{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-bead75b0f9233e05", "name": "No API endpoints detected", "shortDescription": {"text": "No API endpoints detected"}, "fullDescription": {"text": "The scanner did not find FastAPI/Flask/Express/NestJS/GraphQL/gRPC routes. If this repo exposes APIs, the framework may be unsupported."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "info", "confidence": 1.0}}, {"id": "scanner-15e02180fd581249", "name": "Stray `console.log` in TS/JS \u2014 apps/room/public/display/setup/tampermonkey/google-meet-handsfree.user.js:27", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 apps/room/public/display/setup/tampermonkey/google-meet-handsfree.user.js:27"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f48b55a508c19788", "name": "`truncate` class without `title=` for hover reveal \u2014 apps/speed-review/src/components/SessionComplete.tsx:121", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 apps/speed-review/src/components/SessionComplete.tsx:121"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-049abb588eec03bf", "name": "Stray `console.log` in TS/JS \u2014 apps/website/scripts/render-preview.ts:23", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 apps/website/scripts/render-preview.ts:23"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ca65617af1ad27de", "name": "Stray `console.log` in TS/JS \u2014 apps/website/scripts/sitemap-generator.ts:82", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 apps/website/scripts/sitemap-generator.ts:82"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-658b9fc55d930f19", "name": "TODO/FIXME marker in shipping code \u2014 apps/website/src/server/routers/testimonials.ts:28", "shortDescription": {"text": "TODO/FIXME marker in shipping code \u2014 apps/website/src/server/routers/testimonials.ts:28"}, "fullDescription": {"text": "Track in /reviews or /issues, not as a code comment that rots.\n\nWhy: Drift control \u2014 shouldn't be the same as Quality TODO scanner.\nRule id: fq.todo-marker"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-6cfa1ff24d2bb51d", "name": "`truncate` class without `title=` for hover reveal \u2014 apps/website/src/components/admin/ImpersonationBadge.tsx:104", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 apps/website/src/components/admin/ImpersonationBadge.tsx:104"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-c99fbda3da928296", "name": "`truncate` class without `title=` for hover reveal \u2014 apps/website/src/components/admin/UserSearchModal.tsx:78", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 apps/website/src/components/admin/UserSearchModal.tsx:78"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-a3f52831e4f5cccc", "name": "`truncate` class without `title=` for hover reveal \u2014 apps/website/src/components/alumni/RecentAlumniList.tsx:69", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 apps/website/src/components/alumni/RecentAlumniList.tsx:69"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-97d0efe04ce23850", "name": "`truncate` class without `title=` for hover reveal \u2014 apps/website/src/components/courses/GroupDiscussionBanner.tsx:234", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 apps/website/src/components/courses/GroupDiscussionBanner.tsx:234"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-6b61eebbff5852e8", "name": "`truncate` class without `title=` for hover reveal \u2014 apps/website/src/components/courses/FacilitatorFeedbackHeader.tsx:1", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 apps/website/src/components/courses/FacilitatorFeedbackHeader.tsx:14"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-0a7954c7f68417b8", "name": "`truncate` class without `title=` for hover reveal \u2014 apps/website/src/components/courses/CourseShell.tsx:58", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 apps/website/src/components/courses/CourseShell.tsx:58"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-1210804a87fed7da", "name": "`truncate` class without `title=` for hover reveal \u2014 apps/website/src/components/courses/ParticipantRow.tsx:15", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 apps/website/src/components/courses/ParticipantRow.tsx:15"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-cafdd13cbf00f402", "name": "TODO/FIXME marker in shipping code \u2014 apps/website/src/components/courses/exercises/GroupResponses.tsx:5", "shortDescription": {"text": "TODO/FIXME marker in shipping code \u2014 apps/website/src/components/courses/exercises/GroupResponses.tsx:5"}, "fullDescription": {"text": "Track in /reviews or /issues, not as a code comment that rots.\n\nWhy: Drift control \u2014 shouldn't be the same as Quality TODO scanner.\nRule id: fq.todo-marker"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-3412657425534e76", "name": "`dangerouslySetInnerHTML` used in a React component \u2014 apps/website/src/components/lander/CourseLander.tsx:172", "shortDescription": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 apps/website/src/components/lander/CourseLander.tsx:172"}, "fullDescription": {"text": "Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library.\n\nWhy: OWASP basics. Already partially flagged by the security analyzer.\nRule id: fq.dangerous-html"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ef79de5a98e9ce99", "name": "`dangerouslySetInnerHTML` used in a React component \u2014 apps/website/src/components/lander/components/FAQSection.tsx:66", "shortDescription": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 apps/website/src/components/lander/components/FAQSection.tsx:66"}, "fullDescription": {"text": "Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library.\n\nWhy: OWASP basics. Already partially flagged by the security analyzer.\nRule id: fq.dangerous-html"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b684f22fb544bc3d", "name": "`truncate` class without `title=` for hover reveal \u2014 apps/website/src/components/lander/components/AlumniStoryCarousel.t", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 apps/website/src/components/lander/components/AlumniStoryCarousel.tsx:317"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-080ad6fe03e93076", "name": "TODO/FIXME marker in shipping code \u2014 apps/website/src/components/analytics/consent.ts:21", "shortDescription": {"text": "TODO/FIXME marker in shipping code \u2014 apps/website/src/components/analytics/consent.ts:21"}, "fullDescription": {"text": "Track in /reviews or /issues, not as a code comment that rots.\n\nWhy: Drift control \u2014 shouldn't be the same as Quality TODO scanner.\nRule id: fq.todo-marker"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-7e0605c39e36c448", "name": "`dangerouslySetInnerHTML` used in a React component \u2014 apps/website/src/components/certificate/CertificateCard.tsx:142", "shortDescription": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 apps/website/src/components/certificate/CertificateCard.tsx:142"}, "fullDescription": {"text": "Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library.\n\nWhy: OWASP basics. Already partially flagged by the security analyzer.\nRule id: fq.dangerous-html"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-061bd9fe9438a604", "name": "`dangerouslySetInnerHTML` used in a React component \u2014 apps/website/src/pages/index.tsx:44", "shortDescription": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 apps/website/src/pages/index.tsx:44"}, "fullDescription": {"text": "Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library.\n\nWhy: OWASP basics. Already partially flagged by the security analyzer.\nRule id: fq.dangerous-html"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea8b9b2e91e2c281", "name": "`dangerouslySetInnerHTML` used in a React component \u2014 apps/website/src/pages/courses/index.tsx:32", "shortDescription": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 apps/website/src/pages/courses/index.tsx:32"}, "fullDescription": {"text": "Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library.\n\nWhy: OWASP basics. Already partially flagged by the security analyzer.\nRule id: fq.dangerous-html"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-dd213e9f3d2daa88", "name": "`dangerouslySetInnerHTML` used in a React component \u2014 apps/website/src/pages/join-us/[slug].tsx:47", "shortDescription": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 apps/website/src/pages/join-us/[slug].tsx:47"}, "fullDescription": {"text": "Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library.\n\nWhy: OWASP basics. Already partially flagged by the security analyzer.\nRule id: fq.dangerous-html"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1ebbbd754a272361", "name": "`truncate` class without `title=` for hover reveal \u2014 apps/website/src/pages/facilitator-applications/quick-apply/index.t", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 apps/website/src/pages/facilitator-applications/quick-apply/index.tsx:134"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-85660a373d52ea93", "name": "Stray `console.log` in TS/JS \u2014 apps/editor/src/components/MarkdownEditor.stories.tsx:43", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 apps/editor/src/components/MarkdownEditor.stories.tsx:43"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-dcfda95c1e07b374", "name": "TODO/FIXME marker in shipping code \u2014 apps/meet/src/pages/index.tsx:14", "shortDescription": {"text": "TODO/FIXME marker in shipping code \u2014 apps/meet/src/pages/index.tsx:14"}, "fullDescription": {"text": "Track in /reviews or /issues, not as a code comment that rots.\n\nWhy: Drift control \u2014 shouldn't be the same as Quality TODO scanner.\nRule id: fq.todo-marker"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-9af62f396feaf114", "name": "TODO/FIXME marker in shipping code \u2014 apps/infra/src/k8s/serviceDefinitions.ts:392", "shortDescription": {"text": "TODO/FIXME marker in shipping code \u2014 apps/infra/src/k8s/serviceDefinitions.ts:392"}, "fullDescription": {"text": "Track in /reviews or /issues, not as a code comment that rots.\n\nWhy: Drift control \u2014 shouldn't be the same as Quality TODO scanner.\nRule id: fq.todo-marker"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-8e8dce23351900bc", "name": "TODO/FIXME marker in shipping code \u2014 apps/pg-sync-service/src/routesPlugin.ts:18", "shortDescription": {"text": "TODO/FIXME marker in shipping code \u2014 apps/pg-sync-service/src/routesPlugin.ts:18"}, "fullDescription": {"text": "Track in /reviews or /issues, not as a code comment that rots.\n\nWhy: Drift control \u2014 shouldn't be the same as Quality TODO scanner.\nRule id: fq.todo-marker"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-60ec9f94139e984c", "name": "TODO/FIXME marker in shipping code \u2014 apps/pg-sync-service/src/lib/errorHandlerPlugin.ts:46", "shortDescription": {"text": "TODO/FIXME marker in shipping code \u2014 apps/pg-sync-service/src/lib/errorHandlerPlugin.ts:46"}, "fullDescription": {"text": "Track in /reviews or /issues, not as a code comment that rots.\n\nWhy: Drift control \u2014 shouldn't be the same as Quality TODO scanner.\nRule id: fq.todo-marker"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-4b6f2a4016dbdb8f", "name": "TODO/FIXME marker in shipping code \u2014 libraries/db/src/index.ts:114", "shortDescription": {"text": "TODO/FIXME marker in shipping code \u2014 libraries/db/src/index.ts:114"}, "fullDescription": {"text": "Track in /reviews or /issues, not as a code comment that rots.\n\nWhy: Drift control \u2014 shouldn't be the same as Quality TODO scanner.\nRule id: fq.todo-marker"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-84edcfafca9ae284", "name": "TODO/FIXME marker in shipping code \u2014 libraries/db/src/lib/typeUtils.ts:8", "shortDescription": {"text": "TODO/FIXME marker in shipping code \u2014 libraries/db/src/lib/typeUtils.ts:8"}, "fullDescription": {"text": "Track in /reviews or /issues, not as a code comment that rots.\n\nWhy: Drift control \u2014 shouldn't be the same as Quality TODO scanner.\nRule id: fq.todo-marker"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-90d03c241236a504", "name": "TODO/FIXME marker in shipping code \u2014 libraries/db/src/lib/db-core.ts:102", "shortDescription": {"text": "TODO/FIXME marker in shipping code \u2014 libraries/db/src/lib/db-core.ts:102"}, "fullDescription": {"text": "Track in /reviews or /issues, not as a code comment that rots.\n\nWhy: Drift control \u2014 shouldn't be the same as Quality TODO scanner.\nRule id: fq.todo-marker"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-870323b2060ffc78", "name": "Stray `console.log` in TS/JS \u2014 libraries/affected-packages/src/deploy-array.ts:11", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 libraries/affected-packages/src/deploy-array.ts:11"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c9424fab34139c20", "name": "Stray `console.log` in TS/JS \u2014 libraries/affected-packages/src/turbo-filter.ts:11", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 libraries/affected-packages/src/turbo-filter.ts:11"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ac55d2328ce7840e", "name": "TODO/FIXME marker in shipping code \u2014 libraries/ui/src/FaceTiles.tsx:20", "shortDescription": {"text": "TODO/FIXME marker in shipping code \u2014 libraries/ui/src/FaceTiles.tsx:20"}, "fullDescription": {"text": "Track in /reviews or /issues, not as a code comment that rots.