:7"}, "fullDescription": {"text": "Found a known-risky pattern (new_function_used). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-2f314a41e8957f07", "name": "Insecure pattern 'dangerous_innerhtml' in eval/benchmarks/v4/panel/sonnet-4-6/tsx-removed-sanitization.json:11", "shortDescription": {"text": "Insecure pattern 'dangerous_innerhtml' in eval/benchmarks/v4/panel/sonnet-4-6/tsx-removed-sanitization.json:11"}, "fullDescription": {"text": "Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ee60e883582b2c89", "name": "Insecure pattern 'eval_used' in eval/benchmarks/v4/panel/sonnet-4-6/dynamic-code-execution.json:7", "shortDescription": {"text": "Insecure pattern 'eval_used' in eval/benchmarks/v4/panel/sonnet-4-6/dynamic-code-execution.json:7"}, "fullDescription": {"text": "Found a known-risky pattern (eval_used). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-21c9fe41e9dc950e", "name": "Insecure pattern 'eval_used' in eval/benchmarks/v4/panel/haiku-4-5/benign-eval-in-string.json:7", "shortDescription": {"text": "Insecure pattern 'eval_used' in eval/benchmarks/v4/panel/haiku-4-5/benign-eval-in-string.json:7"}, "fullDescription": {"text": "Found a known-risky pattern (eval_used). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-9a2eadcabcc20685", "name": "Insecure pattern 'new_function_used' in eval/benchmarks/v4/panel/haiku-4-5/benign-eval-in-string.json:7", "shortDescription": {"text": "Insecure pattern 'new_function_used' in eval/benchmarks/v4/panel/haiku-4-5/benign-eval-in-string.json:7"}, "fullDescription": {"text": "Found a known-risky pattern (new_function_used). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-fac1a3a444eb88e6", "name": "Insecure pattern 'eval_used' in eval/benchmarks/v4/panel/haiku-4-5/dynamic-code-execution.json:7", "shortDescription": {"text": "Insecure pattern 'eval_used' in eval/benchmarks/v4/panel/haiku-4-5/dynamic-code-execution.json:7"}, "fullDescription": {"text": "Found a known-risky pattern (eval_used). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-7c8dc634fdfb3b0c", "name": "Insecure pattern 'eval_used' in eval/benchmarks/v4/answers/benign-eval-in-string.json:7", "shortDescription": {"text": "Insecure pattern 'eval_used' in eval/benchmarks/v4/answers/benign-eval-in-string.json:7"}, "fullDescription": {"text": "Found a known-risky pattern (eval_used). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-e2673ab246ac4e43", "name": "Insecure pattern 'new_function_used' in eval/benchmarks/v4/answers/benign-eval-in-string.json:7", "shortDescription": {"text": "Insecure pattern 'new_function_used' in eval/benchmarks/v4/answers/benign-eval-in-string.json:7"}, "fullDescription": {"text": "Found a known-risky pattern (new_function_used). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-51e2845ff6f9eb0f", "name": "Insecure pattern 'dangerous_innerhtml' in eval/benchmarks/v4/answers/tsx-removed-sanitization.json:16", "shortDescription": {"text": "Insecure pattern 'dangerous_innerhtml' in eval/benchmarks/v4/answers/tsx-removed-sanitization.json:16"}, "fullDescription": {"text": "Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8dcda062ac90db16", "name": "Insecure pattern 'eval_used' in eval/benchmarks/v4/answers/dynamic-code-execution.json:7", "shortDescription": {"text": "Insecure pattern 'eval_used' in eval/benchmarks/v4/answers/dynamic-code-execution.json:7"}, "fullDescription": {"text": "Found a known-risky pattern (eval_used). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-7d89166c143c1793", "name": "Insecure pattern 'node_child_process' in eval/lib/repo.mjs:1", "shortDescription": {"text": "Insecure pattern 'node_child_process' in eval/lib/repo.mjs:1"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-68160078ea04ff94", "name": "Insecure pattern 'node_child_process' in eval/lib/cli.mjs:3", "shortDescription": {"text": "Insecure pattern 'node_child_process' in eval/lib/cli.mjs:3"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7a3200d94dc95d3f", "name": "Insecure pattern 'eval_used' in src-tauri/src/watcher.rs:698", "shortDescription": {"text": "Insecure pattern 'eval_used' in src-tauri/src/watcher.rs:698"}, "fullDescription": {"text": "Found a known-risky pattern (eval_used). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-956d9a6a3668fcc2", "name": "Insecure pattern 'eval_used' in src-tauri/src/structural.rs:252", "shortDescription": {"text": "Insecure pattern 'eval_used' in src-tauri/src/structural.rs:252"}, "fullDescription": {"text": "Found a known-risky pattern (eval_used). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-6630de516c496f5b", "name": "Insecure pattern 'eval_used' in src-tauri/src/rules.rs:377", "shortDescription": {"text": "Insecure pattern 'eval_used' in src-tauri/src/rules.rs:377"}, "fullDescription": {"text": "Found a known-risky pattern (eval_used). