{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-9d4fada38f13232a", "name": "`dangerouslySetInnerHTML` used in a React component \u2014 dashboard/LaptopTracker.jsx:7", "shortDescription": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 dashboard/LaptopTracker.jsx:7"}, "fullDescription": {"text": "Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library.\n\nWhy: OWASP basics. Already partially flagged by the security analyzer.\nRule id: fq.dangerous-html"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-cdc6af9796b794d0", "name": "Insecure pattern 'dangerous_innerhtml' in CLAUDE.md:64", "shortDescription": {"text": "Insecure pattern 'dangerous_innerhtml' in CLAUDE.md:64"}, "fullDescription": {"text": "Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-36913143de486f40", "name": "Insecure pattern 'node_child_process' in package.json:14", "shortDescription": {"text": "Insecure pattern 'node_child_process' in package.json:14"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-937b4a2120faa6be", "name": "Insecure pattern 'node_child_process' in watcher/preview/render-proof.mjs:10", "shortDescription": {"text": "Insecure pattern 'node_child_process' in watcher/preview/render-proof.mjs:10"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6372cebde0220094", "name": "No auth library detected", "shortDescription": {"text": "No auth library detected"}, "fullDescription": {"text": "The scanner did not find any standard auth library (JWT, OAuth, NextAuth, Auth0, etc.). The repo has auth/admin/session surface indicators, so auth may live in custom code, in a separate service, or be missing."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7efbda965f283c17", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8851d6bc6441f0e6", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b5f75ed718161b55", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 19 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-72b2a6250083a784", "name": "Placeholder or mock-heavy implementation detected", "shortDescription": {"text": "Placeholder or mock-heavy implementation detected"}, "fullDescription": {"text": "Found 35 placeholder/mock markers across 6 source files. This often means the repo looks complete while core flows still use generated scaffolding or fake data."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-cc55229a7a3c078d", "name": "Agent authority lacks a verifier contract: .mcp.json", "shortDescription": {"text": "Agent authority lacks a verifier contract: .mcp.json"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-122f91b7f2906dc4", "name": "Agent authority lacks a verifier contract: .claude/settings.json", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/settings.json"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c9967e08c49def1f", "name": "Agent authority lacks a verifier contract: .claude/skills/mock/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/skills/mock/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-650fa2f89371a5ae", "name": "Legacy-named symbol `showOld` in dashboard/LaptopTracker.jsx:142", "shortDescription": {"text": "Legacy-named symbol `showOld` in dashboard/LaptopTracker.jsx:142"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-88697cdcd8483a0b", "name": "Commented-code block (5 lines) in artifact/LaptopTracker.jsx:3", "shortDescription": {"text": "Commented-code block (5 lines) in artifact/LaptopTracker.jsx:3"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-9f31df20bf764412", "name": "Commented-code block (5 lines) in watcher/check.mjs:7", "shortDescription": {"text": "Commented-code block (5 lines) in watcher/check.mjs:7"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-5838d33553d34e28", "name": "`fetch()` without try/.catch or AbortSignal \u2014 watcher/check.mjs:221", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 watcher/check.mjs:221"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-90d13df34b445f82", "name": "Commented-code block (7 lines) in watcher/mocks/mock-fetch.mjs:7", "shortDescription": {"text": "Commented-code block (7 lines) in watcher/mocks/mock-fetch.mjs:7"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-54b6b33481452566", "name": "`fetch()` without try/.catch or AbortSignal \u2014 watcher/test/serpapi.test.mjs:17", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 watcher/test/serpapi.test.mjs:17"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c0bb8c4413362567", "name": "Commented-code block (7 lines) in watcher/test/tokens.test.mjs:3", "shortDescription": {"text": "Commented-code block (7 lines) in watcher/test/tokens.test.mjs:3"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-1eb61f90d3f32810", "name": "Commented-code block (7 lines) in watcher/test/engine.test.mjs:256", "shortDescription": {"text": "Commented-code block (7 lines) in watcher/test/engine.test.mjs:256"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-06a76a674d0cb49b", "name": "Commented-code block (7 lines) in watcher/lib/tokens.mjs:9", "shortDescription": {"text": "Commented-code block (7 lines) in