\n\nWhy: Drift control \u2014 shouldn't be the same as Quality TODO scanner.\nRule id: fq.todo-marker"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-fa8070f247b95883", "name": "Stray `console.log` in TS/JS \u2014 libraries/ui/src/CTALinkOrButton.stories.tsx:30", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 libraries/ui/src/CTALinkOrButton.stories.tsx:30"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8d932ae06059c145", "name": "`truncate` class without `title=` for hover reveal \u2014 libraries/ui/src/BugReportModal.tsx:51", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 libraries/ui/src/BugReportModal.tsx:51"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-047c6ac3c34bb0aa", "name": "Privileged port 256 in use", "shortDescription": {"text": "Privileged port 256 in use"}, "fullDescription": {"text": "Port 256 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-59b381848161d5ee", "name": "Privileged port 968 in use", "shortDescription": {"text": "Privileged port 968 in use"}, "fullDescription": {"text": "Port 968 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a6feab8c34275240", "name": "Dockerfile runs as root: apps/website-proxy/Dockerfile", "shortDescription": {"text": "Dockerfile runs as root: apps/website-proxy/Dockerfile"}, "fullDescription": {"text": "No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a6d157b8501ba573", "name": "Dockerfile runs as root: apps/posthog-proxy/Dockerfile", "shortDescription": {"text": "Dockerfile runs as root: apps/posthog-proxy/Dockerfile"}, "fullDescription": {"text": "No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7e8a071d3ed1c86f", "name": "Dockerfile runs as root: apps/storybook/Dockerfile", "shortDescription": {"text": "Dockerfile runs as root: apps/storybook/Dockerfile"}, "fullDescription": {"text": "No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4a210ac3b4b59ff4", "name": "Dockerfile runs as root: .devcontainer/Dockerfile", "shortDescription": {"text": "Dockerfile runs as root: .devcontainer/Dockerfile"}, "fullDescription": {"text": "No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0c42c4d8365207fa", "name": "Docker base image is tag-pinned but not digest-pinned: mcr.microsoft.com/devcontainers/javascript-node:22", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: mcr.microsoft.com/devcontainers/javascript-node:22"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-aa5acaa49eb8315b", "name": "Containers defined but no K8s/orchestration manifest found", "shortDescription": {"text": "Containers defined but no K8s/orchestration manifest found"}, "fullDescription": {"text": "Repo has Dockerfiles/compose but no Kubernetes/Nomad manifests. If the target deployment is K8s, the manifests may live in a separate ops repo."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fa08c13eddd084cc", "name": "Runtime dotenv file present in repo: apps/room/.env.test", "shortDescription": {"text": "Runtime dotenv file present in repo: apps/room/.env.test"}, "fullDescription": {"text": "`apps/room/.env.test` looks like a runtime dotenv file. It contains secret-looking assignments for DISPLAY_BEARER_TOKEN, ALERTS_SLACK_BOT_TOKEN. Move real values to a secret manager and keep only `.env.example` style templates in source control."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-c8bb68a442f89d0b", "name": "Runtime dotenv file present in repo: apps/course-demos/.env.test", "shortDescription": {"text": "Runtime dotenv file present in repo: apps/course-demos/.env.test"}, "fullDescription": {"text": "`apps/course-demos/.env.test` looks like a runtime dotenv file. It contains secret-looking assignments for AIRTABLE_PERSONAL_ACCESS_TOKEN, ANTHROPIC_API_KEY, OPENAI_API_KEY, ALERTS_SLACK_BOT_TOKEN. Move real values to a secret manager and keep only `.env.example` style templates in source control."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-1d18162a9a66b672", "name": "Runtime dotenv file present in repo: apps/speed-review/.env.test", "shortDescription": {"text": "Runtime dotenv file present in repo: apps/speed-review/.env.test"}, "fullDescription": {"text": "`apps/speed-review/.env.test` looks like a runtime dotenv file. It contains secret-looking assignments for AIRTABLE_PERSONAL_ACCESS_TOKEN, ALERTS_SLACK_BOT_TOKEN. Move real values to a secret manager and keep only `.env.example` style templates in source control."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-a9cdba81292c9994", "name": "Runtime dotenv file present in repo: apps/website/.env.test", "shortDescription": {"text": "Runtime dotenv file present in repo: apps/website/.env.test"}, "fullDescription": {"text": "`apps/website/.env.test` looks like a runtime dotenv file. It contains secret-looking assignments for AIRTABLE_PERSONAL_ACCESS_TOKEN, ALERTS_SLACK_BOT_TOKEN, KEYCLOAK_CLIENT_SECRET. Move real values to a secret manager and keep only `.env.example` style templates in source control."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-061eefd5d4657010", "name": "Runtime dotenv file present in repo: apps/availability/.env.test", "shortDescription": {"text": "Runtime dotenv file present in repo: apps/availability/.env.test"}, "fullDescription": {"text": "`apps/availability/.env.test` looks like a runtime dotenv file. It contains secret-looking assignments for AIRTABLE_PERSONAL_ACCESS_TOKEN, ALERTS_SLACK_BOT_TOKEN. Move real values to a secret manager and keep only `.env.example` style templates in source control."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-3a3bbf7dc13cc379", "name": "Runtime dotenv file present in repo: apps/editor/.env.test", "shortDescription": {"text": "Runtime dotenv file present in repo: apps/editor/.env.test"}, "fullDescription": {"text": "`apps/editor/.env.test` looks like a runtime dotenv file. It contains secret-looking assignments for AIRTABLE_PERSONAL_ACCESS_TOKEN, ALERTS_SLACK_BOT_TOKEN. Move real values to a secret manager and keep only `.env.example` style templates in source control."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-abfafed97a1135eb", "name": "Runtime dotenv file present in repo: apps/meet/.env.test", "shortDescription": {"text": "Runtime dotenv file present in repo: apps/meet/.env.test"}, "fullDescription": {"text": "`apps/meet/.env.test` looks like a runtime dotenv file. It contains secret-looking assignments for AIRTABLE_PERSONAL_ACCESS_TOKEN, ZOOM_CLIENT_SECRET, ALERTS_SLACK_BOT_TOKEN. Move real values to a secret manager and keep only `.env.example` style templates in source control."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-3d140e1fbad8fb35", "name": "Runtime dotenv file present in repo: apps/pg-sync-service/.env.test", "shortDescription": {"text": "Runtime dotenv file present in repo: apps/pg-sync-service/.env.test"}, "fullDescription": {"text": "`apps/pg-sync-service/.env.test` looks like a runtime dotenv file. It contains secret-looking assignments for AIRTABLE_PERSONAL_ACCESS_TOKEN, ALERTS_SLACK_BOT_TOKEN. Move real values to a secret manager and keep only `.env.example` style templates in source control."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-a255de4954d471bf", "name": "Runtime dotenv file present in repo: libraries/db/.env.test", "shortDescription": {"text": "Runtime dotenv file present in repo: libraries/db/.env.test"}, "fullDescription": {"text": "`libraries/db/.env.test` looks like a runtime dotenv file. It contains secret-looking assignments for AIRTABLE_PERSONAL_ACCESS_TOKEN, ALERTS_SLACK_BOT_TOKEN. Move real values to a secret manager and keep only `.env.example` style templates in source control."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-5d54dc8a688e068f", "name": "Runtime dotenv file present in repo: libraries/computed-airtable-fields/.env.test", "shortDescription": {"text": "Runtime dotenv file present in repo: libraries/computed-airtable-fields/.env.test"}, "fullDescription": {"text": "`libraries/computed-airtable-fields/.env.test` looks like a runtime dotenv file. It contains secret-looking assignments for AIRTABLE_PERSONAL_ACCESS_TOKEN, ALERTS_SLACK_BOT_TOKEN. Move real values to a secret manager and keep only `.env.example` style templates in source control."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-ba8a243cbd443d35", "name": "Insecure pattern 'node_child_process' in apps/website/scripts/render-preview.ts:17", "shortDescription": {"text": "Insecure pattern 'node_child_process' in apps/website/scripts/render-preview.ts:17"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e26867457228b9d7", "name": "Insecure pattern 'node_child_process' in apps/website/scripts/sitemap-generator.ts:2", "shortDescription": {"text": "Insecure pattern 'node_child_process' in apps/website/scripts/sitemap-generator.ts:2"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-bb0b77f735c51759", "name": "Insecure pattern 'dangerous_innerhtml' in apps/website/src/components/lander/CourseLander.tsx:172", "shortDescription": {"text": "Insecure pattern 'dangerous_innerhtml' in apps/website/src/components/lander/CourseLander.tsx:172"}, "fullDescription": {"text": "Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b12905eed2ca06f1", "name": "Insecure pattern 'dangerous_innerhtml' in apps/website/src/components/lander/components/FAQSection.tsx:66", "shortDescription": {"text": "Insecure pattern 'dangerous_innerhtml' in apps/website/src/components/lander/components/FAQSection.tsx:66"}, "fullDescription": {"text": "Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2178ad69ae841e41", "name": "Insecure pattern 'dangerous_innerhtml' in apps/website/src/components/certificate/CertificateCard.tsx:142", "shortDescription": {"text": "Insecure pattern 'dangerous_innerhtml' in apps/website/src/components/certificate/CertificateCard.tsx:142"}, "fullDescription": {"text": "Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ae7ae78f9d049217", "name": "Insecure pattern 'dangerous_innerhtml' in apps/website/src/pages/index.tsx:44", "shortDescription": {"text": "Insecure pattern 'dangerous_innerhtml' in apps/website/src/pages/index.tsx:44"}, "fullDescription": {"text": "Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-24510fdd2f899ed7", "name": "Insecure pattern 'dangerous_innerhtml' in apps/website/src/pages/courses/index.tsx:32", "shortDescription": {"text": "Insecure pattern 'dangerous_innerhtml' in apps/website/src/pages/courses/index.tsx:32"}, "fullDescription": {"text": "Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b000081dea676d8f", "name": "Insecure pattern 'dangerous_innerhtml' in apps/website/src/pages/join-us/[slug].tsx:47", "shortDescription": {"text": "Insecure pattern 'dangerous_innerhtml' in apps/website/src/pages/join-us/[slug].tsx:47"}, "fullDescription": {"text": "Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-372effd58c50feea", "name": "Insecure pattern 'direct_innerhtml_assignment' in apps/website/src/__tests__/pages/index.test.tsx:34", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in apps/website/src/__tests__/pages/index.test.tsx:34"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ad466cbf6cd7c6bb", "name": "Insecure pattern 'direct_innerhtml_assignment' in apps/website/src/__tests__/pages/certification.test.tsx:58", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in apps/website/src/__tests__/pages/certification.test.tsx:58"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-65de51d577ceb0b5", "name": "Insecure pattern 'direct_innerhtml_assignment' in apps/website/src/__tests__/pages/missions/[slug].test.tsx:49", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in apps/website/src/__tests__/pages/missions/[slug].test.tsx:49"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-bc31d89856fd7b9e", "name": "Insecure pattern 'direct_innerhtml_assignment' in apps/website/src/__tests__/pages/courses/[courseSlug]/index.test.tsx:5", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in apps/website/src/__tests__/pages/courses/[courseSlug]/index.test.tsx:52"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6e87b0a89040148d", "name": "Insecure pattern 'direct_innerhtml_assignment' in apps/website/src/__tests__/pages/courses/[courseSlug]/units/[unitNumbe", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in apps/website/src/__tests__/pages/courses/[courseSlug]/units/[unitNumber].test.tsx:238"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b3b773631213d545", "name": "Insecure pattern 'direct_innerhtml_assignment' in apps/website/src/__tests__/pages/join-us/[slug].test.tsx:55", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in apps/website/src/__tests__/pages/join-us/[slug].test.tsx:55"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9779d11358b4ab56", "name": "Insecure pattern 'direct_innerhtml_assignment' in apps/editor/src/components/MarkdownEditor.test.tsx:60", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in apps/editor/src/components/MarkdownEditor.test.tsx:60"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-22d811c7dee585e5", "name": "Insecure pattern 'node_child_process' in libraries/docker-scripts/src/index.js:4", "shortDescription": {"text": "Insecure pattern 'node_child_process' in libraries/docker-scripts/src/index.js:4"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9ea532a6412a6440", "name": "Possible secret in libraries/db/src/lib/mock-airtable-ts.ts", "shortDescription": {"text": "Possible secret in libraries/db/src/lib/mock-airtable-ts.ts"}, "fullDescription": {"text": "Detected pattern matching generic_api_key. Rotate the credential and move to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-4d4154af0dcdc573", "name": "Insecure pattern 'exec_used' in libraries/affected-packages/src/lib/execAsync.ts:4", "shortDescription": {"text": "Insecure pattern 'exec_used' in libraries/affected-packages/src/lib/execAsync.ts:4"}, "fullDescription": {"text": "Found a known-risky pattern (exec_used). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-1a3bac1e65f44250", "name": "Insecure pattern 'node_child_process' in libraries/affected-packages/src/lib/execAsync.ts:1", "shortDescription": {"text": "Insecure pattern 'node_child_process' in libraries/affected-packages/src/lib/execAsync.ts:1"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a34ca2c5c419e418", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/github-script@v8 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a69dafe9590b91f2", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v5 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-bbc1239a630fa1bd", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/github-script@v8 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-de53ac274e5b4ecf", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v5 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-37716d9c0a33ad5c", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-cb639d9a10a47b23", "name": "package.json defines install-time lifecycle scripts", "shortDescription": {"text": "package.json defines install-time lifecycle scripts"}, "fullDescription": {"text": "preinstall/install/postinstall/prepare scripts execute during dependency installation. Review them carefully for network calls, obfuscation, shell execution, or credential access."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a53a369ad26e63db", "name": "Install-time lifecycle script performs network/shell-sensitive actions", "shortDescription": {"text": "Install-time lifecycle script performs network/shell-sensitive actions"}, "fullDescription": {"text": "preinstall/install/postinstall/prepare scripts execute during dependency installation. Review them carefully for network calls, obfuscation, shell execution, or credential access."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-77b3ef38f20f04d3", "name": "Install-time lifecycle script performs network/shell-sensitive actions", "shortDescription": {"text": "Install-time lifecycle script performs network/shell-sensitive actions"}, "fullDescription": {"text": "preinstall/install/postinstall/prepare scripts execute during dependency installation. Review them carefully for network calls, obfuscation, shell execution, or credential access."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-84e621d2007e92c9", "name": "Install-time lifecycle script performs network/shell-sensitive actions", "shortDescription": {"text": "Install-time lifecycle script performs network/shell-sensitive actions"}, "fullDescription": {"text": "preinstall/install/postinstall/prepare scripts execute during dependency installation. Review them carefully for network calls, obfuscation, shell execution, or credential access."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-169644f8405cec82", "name": "Install-time lifecycle script performs network/shell-sensitive actions", "shortDescription": {"text": "Install-time lifecycle script performs network/shell-sensitive actions"}, "fullDescription": {"text": "preinstall/install/postinstall/prepare scripts execute during dependency installation. Review them carefully for network calls, obfuscation, shell execution, or credential access."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a2562333003bc252", "name": "Install-time lifecycle script performs network/shell-sensitive actions", "shortDescription": {"text": "Install-time lifecycle script performs network/shell-sensitive actions"}, "fullDescription": {"text": "preinstall/install/postinstall/prepare scripts execute during dependency installation. Review them carefully for network calls, obfuscation, shell execution, or credential access."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-5d3639181e191e2d", "name": "Install-time lifecycle script performs network/shell-sensitive actions", "shortDescription": {"text": "Install-time lifecycle script performs network/shell-sensitive actions"}, "fullDescription": {"text": "preinstall/install/postinstall/prepare scripts execute during dependency installation. Review them carefully for network calls, obfuscation, shell execution, or credential access."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8b53e4a51389a951", "name": "Install-time lifecycle script performs network/shell-sensitive actions", "shortDescription": {"text": "Install-time lifecycle script performs network/shell-sensitive actions"}, "fullDescription": {"text": "preinstall/install/postinstall/prepare scripts execute during dependency installation. Review them carefully for network calls, obfuscation, shell execution, or credential access."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-69e8f8dc2f7bb006", "name": "package.json defines install-time lifecycle scripts", "shortDescription": {"text": "package.json defines install-time lifecycle scripts"}, "fullDescription": {"text": "preinstall/install/postinstall/prepare scripts execute during dependency installation. Review them carefully for network calls, obfuscation, shell execution, or credential access."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b8b8c9cb660ef5d2", "name": "Install-time lifecycle script performs network/shell-sensitive actions", "shortDescription": {"text": "Install-time lifecycle script performs network/shell-sensitive actions"}, "fullDescription": {"text": "preinstall/install/postinstall/prepare scripts execute during dependency installation. Review them carefully for network calls, obfuscation, shell execution, or credential access."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6c96f9f603250df5", "name": "Install-time lifecycle script performs network/shell-sensitive actions", "shortDescription": {"text": "Install-time lifecycle script performs network/shell-sensitive actions"}, "fullDescription": {"text": "preinstall/install/postinstall/prepare scripts execute during dependency installation. Review them carefully for network calls, obfuscation, shell execution, or credential access."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-948ae22f36d8d262", "name": "Node manifest has dependencies but no lockfile: apps/room/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: apps/room/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-318a599caba3bd74", "name": "Node manifest has dependencies but no lockfile: apps/login/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: apps/login/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b3f35142d60efce5", "name": "Node manifest has dependencies but no lockfile: apps/course-demos/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: apps/course-demos/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3da9ab24d6cf880a", "name": "Node manifest has dependencies but no lockfile: apps/speed-review/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: apps/speed-review/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2a3c3892bcd596b5", "name": "Node manifest has dependencies but no lockfile: apps/website/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: apps/website/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b7928b294f06b77d", "name": "Node manifest has dependencies but no lockfile: apps/availability/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: apps/availability/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ce081cc1b788ffc1", "name": "Node manifest has dependencies but no lockfile: apps/editor/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: apps/editor/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f364bc349f7499be", "name": "Node manifest has dependencies but no lockfile: apps/website-proxy/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: apps/website-proxy/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-bac06ba99cb86b0c", "name": "Node manifest has dependencies but no lockfile: apps/meet/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: apps/meet/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-307edab3520e696a", "name": "Node manifest has dependencies but no lockfile: apps/infra/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: apps/infra/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-17054a93bfba9985", "name": "Node manifest has dependencies but no lockfile: apps/pg-sync-service/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: apps/pg-sync-service/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0b586f3b52556b29", "name": "Node manifest has dependencies but no lockfile: apps/frontend-example/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: apps/frontend-example/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8579a3c5cc92f9f2", "name": "Node manifest has dependencies but no lockfile: apps/posthog-proxy/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: apps/posthog-proxy/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-08199299167de98a", "name": "Node manifest has dependencies but no lockfile: apps/app-template/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: apps/app-template/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e683b13decdf8f3e", "name": "Node manifest has dependencies but no lockfile: apps/storybook/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: apps/storybook/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c1ea8acac2d866eb", "name": "Node manifest has dependencies but no lockfile: libraries/utils/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: libraries/utils/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d5383ab9b784ac5a", "name": "Node manifest has dependencies but no lockfile: libraries/eslint-config/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: libraries/eslint-config/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2c25c05d27512ecc", "name": "Node manifest has dependencies but no lockfile: libraries/db/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: libraries/db/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5459a23c9d40bace", "name": "Node manifest has dependencies but no lockfile: libraries/computed-airtable-fields/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: libraries/computed-airtable-fields/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e53b3cead003c30f", "name": "Node manifest has dependencies but no lockfile: libraries/affected-packages/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: libraries/affected-packages/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-17d528f584f268d5", "name": "Node manifest has dependencies but no lockfile: libraries/ui/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: libraries/ui/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 14 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-72b2a6250083a784", "name": "Placeholder or mock-heavy implementation detected", "shortDescription": {"text": "Placeholder or mock-heavy implementation detected"}, "fullDescription": {"text": "Found 68 placeholder/mock markers across 30 source files. This often means the repo looks complete while core flows still use generated scaffolding or fake data."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-749d4bc1bd66df5f", "name": "Agent instructions exist but release-hardening basics are missing", "shortDescription": {"text": "Agent instructions exist but release-hardening basics are missing"}, "fullDescription": {"text": "AI-coder instruction files were found, but the repo is missing lockfile. Treat this as a contract gap: the agent is guided, but the generated output is not yet guarded by the controls that make it repeatable."