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-b6f2a615fbe702b5", "name": "Insecure pattern 'cors_wildcard' in src-tauri/src/rules.rs:2732", "shortDescription": {"text": "Insecure pattern 'cors_wildcard' in src-tauri/src/rules.rs:2732"}, "fullDescription": {"text": "Found a known-risky pattern (cors_wildcard). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f2d34445b898e8a0", "name": "Insecure pattern 'eval_used' in src-tauri/src/session.rs:1713", "shortDescription": {"text": "Insecure pattern 'eval_used' in src-tauri/src/session.rs:1713"}, "fullDescription": {"text": "Found a known-risky pattern (eval_used). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-0631cbcff313e79b", "name": "Insecure pattern 'eval_used' in src-tauri/src/lang/python.rs:290", "shortDescription": {"text": "Insecure pattern 'eval_used' in src-tauri/src/lang/python.rs:290"}, "fullDescription": {"text": "Found a known-risky pattern (eval_used). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-496df08b967ab247", "name": "Insecure pattern 'exec_used' in src-tauri/src/lang/python.rs:290", "shortDescription": {"text": "Insecure pattern 'exec_used' in src-tauri/src/lang/python.rs:290"}, "fullDescription": {"text": "Found a known-risky pattern (exec_used). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-46c644c6227e4d4a", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "azure/trusted-signing-action@v0.5.1 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1838a141491ce38c", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a55af5ea0604e267", "name": "Very large file: src-tauri/src/deps_diff.rs (2112 lines)", "shortDescription": {"text": "Very large file: src-tauri/src/deps_diff.rs (2112 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4cfe9deb0f76fffb", "name": "Very large file: src-tauri/src/parse.rs (2078 lines)", "shortDescription": {"text": "Very large file: src-tauri/src/parse.rs (2078 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7f12f63198e6c413", "name": "Very large file: src-tauri/src/rules.rs (3364 lines)", "shortDescription": {"text": "Very large file: src-tauri/src/rules.rs (3364 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-183b168868cc5914", "name": "Very large file: src-tauri/src/session.rs (2408 lines)", "shortDescription": {"text": "Very large file: src-tauri/src/session.rs (2408 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6893a6c8b0861585", "name": "Very low test-to-source ratio", "shortDescription": {"text": "Very low test-to-source ratio"}, "fullDescription": {"text": "16 test file(s) for 183 source file(s) (ratio 0.09). Consider adding integration or unit tests for critical paths."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 56 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-72b2a6250083a784", "name": "Placeholder or mock-heavy implementation detected", "shortDescription": {"text": "Placeholder or mock-heavy implementation detected"}, "fullDescription": {"text": "Found 17 placeholder/mock markers across 9 source files. This often means the repo looks complete while core flows still use generated scaffolding or fake data."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-37a9484e12074aa1", "name": "Commented-code block (7 lines) in tests/unit/evalScoring.test.ts:897", "shortDescription": {"text": "Commented-code block (7 lines) in tests/unit/evalScoring.test.ts:897"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-974b71ef3ff5f29b", "name": "Commented-code block (5 lines) in scripts/capture-demo-video.mjs:3", "shortDescription": {"text": "Commented-code block (5 lines) in scripts/capture-demo-video.mjs:3"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-57bfb2f676b21535", "name": "Commented-code block (7 lines) in scripts/build-coverage-card.mjs:5", "shortDescription": {"text": "Commented-code block (7 lines) in scripts/build-coverage-card.mjs:5"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-6336feb3a2176790", "name": "Commented-code block (5 lines) in scripts/fix-icon-alpha.mjs:3", "shortDescription": {"text": "Commented-code block (5 lines) in scripts/fix-icon-alpha.mjs:3"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-b36fe2fcf977dd0b", "name": "Commented-code block (5 lines) in scripts/fp-replay.mjs:2", "shortDescription": {"text": "Commented-code block (5 lines) in scripts/fp-replay.mjs:2"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-96d15170c5b319f0", "name": "Commented-code block (7 lines) in scripts/capture-trailer.mjs:3", "shortDescription": {"text": "Commented-code block (7 