{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-eea7bf099c92de96", "name": "`truncate` class without `title=` for hover reveal \u2014 app/settings/labels/settings-panel.tsx:1629", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 app/settings/labels/settings-panel.tsx:1629"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-0217e2e9807e464b", "name": "TODO/FIXME marker in shipping code \u2014 app/api/mailhub/rakuten/reply/route.ts:79", "shortDescription": {"text": "TODO/FIXME marker in shipping code \u2014 app/api/mailhub/rakuten/reply/route.ts:79"}, "fullDescription": {"text": "Track in /reviews or /issues, not as a code comment that rots.\n\nWhy: Drift control \u2014 shouldn't be the same as Quality TODO scanner.\nRule id: fq.todo-marker"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-e8210e1cd36d57a6", "name": "Stray `console.log` in TS/JS \u2014 app/api/mailhub/rakuten/reply/route.ts:45", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 app/api/mailhub/rakuten/reply/route.ts:45"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b3e9df3212232dce", "name": "TODO/FIXME marker in shipping code \u2014 app/api/mailhub/assign/route.ts:47", "shortDescription": {"text": "TODO/FIXME marker in shipping code \u2014 app/api/mailhub/assign/route.ts:47"}, "fullDescription": {"text": "Track in /reviews or /issues, not as a code comment that rots.\n\nWhy: Drift control \u2014 shouldn't be the same as Quality TODO scanner.\nRule id: fq.todo-marker"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-3a6da8d9e8ed397b", "name": "TODO/FIXME marker in shipping code \u2014 app/api/mailhub/alerts/run/route.ts:28", "shortDescription": {"text": "TODO/FIXME marker in shipping code \u2014 app/api/mailhub/alerts/run/route.ts:28"}, "fullDescription": {"text": "Track in /reviews or /issues, not as a code comment that rots.\n\nWhy: Drift control \u2014 shouldn't be the same as Quality TODO scanner.\nRule id: fq.todo-marker"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-92585568bfaccb28", "name": "TODO/FIXME marker in shipping code \u2014 app/api/mailhub/report/weekly/route.ts:60", "shortDescription": {"text": "TODO/FIXME marker in shipping code \u2014 app/api/mailhub/report/weekly/route.ts:60"}, "fullDescription": {"text": "Track in /reviews or /issues, not as a code comment that rots.\n\nWhy: Drift control \u2014 shouldn't be the same as Quality TODO scanner.\nRule id: fq.todo-marker"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-0d66db115b7d8e7f", "name": "`truncate` class without `title=` for hover reveal \u2014 app/inbox/InboxShell.tsx:6183", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 app/inbox/InboxShell.tsx:6183"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-0b4ecec097bff739", "name": "TODO/FIXME marker in shipping code \u2014 app/inbox/InboxShell.tsx:8034", "shortDescription": {"text": "TODO/FIXME marker in shipping code \u2014 app/inbox/InboxShell.tsx:8034"}, "fullDescription": {"text": "Track in /reviews or /issues, not as a code comment that rots.\n\nWhy: Drift control \u2014 shouldn't be the same as Quality TODO scanner.\nRule id: fq.todo-marker"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-4e13259128010489", "name": "`truncate` class without `title=` for hover reveal \u2014 app/inbox/components/InternalOpsPane.tsx:543", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 app/inbox/components/InternalOpsPane.tsx:543"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-1bd590764ed749c4", "name": "`truncate` class without `title=` for hover reveal \u2014 app/inbox/components/ViewsCommandPalette.tsx:92", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 app/inbox/components/ViewsCommandPalette.tsx:92"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-4d2c70eb40c15e78", "name": "`truncate` class without `title=` for hover reveal \u2014 app/inbox/components/HandoffDrawer.tsx:195", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 app/inbox/components/HandoffDrawer.tsx:195"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-83e806cb335e08dc", "name": "`truncate` class without `title=` for hover reveal \u2014 app/inbox/components/Sidebar.tsx:92", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 app/inbox/components/Sidebar.tsx:92"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-4db0f41676577246", "name": "TODO/FIXME marker in shipping code \u2014 lib/gmail.ts:1802", "shortDescription": {"text": "TODO/FIXME marker in shipping code \u2014 lib/gmail.ts:1802"}, "fullDescription": {"text": "Track in /reviews or /issues, not as a code comment that rots.