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6fdfe5c037f9d894", "name": "Commented-code block (8 lines) in apps/room/public/display/setup/tampermonkey/google-meet-handsfree.user.js:2", "shortDescription": {"text": "Commented-code block (8 lines) in apps/room/public/display/setup/tampermonkey/google-meet-handsfree.user.js:2"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-fdd8b001e9415209", "name": "Commented-code block (9 lines) in apps/room/public/display/setup/tampermonkey/bluedot-room-bridge.user.js:2", "shortDescription": {"text": "Commented-code block (9 lines) in apps/room/public/display/setup/tampermonkey/bluedot-room-bridge.user.js:2"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-ddb541992cef002f", "name": "`fetch()` without try/.catch or AbortSignal \u2014 apps/room/public/display/setup/tampermonkey/bluedot-room-bridge.user.js:24", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 apps/room/public/display/setup/tampermonkey/bluedot-room-bridge.user.js:24"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-060e1e10815efa82", "name": "`fetch()` without try/.catch or AbortSignal \u2014 apps/course-demos/src/components/ShareSavedDemoButton.tsx:27", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 apps/course-demos/src/components/ShareSavedDemoButton.tsx:27"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-90f4b4bb531ee954", "name": "`fetch()` without try/.catch or AbortSignal \u2014 apps/speed-review/src/lib/api/airtable.ts:334", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 apps/speed-review/src/lib/api/airtable.ts:334"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d87a9a678b03388d", "name": "`fetch()` without try/.catch or AbortSignal \u2014 apps/speed-review/src/lib/client/api.ts:25", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 apps/speed-review/src/lib/client/api.ts:25"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c5b29631d55ce508", "name": "`fetch()` without try/.catch or AbortSignal \u2014 apps/website/scripts/render-preview.ts:55", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 apps/website/scripts/render-preview.ts:55"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4d8b3d41f46200ce", "name": "`fetch()` without try/.catch or AbortSignal \u2014 apps/website/src/server/airtableFieldOptions.ts:27", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 apps/website/src/server/airtableFieldOptions.ts:27"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-27467c0ed6f7a800", "name": "`fetch()` without try/.catch or AbortSignal \u2014 apps/website/src/server/routers/subscription-preferences.ts:33", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 apps/website/src/server/routers/subscription-preferences.ts:33"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4eed145d93d36eaa", "name": "Commented-code block (5 lines) in apps/website/src/server/routers/course-registrations.test.ts:150", "shortDescription": {"text": "Commented-code block (5 lines) in apps/website/src/server/routers/course-registrations.test.ts:150"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-0b54f62aa7fcb783", "name": "`fetch()` without try/.catch or AbortSignal \u2014 apps/website/src/server/routers/luma.ts:178", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 apps/website/src/server/routers/luma.ts:178"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f99d8a93405f1304", "name": "Commented-code block (7 lines) in apps/website/src/server/routers/grants.ts:71", "shortDescription": {"text": "Commented-code block (7 lines) in apps/website/src/server/routers/grants.ts:71"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-980ba9ab9e418094", "name": "Commented-code block (5 lines) in apps/website/src/server/routers/certificates.test.ts:55", "shortDescription": {"text": "Commented-code block (5 lines) in apps/website/src/server/routers/certificates.test.ts:55"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-978176d2ea520e2e", "name": "Commented-code block (5 lines) in apps/website/src/components/admin/ImpersonationBadge.tsx:20", "shortDescription": {"text": "Commented-code block (5 lines) in apps/website/src/components/admin/ImpersonationBadge.tsx:20"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-cb75ba0a6c7b49c8", "name": "Legacy-named symbol `culture_dewi_v1` in apps/website/src/components/join-us/CultureSection.tsx:14", "shortDescription": {"text": "Legacy-named symbol `culture_dewi_v1` in apps/website/src/components/join-us/CultureSection.tsx:14"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-94c6dedbbe678df0", "name": "Commented-code block (5 lines) in apps/website/src/pages/login/clear.tsx:22", "shortDescription": {"text": "Commented-code block (5 lines) in apps/website/src/pages/login/clear.tsx:22"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-54f4911afce6bec7", "name": "`fetch()` without try/.catch or AbortSignal \u2014 apps/website/src/lib/downloadCalendarFile.ts:13", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 apps/website/src/lib/downloadCalendarFile.ts:13"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b7ac0889064d8dcb", "name": "Commented-code block (5 lines) in apps/infra/src/k8s/serviceDefinitions.ts:388", "shortDescription": {"text": "Commented-code block (5 lines) in apps/infra/src/k8s/serviceDefinitions.ts:388"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-001aba78c402febb", "name": "Commented-code block (16 lines) in apps/infra/src/k8s/observability.ts:16", "shortDescription": {"text": "Commented-code block (16 lines) in apps/infra/src/k8s/observability.ts:16"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-36625245c2e5a2e0", "name": "Commented-code block (7 lines) in apps/infra/src/vultr/vke.ts:9", "shortDescription": {"text": "Commented-code block (7 lines) in apps/infra/src/vultr/vke.ts:9"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-cabe1fdff261743c", "name": "Commented-code block (9 lines) in apps/pg-sync-service/src/routesPlugin.ts:18", "shortDescription": {"text": "Commented-code block (9 lines) in apps/pg-sync-service/src/routesPlugin.ts:18"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-45f220ee5765fd43", "name": "Commented-code block (7 lines) in apps/pg-sync-service/src/lib/schema-sync.test.ts:125", "shortDescription": {"text": "Commented-code block (7 lines) in apps/pg-sync-service/src/lib/schema-sync.test.ts:125"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-85eecb2095cc9f70", "name": "Commented-code block (6 lines) in apps/frontend-example/src/pages/authed.tsx:10", "shortDescription": {"text": "Commented-code block (6 lines) in apps/frontend-example/src/pages/authed.tsx:10"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-886c0a8103a9a5cd", "name": "`fetch()` without try/.catch or AbortSignal \u2014 apps/storybook/public/mockServiceWorker.js:237", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 apps/storybook/public/mockServiceWorker.js:237"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8435f56bd65e9e1f", "name": "`fetch()` without try/.catch or AbortSignal \u2014 libraries/utils/src/slackNotifications.ts:244", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 libraries/utils/src/slackNotifications.ts:244"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-fe03d18177a523b1", "name": "Commented-code block (5 lines) in libraries/affected-packages/src/lib/getPackagesWithChanges.ts:10", "shortDescription": {"text": "Commented-code block (5 lines) in libraries/affected-packages/src/lib/getPackagesWithChanges.ts:10"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-896ce168dfb6a209", "name": "Commented-code block (5 lines) in libraries/ui/src/Collapsible.test.tsx:28", "shortDescription": {"text": "Commented-code block (5 lines) in libraries/ui/src/Collapsible.test.tsx:28"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/24641"}, "properties": {"repository": "bluedotimpact/bluedot", "repoUrl": "https://github.com/bluedotimpact/bluedot", "branch": "main"}, "results": [{"ruleId": "scanner-bead75b0f9233e05", "level": "none", "message": {"text": "No API endpoints detected"}, "properties": {"repobilityId": "0f8bb852027c38f8", "scanner": "scanner-primary", "fingerprint": "bead75b0f9233e05", "layer": "api", "severity": "info", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-15e02180fd581249", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 apps/room/public/display/setup/tampermonkey/google-meet-handsfree.user.js:27"}, "properties": {"repobilityId": "8389b0d66ed7fcbb", "scanner": "scanner-primary", "fingerprint": "15e02180fd581249", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-f48b55a508c19788", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 apps/speed-review/src/components/SessionComplete.tsx:121"}, "properties": {"repobilityId": "7b1b333208415299", "scanner": "scanner-primary", "fingerprint": "f48b55a508c19788", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-049abb588eec03bf", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 apps/website/scripts/render-preview.ts:23"}, "properties": {"repobilityId": "60d9d00968ad670c", "scanner": "scanner-primary", "fingerprint": "049abb588eec03bf", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-ca65617af1ad27de", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 apps/website/scripts/sitemap-generator.ts:82"}, "properties": {"repobilityId": "6d1d1d22faa51c85", "scanner": "scanner-primary", "fingerprint": "ca65617af1ad27de", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-658b9fc55d930f19", "level": "none", "message": {"text": "TODO/FIXME marker in shipping code \u2014 apps/website/src/server/routers/testimonials.ts:28"}, "properties": {"repobilityId": "754b87764805bcbb", "scanner": "scanner-primary", "fingerprint": "658b9fc55d930f19", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.todo-marker"]}}, {"ruleId": "scanner-6cfa1ff24d2bb51d", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 apps/website/src/components/admin/ImpersonationBadge.tsx:104"}, "properties": {"repobilityId": "fd975f98e5acf5de", "scanner": "scanner-primary", "fingerprint": "6cfa1ff24d2bb51d", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-c99fbda3da928296", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 apps/website/src/components/admin/UserSearchModal.tsx:78"}, "properties": {"repobilityId": "40d3aa8795eeebbb", "scanner": "scanner-primary", "fingerprint": "c99fbda3da928296", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-a3f52831e4f5cccc", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 apps/website/src/components/alumni/RecentAlumniList.tsx:69"}, "properties": {"repobilityId": "5a2417de4b118e04", "scanner": "scanner-primary", "fingerprint": "a3f52831e4f5cccc", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-97d0efe04ce23850", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 apps/website/src/components/courses/GroupDiscussionBanner.tsx:234"}, "properties": {"repobilityId": "09515ac7066fcbdc", "scanner": "scanner-primary", "fingerprint": "97d0efe04ce23850", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-6b61eebbff5852e8", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 apps/website/src/components/courses/FacilitatorFeedbackHeader.tsx:14"}, "properties": {"repobilityId": "f7484f3a98a5d1a6", "scanner": "scanner-primary", "fingerprint": "6b61eebbff5852e8", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-0a7954c7f68417b8", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 apps/website/src/components/courses/CourseShell.tsx:58"}, "properties": {"repobilityId": "9f09c0dc5d1514fc", "scanner": "scanner-primary", "fingerprint": "0a7954c7f68417b8", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-1210804a87fed7da", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 apps/website/src/components/courses/ParticipantRow.tsx:15"}, "properties": {"repobilityId": "2d628e84a0df4f94", "scanner": "scanner-primary", "fingerprint": "1210804a87fed7da", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-cafdd13cbf00f402", "level": "none", "message": {"text": "TODO/FIXME marker in shipping code \u2014 apps/website/src/components/courses/exercises/GroupResponses.tsx:5"}, "properties": {"repobilityId": "f884d04017557d9e", "scanner": "scanner-primary", "fingerprint": "cafdd13cbf00f402", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.todo-marker"]}}, {"ruleId": "scanner-3412657425534e76", "level": "warning", "message": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 apps/website/src/components/lander/CourseLander.tsx:172"}, "properties": {"repobilityId": "cfa23ef8c589d40f", "scanner": "scanner-primary", "fingerprint": "3412657425534e76", "layer": "frontend", "severity": "medium", "confidence": 1.0, "tags": ["frontend-quality", "fq.dangerous-html"]}}, {"ruleId": "scanner-ef79de5a98e9ce99", "level": "warning", "message": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 apps/website/src/components/lander/components/FAQSection.tsx:66"}, "properties": {"repobilityId": "9ce8723acbf3116c", "scanner": "scanner-primary", "fingerprint": "ef79de5a98e9ce99", "layer": "frontend", "severity": "medium", "confidence": 1.0, "tags": ["frontend-quality", "fq.dangerous-html"]}}, {"ruleId": "scanner-b684f22fb544bc3d", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 