lines) in scripts/capture-trailer.mjs:3"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-c9d4ac64c276ee2f", "name": "Commented-code block (6 lines) in eval/panel.mjs:6", "shortDescription": {"text": "Commented-code block (6 lines) in eval/panel.mjs:6"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-389d5f44c5403008", "name": "`fetch()` without try/.catch or AbortSignal \u2014 eval/cases/mjs-disabled-tls.case.mjs:18", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 eval/cases/mjs-disabled-tls.case.mjs:18"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7ba5edd7eb6f64d0", "name": "Commented-code block (7 lines) in eval/cases/python-structural-drift.case.mjs:1", "shortDescription": {"text": "Commented-code block (7 lines) in eval/cases/python-structural-drift.case.mjs:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-d2d4b40878119260", "name": "Commented-code block (8 lines) in eval/cases/go-guard-removed.case.mjs:1", "shortDescription": {"text": "Commented-code block (8 lines) in eval/cases/go-guard-removed.case.mjs:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-855c4096ce7f428b", "name": "Commented-code block (5 lines) in eval/cases/oversized-file-skip.case.mjs:1", "shortDescription": {"text": "Commented-code block (5 lines) in eval/cases/oversized-file-skip.case.mjs:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-f8443dbc3939d5d2", "name": "Commented-code block (5 lines) in eval/cases/go-cookies-weakened.case.mjs:1", "shortDescription": {"text": "Commented-code block (5 lines) in eval/cases/go-cookies-weakened.case.mjs:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-7f468e8193c6c010", "name": "Commented-code block (5 lines) in eval/cases/noisy-benign-refactor.case.mjs:1", "shortDescription": {"text": "Commented-code block (5 lines) in eval/cases/noisy-benign-refactor.case.mjs:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-3e33ee8bc25b5386", "name": "Commented-code block (5 lines) in eval/cases/python-guard-removed.case.mjs:1", "shortDescription": {"text": "Commented-code block (5 lines) in eval/cases/python-guard-removed.case.mjs:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-6a85866336c262eb", "name": "`fetch()` without try/.catch or AbortSignal \u2014 eval/cases/python-error-handling-removed.case.mjs:14", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 eval/cases/python-error-handling-removed.case.mjs:14"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/20256"}, "properties": {"repository": "Statusnone420/Diff-Drift", "repoUrl": "https://github.com/Statusnone420/Diff-Drift", "branch": "main"}, "results": [{"ruleId": "scanner-15b353c7f01a2c3d", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in scripts/capture-demo.mjs:12"}, "properties": {"repobilityId": "f4708744dbefc8db", "scanner": "scanner-primary", "fingerprint": "15b353c7f01a2c3d", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/capture-demo.mjs"}, "region": {"startLine": 12}}}]}, {"ruleId": "scanner-db3c6843ef7270b5", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in scripts/capture-demo.mjs:76"}, "properties": {"repobilityId": "045ff17eec1c4a46", "scanner": "scanner-primary", "fingerprint": "db3c6843ef7270b5", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/capture-demo.mjs"}, "region": {"startLine": 76}}}]}, {"ruleId": "scanner-c933f6ce6d53c4e6", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in scripts/capture-demo-video.mjs:15"}, "properties": {"repobilityId": "aa87e23b4a03f019", "scanner": "scanner-primary", "fingerprint": "c933f6ce6d53c4e6", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/capture-demo-video.mjs"}, "region": {"startLine": 15}}}]}, {"ruleId": "scanner-ee15f1e4893a8ef2", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in scripts/capture-demo-video.mjs:89"}, "properties": {"repobilityId": "3e4ad8ccc75c7c0c", "scanner": "scanner-primary", "fingerprint": "ee15f1e4893a8ef2", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/capture-demo-video.mjs"}, "region": {"startLine": 89}}}]}, {"ruleId": "scanner-29b3a385feb99e64", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in scripts/seed-demo.mjs:4"}, "properties": {"repobilityId": "67007cc1e8784b18", "scanner": "scanner-primary", "fingerprint": "29b3a385feb99e64", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/seed-demo.mjs"}, "region": {"startLine": 4}}}]}, {"ruleId": "scanner-273259f6f4b58058", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in scripts/fp-replay.mjs:13"}, "properties": {"repobilityId": "ab15a1e0e9186276", "scanner": "scanner-primary", "fingerprint": "273259f6f4b58058", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/fp-replay.mjs"}, "region": {"startLine": 