{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-ee88b627e81b1653", "name": "Possibly dead Python function: setup_hook", "shortDescription": {"text": "Possibly dead Python function: setup_hook"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5246b38ac9dcb6e4", "name": "Possibly dead Python function: log_progress", "shortDescription": {"text": "Possibly dead Python function: log_progress"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f736517cbf1dfa06", "name": "Possibly dead Python function: log_completion", "shortDescription": {"text": "Possibly dead Python function: log_completion"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b854f492a1215d1f", "name": "Possibly dead Python function: request_shutdown", "shortDescription": {"text": "Possibly dead Python function: request_shutdown"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0e53a0ab63763fcb", "name": "Possibly dead Python function: is_development", "shortDescription": {"text": "Possibly dead Python function: is_development"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-dd2f98d763f65246", "name": "Possibly dead Python function: reset_stats", "shortDescription": {"text": "Possibly dead Python function: reset_stats"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-101c4ef079831307", "name": "Possibly dead Python function: check_connection_health", "shortDescription": {"text": "Possibly dead Python function: check_connection_health"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8b64da41c4bca882", "name": "Possibly dead Python function: validate_connections", "shortDescription": {"text": "Possibly dead Python function: validate_connections"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-932da66c3b8ff0dd", "name": "Possibly dead Python function: prepare_statement", "shortDescription": {"text": "Possibly dead Python function: prepare_statement"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6174b54bea7117e0", "name": "Possibly dead Python function: execute_with_callback", "shortDescription": {"text": "Possibly dead Python function: execute_with_callback"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-dcbb276e0c85a5a6", "name": "Possibly dead Python function: fetch_with_timeout", "shortDescription": {"text": "Possibly dead Python function: fetch_with_timeout"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9f77afb9addcd508", "name": "Possibly dead Python function: fetchrow_with_timeout", "shortDescription": {"text": "Possibly dead Python function: fetchrow_with_timeout"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-89dde8d54a6816af", "name": "Possibly dead Python function: paginate", "shortDescription": {"text": "Possibly dead Python function: paginate"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-89eb813bbb47699c", "name": "Possibly dead Python function: invalidate", "shortDescription": {"text": "Possibly dead Python function: invalidate"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-433ef28ce9062aff", "name": "Possibly dead Python function: reset_stats", "shortDescription": {"text": "Possibly dead Python function: reset_stats"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4fdb775b1d926014", "name": "Possibly dead Python function: decorator", "shortDescription": {"text": "Possibly dead Python function: decorator"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6ded2eed8747b351", "name": "Possibly dead Python function: validate_float", "shortDescription": {"text": "Possibly dead Python function: validate_float"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c497ff5cf27593aa", "name": "Possibly dead Python function: validate_boolean", "shortDescription": {"text": "Possibly dead Python function: validate_boolean"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2be8a25bc51a5e7b", "name": "Possibly dead Python function: validate_date", "shortDescription": {"text": "Possibly dead Python function: validate_date"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0d1e91c861580934", "name": "Possibly dead Python function: validate_choice", "shortDescription": {"text": "Possibly dead Python function: validate_choice"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-37abb792e4459f30", "name": "Possibly dead Python function: validate_email", "shortDescription": {"text": "Possibly dead Python function: validate_email"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fc74a16e8da3beb2", "name": "Possibly dead Python function: validate_discord_id", "shortDescription": {"text": "Possibly dead Python function: validate_discord_id"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-de3c1f217d72a063", "name": "Docker base image is tag-pinned but not digest-pinned: python:3.12-slim", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: python:3.12-slim"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-acfdee02c47b98c5", "name": "Dockerfile