\n\nWhy: Drift control \u2014 shouldn't be the same as Quality TODO scanner.\nRule id: fq.todo-marker"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-df19912a3f70aade", "name": "Stray `console.log` in TS/JS \u2014 lib/gmail.ts:1178", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 lib/gmail.ts:1178"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a75a36eb6ec491ca", "name": "Stray `console.log` in TS/JS \u2014 lib/alerts.ts:106", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 lib/alerts.ts:106"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-200138961fcd3394", "name": "TODO/FIXME marker in shipping code \u2014 lib/ruleSuggestions.ts:87", "shortDescription": {"text": "TODO/FIXME marker in shipping code \u2014 lib/ruleSuggestions.ts:87"}, "fullDescription": {"text": "Track in /reviews or /issues, not as a code comment that rots.\n\nWhy: Drift control \u2014 shouldn't be the same as Quality TODO scanner.\nRule id: fq.todo-marker"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-2b6b0b371fb03bfb", "name": "TODO/FIXME marker in shipping code \u2014 lib/time-utils.ts:106", "shortDescription": {"text": "TODO/FIXME marker in shipping code \u2014 lib/time-utils.ts:106"}, "fullDescription": {"text": "Track in /reviews or /issues, not as a code comment that rots.\n\nWhy: Drift control \u2014 shouldn't be the same as Quality TODO scanner.\nRule id: fq.todo-marker"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-97551bab1a38cf2b", "name": "Stray `console.log` in TS/JS \u2014 lib/audit-log.ts:142", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 lib/audit-log.ts:142"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-14f582c1447c8974", "name": "`dangerouslySetInnerHTML` used in a React component \u2014 lib/__tests__/gmail.test.ts:124", "shortDescription": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 lib/__tests__/gmail.test.ts:124"}, "fullDescription": {"text": "Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library.\n\nWhy: OWASP basics. Already partially flagged by the security analyzer.\nRule id: fq.dangerous-html"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6d655d8666a8deef", "name": "Stray `console.log` in TS/JS \u2014 e2e/qa-strict-unified.spec.ts:1230", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 e2e/qa-strict-unified.spec.ts:1230"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e070c779170c2ea3", "name": "Stray `console.log` in TS/JS \u2014 e2e/phase3-regressions.spec.ts:4", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 e2e/phase3-regressions.spec.ts:4"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8f14c6be01820587", "name": "Insecure pattern 'node_child_process' in scripts/security-scan.mjs:11", "shortDescription": {"text": "Insecure pattern 'node_child_process' in scripts/security-scan.mjs:11"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-881387ffdc6a35d7", "name": "Insecure pattern 'node_child_process' in scripts/e2e-preclean.mjs:19", "shortDescription": {"text": "Insecure pattern 'node_child_process' in scripts/e2e-preclean.mjs:19"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-efc9514c2ae48d92", "name": "Insecure pattern 'direct_innerhtml_assignment' in app/inbox/InboxShell.tsx:355", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in app/inbox/InboxShell.tsx:355"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-46b37206f79755e3", "name": "Insecure pattern 'dangerous_innerhtml' in lib/__tests__/gmail.test.ts:124", "shortDescription": {"text": "Insecure pattern 'dangerous_innerhtml' in lib/__tests__/gmail.test.ts:124"}, "fullDescription": {"text": "Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ddafaf23d9a17c53", "name": "Insecure pattern 'node_child_process' in lib/__tests__/ops-artifact-secret-scan.test.ts:4", "shortDescription": {"text": "Insecure pattern 'node_child_process' in lib/__tests__/ops-artifact-secret-scan.test.ts:4"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ccd95da7dd323be6", "name": "Insecure pattern 'private_key_in_repo' in lib/__tests__/ops-artifact-secret-scan.test.ts:35", "shortDescription": {"text": "Insecure pattern 'private_key_in_repo' in lib/__tests__/ops-artifact-secret-scan.test.ts:35"}, "fullDescription": {"text": "Found a known-risky pattern (private_key_in_repo). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-b547dccfefc2abf5", "name": "Insecure pattern 'private_key_in_repo' in lib/__tests__/activityStore.test.ts:116", "shortDescription": {"text": "Insecure pattern 'private_key_in_repo' in lib/__tests__/activityStore.test.ts:116"}, "fullDescription": {"text": "Found a known-risky pattern (private_key_in_repo). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-9c371ff15082a705", "name": "Insecure pattern 'dangerous_innerhtml' in playwright-report/index.html:58", "shortDescription": {"text": "Insecure pattern 'dangerous_innerhtml' in playwright-report/index.html:58"}, "fullDescription": {"text": "Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9029cfde635dd36d", "name": "Insecure pattern 'direct_innerhtml_assignment' in playwright-report/index.html:57", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in playwright-report/index.html:57"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-119a23a8186c3dfc", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/upload-artifact@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-59a476858a35383b", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8e71a6da00189d28", "name": "Very large file: app/settings/labels/settings-panel.tsx (3601 lines)", "shortDescription": {"text": "Very large file: app/settings/labels/settings-panel.tsx (3601 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ae1250bdc785471b", "name": "Very large file: app/inbox/InboxShell.tsx (8876 lines)", "shortDescription": {"text": "Very large file: app/inbox/InboxShell.tsx (8876 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f5e4f05c6c3fa824", "name": "Very large file: lib/gmail.ts (2440 lines)", "shortDescription": {"text": "Very large file: lib/gmail.ts (2440 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0282548a620c870a", "name": "Very large file: e2e/qa-strict-unified.spec.ts (7008 lines)", "shortDescription": {"text": "Very large file: e2e/qa-strict-unified.spec.ts (7008 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a2c6cc64b5d4f346", "name": "71 TODO/FIXME markers", "shortDescription": {"text": "71 TODO/FIXME markers"}, "fullDescription": {"text": "High count of TODO/FIXME/HACK markers \u2014 track them as issues so they're not forgotten."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-141b30a41e03817b", "name": "No license file detected", "shortDescription": {"text": "No license file detected"}, "fullDescription": {"text": "No LICENSE/COPYING/NOTICE file was found. Generated repositories often omit licensing, which blocks reuse and automated intake."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 215 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-72b2a6250083a784", "name": "Placeholder or mock-heavy implementation detected", "shortDescription": {"text": "Placeholder or mock-heavy implementation detected"}, "fullDescription": {"text": "Found 48 placeholder/mock markers across 12 source files. This often means the repo looks complete while core flows still use generated scaffolding or fake data."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-749d4bc1bd66df5f", "name": "Agent instructions exist but release-hardening basics are missing", "shortDescription": {"text": "Agent instructions exist but release-hardening basics are missing"}, "fullDescription": {"text": "AI-coder instruction files were found, but the repo is missing license. Treat this as a contract gap: the agent is guided, but the generated output is not yet guarded by the controls that make it repeatable."