watcher/lib/tokens.mjs:9"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-3f40946b8f2570ae", "name": "Commented-code block (6 lines) in watcher/lib/config-validate.mjs:1", "shortDescription": {"text": "Commented-code block (6 lines) in watcher/lib/config-validate.mjs:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-c88307b77d71159a", "name": "Commented-code block (7 lines) in watcher/lib/publish.mjs:3", "shortDescription": {"text": "Commented-code block (7 lines) in watcher/lib/publish.mjs:3"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-c13d477cd1b64de9", "name": "Commented-code block (13 lines) in watcher/lib/signals.mjs:4", "shortDescription": {"text": "Commented-code block (13 lines) in watcher/lib/signals.mjs:4"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-4d7e916052f9eda8", "name": "Commented-code block (5 lines) in watcher/lib/email.mjs:3", "shortDescription": {"text": "Commented-code block (5 lines) in watcher/lib/email.mjs:3"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-d9d07410263dddc6", "name": "Commented-code block (5 lines) in watcher/lib/serpapi.mjs:4", "shortDescription": {"text": "Commented-code block (5 lines) in watcher/lib/serpapi.mjs:4"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-08654ed36c107f4d", "name": "`fetch()` without try/.catch or AbortSignal \u2014 watcher/lib/serpapi.mjs:139", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 watcher/lib/serpapi.mjs:139"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a234928d95886e5c", "name": "Commented-code block (6 lines) in watcher/lib/verify.mjs:3", "shortDescription": {"text": "Commented-code block (6 lines) in watcher/lib/verify.mjs:3"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-0b8b9e84f2766c2e", "name": "Commented-code block (7 lines) in watcher/lib/state.mjs:6", "shortDescription": {"text": "Commented-code block (7 lines) in watcher/lib/state.mjs:6"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-e0836eff0f621ae6", "name": "Commented-code block (5 lines) in watcher/lib/engine.mjs:5", "shortDescription": {"text": "Commented-code block (5 lines) in watcher/lib/engine.mjs:5"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-c31f01a3da971f80", "name": "Commented-code block (6 lines) in watcher/lib/sources.mjs:3", "shortDescription": {"text": "Commented-code block (6 lines) in watcher/lib/sources.mjs:3"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-980d32b28348b708", "name": "Commented-code block (5 lines) in watcher/preview/email-qa.mjs:3", "shortDescription": {"text": "Commented-code block (5 lines) in watcher/preview/email-qa.mjs:3"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-7af89e7c493c9d8c", "name": "`fetch()` without try/.catch or AbortSignal \u2014 watcher/preview/preview-server.mjs:6", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 watcher/preview/preview-server.mjs:6"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c55bbbc4058c3da4", "name": "Commented-code block (5 lines) in watcher/preview/render-proof.mjs:1", "shortDescription": {"text": "Commented-code block (5 lines) in watcher/preview/render-proof.mjs:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-3482f7e5dd70cd1a", "name": "6 env vars used in code but missing from .env.example", "shortDescription": {"text": "6 env vars used in code but missing from .env.example"}, "fullDescription": {"text": "Drift between code and config docs. The first few: `CONFIG_PATH`, `DASHBOARD_PATH`, `FORCE_DIGEST`, `NOW_MS`, `STATE_PATH`, `WATCHER_MOCK`. Add them (with a placeholder/comment) to .env.example so onboarding doesn't break."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/17750"}, "properties": {"repository": "Rahul-Innv/Laptop-tracker", "repoUrl": "https://github.com/Rahul-Innv/Laptop-tracker", "branch": "main"}, "results": [{"ruleId": "scanner-9d4fada38f13232a", "level": "warning", "message": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 dashboard/LaptopTracker.jsx:7"}, "properties": {"repobilityId": "86a476af89ebdf1c", "scanner": "scanner-primary", "fingerprint": "9d4fada38f13232a", "layer": "frontend", "severity": "medium", "confidence": 1.0, "tags": ["frontend-quality", "fq.dangerous-html"]}}, {"ruleId": "scanner-cdc6af9796b794d0", "level": "warning", "message": {"text": "Insecure pattern 'dangerous_innerhtml' in CLAUDE.md:64"}, "properties": {"repobilityId": "1d599077e226eef8", "scanner": "scanner-primary", "fingerprint": "cdc6af9796b794d0", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "dangerous_innerhtml"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "CLAUDE.md"}, "region": {"startLine": 64}}}]}, {"ruleId": "scanner-36913143de486f40", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in package.json:14"}, "properties": {"repobilityId": "40fa5506c1a3b684", "scanner": "scanner-primary", "fingerprint": "36913143de486f40", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 14}}}]}, {"ruleId": "scanner-937b4a2120faa6be", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in