apps/website/src/components/lander/components/AlumniStoryCarousel.tsx:317"}, "properties": {"repobilityId": "d6937902512fe037", "scanner": "scanner-primary", "fingerprint": "b684f22fb544bc3d", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-080ad6fe03e93076", "level": "none", "message": {"text": "TODO/FIXME marker in shipping code \u2014 apps/website/src/components/analytics/consent.ts:21"}, "properties": {"repobilityId": "462de3855c5dc04f", "scanner": "scanner-primary", "fingerprint": "080ad6fe03e93076", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.todo-marker"]}}, {"ruleId": "scanner-7e0605c39e36c448", "level": "warning", "message": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 apps/website/src/components/certificate/CertificateCard.tsx:142"}, "properties": {"repobilityId": "265590f7380a7e51", "scanner": "scanner-primary", "fingerprint": "7e0605c39e36c448", "layer": "frontend", "severity": "medium", "confidence": 1.0, "tags": ["frontend-quality", "fq.dangerous-html"]}}, {"ruleId": "scanner-061bd9fe9438a604", "level": "warning", "message": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 apps/website/src/pages/index.tsx:44"}, "properties": {"repobilityId": "70254d98de6aec64", "scanner": "scanner-primary", "fingerprint": "061bd9fe9438a604", "layer": "frontend", "severity": "medium", "confidence": 1.0, "tags": ["frontend-quality", "fq.dangerous-html"]}}, {"ruleId": "scanner-ea8b9b2e91e2c281", "level": "warning", "message": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 apps/website/src/pages/courses/index.tsx:32"}, "properties": {"repobilityId": "3ca8c046c1476d6e", "scanner": "scanner-primary", "fingerprint": "ea8b9b2e91e2c281", "layer": "frontend", "severity": "medium", "confidence": 1.0, "tags": ["frontend-quality", "fq.dangerous-html"]}}, {"ruleId": "scanner-dd213e9f3d2daa88", "level": "warning", "message": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 apps/website/src/pages/join-us/[slug].tsx:47"}, "properties": {"repobilityId": "47b2bde0218ab410", "scanner": "scanner-primary", "fingerprint": "dd213e9f3d2daa88", "layer": "frontend", "severity": "medium", "confidence": 1.0, "tags": ["frontend-quality", "fq.dangerous-html"]}}, {"ruleId": "scanner-1ebbbd754a272361", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 apps/website/src/pages/facilitator-applications/quick-apply/index.tsx:134"}, "properties": {"repobilityId": "c1dafc3865d1e85d", "scanner": "scanner-primary", "fingerprint": "1ebbbd754a272361", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-85660a373d52ea93", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 apps/editor/src/components/MarkdownEditor.stories.tsx:43"}, "properties": {"repobilityId": "6a9013d1de4cc389", "scanner": "scanner-primary", "fingerprint": "85660a373d52ea93", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-dcfda95c1e07b374", "level": "none", "message": {"text": "TODO/FIXME marker in shipping code \u2014 apps/meet/src/pages/index.tsx:14"}, "properties": {"repobilityId": "739e6ac754252c0f", "scanner": "scanner-primary", "fingerprint": "dcfda95c1e07b374", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.todo-marker"]}}, {"ruleId": "scanner-9af62f396feaf114", "level": "none", "message": {"text": "TODO/FIXME marker in shipping code \u2014 apps/infra/src/k8s/serviceDefinitions.ts:392"}, "properties": {"repobilityId": "b8c45e0f36da6df1", "scanner": "scanner-primary", "fingerprint": "9af62f396feaf114", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.todo-marker"]}}, {"ruleId": "scanner-8e8dce23351900bc", "level": "none", "message": {"text": "TODO/FIXME marker in shipping code \u2014 apps/pg-sync-service/src/routesPlugin.ts:18"}, "properties": {"repobilityId": "621ddc6acdf93e4b", "scanner": "scanner-primary", "fingerprint": "8e8dce23351900bc", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.todo-marker"]}}, {"ruleId": "scanner-60ec9f94139e984c", "level": "none", "message": {"text": "TODO/FIXME marker in shipping code \u2014 apps/pg-sync-service/src/lib/errorHandlerPlugin.ts:46"}, "properties": {"repobilityId": "f5c15b6683a641bf", "scanner": "scanner-primary", "fingerprint": "60ec9f94139e984c", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.todo-marker"]}}, {"ruleId": "scanner-4b6f2a4016dbdb8f", "level": "none", "message": {"text": "TODO/FIXME marker in shipping code \u2014 libraries/db/src/index.ts:114"}, "properties": {"repobilityId": "f9e37cc59bbe3a6b", "scanner": "scanner-primary", "fingerprint": "4b6f2a4016dbdb8f", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.todo-marker"]}}, {"ruleId": "scanner-84edcfafca9ae284", "level": "none", "message": {"text": "TODO/FIXME marker in shipping code \u2014 libraries/db/src/lib/typeUtils.ts:8"}, "properties": {"repobilityId": "7b1fbe0b0fc84c64", "scanner": "scanner-primary", "fingerprint": "84edcfafca9ae284", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.todo-marker"]}}, {"ruleId": "scanner-90d03c241236a504", "level": "none", "message": {"text": "TODO/FIXME marker in shipping code \u2014 libraries/db/src/lib/db-core.ts:102"}, "properties": {"repobilityId": "4a8bbec266a211a4", "scanner": "scanner-primary", "fingerprint": "90d03c241236a504", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.todo-marker"]}}, {"ruleId": "scanner-870323b2060ffc78", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 libraries/affected-packages/src/deploy-array.ts:11"}, "properties": {"repobilityId": "23abc65cc0df4628", "scanner": "scanner-primary", "fingerprint": "870323b2060ffc78", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-c9424fab34139c20", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 libraries/affected-packages/src/turbo-filter.ts:11"}, "properties": {"repobilityId": "533307605e736ae0", "scanner": "scanner-primary", "fingerprint": "c9424fab34139c20", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-ac55d2328ce7840e", "level": "none", "message": {"text": "TODO/FIXME marker in shipping code \u2014 libraries/ui/src/FaceTiles.tsx:20"}, "properties": {"repobilityId": "0d04ec39fb9c1239", "scanner": "scanner-primary", "fingerprint": "ac55d2328ce7840e", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.todo-marker"]}}, {"ruleId": "scanner-fa8070f247b95883", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 libraries/ui/src/CTALinkOrButton.stories.tsx:30"}, "properties": {"repobilityId": "e3661697a3733d50", "scanner": "scanner-primary", "fingerprint": "fa8070f247b95883", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-8d932ae06059c145", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 libraries/ui/src/BugReportModal.tsx:51"}, "properties": {"repobilityId": "aa1a8bc8cde4a707", "scanner": "scanner-primary", "fingerprint": "8d932ae06059c145", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-047c6ac3c34bb0aa", "level": "warning", "message": {"text": "Privileged port 256 in use"}, "properties": {"repobilityId": "0ec1f2d0c9e6da94", "scanner": "scanner-primary", "fingerprint": "047c6ac3c34bb0aa", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/room/Dockerfile"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-59b381848161d5ee", "level": "warning", "message": {"text": "Privileged port 968 in use"}, "properties": {"repobilityId": "8fa96f57ca0160bb", "scanner": "scanner-primary", "fingerprint": "59b381848161d5ee", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/room/Dockerfile"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a6feab8c34275240", "level": "warning", "message": {"text": "Dockerfile runs as root: apps/website-proxy/Dockerfile"}, "properties": {"repobilityId": "ae2e1f456325770f", "scanner": "scanner-primary", "fingerprint": "a6feab8c34275240", "layer": "hardware", "severity": "medium", "confidence": 1.0, "tags": ["security", "container"]}}, {"ruleId": "scanner-a6d157b8501ba573", "level": "warning", "message": {"text": "Dockerfile runs as root: apps/posthog-proxy/Dockerfile"}, "properties": {"repobilityId": "b75d04c787928860", "scanner": "scanner-primary", "fingerprint": "a6d157b8501ba573", "layer": "hardware", "severity": "medium", "confidence": 1.0, "tags": ["security", "container"]}}, {"ruleId": "scanner-7e8a071d3ed1c86f", "level": "warning", "message": {"text": "Dockerfile runs as root: apps/storybook/Dockerfile"}, "properties": {"repobilityId": "bdc11173ce38220b", "scanner": "scanner-primary", "fingerprint": "7e8a071d3ed1c86f", "layer": "hardware", "severity": "medium", "confidence": 1.0, "tags": ["security", "container"]}}, {"ruleId": "scanner-4a210ac3b4b59ff4", "level": "warning", "message": {"text": "Dockerfile runs as root: .devcontainer/Dockerfile"}, "properties": {"repobilityId": "7855b1f55d0800cf", "scanner": "scanner-primary", "fingerprint": "4a210ac3b4b59ff4", "layer": "hardware", "severity": "medium", "confidence": 1.0, "tags": ["security", "container"]}}, {"ruleId": "scanner-0c42c4d8365207fa", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: mcr.microsoft.com/devcontainers/javascript-node:22"}, "properties": {"repobilityId": "3097e1ae02ae4f42", "scanner": "scanner-primary", "fingerprint": "0c42c4d8365207fa", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".devcontainer/Dockerfile"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-aa5acaa49eb8315b", "level": "note", "message": {"text": "Containers defined but no K8s/orchestration manifest found"}, "properties": {"repobilityId": "b230ea9b68736081", "scanner": "scanner-primary", "fingerprint": "aa5acaa49eb8315b", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["coverage", "deployment"]}}, {"ruleId": "scanner-fa08c13eddd084cc", "level": "error", "message": {"text": "Runtime dotenv file present in repo: apps/room/.env.test"}, "properties": {"repobilityId": "23ebbe845d220aba", "scanner": "scanner-primary", "fingerprint": "fa08c13eddd084cc", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets", "config", "env-file", "runtime-env", "env_file_with_secret"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/room/.env.test"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c8bb68a442f89d0b", "level": "error", "message": {"text": "Runtime dotenv file present in repo: apps/course-demos/.env.test"}, "properties": {"repobilityId": "812ff9470699e224", "scanner": "scanner-primary", "fingerprint": "c8bb68a442f89d0b", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets", "config", "env-file", "runtime-env", "env_file_with_secret"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/course-demos/.env.test"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-1d18162a9a66b672", "level": "error", "message": {"text": "Runtime dotenv file present in repo: apps/speed-review/.env.test"}, "properties": {"repobilityId": "59cee822ab1fedaf", "scanner": "scanner-primary", "fingerprint": "1d18162a9a66b672", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets", "config", "env-file", "runtime-env", "env_file_with_secret"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/speed-review/.env.test"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a9cdba81292c9994", "level": "error", "message": {"text": "Runtime dotenv file present in repo: apps/website/.env.test"}, "properties": {"repobilityId": "e06d90a14e3d6c34", "scanner": "scanner-primary", "fingerprint": "a9cdba81292c9994", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets", "config", "env-file", "runtime-env", "env_file_with_secret"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/website/.env.test"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-061eefd5d4657010", "level": "error", "message": {"text": "Runtime dotenv file present in repo: apps/availability/.env.test"}, "properties": {"repobilityId": "b8fe7b2032cfdf94", "scanner": "scanner-primary", "fingerprint": "061eefd5d4657010", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets", "config", "env-file", "runtime-env", "env_file_with_secret"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/availability/.env.test"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3a3bbf7dc13cc379", "level": "error", "message": {"text": "Runtime dotenv file present in repo: apps/editor/.env.test"}, "properties": {"repobilityId": "67c6b780a0e12950", "scanner": "scanner-primary", "fingerprint": "3a3bbf7dc13cc379", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets", "config", "env-file", "runtime-env", "env_file_with_secret"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/editor/.env.test"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-abfafed97a1135eb", "level": "error", "message": {"text": "Runtime dotenv file present in repo: apps/meet/.env.test"}, "properties": {"repobilityId": "6aaf59e73b45a8b1", "scanner": "scanner-primary", "fingerprint": "abfafed97a1135eb", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets", "config", "env-file", "runtime-env", "env_file_with_secret"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/meet/.env.test"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3d140e1fbad8fb35", "level": "error", "message": {"text": "Runtime dotenv file present in repo: apps/pg-sync-service/.env.test"}, "properties": {"repobilityId": "2a428dcc513213b9", "scanner": "scanner-primary", "fingerprint": "3d140e1fbad8fb35", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets", "config", "env-file", "runtime-env", "env_file_with_secret"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/pg-sync-service/.env.test"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a255de4954d471bf", "level": "error", "message": {"text": "Runtime dotenv file present in repo: libraries/db/.env.test"}, "properties": {"repobilityId": "7aa06199bdf6c484", "scanner": "scanner-primary", "fingerprint": "a255de4954d471bf", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets", "config", "env-file", "runtime-env", "env_file_with_secret"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "libraries/db/.env.test"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-5d54dc8a688e068f", "level": "error", "message": {"text": "Runtime dotenv file present in repo: libraries/computed-airtable-fields/.env.test"}, "properties": {"repobilityId": "4ec4b991170f0e99", "scanner": "scanner-primary", "fingerprint": "5d54dc8a688e068f", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets", "config", "env-file", "runtime-env", "env_file_with_secret"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "libraries/computed-airtable-fields/.env.test"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ba8a243cbd443d35", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in apps/website/scripts/render-preview.ts:17"}, "properties": {"repobilityId": "7a867abcafd074b0", "scanner": "scanner-primary", "fingerprint": "ba8a243cbd443d35", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/website/scripts/render-preview.ts"}, "region": {"startLine": 17}}}]}, {"ruleId": "scanner-e26867457228b9d7", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in apps/website/scripts/sitemap-generator.ts:2"}, "properties": {"repobilityId": "dfbf98ff1307764d", "scanner": "scanner-primary", "fingerprint": "e26867457228b9d7", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/website/scripts/sitemap-generator.ts"}, "region": {"startLine": 2}}}]}, {"ruleId": "scanner-bb0b77f735c51759", "level": "warning", "message": {"text": "Insecure pattern 'dangerous_innerhtml' in apps/website/src/components/lander/CourseLander.tsx:172"}, "properties": {"repobilityId": "3ad18c6cc065e9a1", "scanner": "scanner-primary", "fingerprint": "bb0b77f735c51759", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "dangerous_innerhtml"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/website/src/components/lander/CourseLander.tsx"}, "region": {"startLine": 172}}}]}, {"ruleId": "scanner-b12905eed2ca06f1", "level": "warning", "message": {"text": "Insecure pattern 'dangerous_innerhtml' in apps/website/src/components/lander/components/FAQSection.tsx:66"}, "properties": {"repobilityId": "2f6a720339b7213c", "scanner": "scanner-primary", "fingerprint": "b12905eed2ca06f1", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "dangerous_innerhtml"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/website/src/components/lander/components/FAQSection.tsx"}, "region": {"startLine": 66}}}]}, {"ruleId": "scanner-2178ad69ae841e41", "level": "warning", "message": {"text": "Insecure pattern 'dangerous_innerhtml' in apps/website/src/components/certificate/CertificateCard.tsx:142"}, "properties": {"repobilityId": "ea8e2395ff69a4c3", "scanner": "scanner-primary", "fingerprint": "2178ad69ae841e41", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "dangerous_innerhtml"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/website/src/components/certificate/CertificateCard.tsx"}, "region": {"startLine": 142}}}]}, {"ruleId": "scanner-ae7ae78f9d049217", "level": "warning", "message": {"text": "Insecure pattern 'dangerous_innerhtml' in apps/website/src/pages/index.tsx:44"}, "properties": {"repobilityId": "6ee361f41521954d", "scanner": "scanner-primary", "fingerprint": "ae7ae78f9d049217", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "dangerous_innerhtml"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/website/src/pages/index.tsx"}, "region": {"startLine": 44}}}]}, {"ruleId": "scanner-24510fdd2f899ed7", "level": "warning", "message": {"text": "Insecure pattern 'dangerous_innerhtml' in apps/website/src/pages/courses/index.tsx:32"}, "properties": {"repobilityId": "9056089b640288bf", "scanner": "scanner-primary", "fingerprint": "24510fdd2f899ed7", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "dangerous_innerhtml"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/website/src/pages/courses/index.tsx"}, "region": {"startLine": 32}}}]}, {"ruleId": "scanner-b000081dea676d8f", "level": "warning", "message": {"text": "Insecure pattern 'dangerous_innerhtml' in apps/website/src/pages/join-us/[slug].tsx:47"}, "properties": {"repobilityId": "3ea053bfecdbb944", "scanner": "scanner-primary", "fingerprint": "b000081dea676d8f", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "dangerous_innerhtml"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/website/src/pages/join-us/[slug].tsx"}, "region": {"startLine": 47}}}]}, {"ruleId": "scanner-372effd58c50feea", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in apps/website/src/__tests__/pages/index.test.tsx:34"}, "properties": {"repobilityId": "ffef6636a3566c41", "scanner": "scanner-primary", "fingerprint": "372effd58c50feea", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/website/src/__tests__/pages/index.test.tsx"}, "region": {"startLine": 34}}}]}, {"ruleId": "scanner-ad466cbf6cd7c6bb", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in apps/website/src/__tests__/pages/certification.test.tsx:58"}, "properties": {"repobilityId": "e45ad090c20ff12a", "scanner": "scanner-primary", "fingerprint": "ad466cbf6cd7c6bb", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/website/src/__tests__/pages/certification.test.tsx"}, "region": {"startLine": 58}}}]}, {"ruleId": "scanner-65de51d577ceb0b5", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in apps/website/src/__tests__/pages/missions/[slug].test.tsx:49"}, "properties": {"repobilityId": "29af5799e22ae534", "scanner": "scanner-primary", "fingerprint": "65de51d577ceb0b5", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/website/src/__tests__/pages/missions/[slug].test.tsx"}, "region": {"startLine": 49}}}]}, {"ruleId": "scanner-bc31d89856fd7b9e", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in apps/website/src/__tests__/pages/courses/[courseSlug]/index.test.tsx:52"}, "properties": {"repobilityId": "66f6347e6e47263d", "scanner": "scanner-primary", "fingerprint": "bc31d89856fd7b9e", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/website/src/__tests__/pages/courses/[courseSlug]/index.test.tsx"}, "region": {"startLine": 52}}}]}, {"ruleId": "scanner-6e87b0a89040148d", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in apps/website/src/__tests__/pages/courses/[courseSlug]/units/[unitNumber].test.tsx:238"}, "properties": {"repobilityId": "f06586e376800bf5", "scanner": "scanner-primary", "fingerprint": "6e87b0a89040148d", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/website/src/__tests__/pages/courses/[courseSlug]/units/[unitNumber].test.tsx"}, "region": {"startLine": 238}}}]}, {"ruleId": "scanner-b3b773631213d545", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in apps/website/src/__tests__/pages/join-us/[slug].test.tsx:55"}, "properties": {"repobilityId": "ead1d1ddabc24b37", "scanner": "scanner-primary", "fingerprint": "b3b773631213d545", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/website/src/__tests__/pages/join-us/[slug].test.tsx"}, "region": {"startLine": 55}}}]}, {"ruleId": "scanner-9779d11358b4ab56", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in apps/editor/src/components/MarkdownEditor.test.tsx:60"}, "properties": {"repobilityId": "dd498152cf0be7b7", "scanner": "scanner-primary", "fingerprint": "9779d11358b4ab56", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/editor/src/components/MarkdownEditor.test.tsx"}, "region": {"startLine": 60}}}]}, {"ruleId": "scanner-22d811c7dee585e5", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in libraries/docker-scripts/src/index.js:4"}, "properties": {"repobilityId": "e06df2d94d7808d3", "scanner": "scanner-primary", "fingerprint": "22d811c7dee585e5", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "libraries/docker-scripts/src/index.js"}, "region": {"startLine": 4}}}]}, {"ruleId": "scanner-9ea532a6412a6440", "level": "error", "message": {"text": "Possible secret in libraries/db/src/lib/mock-airtable-ts.ts"}, "properties": {"repobilityId": "58625a916105a0f1", "scanner": "scanner-primary", "fingerprint": "9ea532a6412a6440", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "libraries/db/src/lib/mock-airtable-ts.ts"}, "region": {"startLine": 28}}}]}, {"ruleId": "scanner-4d4154af0dcdc573", "level": "error", "message": {"text": "Insecure pattern 'exec_used' in libraries/affected-packages/src/lib/execAsync.ts:4"}, "properties": {"repobilityId": "326eb0536bdc7394", "scanner": "scanner-primary", "fingerprint": "4d4154af0dcdc573", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "exec_used"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "libraries/affected-packages/src/lib/execAsync.ts"}, "region": {"startLine": 4}}}]}, {"ruleId": "scanner-1a3bac1e65f44250", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in libraries/affected-packages/src/lib/execAsync.ts:1"}, "properties": {"repobilityId": "3a7abde12480cc00", "scanner": "scanner-primary", "fingerprint": "1a3bac1e65f44250", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "libraries/affected-packages/src/lib/execAsync.ts"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a34ca2c5c419e418", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "24c8503be8b62871", "scanner": "scanner-primary", "fingerprint": "a34ca2c5c419e418", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/website_deploy_production.yaml"}, "region": {"startLine": 21}}}]}, {"ruleId": "scanner-a34ca2c5c419e418", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "2652fbc3759d1ddf", "scanner": "scanner-primary", "fingerprint": "a34ca2c5c419e418", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/website_deploy_production.yaml"}, "region": {"startLine": 82}}}]}, {"ruleId": "scanner-a34ca2c5c419e418", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "09aa71c3c94c503b", "scanner": "scanner-primary", "fingerprint": "a34ca2c5c419e418", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/website_deploy_production.yaml"}, "region": {"startLine": 86}}}]}, {"ruleId": "scanner-a34ca2c5c419e418", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "e9cfbbfa0ae0d2e2", "scanner": "scanner-primary", "fingerprint": "a34ca2c5c419e418", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/website_deploy_production.yaml"}, "region": {"startLine": 94}}}]}, {"ruleId": "scanner-a34ca2c5c419e418", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "e9cfbbfa0ae0d2e2", "scanner": "scanner-primary", "fingerprint": "a34ca2c5c419e418", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/website_deploy_production.yaml"}, "region": {"startLine": 111}}}]}, {"ruleId": "scanner-a34ca2c5c419e418", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "e9cfbbfa0ae0d2e2", "scanner": "scanner-primary", "fingerprint": "a34ca2c5c419e418", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/website_deploy_production.yaml"}, "region": {"startLine": 119}}}]}, {"ruleId": "scanner-a69dafe9590b91f2", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "e6e93096d26cc55d", "scanner": "scanner-primary", "fingerprint": "a69dafe9590b91f2", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci_cd.yaml"}, "region": {"startLine": 23}}}]}, {"ruleId": "scanner-a69dafe9590b91f2", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "e2080f93d7715ebc", "scanner": "scanner-primary", "fingerprint": "a69dafe9590b91f2", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci_cd.yaml"}, "region": {"startLine": 29}}}]}, {"ruleId": "scanner-a69dafe9590b91f2", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "13e9377bd4379083", "scanner": "scanner-primary", "fingerprint": "a69dafe9590b91f2", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci_cd.yaml"}, "region": {"startLine": 37}}}]}, {"ruleId": "scanner-a69dafe9590b91f2", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "e6e93096d26cc55d", "scanner": "scanner-primary", "fingerprint": "a69dafe9590b91f2", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci_cd.yaml"}, "region": {"startLine": 75}}}]}, {"ruleId": "scanner-a69dafe9590b91f2", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "e2080f93d7715ebc", "scanner": "scanner-primary", "fingerprint": "a69dafe9590b91f2", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci_cd.yaml"}, "region": {"startLine": 78}}}]}, {"ruleId": "scanner-a69dafe9590b91f2", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "1af56353a348c97f", "scanner": "scanner-primary", "fingerprint": "a69dafe9590b91f2", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci_cd.yaml"}, "region": {"startLine": 86}}}]}, {"ruleId": "scanner-a69dafe9590b91f2", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "13e9377bd4379083", "scanner": "scanner-primary", "fingerprint": "a69dafe9590b91f2", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci_cd.yaml"}, "region": {"startLine": 