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-b06e1151dd3571cc", "name": "Commented-code block (5 lines) in playwright.config.ts:19", "shortDescription": {"text": "Commented-code block (5 lines) in playwright.config.ts:19"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-db68186d76b6cc63", "name": "Commented-code block (7 lines) in app/api/mailhub/assign/route.ts:46", "shortDescription": {"text": "Commented-code block (7 lines) in app/api/mailhub/assign/route.ts:46"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-cf7e6db0fce3b09d", "name": "Legacy-named symbol `template_copy` in app/inbox/InboxShell.tsx:5232", "shortDescription": {"text": "Legacy-named symbol `template_copy` in app/inbox/InboxShell.tsx:5232"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-59c63db8444c6df5", "name": "`fetch()` without try/.catch or AbortSignal \u2014 app/inbox/InboxShell.tsx:460", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 app/inbox/InboxShell.tsx:460"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8912706761eb0ee5", "name": "`fetch()` without try/.catch or AbortSignal \u2014 app/inbox/client-api.ts:2", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 app/inbox/client-api.ts:2"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2f4f8153b88dd519", "name": "Legacy-named symbol `template_copy` in app/inbox/components/InternalOpsPane.tsx:579", "shortDescription": {"text": "Legacy-named symbol `template_copy` in app/inbox/components/InternalOpsPane.tsx:579"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6b9a8fa9c802d7b8", "name": "`fetch()` without try/.catch or AbortSignal \u2014 lib/alerts.ts:91", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 lib/alerts.ts:91"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-424aa09023b43e52", "name": "Legacy-named symbol `template_copy` in lib/audit-log.ts:34", "shortDescription": {"text": "Legacy-named symbol `template_copy` in lib/audit-log.ts:34"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a4686dc9bc830048", "name": "Legacy-named symbol `veryOld` in lib/__tests__/time-utils.test.ts:86", "shortDescription": {"text": "Legacy-named symbol `veryOld` in lib/__tests__/time-utils.test.ts:86"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b1546f1da963bda4", "name": "Legacy-named symbol `__test_cfg_legacy` in lib/__tests__/configStore.test.ts:197", "shortDescription": {"text": "Legacy-named symbol `__test_cfg_legacy` in lib/__tests__/configStore.test.ts:197"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-46a4964a66c969c3", "name": "Commented-code block (5 lines) in lib/__tests__/configStore.test.ts:613", "shortDescription": {"text": "Commented-code block (5 lines) in lib/__tests__/configStore.test.ts:613"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-bddda3d5a14c7401", "name": "29 env vars used in code but missing from .env.example", "shortDescription": {"text": "29 env vars used in code but missing from .env.example"}, "fullDescription": {"text": "Drift between code and config docs. The first few: `CI`, `MAILHUB_ACTIVITY_STORE`, `MAILHUB_ADMINS`, `MAILHUB_ALERTS_PROVIDER`, `MAILHUB_ALERTS_SECRET`, `MAILHUB_CONFIG_EXPORT_SECRET`, `MAILHUB_CONFIG_STORE`, `MAILHUB_ENV` + 21 more. Add them (with a placeholder/comment) to .env.example so onboarding doesn't break."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2c04133e54348533", "name": "Near-duplicate function bodies in 2 places", "shortDescription": {"text": "Near-duplicate function bodies in 2 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nscripts/fix_amazon_labels.py:get_all_message_ids, scripts/create_cancel_label.py:get_all_message_ids\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/22469"}, "properties": {"repository": "vyper-japan/mailhub", "repoUrl": "https://github.com/vyper-japan/mailhub", "branch": "main"}, "results": [{"ruleId": "scanner-eea7bf099c92de96", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 app/settings/labels/settings-panel.tsx:1629"}, "properties": {"repobilityId": "64055ceecd3f43f2", "scanner": "scanner-primary", "fingerprint": "eea7bf099c92de96", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-0217e2e9807e464b", "level": "none", "message": {"text": "TODO/FIXME marker in shipping code \u2014 