13}}}]}, {"ruleId": "scanner-5eaf20b088f753bb", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in scripts/capture-trailer.mjs:21"}, "properties": {"repobilityId": "d145d449a3d114a9", "scanner": "scanner-primary", "fingerprint": "5eaf20b088f753bb", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/capture-trailer.mjs"}, "region": {"startLine": 21}}}]}, {"ruleId": "scanner-778a740c966a57e9", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in scripts/capture-trailer.mjs:177"}, "properties": {"repobilityId": "21388f3f8dcd77e2", "scanner": "scanner-primary", "fingerprint": "778a740c966a57e9", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/capture-trailer.mjs"}, "region": {"startLine": 177}}}]}, {"ruleId": "scanner-eb60da72c0815511", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in eval/cases/child-process-execution.case.mjs:15"}, "properties": {"repobilityId": "8536343f17a79c08", "scanner": "scanner-primary", "fingerprint": "eb60da72c0815511", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "eval/cases/child-process-execution.case.mjs"}, "region": {"startLine": 15}}}]}, {"ruleId": "scanner-8d0c47bd99c3f9c5", "level": "warning", "message": {"text": "Insecure pattern 'cors_wildcard' in eval/cases/python-cors-permissive.case.mjs:23"}, "properties": {"repobilityId": "96cdfdd5f4c67e26", "scanner": "scanner-primary", "fingerprint": "8d0c47bd99c3f9c5", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "cors_wildcard"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "eval/cases/python-cors-permissive.case.mjs"}, "region": {"startLine": 23}}}]}, {"ruleId": "scanner-4e0c5c662849e37e", "level": "error", "message": {"text": "Insecure pattern 'eval_used' in eval/cases/dynamic-code-execution.case.mjs:16"}, "properties": {"repobilityId": "89d496dfdd8531fe", "scanner": "scanner-primary", "fingerprint": "4e0c5c662849e37e", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "eval_used"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "eval/cases/dynamic-code-execution.case.mjs"}, "region": {"startLine": 16}}}]}, {"ruleId": "scanner-932e699d4bfd52c0", "level": "error", "message": {"text": "Insecure pattern 'eval_used' in eval/cases/benign-eval-in-string.case.mjs:3"}, "properties": {"repobilityId": "c5b8de3118f1adc3", "scanner": "scanner-primary", "fingerprint": "932e699d4bfd52c0", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "eval_used"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "eval/cases/benign-eval-in-string.case.mjs"}, "region": {"startLine": 3}}}]}, {"ruleId": "scanner-192e02e2e3a439a7", "level": "error", "message": {"text": "Insecure pattern 'new_function_used' in eval/cases/benign-eval-in-string.case.mjs:16"}, "properties": {"repobilityId": "c9259adbf136cf00", "scanner": "scanner-primary", "fingerprint": "192e02e2e3a439a7", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "new_function_used"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "eval/cases/benign-eval-in-string.case.mjs"}, "region": {"startLine": 16}}}]}, {"ruleId": "scanner-c68590144e32ac9a", "level": "warning", "message": {"text": "Insecure pattern 'cors_wildcard' in eval/cases/broadened-cors.case.mjs:16"}, "properties": {"repobilityId": "bfa4d9c4a9974c5a", "scanner": "scanner-primary", "fingerprint": "c68590144e32ac9a", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "cors_wildcard"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "eval/cases/broadened-cors.case.mjs"}, "region": {"startLine": 16}}}]}, {"ruleId": "scanner-aef1ef0968de84c0", "level": "warning", "message": {"text": "Insecure pattern 'dangerous_innerhtml' in eval/benchmarks/v2/answers/tsx-removed-sanitization.json:22"}, "properties": {"repobilityId": "de3d576c10362f5e", "scanner": "scanner-primary", "fingerprint": "aef1ef0968de84c0", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "dangerous_innerhtml"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "eval/benchmarks/v2/answers/tsx-removed-sanitization.json"}, "region": {"startLine": 22}}}]}, {"ruleId": "scanner-e5a233f979a2cdf1", "level": "error", "message": {"text": "Insecure pattern 'eval_used' in eval/benchmarks/v2/answers/dynamic-code-execution.json:12"}, "properties": {"repobilityId": "cfeedc8981140fe0", "scanner": "scanner-primary", "fingerprint": "e5a233f979a2cdf1", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "eval_used"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "eval/benchmarks/v2/answers/dynamic-code-execution.json"}, "region": {"startLine": 12}}}]}, {"ruleId": "scanner-fbff0646f3bc69ff", "level": "warning", "message": {"text": "Insecure pattern 'cors_wildcard' in