watcher/preview/render-proof.mjs:10"}, "properties": {"repobilityId": "b2fe44f719decc8e", "scanner": "scanner-primary", "fingerprint": "937b4a2120faa6be", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "watcher/preview/render-proof.mjs"}, "region": {"startLine": 10}}}]}, {"ruleId": "scanner-6372cebde0220094", "level": "warning", "message": {"text": "No auth library detected"}, "properties": {"repobilityId": "a5b6035a5bbf8054", "scanner": "scanner-primary", "fingerprint": "6372cebde0220094", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["coverage", "auth"]}}, {"ruleId": "scanner-7efbda965f283c17", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "3c7ec7ebb8499138", "scanner": "scanner-primary", "fingerprint": "7efbda965f283c17", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/test.yml"}, "region": {"startLine": 24}}}]}, {"ruleId": "scanner-7efbda965f283c17", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "556d2dda8be37861", "scanner": "scanner-primary", "fingerprint": "7efbda965f283c17", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/test.yml"}, "region": {"startLine": 27}}}]}, {"ruleId": "scanner-8851d6bc6441f0e6", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "62b807c8fed223eb", "scanner": "scanner-primary", "fingerprint": "8851d6bc6441f0e6", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/watcher.yml"}, "region": {"startLine": 28}}}]}, {"ruleId": "scanner-8851d6bc6441f0e6", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "7da55274a7fcb7d8", "scanner": "scanner-primary", "fingerprint": "8851d6bc6441f0e6", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/watcher.yml"}, "region": {"startLine": 31}}}]}, {"ruleId": "scanner-b5f75ed718161b55", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "7a6b7c664b82bb9c", "scanner": "scanner-primary", "fingerprint": "b5f75ed718161b55", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/watcher.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "295ca7603565fb19", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-72b2a6250083a784", "level": "warning", "message": {"text": "Placeholder or mock-heavy implementation detected"}, "properties": {"repobilityId": "38ede37507c08172", "scanner": "scanner-primary", "fingerprint": "72b2a6250083a784", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "incomplete", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "8d632b9206318be9", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "453a4e67a541e584", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "a11287dc64fcd9a4", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-cc55229a7a3c078d", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .mcp.json"}, "properties": {"repobilityId": "51942fb3d5b8b5b4", "scanner": "scanner-primary", "fingerprint": "cc55229a7a3c078d", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "mcp_config"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".mcp.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-122f91b7f2906dc4", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/settings.json"}, "properties": {"repobilityId": "a2967269048b6a9d", "scanner": "scanner-primary", "fingerprint": "122f91b7f2906dc4", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/settings.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c9967e08c49def1f", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/skills/mock/SKILL.md"}, "properties": {"repobilityId": "b1845248cdc59fd3", "scanner": "scanner-primary", "fingerprint": "c9967e08c49def1f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/mock/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-650fa2f89371a5ae", "level": "note", "message": {"text": "Legacy-named symbol `showOld` in dashboard/LaptopTracker.jsx:142"}, "properties": {"repobilityId": "e20d2f24bb33c52f", "scanner": "scanner-primary", "fingerprint": "650fa2f89371a5ae", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-88697cdcd8483a0b", "level": "none", "message": {"text": "Commented-code block (5 lines) in artifact/LaptopTracker.jsx:3"}, "properties": {"repobilityId": "3d4b475a12bb3d32", "scanner": "scanner-primary", "fingerprint": "88697cdcd8483a0b", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-9f31df20bf764412", "level": "none", "message": {"text": "Commented-code block (5 lines) in watcher/check.mjs:7"}, "properties": {"repobilityId": "6db217ae26f00a0f", "scanner": "scanner-primary", "fingerprint": "9f31df20bf764412", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-5838d33553d34e28", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 watcher/check.mjs:221"}, "properties": {"repobilityId": "6e899ee75c4eeb32", "scanner": "scanner-primary", "fingerprint": "5838d33553d34e28", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-90d13df34b445f82", "level": "none", "message": {"text": "Commented-code block (7 lines) in watcher/mocks/mock-fetch.mjs:7"}, "properties": {"repobilityId": "3b078e9a8529edc3", "scanner": "scanner-primary", "fingerprint": "90d13df34b445f82", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-54b6b33481452566", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 