app/api/mailhub/rakuten/reply/route.ts:79"}, "properties": {"repobilityId": "81e9fda1064fc62f", "scanner": "scanner-primary", "fingerprint": "0217e2e9807e464b", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.todo-marker"]}}, {"ruleId": "scanner-e8210e1cd36d57a6", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 app/api/mailhub/rakuten/reply/route.ts:45"}, "properties": {"repobilityId": "61a05c70b6960dba", "scanner": "scanner-primary", "fingerprint": "e8210e1cd36d57a6", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-b3e9df3212232dce", "level": "none", "message": {"text": "TODO/FIXME marker in shipping code \u2014 app/api/mailhub/assign/route.ts:47"}, "properties": {"repobilityId": "e7a8a8e15fa1e801", "scanner": "scanner-primary", "fingerprint": "b3e9df3212232dce", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.todo-marker"]}}, {"ruleId": "scanner-3a6da8d9e8ed397b", "level": "none", "message": {"text": "TODO/FIXME marker in shipping code \u2014 app/api/mailhub/alerts/run/route.ts:28"}, "properties": {"repobilityId": "51aade78e46e7641", "scanner": "scanner-primary", "fingerprint": "3a6da8d9e8ed397b", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.todo-marker"]}}, {"ruleId": "scanner-92585568bfaccb28", "level": "none", "message": {"text": "TODO/FIXME marker in shipping code \u2014 app/api/mailhub/report/weekly/route.ts:60"}, "properties": {"repobilityId": "f75e0cf2087d3945", "scanner": "scanner-primary", "fingerprint": "92585568bfaccb28", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.todo-marker"]}}, {"ruleId": "scanner-0d66db115b7d8e7f", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 app/inbox/InboxShell.tsx:6183"}, "properties": {"repobilityId": "3c30bfe42b560103", "scanner": "scanner-primary", "fingerprint": "0d66db115b7d8e7f", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-0b4ecec097bff739", "level": "none", "message": {"text": "TODO/FIXME marker in shipping code \u2014 app/inbox/InboxShell.tsx:8034"}, "properties": {"repobilityId": "f58db1976c663055", "scanner": "scanner-primary", "fingerprint": "0b4ecec097bff739", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.todo-marker"]}}, {"ruleId": "scanner-4e13259128010489", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 app/inbox/components/InternalOpsPane.tsx:543"}, "properties": {"repobilityId": "802bf057934339b5", "scanner": "scanner-primary", "fingerprint": "4e13259128010489", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-1bd590764ed749c4", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 app/inbox/components/ViewsCommandPalette.tsx:92"}, "properties": {"repobilityId": "c37e6ec5c3a2fd27", "scanner": "scanner-primary", "fingerprint": "1bd590764ed749c4", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-4d2c70eb40c15e78", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 app/inbox/components/HandoffDrawer.tsx:195"}, "properties": {"repobilityId": "4267027cd374a2ae", "scanner": "scanner-primary", "fingerprint": "4d2c70eb40c15e78", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-83e806cb335e08dc", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 app/inbox/components/Sidebar.tsx:92"}, "properties": {"repobilityId": "16d47067f2c67bfd", "scanner": "scanner-primary", "fingerprint": "83e806cb335e08dc", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-4db0f41676577246", "level": "none", "message": {"text": "TODO/FIXME marker in shipping code \u2014 lib/gmail.ts:1802"}, "properties": {"repobilityId": "24a07ea6d1230a1c", "scanner": "scanner-primary", "fingerprint": "4db0f41676577246", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.todo-marker"]}}, {"ruleId": "scanner-df19912a3f70aade", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 lib/gmail.ts:1178"}, "properties": {"repobilityId": "013a6b557535ef70", "scanner": "scanner-primary", "fingerprint": "df19912a3f70aade", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-a75a36eb6ec491ca", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 lib/alerts.ts:106"}, "properties": {"repobilityId": "9bc5c5dc81249540", "scanner": "scanner-primary", "fingerprint": "a75a36eb6ec491ca", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-200138961fcd3394", "level": "none", "message": {"text": "TODO/FIXME