runs as root: docker/postgres-ssl-logs/Dockerfile", "shortDescription": {"text": "Dockerfile runs as root: docker/postgres-ssl-logs/Dockerfile"}, "fullDescription": {"text": "No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-cb9691a18e055710", "name": "Docker base image is tag-pinned but not digest-pinned: ghcr.io/railwayapp-templates/postgres-ssl:18", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: ghcr.io/railwayapp-templates/postgres-ssl:18"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-aa5acaa49eb8315b", "name": "Containers defined but no K8s/orchestration manifest found", "shortDescription": {"text": "Containers defined but no K8s/orchestration manifest found"}, "fullDescription": {"text": "Repo has Dockerfiles/compose but no Kubernetes/Nomad manifests. If the target deployment is K8s, the manifests may live in a separate ops repo."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9710c8d059e53154", "name": "No frontend routes/components detected", "shortDescription": {"text": "No frontend routes/components detected"}, "fullDescription": {"text": "No React/Vue/Next routes were found. This is fine for backend-only repos."}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-f2d830d7ae5c1641", "name": "Runtime dotenv file present in repo: .env.test", "shortDescription": {"text": "Runtime dotenv file present in repo: .env.test"}, "fullDescription": {"text": "`.env.test` looks like a runtime dotenv file. No high-confidence secret value was matched, but runtime dotenv files often drift into live credentials. Move real values to a secret manager and keep only `.env.example` style templates in source control."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-6372cebde0220094", "name": "No auth library detected", "shortDescription": {"text": "No auth library detected"}, "fullDescription": {"text": "The scanner did not find any standard auth library (JWT, OAuth, NextAuth, Auth0, etc.). The repo has auth/admin/session surface indicators, so auth may live in custom code, in a separate service, or be missing."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e0662b204e97cff6", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/setup-python@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-27924aa79fa4a517", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/setup-python@v5 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-62933198a92603fc", "name": "Very large file: utils/error_handling.py (1290 lines)", "shortDescription": {"text": "Very large file: utils/error_handling.py (1290 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4e7857ab03fe47b5", "name": "Very large file: cogs/stats_commands.py (2420 lines)", "shortDescription": {"text": "Very large file: cogs/stats_commands.py (2420 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fec150b3f317b8bc", "name": "Very large file: cogs/patreon_poll.py (1439 lines)", "shortDescription": {"text": "Very large file: cogs/patreon_poll.py (1439 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5c93a0f3609c8728", "name": "Very large file: cogs/twi.py (1184 lines)", "shortDescription": {"text": "Very large file: cogs/twi.py (1184 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d32f373fab182686", "name": "Very large file: cogs/stats_listeners.py (1647 lines)", "shortDescription": {"text": "Very large file: cogs/stats_listeners.py (1647 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1618ab5bb71aab69", "name": "Very large file: cogs/gallery.py (2125 lines)", "shortDescription": {"text": "Very large file: cogs/gallery.py (2125 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-098428681f1035e1", "name": "Very large file: cogs/owner.py (1708 lines)", "shortDescription": {"text": "Very large file: cogs/owner.py (1708 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-141b30a41e03817b", "name": "No license file detected", "shortDescription": {"text": "No license file detected"}, "fullDescription": {"text": "No LICENSE/COPYING/NOTICE file was found. Generated repositories often omit licensing, which blocks reuse and automated intake."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 42 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-72b2a6250083a784", "name": "Placeholder or mock-heavy implementation detected", "shortDescription": {"text": "Placeholder or mock-heavy implementation detected"}, "fullDescription": {"text": "Found 13 placeholder/mock markers across 4 source files. This often means the repo looks complete while core flows still use generated scaffolding or fake data."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-749d4bc1bd66df5f", "name": "Agent instructions exist but release-hardening basics are missing", "shortDescription": {"text": "Agent instructions exist but release-hardening basics are missing"}, "fullDescription": {"text": "AI-coder instruction files were found, but the repo is missing license. Treat this as a contract gap: the agent is guided, but the generated output is not yet guarded by the controls that make it repeatable."