eval/benchmarks/v2/answers/broadened-cors.json:21"}, "properties": {"repobilityId": "134e0741410d1c4e", "scanner": "scanner-primary", "fingerprint": "fbff0646f3bc69ff", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "cors_wildcard"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "eval/benchmarks/v2/answers/broadened-cors.json"}, "region": {"startLine": 21}}}]}, {"ruleId": "scanner-c8f95ebb71e1d8f9", "level": "warning", "message": {"text": "Insecure pattern 'dangerous_innerhtml' in eval/benchmarks/v3/answers/tsx-removed-sanitization.json:15"}, "properties": {"repobilityId": "006949cbe51e32a8", "scanner": "scanner-primary", "fingerprint": "c8f95ebb71e1d8f9", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "dangerous_innerhtml"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "eval/benchmarks/v3/answers/tsx-removed-sanitization.json"}, "region": {"startLine": 15}}}]}, {"ruleId": "scanner-58551d239f4a5c03", "level": "error", "message": {"text": "Insecure pattern 'eval_used' in eval/benchmarks/v3/answers/dynamic-code-execution.json:11"}, "properties": {"repobilityId": "7ece3ff63901bbae", "scanner": "scanner-primary", "fingerprint": "58551d239f4a5c03", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "eval_used"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "eval/benchmarks/v3/answers/dynamic-code-execution.json"}, "region": {"startLine": 11}}}]}, {"ruleId": "scanner-cbecd1b60f370a73", "level": "error", "message": {"text": "Insecure pattern 'eval_used' in eval/benchmarks/v4/panel/panel-scorecard.html:93"}, "properties": {"repobilityId": "805ac78bc5c1a0e1", "scanner": "scanner-primary", "fingerprint": "cbecd1b60f370a73", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "eval_used"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "eval/benchmarks/v4/panel/panel-scorecard.html"}, "region": {"startLine": 93}}}]}, {"ruleId": "scanner-5a513b4946b41f37", "level": "error", "message": {"text": "Insecure pattern 'eval_used' in eval/benchmarks/v4/panel/panel-scorecard.json:358"}, "properties": {"repobilityId": "1ea110e8a5b2b24e", "scanner": "scanner-primary", "fingerprint": "5a513b4946b41f37", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "eval_used"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "eval/benchmarks/v4/panel/panel-scorecard.json"}, "region": {"startLine": 358}}}]}, {"ruleId": "scanner-32d11b1bad58c7cd", "level": "error", "message": {"text": "Insecure pattern 'eval_used' in eval/benchmarks/v4/panel/sonnet-4-6/benign-eval-in-string.json:7"}, "properties": {"repobilityId": "10d9ffbb7bfd435d", "scanner": "scanner-primary", "fingerprint": "32d11b1bad58c7cd", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "eval_used"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "eval/benchmarks/v4/panel/sonnet-4-6/benign-eval-in-string.json"}, "region": {"startLine": 7}}}]}, {"ruleId": "scanner-e7ba0b705b7f7039", "level": "error", "message": {"text": "Insecure pattern 'new_function_used' in eval/benchmarks/v4/panel/sonnet-4-6/benign-eval-in-string.json:7"}, "properties": {"repobilityId": "e1498498877e1896", "scanner": "scanner-primary", "fingerprint": "e7ba0b705b7f7039", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "new_function_used"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "eval/benchmarks/v4/panel/sonnet-4-6/benign-eval-in-string.json"}, "region": {"startLine": 7}}}]}, {"ruleId": "scanner-2f314a41e8957f07", "level": "warning", "message": {"text": "Insecure pattern 'dangerous_innerhtml' in eval/benchmarks/v4/panel/sonnet-4-6/tsx-removed-sanitization.json:11"}, "properties": {"repobilityId": "8b789aa8d1f6800d", "scanner": "scanner-primary", "fingerprint": "2f314a41e8957f07", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "dangerous_innerhtml"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "eval/benchmarks/v4/panel/sonnet-4-6/tsx-removed-sanitization.json"}, "region": {"startLine": 11}}}]}, {"ruleId": "scanner-ee60e883582b2c89", "level": "error", "message": {"text": "Insecure pattern 'eval_used' in eval/benchmarks/v4/panel/sonnet-4-6/dynamic-code-execution.json:7"}, "properties": {"repobilityId": "05e2ca81e1003dee", "scanner": "scanner-primary", "fingerprint": "ee60e883582b2c89", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "eval_used"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "eval/benchmarks/v4/panel/sonnet-4-6/dynamic-code-execution.json"}, "region": {"startLine": 7}}}]}, {"ruleId": "scanner-21c9fe41e9dc950e", "level": "error", "message": {"text": "Insecure pattern 'eval_used' in eval/benchmarks/v4/panel/haiku-4-5/benign-eval-in-string.json:7"}, "properties": {"repobilityId": "e0e083d256acb76c", "scanner": "scanner-primary", "fingerprint": "21c9fe41e9dc950e", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "eval_used"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "eval/benchmarks/v4/panel/haiku-4-5/benign-eval-in-string.json"}, "region": {"startLine": 