marker in shipping code \u2014 lib/ruleSuggestions.ts:87"}, "properties": {"repobilityId": "2a77ab18627c8409", "scanner": "scanner-primary", "fingerprint": "200138961fcd3394", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.todo-marker"]}}, {"ruleId": "scanner-2b6b0b371fb03bfb", "level": "none", "message": {"text": "TODO/FIXME marker in shipping code \u2014 lib/time-utils.ts:106"}, "properties": {"repobilityId": "edc1cafdc9ccb985", "scanner": "scanner-primary", "fingerprint": "2b6b0b371fb03bfb", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.todo-marker"]}}, {"ruleId": "scanner-97551bab1a38cf2b", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 lib/audit-log.ts:142"}, "properties": {"repobilityId": "294d67a855f9cd77", "scanner": "scanner-primary", "fingerprint": "97551bab1a38cf2b", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-14f582c1447c8974", "level": "warning", "message": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 lib/__tests__/gmail.test.ts:124"}, "properties": {"repobilityId": "a7503b03abb0f603", "scanner": "scanner-primary", "fingerprint": "14f582c1447c8974", "layer": "frontend", "severity": "medium", "confidence": 1.0, "tags": ["frontend-quality", "fq.dangerous-html"]}}, {"ruleId": "scanner-6d655d8666a8deef", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 e2e/qa-strict-unified.spec.ts:1230"}, "properties": {"repobilityId": "7142c657cbe6db2d", "scanner": "scanner-primary", "fingerprint": "6d655d8666a8deef", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-e070c779170c2ea3", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 e2e/phase3-regressions.spec.ts:4"}, "properties": {"repobilityId": "e0a18f026a76058f", "scanner": "scanner-primary", "fingerprint": "e070c779170c2ea3", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-8f14c6be01820587", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in scripts/security-scan.mjs:11"}, "properties": {"repobilityId": "fb1761f537776b2a", "scanner": "scanner-primary", "fingerprint": "8f14c6be01820587", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/security-scan.mjs"}, "region": {"startLine": 11}}}]}, {"ruleId": "scanner-881387ffdc6a35d7", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in scripts/e2e-preclean.mjs:19"}, "properties": {"repobilityId": "30c329d7d688bb7c", "scanner": "scanner-primary", "fingerprint": "881387ffdc6a35d7", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/e2e-preclean.mjs"}, "region": {"startLine": 19}}}]}, {"ruleId": "scanner-efc9514c2ae48d92", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in app/inbox/InboxShell.tsx:355"}, "properties": {"repobilityId": "79f9c84d610b2a06", "scanner": "scanner-primary", "fingerprint": "efc9514c2ae48d92", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "app/inbox/InboxShell.tsx"}, "region": {"startLine": 355}}}]}, {"ruleId": "scanner-46b37206f79755e3", "level": "warning", "message": {"text": "Insecure pattern 'dangerous_innerhtml' in lib/__tests__/gmail.test.ts:124"}, "properties": {"repobilityId": "255e074664f78602", "scanner": "scanner-primary", "fingerprint": "46b37206f79755e3", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "dangerous_innerhtml"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "lib/__tests__/gmail.test.ts"}, "region": {"startLine": 124}}}]}, {"ruleId": "scanner-ddafaf23d9a17c53", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in lib/__tests__/ops-artifact-secret-scan.test.ts:4"}, "properties": {"repobilityId": "4a7e687f2a10316c", "scanner": "scanner-primary", "fingerprint": "ddafaf23d9a17c53", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "lib/__tests__/ops-artifact-secret-scan.test.ts"}, "region": {"startLine": 4}}}]}, {"ruleId": "scanner-ccd95da7dd323be6", "level": "error", "message": {"text": "Insecure pattern 'private_key_in_repo' in lib/__tests__/ops-artifact-secret-scan.test.ts:35"}, "properties": {"repobilityId": "21240157f5297496", "scanner": "scanner-primary", "fingerprint": "ccd95da7dd323be6", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["owasp", "private_key_in_repo"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "lib/__tests__/ops-artifact-secret-scan.test.ts"}, "region": {"startLine": 