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-3b7509c43f635e64", "name": "Commented-code block (7 lines) in main.py:1118", "shortDescription": {"text": "Commented-code block (7 lines) in main.py:1118"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-ea4068a1d6b43dde", "name": "Commented-code block (7 lines) in tests/test_external_api_integration.py:32", "shortDescription": {"text": "Commented-code block (7 lines) in tests/test_external_api_integration.py:32"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-972851b466c0c5d4", "name": "Commented-code block (5 lines) in tests/test_owner_cog.py:22", "shortDescription": {"text": "Commented-code block (5 lines) in tests/test_owner_cog.py:22"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-f2baa6cfc6a736c1", "name": "Commented-code block (7 lines) in tests/test_cogs.py:271", "shortDescription": {"text": "Commented-code block (7 lines) in tests/test_cogs.py:271"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-e28d87ce7cde21d7", "name": "Commented-code block (5 lines) in tests/test_heartbeat.py:18", "shortDescription": {"text": "Commented-code block (5 lines) in tests/test_heartbeat.py:18"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-909f8bc2aa954aec", "name": "Commented-code block (6 lines) in tests/integration/conftest.py:69", "shortDescription": {"text": "Commented-code block (6 lines) in tests/integration/conftest.py:69"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-7d8a2f852d466dc0", "name": "Commented-code block (5 lines) in utils/resource_monitor.py:211", "shortDescription": {"text": "Commented-code block (5 lines) in utils/resource_monitor.py:211"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-9de70b656d2e5d98", "name": "Commented-code block (12 lines) in utils/sentry_setup.py:122", "shortDescription": {"text": "Commented-code block (12 lines) in utils/sentry_setup.py:122"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-153a9b764543718e", "name": "Legacy-named symbol `response_copy` in utils/error_handling.py:484", "shortDescription": {"text": "Legacy-named symbol `response_copy` in utils/error_handling.py:484"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-da27b4d9c807059f", "name": "Commented-code block (6 lines) in utils/error_handling.py:389", "shortDescription": {"text": "Commented-code block (6 lines) in utils/error_handling.py:389"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-85199f7fb78bbdb7", "name": "Commented-code block (6 lines) in cogs/quotes.py:177", "shortDescription": {"text": "Commented-code block (6 lines) in cogs/quotes.py:177"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-71d4844283bf0992", "name": "Commented-code block (5 lines) in cogs/heartbeat.py:34", "shortDescription": {"text": "Commented-code block (5 lines) in cogs/heartbeat.py:34"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-98a410bc03c8513f", "name": "Commented-code block (5 lines) in cogs/twi.py:160", "shortDescription": {"text": "Commented-code block (5 lines) in cogs/twi.py:160"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-f2097fd6a8d2ac18", "name": "Commented-code block (6 lines) in cogs/external_services.py:89", "shortDescription": {"text": "Commented-code block (6 lines) in cogs/external_services.py:89"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-c6a08246367c01da", "name": "Commented-code block (6 lines) in cogs/gallery.py:322", "shortDescription": {"text": "Commented-code block (6 lines) in cogs/gallery.py:322"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-1b5a76780c3df9aa", "name": "1 env vars used in code but missing from .env.example", "shortDescription": {"text": "1 env vars used in code but missing from .env.example"}, "fullDescription": {"text": "Drift between code and config docs. The first few: `LOGGING_LEVEL`. Add them (with a placeholder/comment) to .env.example so onboarding doesn't break."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-2c04133e54348533", "name": "Near-duplicate function bodies in 2 places", "shortDescription": {"text": "Near-duplicate function bodies in 2 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nmain.py:log_progress, cogs/stats_commands.py:progress_callback\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-be46ea126aa5d8dc", "name": "Near-duplicate function bodies in 3 places", "shortDescription": {"text": "Near-duplicate function bodies in 3 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nscripts/schema/query_faiss_schema.py:build_prompt, utils/schema_search.py:build_sql_prompt, utils/schema_search.py:generate_sql\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-49c98f7cedd9c977", "name": "Near-duplicate