7}}}]}, {"ruleId": "scanner-9a2eadcabcc20685", "level": "error", "message": {"text": "Insecure pattern 'new_function_used' in eval/benchmarks/v4/panel/haiku-4-5/benign-eval-in-string.json:7"}, "properties": {"repobilityId": "75adacf412f2b829", "scanner": "scanner-primary", "fingerprint": "9a2eadcabcc20685", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "new_function_used"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "eval/benchmarks/v4/panel/haiku-4-5/benign-eval-in-string.json"}, "region": {"startLine": 7}}}]}, {"ruleId": "scanner-fac1a3a444eb88e6", "level": "error", "message": {"text": "Insecure pattern 'eval_used' in eval/benchmarks/v4/panel/haiku-4-5/dynamic-code-execution.json:7"}, "properties": {"repobilityId": "24ece794ae5794c0", "scanner": "scanner-primary", "fingerprint": "fac1a3a444eb88e6", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "eval_used"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "eval/benchmarks/v4/panel/haiku-4-5/dynamic-code-execution.json"}, "region": {"startLine": 7}}}]}, {"ruleId": "scanner-7c8dc634fdfb3b0c", "level": "error", "message": {"text": "Insecure pattern 'eval_used' in eval/benchmarks/v4/answers/benign-eval-in-string.json:7"}, "properties": {"repobilityId": "737697e380bd811c", "scanner": "scanner-primary", "fingerprint": "7c8dc634fdfb3b0c", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "eval_used"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "eval/benchmarks/v4/answers/benign-eval-in-string.json"}, "region": {"startLine": 7}}}]}, {"ruleId": "scanner-e2673ab246ac4e43", "level": "error", "message": {"text": "Insecure pattern 'new_function_used' in eval/benchmarks/v4/answers/benign-eval-in-string.json:7"}, "properties": {"repobilityId": "b55ad87e228046dd", "scanner": "scanner-primary", "fingerprint": "e2673ab246ac4e43", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "new_function_used"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "eval/benchmarks/v4/answers/benign-eval-in-string.json"}, "region": {"startLine": 7}}}]}, {"ruleId": "scanner-51e2845ff6f9eb0f", "level": "warning", "message": {"text": "Insecure pattern 'dangerous_innerhtml' in eval/benchmarks/v4/answers/tsx-removed-sanitization.json:16"}, "properties": {"repobilityId": "74150dd229b45cd8", "scanner": "scanner-primary", "fingerprint": "51e2845ff6f9eb0f", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "dangerous_innerhtml"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "eval/benchmarks/v4/answers/tsx-removed-sanitization.json"}, "region": {"startLine": 16}}}]}, {"ruleId": "scanner-8dcda062ac90db16", "level": "error", "message": {"text": "Insecure pattern 'eval_used' in eval/benchmarks/v4/answers/dynamic-code-execution.json:7"}, "properties": {"repobilityId": "cbef61f1d8850f35", "scanner": "scanner-primary", "fingerprint": "8dcda062ac90db16", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "eval_used"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "eval/benchmarks/v4/answers/dynamic-code-execution.json"}, "region": {"startLine": 7}}}]}, {"ruleId": "scanner-7d89166c143c1793", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in eval/lib/repo.mjs:1"}, "properties": {"repobilityId": "08ad122119ee66e1", "scanner": "scanner-primary", "fingerprint": "7d89166c143c1793", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "eval/lib/repo.mjs"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-68160078ea04ff94", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in eval/lib/cli.mjs:3"}, "properties": {"repobilityId": "44a611154021ab55", "scanner": "scanner-primary", "fingerprint": "68160078ea04ff94", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "eval/lib/cli.mjs"}, "region": {"startLine": 3}}}]}, {"ruleId": "scanner-7a3200d94dc95d3f", "level": "error", "message": {"text": "Insecure pattern 'eval_used' in src-tauri/src/watcher.rs:698"}, "properties": {"repobilityId": "0d44efd62e5d8d8f", "scanner": "scanner-primary", "fingerprint": "7a3200d94dc95d3f", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "eval_used"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src-tauri/src/watcher.rs"}, "region": {"startLine": 698}}}]}, {"ruleId": "scanner-956d9a6a3668fcc2", "level": "error", "message": {"text": "Insecure pattern 'eval_used' in src-tauri/src/structural.rs:252"}, "properties": {"repobilityId": "b503039ff850d719", "scanner": "scanner-primary", "fingerprint": "956d9a6a3668fcc2", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "eval_used"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src-tauri/src/structural.rs"}, "region": {"startLine": 