35}}}]}, {"ruleId": "scanner-b547dccfefc2abf5", "level": "error", "message": {"text": "Insecure pattern 'private_key_in_repo' in lib/__tests__/activityStore.test.ts:116"}, "properties": {"repobilityId": "9a4772c6c1dda1ea", "scanner": "scanner-primary", "fingerprint": "b547dccfefc2abf5", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["owasp", "private_key_in_repo"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "lib/__tests__/activityStore.test.ts"}, "region": {"startLine": 116}}}]}, {"ruleId": "scanner-9c371ff15082a705", "level": "warning", "message": {"text": "Insecure pattern 'dangerous_innerhtml' in playwright-report/index.html:58"}, "properties": {"repobilityId": "5c1a4d4daf334529", "scanner": "scanner-primary", "fingerprint": "9c371ff15082a705", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "dangerous_innerhtml"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "playwright-report/index.html"}, "region": {"startLine": 58}}}]}, {"ruleId": "scanner-9029cfde635dd36d", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in playwright-report/index.html:57"}, "properties": {"repobilityId": "72bf5b0e0e2b9155", "scanner": "scanner-primary", "fingerprint": "9029cfde635dd36d", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "playwright-report/index.html"}, "region": {"startLine": 57}}}]}, {"ruleId": "scanner-119a23a8186c3dfc", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "ed5a8c7709c38cac", "scanner": "scanner-primary", "fingerprint": "119a23a8186c3dfc", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/mailhub-config-export.yml"}, "region": {"startLine": 67}}}]}, {"ruleId": "scanner-59a476858a35383b", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "d1d263492077c5ae", "scanner": "scanner-primary", "fingerprint": "59a476858a35383b", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/mailhub-alerts.yml"}, "region": {"startLine": 28}}}]}, {"ruleId": "scanner-8e71a6da00189d28", "level": "note", "message": {"text": "Very large file: app/settings/labels/settings-panel.tsx (3601 lines)"}, "properties": {"repobilityId": "c14a49a82065ef94", "scanner": "scanner-primary", "fingerprint": "8e71a6da00189d28", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-ae1250bdc785471b", "level": "note", "message": {"text": "Very large file: app/inbox/InboxShell.tsx (8876 lines)"}, "properties": {"repobilityId": "2a618002238e39e3", "scanner": "scanner-primary", "fingerprint": "ae1250bdc785471b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-f5e4f05c6c3fa824", "level": "note", "message": {"text": "Very large file: lib/gmail.ts (2440 lines)"}, "properties": {"repobilityId": "2d1ac0b5aacbed48", "scanner": "scanner-primary", "fingerprint": "f5e4f05c6c3fa824", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-0282548a620c870a", "level": "note", "message": {"text": "Very large file: e2e/qa-strict-unified.spec.ts (7008 lines)"}, "properties": {"repobilityId": "f85abb0f634fbfc6", "scanner": "scanner-primary", "fingerprint": "0282548a620c870a", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-a2c6cc64b5d4f346", "level": "note", "message": {"text": "71 TODO/FIXME markers"}, "properties": {"repobilityId": "4b38c118003e07d2", "scanner": "scanner-primary", "fingerprint": "a2c6cc64b5d4f346", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["maintenance"]}}, {"ruleId": "scanner-141b30a41e03817b", "level": "note", "message": {"text": "No license file detected"}, "properties": {"repobilityId": "fee7e223d7aa53cc", "scanner": "scanner-primary", "fingerprint": "141b30a41e03817b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["license", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "0ad39213cd82aa18", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-72b2a6250083a784", "level": "warning", "message": {"text": "Placeholder or mock-heavy implementation detected"}, "properties": {"repobilityId": "2756daf2cd2e5f3f", "scanner": "scanner-primary", "fingerprint": "72b2a6250083a784", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "incomplete", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "f46d526ba0d883cb", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-749d4bc1bd66df5f", "level": "warning", "message": {"text": "Agent