function bodies in 4 places", "shortDescription": {"text": "Near-duplicate function bodies in 4 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nutils/db.py:fetchval, utils/db.py:fetch, utils/db.py:fetch, utils/db.py:fetchval\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/22742"}, "properties": {"repository": "WillHalloward/twi_bot_shard", "repoUrl": "https://github.com/WillHalloward/twi_bot_shard", "branch": "main"}, "results": [{"ruleId": "scanner-ee88b627e81b1653", "level": "note", "message": {"text": "Possibly dead Python function: setup_hook"}, "properties": {"repobilityId": "21ca643157480dac", "scanner": "scanner-primary", "fingerprint": "ee88b627e81b1653", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "main.py:199"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-5246b38ac9dcb6e4", "level": "note", "message": {"text": "Possibly dead Python function: log_progress"}, "properties": {"repobilityId": "c1add1ac54b85f36", "scanner": "scanner-primary", "fingerprint": "5246b38ac9dcb6e4", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "main.py:393"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f736517cbf1dfa06", "level": "note", "message": {"text": "Possibly dead Python function: log_completion"}, "properties": {"repobilityId": "a9f70c25412a53f7", "scanner": "scanner-primary", "fingerprint": "f736517cbf1dfa06", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "main.py:410"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b854f492a1215d1f", "level": "note", "message": {"text": "Possibly dead Python function: request_shutdown"}, "properties": {"repobilityId": "da031b332ae0c261", "scanner": "scanner-primary", "fingerprint": "b854f492a1215d1f", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "main.py:1128"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-0e53a0ab63763fcb", "level": "note", "message": {"text": "Possibly dead Python function: is_development"}, "properties": {"repobilityId": "aab6fe7c1664125d", "scanner": "scanner-primary", "fingerprint": "0e53a0ab63763fcb", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "config/__init__.py:582"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-dd2f98d763f65246", "level": "note", "message": {"text": "Possibly dead Python function: reset_stats"}, "properties": {"repobilityId": "b6f1cfbf42e92d47", "scanner": "scanner-primary", "fingerprint": "dd2f98d763f65246", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "utils/http_client.py:1018"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-101c4ef079831307", "level": "note", "message": {"text": "Possibly dead Python function: check_connection_health"}, "properties": {"repobilityId": "c95d06aeeb5ab1d6", "scanner": "scanner-primary", "fingerprint": "101c4ef079831307", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "utils/db.py:136"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-8b64da41c4bca882", "level": "note", "message": {"text": "Possibly dead Python function: validate_connections"}, "properties": {"repobilityId": "c98cd0e7c0c94750", "scanner": "scanner-primary", "fingerprint": "8b64da41c4bca882", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "utils/db.py:150"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-932da66c3b8ff0dd", "level": "note", "message": {"text": "Possibly dead Python function: prepare_statement"}, "properties": {"repobilityId": "2a3e360a3ced954a", "scanner": "scanner-primary", "fingerprint": "932da66c3b8ff0dd", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "utils/db.py:163"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6174b54bea7117e0", "level": "note", "message": {"text": "Possibly dead Python function: execute_with_callback"}, "properties": {"repobilityId": "c365c042f834a71c", "scanner": "scanner-primary", "fingerprint": "6174b54bea7117e0", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "utils/db.py:708"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-dcbb276e0c85a5a6", "level": "note", "message": {"text": "Possibly dead Python function: fetch_with_timeout"}, "properties": {"repobilityId": "cf5175a73d706b33", "scanner": "scanner-primary", "fingerprint": "dcbb276e0c85a5a6", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "utils/db.py:812"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-9f77afb9addcd508", "level": "note", "message": {"text": "Possibly dead Python function: fetchrow_with_timeout"}, "properties": {"repobilityId": "53be13f941b53eca", "scanner": "scanner-primary", "fingerprint": "9f77afb9addcd508", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "utils/db.py:880"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-89dde8d54a6816af", "level": "note", "message": {"text": "Possibly dead Python function: paginate"}, "properties": {"repobilityId": "6d728fd27940db6b", "scanner": "scanner-primary", "fingerprint": "89dde8d54a6816af", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "utils/db.py:948"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-89eb813bbb47699c", "level": "note", "message": {"text": "Possibly dead Python function: invalidate"}, "properties": {"repobilityId": "528be77e1d75b539", "scanner": "scanner-primary", "fingerprint": "89eb813bbb47699c", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "utils/query_cache.py:237"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-433ef28ce9062aff", "level": "note", "message": {"text": "Possibly dead Python function: reset_stats"}, "properties": {"repobilityId": "b6f1cfbf42e92d47", "scanner": "scanner-primary", "fingerprint": "433ef28ce9062aff", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "utils/query_cache.py:288"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-4fdb775b1d926014", "level": "note", "message": {"text": "Possibly dead Python function: decorator"}, "properties": {"repobilityId": "ffbcbc9bc189af1c", "scanner": "scanner-primary", "fingerprint": "4fdb775b1d926014", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "utils/query_cache.py:327"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6ded2eed8747b351", "level": "note", "message": {"text": "Possibly dead Python function: validate_float"}, "properties": {"repobilityId": "a0ac69efcaa890c2", "scanner": "scanner-primary", "fingerprint": "6ded2eed8747b351", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "utils/validation.py:151"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c497ff5cf27593aa", "level": "note", "message": {"text": "Possibly dead Python function: validate_boolean"}, "properties": {"repobilityId": "47b0a3e8a36608b8", "scanner": "scanner-primary", "fingerprint": "c497ff5cf27593aa", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "utils/validation.py:194"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-2be8a25bc51a5e7b", "level": "note", "message": {"text": "Possibly dead Python function: validate_date"}, "properties": {"repobilityId": "d29929acdc5dfc8a", "scanner": "scanner-primary", "fingerprint": "2be8a25bc51a5e7b", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "utils/validation.py:228"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-0d1e91c861580934", "level": "note", "message": {"text": "Possibly dead Python function: validate_choice"}, "properties": {"repobilityId": "33be30ac2e71d88b", "scanner": "scanner-primary", "fingerprint": "0d1e91c861580934", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "utils/validation.py:292"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-37abb792e4459f30", "level": "note", "message": {"text": "Possibly dead Python function: validate_email"}, "properties": {"repobilityId": "a960e886ee03d053", "scanner": "scanner-primary", "fingerprint": "37abb792e4459f30", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "utils/validation.py:338"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-fc74a16e8da3beb2", "level": "note", "message": {"text": "Possibly dead Python function: validate_discord_id"}, "properties": {"repobilityId": "4dec3f753c301c09", "scanner": "scanner-primary", "fingerprint": "fc74a16e8da3beb2", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "utils/validation.py:423"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-de3c1f217d72a063", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: python:3.12-slim"}, "properties": {"repobilityId": "182c359aa215dd71", "scanner": "scanner-primary", "fingerprint": "de3c1f217d72a063", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Dockerfile"}, "region": {"startLine": 3}}}]}, {"ruleId": "scanner-acfdee02c47b98c5", "level": "warning", "message": {"text": "Dockerfile runs as root: docker/postgres-ssl-logs/Dockerfile"}, "properties": {"repobilityId": "53cfdf952cd6fed6", "scanner": "scanner-primary", "fingerprint": "acfdee02c47b98c5", "layer": "hardware", "severity": "medium", "confidence": 1.0, "tags": ["security", "container"]}}, {"ruleId": "scanner-cb9691a18e055710", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: ghcr.io/railwayapp-templates/postgres-ssl:18"}, "properties": {"repobilityId": "a0394e2817b13a39", "scanner": "scanner-primary", "fingerprint": "cb9691a18e055710", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docker/postgres-ssl-logs/Dockerfile"}, "region": {"startLine": 13}}}]}, {"ruleId": "scanner-aa5acaa49eb8315b", "level": "note", "message": {"text": "Containers defined but no K8s/orchestration manifest found"}, "properties": {"repobilityId": "b230ea9b68736081", "scanner": "scanner-primary", "fingerprint": "aa5acaa49eb8315b", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["coverage", "deployment"]}}, {"ruleId": "scanner-9710c8d059e53154", "level": "none", "message": {"text": "No frontend routes/components