252}}}]}, {"ruleId": "scanner-6630de516c496f5b", "level": "error", "message": {"text": "Insecure pattern 'eval_used' in src-tauri/src/rules.rs:377"}, "properties": {"repobilityId": "dbbf70b31823074f", "scanner": "scanner-primary", "fingerprint": "6630de516c496f5b", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "eval_used"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src-tauri/src/rules.rs"}, "region": {"startLine": 377}}}]}, {"ruleId": "scanner-b6f2a615fbe702b5", "level": "warning", "message": {"text": "Insecure pattern 'cors_wildcard' in src-tauri/src/rules.rs:2732"}, "properties": {"repobilityId": "d375e21a5db5f00d", "scanner": "scanner-primary", "fingerprint": "b6f2a615fbe702b5", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "cors_wildcard"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src-tauri/src/rules.rs"}, "region": {"startLine": 2732}}}]}, {"ruleId": "scanner-f2d34445b898e8a0", "level": "error", "message": {"text": "Insecure pattern 'eval_used' in src-tauri/src/session.rs:1713"}, "properties": {"repobilityId": "f6a800e15dd1144e", "scanner": "scanner-primary", "fingerprint": "f2d34445b898e8a0", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "eval_used"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src-tauri/src/session.rs"}, "region": {"startLine": 1713}}}]}, {"ruleId": "scanner-0631cbcff313e79b", "level": "error", "message": {"text": "Insecure pattern 'eval_used' in src-tauri/src/lang/python.rs:290"}, "properties": {"repobilityId": "535bcc867e3b2199", "scanner": "scanner-primary", "fingerprint": "0631cbcff313e79b", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "eval_used"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src-tauri/src/lang/python.rs"}, "region": {"startLine": 290}}}]}, {"ruleId": "scanner-496df08b967ab247", "level": "error", "message": {"text": "Insecure pattern 'exec_used' in src-tauri/src/lang/python.rs:290"}, "properties": {"repobilityId": "87a03b09a2e80092", "scanner": "scanner-primary", "fingerprint": "496df08b967ab247", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "exec_used"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src-tauri/src/lang/python.rs"}, "region": {"startLine": 290}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "3ff63467f81d5cbd", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 87}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "3ff63467f81d5cbd", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 103}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "27d456369ab90cf1", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 148}}}]}, {"ruleId": "scanner-1838a141491ce38c", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "b8fd4f5048f96576", "scanner": "scanner-primary", "fingerprint": "1838a141491ce38c", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a55af5ea0604e267", "level": "note", "message": {"text": "Very large file: src-tauri/src/deps_diff.rs (2112 lines)"}, "properties": {"repobilityId": "3fdeea425504ffd0", "scanner": "scanner-primary", "fingerprint": "a55af5ea0604e267", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-4cfe9deb0f76fffb", "level": "note", "message": {"text": "Very large file: src-tauri/src/parse.rs (2078 lines)"}, "properties": {"repobilityId": "fa5aa448de218bf6", "scanner": "scanner-primary", "fingerprint": "4cfe9deb0f76fffb", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-7f12f63198e6c413", "level": "note", "message": {"text": "Very large file: src-tauri/src/rules.rs (3364 lines)"}, "properties": {"repobilityId": "1ac1e2febaf606fc", "scanner": "scanner-primary", "fingerprint": "7f12f63198e6c413", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-183b168868cc5914", "level": "note", "message": {"text": "Very large file: src-tauri/src/session.rs (2408 lines)"}, "properties": {"repobilityId": "06083b1f3e114c35", "scanner": "scanner-primary", "fingerprint": "183b168868cc5914", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-6893a6c8b0861585", "level": "warning", "message": {"text": "Very low test-to-source ratio"}, "properties": {"repobilityId": "54a7de3f06314bf0", "scanner": "scanner-primary", "fingerprint": "6893a6c8b0861585", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["tests", "coverage"]}}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "6b2287d08aeac0dc", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-72b2a6250083a784", "level": "warning", "message": {"text": "Placeholder or mock-heavy implementation