99}}}]}, {"ruleId": "scanner-a69dafe9590b91f2", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "e6e93096d26cc55d", "scanner": "scanner-primary", "fingerprint": "a69dafe9590b91f2", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci_cd.yaml"}, "region": {"startLine": 115}}}]}, {"ruleId": "scanner-a69dafe9590b91f2", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "e2080f93d7715ebc", "scanner": "scanner-primary", "fingerprint": "a69dafe9590b91f2", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci_cd.yaml"}, "region": {"startLine": 118}}}]}, {"ruleId": "scanner-a69dafe9590b91f2", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "1af56353a348c97f", "scanner": "scanner-primary", "fingerprint": "a69dafe9590b91f2", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci_cd.yaml"}, "region": {"startLine": 126}}}]}, {"ruleId": "scanner-a69dafe9590b91f2", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "13e9377bd4379083", "scanner": "scanner-primary", "fingerprint": "a69dafe9590b91f2", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci_cd.yaml"}, "region": {"startLine": 139}}}]}, {"ruleId": "scanner-a69dafe9590b91f2", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "e6e93096d26cc55d", "scanner": "scanner-primary", "fingerprint": "a69dafe9590b91f2", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci_cd.yaml"}, "region": {"startLine": 155}}}]}, {"ruleId": "scanner-a69dafe9590b91f2", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "e2080f93d7715ebc", "scanner": "scanner-primary", "fingerprint": "a69dafe9590b91f2", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci_cd.yaml"}, "region": {"startLine": 158}}}]}, {"ruleId": "scanner-a69dafe9590b91f2", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "1af56353a348c97f", "scanner": "scanner-primary", "fingerprint": "a69dafe9590b91f2", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci_cd.yaml"}, "region": {"startLine": 166}}}]}, {"ruleId": "scanner-a69dafe9590b91f2", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "13e9377bd4379083", "scanner": "scanner-primary", "fingerprint": "a69dafe9590b91f2", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci_cd.yaml"}, "region": {"startLine": 179}}}]}, {"ruleId": "scanner-a69dafe9590b91f2", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "e6e93096d26cc55d", "scanner": "scanner-primary", "fingerprint": "a69dafe9590b91f2", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci_cd.yaml"}, "region": {"startLine": 223}}}]}, {"ruleId": "scanner-a69dafe9590b91f2", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "e2080f93d7715ebc", "scanner": "scanner-primary", "fingerprint": "a69dafe9590b91f2", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci_cd.yaml"}, "region": {"startLine": 227}}}]}, {"ruleId": "scanner-a69dafe9590b91f2", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "13e9377bd4379083", "scanner": "scanner-primary", "fingerprint": "a69dafe9590b91f2", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci_cd.yaml"}, "region": {"startLine": 235}}}]}, {"ruleId": "scanner-a69dafe9590b91f2", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "13e9377bd4379083", "scanner": "scanner-primary", "fingerprint": "a69dafe9590b91f2", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci_cd.yaml"}, "region": {"startLine": 253}}}]}, {"ruleId": "scanner-a69dafe9590b91f2", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "13e9377bd4379083", "scanner": "scanner-primary", "fingerprint": "a69dafe9590b91f2", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci_cd.yaml"}, "region": {"startLine": 261}}}]}, {"ruleId": "scanner-bbc1239a630fa1bd", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "f2b65d3be1d508f4", "scanner": "scanner-primary", "fingerprint": "bbc1239a630fa1bd", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/auto_label_priority.yml"}, "region": {"startLine": 14}}}]}, {"ruleId": "scanner-de53ac274e5b4ecf", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "b8decd2763556e20", "scanner": "scanner-primary", "fingerprint": "de53ac274e5b4ecf", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/claude.yml"}, "region": {"startLine": 29}}}]}, {"ruleId": "scanner-de53ac274e5b4ecf", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "c14d3e645f85e0de", "scanner": "scanner-primary", "fingerprint": "de53ac274e5b4ecf", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/claude.yml"}, "region": {"startLine": 34}}}]}, {"ruleId": "scanner-de53ac274e5b4ecf", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "1767eb8fd5b0b814", "scanner": "scanner-primary", "fingerprint": "de53ac274e5b4ecf", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/claude.yml"}, "region": {"startLine": 41}}}]}, {"ruleId": "scanner-37716d9c0a33ad5c", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "abfb5752158cf655", "scanner": "scanner-primary", "fingerprint": "37716d9c0a33ad5c", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/claude.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-cb639d9a10a47b23", "level": "note", "message": {"text": "package.json defines install-time lifecycle scripts"}, "properties": {"repobilityId": "edeab51902066991", "scanner": "scanner-primary", "fingerprint": "cb639d9a10a47b23", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "npm", "install-scripts"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a53a369ad26e63db", "level": "warning", "message": {"text": "Install-time lifecycle script performs network/shell-sensitive actions"}, "properties": {"repobilityId": "c1d663e5344ebe71", "scanner": "scanner-primary", "fingerprint": "a53a369ad26e63db", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "npm", "install-scripts"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/room/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-77b3ef38f20f04d3", "level": "warning", "message": {"text": "Install-time lifecycle script performs network/shell-sensitive actions"}, "properties": {"repobilityId": "681189cdc62144db", "scanner": "scanner-primary", "fingerprint": "77b3ef38f20f04d3", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "npm", "install-scripts"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/course-demos/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-84e621d2007e92c9", "level": "warning", "message": {"text": "Install-time lifecycle script performs network/shell-sensitive actions"}, "properties": {"repobilityId": "31b306ecd0bf93a7", "scanner": "scanner-primary", "fingerprint": "84e621d2007e92c9", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "npm", "install-scripts"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/speed-review/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-169644f8405cec82", "level": "warning", "message": {"text": "Install-time lifecycle script performs network/shell-sensitive actions"}, "properties": {"repobilityId": "bfb25279a7da5d8b", "scanner": "scanner-primary", "fingerprint": "169644f8405cec82", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "npm", "install-scripts"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/website/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a2562333003bc252", "level": "warning", "message": {"text": "Install-time lifecycle script performs network/shell-sensitive actions"}, "properties": {"repobilityId": "ab52b7ac74eee241", "scanner": "scanner-primary", "fingerprint": "a2562333003bc252", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "npm", "install-scripts"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/availability/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-5d3639181e191e2d", "level": "warning", "message": {"text": "Install-time lifecycle script performs network/shell-sensitive actions"}, "properties": {"repobilityId": "4bd88389d94459cf", "scanner": "scanner-primary", "fingerprint": "5d3639181e191e2d", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "npm", "install-scripts"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/editor/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-8b53e4a51389a951", "level": "warning", "message": {"text": "Install-time lifecycle script performs network/shell-sensitive actions"}, "properties": {"repobilityId": "af5d77b4b77aaeb5", "scanner": "scanner-primary", "fingerprint": "8b53e4a51389a951", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "npm", "install-scripts"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/meet/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-69e8f8dc2f7bb006", "level": "note", "message": {"text": "package.json defines install-time lifecycle scripts"}, "properties": {"repobilityId": "f65c6bb7a7154562", "scanner": "scanner-primary", "fingerprint": "69e8f8dc2f7bb006", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "npm", "install-scripts"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/infra/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b8b8c9cb660ef5d2", "level": "warning", "message": {"text": "Install-time lifecycle script performs network/shell-sensitive actions"}, "properties": {"repobilityId": "4f8e5550daa25404", "scanner": "scanner-primary", "fingerprint": "b8b8c9cb660ef5d2", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "npm", "install-scripts"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/frontend-example/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6c96f9f603250df5", "level": "warning", "message": {"text": "Install-time lifecycle script performs network/shell-sensitive actions"}, "properties": {"repobilityId": "0db5176ff28910c7", "scanner": "scanner-primary", "fingerprint": "6c96f9f603250df5", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "npm", "install-scripts"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/app-template/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-948ae22f36d8d262", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: apps/room/package.json"}, "properties": {"repobilityId": "2430a0b0d3ae147c", "scanner": "scanner-primary", "fingerprint": "948ae22f36d8d262", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/room/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-318a599caba3bd74", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: apps/login/package.json"}, "properties": {"repobilityId": "dce6b1db57605769", "scanner": "scanner-primary", "fingerprint": "318a599caba3bd74", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/login/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b3f35142d60efce5", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: apps/course-demos/package.json"}, "properties": {"repobilityId": "347fd2cb8a0c40ff", "scanner": "scanner-primary", "fingerprint": "b3f35142d60efce5", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/course-demos/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3da9ab24d6cf880a", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: apps/speed-review/package.json"}, "properties": {"repobilityId": "c913699ad5023be3", "scanner": "scanner-primary", "fingerprint": "3da9ab24d6cf880a", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/speed-review/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-2a3c3892bcd596b5", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: apps/website/package.json"}, "properties": {"repobilityId": "61e5eefadfa8c0a3", "scanner": "scanner-primary", "fingerprint": "2a3c3892bcd596b5", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/website/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b7928b294f06b77d", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: apps/availability/package.json"}, "properties": {"repobilityId": "c00d2a3113053b5b", "scanner": "scanner-primary", "fingerprint": "b7928b294f06b77d", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/availability/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ce081cc1b788ffc1", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: apps/editor/package.json"}, "properties": {"repobilityId": "abce9a5ca968e72e", "scanner": "scanner-primary", "fingerprint": "ce081cc1b788ffc1", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/editor/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f364bc349f7499be", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: apps/website-proxy/package.json"}, "properties": {"repobilityId": "b1ffba57061faa1b", "scanner": "scanner-primary", "fingerprint": "f364bc349f7499be", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/website-proxy/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-bac06ba99cb86b0c", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: apps/meet/package.json"}, "properties": {"repobilityId": "74a4e217ab99a293", "scanner": "scanner-primary", "fingerprint": "bac06ba99cb86b0c", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/meet/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-307edab3520e696a", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: apps/infra/package.json"}, "properties": {"repobilityId": "b5673be72d404fa7", "scanner": "scanner-primary", "fingerprint": "307edab3520e696a", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/infra/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-17054a93bfba9985", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: apps/pg-sync-service/package.json"}, "properties": {"repobilityId": "4987e686eda90b8d", "scanner": "scanner-primary", "fingerprint": "17054a93bfba9985", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/pg-sync-service/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-0b586f3b52556b29", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: apps/frontend-example/package.json"}, "properties": {"repobilityId": "eee23855240f86a1", "scanner": "scanner-primary", "fingerprint": "0b586f3b52556b29", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/frontend-example/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-8579a3c5cc92f9f2", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: apps/posthog-proxy/package.json"}, "properties": {"repobilityId": "d40214ee8efd52fa", "scanner": "scanner-primary", "fingerprint": "8579a3c5cc92f9f2", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/posthog-proxy/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-08199299167de98a", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: apps/app-template/package.json"}, "properties": {"repobilityId": "f8f22f6c5da247d9", "scanner": "scanner-primary", "fingerprint": "08199299167de98a", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/app-template/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e683b13decdf8f3e", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: apps/storybook/package.json"}, "properties": {"repobilityId": "e84b45d33d99ff0b", "scanner": "scanner-primary", "fingerprint": "e683b13decdf8f3e", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/storybook/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c1ea8acac2d866eb", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: libraries/utils/package.json"}, "properties": {"repobilityId": "bd549986308c5bd8", "scanner": "scanner-primary", "fingerprint": "c1ea8acac2d866eb", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "libraries/utils/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d5383ab9b784ac5a", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: libraries/eslint-config/package.json"}, "properties": {"repobilityId": "34a7890e22a62073", "scanner": "scanner-primary", "fingerprint": "d5383ab9b784ac5a", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "libraries/eslint-config/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-2c25c05d27512ecc", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: libraries/db/package.json"}, "properties": {"repobilityId": "c61ecc78922b998a", "scanner": "scanner-primary", "fingerprint": "2c25c05d27512ecc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "libraries/db/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-5459a23c9d40bace", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: libraries/computed-airtable-fields/package.json"}, "properties": {"repobilityId": "5bf31586c85f62db", "scanner": "scanner-primary", "fingerprint": "5459a23c9d40bace", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "libraries/computed-airtable-fields/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e53b3cead003c30f", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: libraries/affected-packages/package.json"}, "properties": {"repobilityId": "44d92297a44bb671", "scanner": "scanner-primary", "fingerprint": "e53b3cead003c30f", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "libraries/affected-packages/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-17d528f584f268d5", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: libraries/ui/package.json"}, "properties": {"repobilityId": "aaedd00a7f6a63d6", "scanner": "scanner-primary", "fingerprint": "17d528f584f268d5", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "libraries/ui/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "c6f82d55060939d9", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-72b2a6250083a784", "level": "warning", "message": {"text": "Placeholder or mock-heavy implementation detected"}, "properties": {"repobilityId": "6b9f69e089033245", "scanner": "scanner-primary", "fingerprint": "72b2a6250083a784", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "incomplete", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "1aef36a0c7044a6c", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-749d4bc1bd66df5f", "level": "warning", "message": {"text": "Agent instructions exist but release-hardening basics are missing"}, "properties": {"repobilityId": "59ebb06df1e1212d", "scanner": "scanner-primary", "fingerprint": "749d4bc1bd66df5f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-6fdfe5c037f9d894", "level": "none", "message": {"text": "Commented-code block (8 lines) in apps/room/public/display/setup/tampermonkey/google-meet-handsfree.user.js:2"}, "properties": {"repobilityId": "e1f4e7808b64f6a1", "scanner": "scanner-primary", "fingerprint": "6fdfe5c037f9d894", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-fdd8b001e9415209", "level": "none", "message": {"text": "Commented-code block (9 lines) in apps/room/public/display/setup/tampermonkey/bluedot-room-bridge.user.js:2"}, "properties": {"repobilityId": "477ee8a0fc40d5f0", "scanner": "scanner-primary", "fingerprint": "fdd8b001e9415209", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-ddb541992cef002f", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 apps/room/public/display/setup/tampermonkey/bluedot-room-bridge.user.js:24"}, "properties": {"repobilityId": "3a724563a313b3cb", "scanner": "scanner-primary", "fingerprint": "ddb541992cef002f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-060e1e10815efa82", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 apps/course-demos/src/components/ShareSavedDemoButton.tsx:27"}, "properties": {"repobilityId": "f764bea012f2ac80", "scanner": "scanner-primary", "fingerprint": "060e1e10815efa82", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-90f4b4bb531ee954", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 apps/speed-review/src/lib/api/airtable.ts:334"}, "properties": {"repobilityId": "a5d528394e7679b5", "scanner": "scanner-primary", "fingerprint": "90f4b4bb531ee954", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-d87a9a678b03388d", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 apps/speed-review/src/lib/client/api.ts:25"}, "properties": {"repobilityId": "49f4bfe6491c515b", "scanner": "scanner-primary", "fingerprint": "d87a9a678b03388d", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-c5b29631d55ce508", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 apps/website/scripts/render-preview.ts:55"}, "properties": {"repobilityId": "8fb4aa5ee26c5663", "scanner": "scanner-primary", "fingerprint": "c5b29631d55ce508", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-4d8b3d41f46200ce", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 apps/website/src/server/airtableFieldOptions.ts:27"}, "properties": {"repobilityId": "3973fd27ec79d4d7", "scanner": "scanner-primary", "fingerprint": "4d8b3d41f46200ce", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-27467c0ed6f7a800", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 apps/website/src/server/routers/subscription-preferences.ts:33"}, "properties": {"repobilityId": "a677b5f9dc777239", "scanner": "scanner-primary", "fingerprint": "27467c0ed6f7a800", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-4eed145d93d36eaa", "level": "none", "message": {"text": "Commented-code block (5 lines) in apps/website/src/server/routers/course-registrations.test.ts:150"}, "properties": {"repobilityId": "852300a14d3aa426", "scanner": "scanner-primary", "fingerprint": "4eed145d93d36eaa", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-0b54f62aa7fcb783", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 apps/website/src/server/routers/luma.ts:178"}, "properties": {"repobilityId": "997654a8e1ade81a", "scanner": "scanner-primary", "fingerprint": "0b54f62aa7fcb783", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-f99d8a93405f1304", "level": "none", "message": {"text": "Commented-code block (7 lines) in apps/website/src/server/routers/grants.ts:71"}, "properties": {"repobilityId": "36b39ff0f7042f7f", "scanner": "scanner-primary", "fingerprint": "f99d8a93405f1304", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-980ba9ab9e418094", "level": "none", "message": {"text": "Commented-code block (5 lines) in apps/website/src/server/routers/certificates.test.ts:55"}, "properties": {"repobilityId": "c779f271df8735a2", "scanner": "scanner-primary", "fingerprint": "980ba9ab9e418094", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-978176d2ea520e2e", "level": "none", "message": {"text": "Commented-code block (5 lines) in apps/website/src/components/admin/ImpersonationBadge.tsx:20"}, "properties": {"repobilityId": "a828d6872d8b0f4e", "scanner": "scanner-primary", "fingerprint": "978176d2ea520e2e", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-cb75ba0a6c7b49c8", "level": "note", "message": {"text": "Legacy-named symbol `culture_dewi_v1` in apps/website/src/components/join-us/CultureSection.tsx:14"}, "properties": {"repobilityId": "6af3068e171470c8", "scanner": "scanner-primary", "fingerprint": "cb75ba0a6c7b49c8", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-94c6dedbbe678df0", "level": "none", "message": {"text": "Commented-code block (5 lines) in apps/website/src/pages/login/clear.tsx:22"}, "properties": {"repobilityId": "e13c90d29e9679b0", "scanner": "scanner-primary", "fingerprint": "94c6dedbbe678df0", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-54f4911afce6bec7", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 apps/website/src/lib/downloadCalendarFile.ts:13"}, "properties": {"repobilityId": "a318ab6826e13f88", "scanner": "scanner-primary", "fingerprint": "54f4911afce6bec7", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-b7ac0889064d8dcb", "level": "none", "message": {"text": "Commented-code block (5 lines) in apps/infra/src/k8s/serviceDefinitions.ts:388"}, "properties": {"repobilityId": "88410e11f4484020", "scanner": "scanner-primary", "fingerprint": "b7ac0889064d8dcb", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-001aba78c402febb", "level": "none", "message": {"text": "Commented-code block (16 lines) in apps/infra/src/k8s/observability.ts:16"}, "properties": {"repobilityId": "68e52187ec1d3ec3", "scanner": "scanner-primary", "fingerprint": "001aba78c402febb", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-36625245c2e5a2e0", "level": "none", "message": {"text": "Commented-code block (7 lines) in apps/infra/src/vultr/vke.ts:9"}, "properties": {"repobilityId": "d7a267dba4aa2f9c", "scanner": "scanner-primary", "fingerprint": "36625245c2e5a2e0", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-cabe1fdff261743c", "level": "none", "message": {"text": "Commented-code block (9 lines) in apps/pg-sync-service/src/routesPlugin.ts:18"}, "properties": {"repobilityId": "eca9cb66ef580e34", "scanner": "scanner-primary", "fingerprint": "cabe1fdff261743c", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-45f220ee5765fd43", "level": "none", "message": {"text": "Commented-code block (7 lines) in apps/pg-sync-service/src/lib/schema-sync.test.ts:125"}, "properties": {"repobilityId": "aa99e05ce503b8e5", "scanner": "scanner-primary", "fingerprint": "45f220ee5765fd43", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-85eecb2095cc9f70", "level": "none", "message": {"text": "Commented-code block (6 lines) in apps/frontend-example/src/pages/authed.tsx:10"}, "properties": {"repobilityId": "5380e9077dfec6fb", "scanner": "scanner-primary", "fingerprint": "85eecb2095cc9f70", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-886c0a8103a9a5cd", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 apps/storybook/public/mockServiceWorker.js:237"}, "properties": {"repobilityId": "c0e1d3f82151a204", "scanner": "scanner-primary", "fingerprint": "886c0a8103a9a5cd", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-8435f56bd65e9e1f", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 libraries/utils/src/slackNotifications.ts:244"}, "properties": {"repobilityId": "2be969527520e163", "scanner": "scanner-primary", "fingerprint": "8435f56bd65e9e1f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-fe03d18177a523b1", "level": "none", "message": {"text": "Commented-code block (5 lines) in libraries/affected-packages/src/lib/getPackagesWithChanges.ts:10"}, "properties": {"repobilityId": "4ffdcaead7c295c0", "scanner": "scanner-primary", "fingerprint": "fe03d18177a523b1", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-896ce168dfb6a209", "level": "none", "message": {"text": "Commented-code block (5 lines) in libraries/ui/src/Collapsible.test.tsx:28"}, "properties": {"repobilityId": "eca2b4f7eda302c7", "scanner": "scanner-primary", "fingerprint": "896ce168dfb6a209", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}]}]}