detected"}, "properties": {"repobilityId": "44ca61485762e494", "scanner": "scanner-primary", "fingerprint": "9710c8d059e53154", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-f2d830d7ae5c1641", "level": "error", "message": {"text": "Runtime dotenv file present in repo: .env.test"}, "properties": {"repobilityId": "25baea8a4d77c75a", "scanner": "scanner-primary", "fingerprint": "f2d830d7ae5c1641", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["secrets", "config", "env-file", "runtime-env"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".env.test"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6372cebde0220094", "level": "warning", "message": {"text": "No auth library detected"}, "properties": {"repobilityId": "a5b6035a5bbf8054", "scanner": "scanner-primary", "fingerprint": "6372cebde0220094", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["coverage", "auth"]}}, {"ruleId": "scanner-e0662b204e97cff6", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "3395bcc48f8ca904", "scanner": "scanner-primary", "fingerprint": "e0662b204e97cff6", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/security-scan.yml"}, "region": {"startLine": 23}}}]}, {"ruleId": "scanner-e0662b204e97cff6", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "f179a586b08ffd9a", "scanner": "scanner-primary", "fingerprint": "e0662b204e97cff6", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/security-scan.yml"}, "region": {"startLine": 42}}}]}, {"ruleId": "scanner-e0662b204e97cff6", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "3395bcc48f8ca904", "scanner": "scanner-primary", "fingerprint": "e0662b204e97cff6", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/security-scan.yml"}, "region": {"startLine": 57}}}]}, {"ruleId": "scanner-e0662b204e97cff6", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "f179a586b08ffd9a", "scanner": "scanner-primary", "fingerprint": "e0662b204e97cff6", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/security-scan.yml"}, "region": {"startLine": 76}}}]}, {"ruleId": "scanner-e0662b204e97cff6", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "bf8b1da758cf19af", "scanner": "scanner-primary", "fingerprint": "e0662b204e97cff6", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/security-scan.yml"}, "region": {"startLine": 95}}}]}, {"ruleId": "scanner-27924aa79fa4a517", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "04f57d208548fcef", "scanner": "scanner-primary", "fingerprint": "27924aa79fa4a517", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 41}}}]}, {"ruleId": "scanner-27924aa79fa4a517", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "3beb6cb780c591da", "scanner": "scanner-primary", "fingerprint": "27924aa79fa4a517", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 46}}}]}, {"ruleId": "scanner-27924aa79fa4a517", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "a3c03147ef1f40b5", "scanner": "scanner-primary", "fingerprint": "27924aa79fa4a517", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 66}}}]}, {"ruleId": "scanner-27924aa79fa4a517", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "04f57d208548fcef", "scanner": "scanner-primary", "fingerprint": "27924aa79fa4a517", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 83}}}]}, {"ruleId": "scanner-27924aa79fa4a517", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "3beb6cb780c591da", "scanner": "scanner-primary", "fingerprint": "27924aa79fa4a517", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 88}}}]}, {"ruleId": "scanner-27924aa79fa4a517", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "3beb6cb780c591da", "scanner": "scanner-primary", "fingerprint": "27924aa79fa4a517", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 117}}}]}, {"ruleId": "scanner-27924aa79fa4a517", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "04f57d208548fcef", "scanner": "scanner-primary", "fingerprint": "27924aa79fa4a517", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 146}}}]}, {"ruleId": "scanner-27924aa79fa4a517", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "3beb6cb780c591da", "scanner": "scanner-primary", "fingerprint": "27924aa79fa4a517", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 151}}}]}, {"ruleId": "scanner-27924aa79fa4a517", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "bd7f3c1c34d83159", "scanner": "scanner-primary", "fingerprint": "27924aa79fa4a517", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 157}}}]}, {"ruleId": "scanner-62933198a92603fc", "level": "note", "message": {"text": "Very large file: utils/error_handling.py (1290 lines)"}, "properties": {"repobilityId": "ace8315be55e6ef2", "scanner": "scanner-primary", "fingerprint": "62933198a92603fc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-4e7857ab03fe47b5", "level": "note", "message": {"text": "Very large file: cogs/stats_commands.py (2420 