detected"}, "properties": {"repobilityId": "59c342a78af62705", "scanner": "scanner-primary", "fingerprint": "72b2a6250083a784", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "incomplete", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "9c231c50fa5a0446", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "7f2d0562384a6e4d", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "d044387e8eb4c13e", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-37a9484e12074aa1", "level": "none", "message": {"text": "Commented-code block (7 lines) in tests/unit/evalScoring.test.ts:897"}, "properties": {"repobilityId": "734147198660cc3e", "scanner": "scanner-primary", "fingerprint": "37a9484e12074aa1", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-974b71ef3ff5f29b", "level": "none", "message": {"text": "Commented-code block (5 lines) in scripts/capture-demo-video.mjs:3"}, "properties": {"repobilityId": "879fe2c1ae232207", "scanner": "scanner-primary", "fingerprint": "974b71ef3ff5f29b", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-57bfb2f676b21535", "level": "none", "message": {"text": "Commented-code block (7 lines) in scripts/build-coverage-card.mjs:5"}, "properties": {"repobilityId": "93fabc257a5ef413", "scanner": "scanner-primary", "fingerprint": "57bfb2f676b21535", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-6336feb3a2176790", "level": "none", "message": {"text": "Commented-code block (5 lines) in scripts/fix-icon-alpha.mjs:3"}, "properties": {"repobilityId": "a92a02a318839455", "scanner": "scanner-primary", "fingerprint": "6336feb3a2176790", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-b36fe2fcf977dd0b", "level": "none", "message": {"text": "Commented-code block (5 lines) in scripts/fp-replay.mjs:2"}, "properties": {"repobilityId": "5af2b0d960346c01", "scanner": "scanner-primary", "fingerprint": "b36fe2fcf977dd0b", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-96d15170c5b319f0", "level": "none", "message": {"text": "Commented-code block (7 lines) in scripts/capture-trailer.mjs:3"}, "properties": {"repobilityId": "232490cff9763833", "scanner": "scanner-primary", "fingerprint": "96d15170c5b319f0", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-c9d4ac64c276ee2f", "level": "none", "message": {"text": "Commented-code block (6 lines) in eval/panel.mjs:6"}, "properties": {"repobilityId": "ebf3286f28c0035c", "scanner": "scanner-primary", "fingerprint": "c9d4ac64c276ee2f", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-389d5f44c5403008", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 eval/cases/mjs-disabled-tls.case.mjs:18"}, "properties": {"repobilityId": "90ef5aaccfc93d0f", "scanner": "scanner-primary", "fingerprint": "389d5f44c5403008", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-7ba5edd7eb6f64d0", "level": "none", "message": {"text": "Commented-code block (7 lines) in eval/cases/python-structural-drift.case.mjs:1"}, "properties": {"repobilityId": "1037077ddb558187", "scanner": "scanner-primary", "fingerprint": "7ba5edd7eb6f64d0", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-d2d4b40878119260", "level": "none", "message": {"text": "Commented-code block (8 lines) in eval/cases/go-guard-removed.case.mjs:1"}, "properties": {"repobilityId": "c6edb736b7896d2b", "scanner": "scanner-primary", "fingerprint": "d2d4b40878119260", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-855c4096ce7f428b", "level": "none", "message": {"text": "Commented-code block (5 lines) in eval/cases/oversized-file-skip.case.mjs:1"}, "properties": {"repobilityId": "0c1f986861ad57b7", "scanner": "scanner-primary", "fingerprint": "855c4096ce7f428b", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-f8443dbc3939d5d2", "level": "none", "message": {"text": "Commented-code block (5 lines) in eval/cases/go-cookies-weakened.case.mjs:1"}, "properties": {"repobilityId": "c84f762777556cf2", "scanner": "scanner-primary", "fingerprint": "f8443dbc3939d5d2", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-7f468e8193c6c010", "level": "none", "message": {"text": "Commented-code block (5 lines) in eval/cases/noisy-benign-refactor.case.mjs:1"}, "properties": {"repobilityId": "d075c8bf3853589d", "scanner": "scanner-primary", "fingerprint": "7f468e8193c6c010", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-3e33ee8bc25b5386", "level": "none", "message": {"text": "Commented-code block (5 lines) in eval/cases/python-guard-removed.case.mjs:1"}, "properties": {"repobilityId": "d0e9651be48e06c8", "scanner": "scanner-primary", "fingerprint": "3e33ee8bc25b5386", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-6a85866336c262eb", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 eval/cases/python-error-handling-removed.case.mjs:14"}, "properties": {"repobilityId": "a956f3b33faa6db5", "scanner": "scanner-primary", "fingerprint": "6a85866336c262eb", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}]}]}