watcher/test/serpapi.test.mjs:17"}, "properties": {"repobilityId": "1145de278cbdbf9e", "scanner": "scanner-primary", "fingerprint": "54b6b33481452566", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-c0bb8c4413362567", "level": "none", "message": {"text": "Commented-code block (7 lines) in watcher/test/tokens.test.mjs:3"}, "properties": {"repobilityId": "2958b24dd01e7cb1", "scanner": "scanner-primary", "fingerprint": "c0bb8c4413362567", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-1eb61f90d3f32810", "level": "none", "message": {"text": "Commented-code block (7 lines) in watcher/test/engine.test.mjs:256"}, "properties": {"repobilityId": "3c8bc49d1a976813", "scanner": "scanner-primary", "fingerprint": "1eb61f90d3f32810", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-06a76a674d0cb49b", "level": "none", "message": {"text": "Commented-code block (7 lines) in watcher/lib/tokens.mjs:9"}, "properties": {"repobilityId": "000b70bca6585391", "scanner": "scanner-primary", "fingerprint": "06a76a674d0cb49b", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-3f40946b8f2570ae", "level": "none", "message": {"text": "Commented-code block (6 lines) in watcher/lib/config-validate.mjs:1"}, "properties": {"repobilityId": "cba724a10d9ec099", "scanner": "scanner-primary", "fingerprint": "3f40946b8f2570ae", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-c88307b77d71159a", "level": "none", "message": {"text": "Commented-code block (7 lines) in watcher/lib/publish.mjs:3"}, "properties": {"repobilityId": "9b3770ad35af0a41", "scanner": "scanner-primary", "fingerprint": "c88307b77d71159a", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-c13d477cd1b64de9", "level": "none", "message": {"text": "Commented-code block (13 lines) in watcher/lib/signals.mjs:4"}, "properties": {"repobilityId": "98fafad9b2c31053", "scanner": "scanner-primary", "fingerprint": "c13d477cd1b64de9", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-4d7e916052f9eda8", "level": "none", "message": {"text": "Commented-code block (5 lines) in watcher/lib/email.mjs:3"}, "properties": {"repobilityId": "ae71a5e9d7ab2457", "scanner": "scanner-primary", "fingerprint": "4d7e916052f9eda8", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-d9d07410263dddc6", "level": "none", "message": {"text": "Commented-code block (5 lines) in watcher/lib/serpapi.mjs:4"}, "properties": {"repobilityId": "685ca7c94d34ca7a", "scanner": "scanner-primary", "fingerprint": "d9d07410263dddc6", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-08654ed36c107f4d", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 watcher/lib/serpapi.mjs:139"}, "properties": {"repobilityId": "384d7c77c39ec000", "scanner": "scanner-primary", "fingerprint": "08654ed36c107f4d", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-a234928d95886e5c", "level": "none", "message": {"text": "Commented-code block (6 lines) in watcher/lib/verify.mjs:3"}, "properties": {"repobilityId": "78eb9020dfe51ab3", "scanner": "scanner-primary", "fingerprint": "a234928d95886e5c", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-0b8b9e84f2766c2e", "level": "none", "message": {"text": "Commented-code block (7 lines) in watcher/lib/state.mjs:6"}, "properties": {"repobilityId": "63865ee6943a9b28", "scanner": "scanner-primary", "fingerprint": "0b8b9e84f2766c2e", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-e0836eff0f621ae6", "level": "none", "message": {"text": "Commented-code block (5 lines) in watcher/lib/engine.mjs:5"}, "properties": {"repobilityId": "4a924338754f9d61", "scanner": "scanner-primary", "fingerprint": "e0836eff0f621ae6", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-c31f01a3da971f80", "level": "none", "message": {"text": "Commented-code block (6 lines) in watcher/lib/sources.mjs:3"}, "properties": {"repobilityId": "f6a9a36adc5cabc2", "scanner": "scanner-primary", "fingerprint": "c31f01a3da971f80", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-980d32b28348b708", "level": "none", "message": {"text": "Commented-code block (5 lines) in watcher/preview/email-qa.mjs:3"}, "properties": {"repobilityId": "16afbdb6d0306849", "scanner": "scanner-primary", "fingerprint": "980d32b28348b708", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-7af89e7c493c9d8c", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 watcher/preview/preview-server.mjs:6"}, "properties": {"repobilityId": "1204f6ab027be992", "scanner": "scanner-primary", "fingerprint": "7af89e7c493c9d8c", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-c55bbbc4058c3da4", "level": "none", "message": {"text": "Commented-code block (5 lines) in watcher/preview/render-proof.mjs:1"}, "properties": {"repobilityId": "f75cef01eae51608", "scanner": "scanner-primary", "fingerprint": "c55bbbc4058c3da4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-3482f7e5dd70cd1a", "level": "note", "message": {"text": "6 env vars used in code but missing from .env.example"}, "properties": {"repobilityId": "1da70f25aa46f6e9", "scanner": "scanner-primary", "fingerprint": "3482f7e5dd70cd1a", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "config-drift"]}}]}]}