lines)"}, "properties": {"repobilityId": "6e3407f5d0cd769d", "scanner": "scanner-primary", "fingerprint": "4e7857ab03fe47b5", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-fec150b3f317b8bc", "level": "note", "message": {"text": "Very large file: cogs/patreon_poll.py (1439 lines)"}, "properties": {"repobilityId": "e3308743a4d137a4", "scanner": "scanner-primary", "fingerprint": "fec150b3f317b8bc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-5c93a0f3609c8728", "level": "note", "message": {"text": "Very large file: cogs/twi.py (1184 lines)"}, "properties": {"repobilityId": "885ae2f2fdf08561", "scanner": "scanner-primary", "fingerprint": "5c93a0f3609c8728", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-d32f373fab182686", "level": "note", "message": {"text": "Very large file: cogs/stats_listeners.py (1647 lines)"}, "properties": {"repobilityId": "f2eda43655ba08ed", "scanner": "scanner-primary", "fingerprint": "d32f373fab182686", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-1618ab5bb71aab69", "level": "note", "message": {"text": "Very large file: cogs/gallery.py (2125 lines)"}, "properties": {"repobilityId": "eb34b78666717abb", "scanner": "scanner-primary", "fingerprint": "1618ab5bb71aab69", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-098428681f1035e1", "level": "note", "message": {"text": "Very large file: cogs/owner.py (1708 lines)"}, "properties": {"repobilityId": "a9e3082d0a8a61dd", "scanner": "scanner-primary", "fingerprint": "098428681f1035e1", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-141b30a41e03817b", "level": "note", "message": {"text": "No license file detected"}, "properties": {"repobilityId": "1d8cf95ba96cc6e3", "scanner": "scanner-primary", "fingerprint": "141b30a41e03817b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["license", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "3e07a0c528a9ffeb", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-72b2a6250083a784", "level": "warning", "message": {"text": "Placeholder or mock-heavy implementation detected"}, "properties": {"repobilityId": "217126b84768f17f", "scanner": "scanner-primary", "fingerprint": "72b2a6250083a784", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "incomplete", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "ce8e72083b955d8e", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-749d4bc1bd66df5f", "level": "warning", "message": {"text": "Agent instructions exist but release-hardening basics are missing"}, "properties": {"repobilityId": "6d5e03a7dc0c4c55", "scanner": "scanner-primary", "fingerprint": "749d4bc1bd66df5f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "72423474823ef94d", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "956719fbff54ca98", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-3b7509c43f635e64", "level": "none", "message": {"text": "Commented-code block (7 lines) in main.py:1118"}, "properties": {"repobilityId": "568b27ad8b1f3fd1", "scanner": "scanner-primary", "fingerprint": "3b7509c43f635e64", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-ea4068a1d6b43dde", "level": "none", "message": {"text": "Commented-code block (7 lines) in tests/test_external_api_integration.py:32"}, "properties": {"repobilityId": "3f68f05481ec9d4b", "scanner": "scanner-primary", "fingerprint": "ea4068a1d6b43dde", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-972851b466c0c5d4", "level": "none", "message": {"text": "Commented-code block (5 lines) in tests/test_owner_cog.py:22"}, "properties": {"repobilityId": "0567d4c2aea520e5", "scanner": "scanner-primary", "fingerprint": "972851b466c0c5d4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-f2baa6cfc6a736c1", "level": "none", "message": {"text": "Commented-code block (7 lines) in tests/test_cogs.py:271"}, "properties": {"repobilityId": "130c89a1aa72728a", "scanner": "scanner-primary", "fingerprint": "f2baa6cfc6a736c1", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-e28d87ce7cde21d7", "level": "none", "message": {"text": "Commented-code block (5 lines) in tests/test_heartbeat.py:18"}, "properties": {"repobilityId": "32e573a114160cb4", "scanner": "scanner-primary", "fingerprint": "e28d87ce7cde21d7", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-909f8bc2aa954aec", "level": "none", "message": {"text": "Commented-code block (6 lines) in tests/integration/conftest.py:69"}, "properties": {"repobilityId": "d90dd806f7694e66", "scanner": "scanner-primary", "fingerprint": "909f8bc2aa954aec", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-7d8a2f852d466dc0", "level": "none", "message": {"text": "Commented-code block (5 lines) in utils/resource_monitor.py:211"}, "properties": {"repobilityId": "49101aa28bb567aa", "scanner": "scanner-primary", "fingerprint": "7d8a2f852d466dc0", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-9de70b656d2e5d98", "level": "none", "message": {"text": "Commented-code