instructions exist but release-hardening basics are missing"}, "properties": {"repobilityId": "e3386bdb9238384e", "scanner": "scanner-primary", "fingerprint": "749d4bc1bd66df5f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "7d3034a36dfc242d", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "6e9c2b31d621936c", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-b06e1151dd3571cc", "level": "none", "message": {"text": "Commented-code block (5 lines) in playwright.config.ts:19"}, "properties": {"repobilityId": "da67ccfd81da29b6", "scanner": "scanner-primary", "fingerprint": "b06e1151dd3571cc", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-db68186d76b6cc63", "level": "none", "message": {"text": "Commented-code block (7 lines) in app/api/mailhub/assign/route.ts:46"}, "properties": {"repobilityId": "bbb0e66ec527bf7a", "scanner": "scanner-primary", "fingerprint": "db68186d76b6cc63", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-cf7e6db0fce3b09d", "level": "note", "message": {"text": "Legacy-named symbol `template_copy` in app/inbox/InboxShell.tsx:5232"}, "properties": {"repobilityId": "17709f9426d7b910", "scanner": "scanner-primary", "fingerprint": "cf7e6db0fce3b09d", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-59c63db8444c6df5", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 app/inbox/InboxShell.tsx:460"}, "properties": {"repobilityId": "909a6d74cd6314e3", "scanner": "scanner-primary", "fingerprint": "59c63db8444c6df5", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-8912706761eb0ee5", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 app/inbox/client-api.ts:2"}, "properties": {"repobilityId": "b857208afa5cf7b2", "scanner": "scanner-primary", "fingerprint": "8912706761eb0ee5", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-2f4f8153b88dd519", "level": "note", "message": {"text": "Legacy-named symbol `template_copy` in app/inbox/components/InternalOpsPane.tsx:579"}, "properties": {"repobilityId": "62b5cadc0209cab2", "scanner": "scanner-primary", "fingerprint": "2f4f8153b88dd519", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-6b9a8fa9c802d7b8", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 lib/alerts.ts:91"}, "properties": {"repobilityId": "e6753674c7bffec0", "scanner": "scanner-primary", "fingerprint": "6b9a8fa9c802d7b8", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-424aa09023b43e52", "level": "note", "message": {"text": "Legacy-named symbol `template_copy` in lib/audit-log.ts:34"}, "properties": {"repobilityId": "91b0fedf3ddf8f41", "scanner": "scanner-primary", "fingerprint": "424aa09023b43e52", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-a4686dc9bc830048", "level": "note", "message": {"text": "Legacy-named symbol `veryOld` in lib/__tests__/time-utils.test.ts:86"}, "properties": {"repobilityId": "716f62ffc650e366", "scanner": "scanner-primary", "fingerprint": "a4686dc9bc830048", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-b1546f1da963bda4", "level": "note", "message": {"text": "Legacy-named symbol `__test_cfg_legacy` in lib/__tests__/configStore.test.ts:197"}, "properties": {"repobilityId": "ae1180012effa774", "scanner": "scanner-primary", "fingerprint": "b1546f1da963bda4", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-46a4964a66c969c3", "level": "none", "message": {"text": "Commented-code block (5 lines) in lib/__tests__/configStore.test.ts:613"}, "properties": {"repobilityId": "b37b8e71b5887e39", "scanner": "scanner-primary", "fingerprint": "46a4964a66c969c3", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-bddda3d5a14c7401", "level": "note", "message": {"text": "29 env vars used in code but missing from .env.example"}, "properties": {"repobilityId": "3519a6b4ac1d4f19", "scanner": "scanner-primary", "fingerprint": "bddda3d5a14c7401", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "config-drift"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "5a0512d442ccb3be", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "39d92cc0370edb7d", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}]}]}