block (12 lines) in utils/sentry_setup.py:122"}, "properties": {"repobilityId": "294e430cc9c20d21", "scanner": "scanner-primary", "fingerprint": "9de70b656d2e5d98", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-153a9b764543718e", "level": "note", "message": {"text": "Legacy-named symbol `response_copy` in utils/error_handling.py:484"}, "properties": {"repobilityId": "b6989c0923b9e675", "scanner": "scanner-primary", "fingerprint": "153a9b764543718e", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-da27b4d9c807059f", "level": "none", "message": {"text": "Commented-code block (6 lines) in utils/error_handling.py:389"}, "properties": {"repobilityId": "4a0229a5acac9838", "scanner": "scanner-primary", "fingerprint": "da27b4d9c807059f", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-85199f7fb78bbdb7", "level": "none", "message": {"text": "Commented-code block (6 lines) in cogs/quotes.py:177"}, "properties": {"repobilityId": "e4a1a4b89377884b", "scanner": "scanner-primary", "fingerprint": "85199f7fb78bbdb7", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-71d4844283bf0992", "level": "none", "message": {"text": "Commented-code block (5 lines) in cogs/heartbeat.py:34"}, "properties": {"repobilityId": "bed5f0a53a097521", "scanner": "scanner-primary", "fingerprint": "71d4844283bf0992", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-98a410bc03c8513f", "level": "none", "message": {"text": "Commented-code block (5 lines) in cogs/twi.py:160"}, "properties": {"repobilityId": "8d60177bef1a2a64", "scanner": "scanner-primary", "fingerprint": "98a410bc03c8513f", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-f2097fd6a8d2ac18", "level": "none", "message": {"text": "Commented-code block (6 lines) in cogs/external_services.py:89"}, "properties": {"repobilityId": "fce7f90fbf59a639", "scanner": "scanner-primary", "fingerprint": "f2097fd6a8d2ac18", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-c6a08246367c01da", "level": "none", "message": {"text": "Commented-code block (6 lines) in cogs/gallery.py:322"}, "properties": {"repobilityId": "afd1433a10a40200", "scanner": "scanner-primary", "fingerprint": "c6a08246367c01da", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-1b5a76780c3df9aa", "level": "none", "message": {"text": "1 env vars used in code but missing from .env.example"}, "properties": {"repobilityId": "d04379b337b44a15", "scanner": "scanner-primary", "fingerprint": "1b5a76780c3df9aa", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "config-drift"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "c7d5986cf3c1895b", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-be46ea126aa5d8dc", "level": "note", "message": {"text": "Near-duplicate function bodies in 3 places"}, "properties": {"repobilityId": "c7d3cca0f9840fcd", "scanner": "scanner-primary", "fingerprint": "be46ea126aa5d8dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "cbbbb455662e953c", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "9ab188aa5c0a5e47", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "14713ab475795795", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "22fa85bcdefc58d0", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-49c98f7cedd9c977", "level": "note", "message": {"text": "Near-duplicate function bodies in 4 places"}, "properties": {"repobilityId": "674b5f951579fdef", "scanner": "scanner-primary", "fingerprint": "49c98f7cedd9c977", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "6ca95cbd1d44b73f", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "b1b772d0c9912955", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "a4e882cbac09a2f7", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "447896673333434d", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "ef9c50c3519eb289", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "4d9ca2b1ce1a077f", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-49c98f7cedd9c977", "level": "note", "message": {"text": "Near-duplicate function bodies in 4 places"}, "properties": {"repobilityId": "e0e0140f67cf2633", "scanner": "scanner-primary", "fingerprint": "49c98f7cedd9c977", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "0f642d8e0e4a05f6", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-49c98f7cedd9c977", "level": "note", "message": {"text": "Near-duplicate function bodies in 4 places"}, "properties": {"repobilityId": "3217a8c436e25243", "scanner": "scanner-primary", "fingerprint": "49c98f7cedd9c977", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "37a4d2952a641d8e", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "ce7f16298178b7bb", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "dda942133dfd74be", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "7de23991ecc0210e", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}]}]}