{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-8defa3b4232dc516", "name": "Possibly dead Python function: process_html_images", "shortDescription": {"text": "Possibly dead Python function: process_html_images"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b5a16561a7ffb2e3", "name": "Possibly dead Python function: replace_src", "shortDescription": {"text": "Possibly dead Python function: replace_src"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-264d5c1797f6a26b", "name": "Possibly dead Python function: repl", "shortDescription": {"text": "Possibly dead Python function: repl"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-20af93a42ce2dc7c", "name": "Possibly dead Python function: replace_src", "shortDescription": {"text": "Possibly dead Python function: replace_src"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d8f51b039c1779d9", "name": "Possibly dead Python function: repl", "shortDescription": {"text": "Possibly dead Python function: repl"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f613a4612a84e35b", "name": "Possibly dead Python function: publish_draft_sync", "shortDescription": {"text": "Possibly dead Python function: publish_draft_sync"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9c82be02aedb74df", "name": "Possibly dead Python function: rewrite", "shortDescription": {"text": "Possibly dead Python function: rewrite"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ecd2a82111ceb9cf", "name": "Possibly dead Python function: rewrite_img_tag", "shortDescription": {"text": "Possibly dead Python function: rewrite_img_tag"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-bf3bac405c3826ed", "name": "Possibly dead Python function: handle_github", "shortDescription": {"text": "Possibly dead Python function: handle_github"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8cd20d539467d2c5", "name": "Docker base image is tag-pinned but not digest-pinned: python:3.11-slim", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: python:3.11-slim"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-faa134129e5545ff", "name": "Docker base image is tag-pinned but not digest-pinned: node:20-alpine", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: node:20-alpine"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b048d166901fd868", "name": "Docker base image is tag-pinned but not digest-pinned: nginx:alpine", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: nginx:alpine"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-186d15298c024e7d", "name": "Insecure pattern 'weak_hash' in README.md:282", "shortDescription": {"text": "Insecure pattern 'weak_hash' in README.md:282"}, "fullDescription": {"text": "Found a known-risky pattern (weak_hash). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f86fbe286dd98d0a", "name": "Insecure pattern 'domparser_html_parse' in frontend/src/utils/clipboard.ts:41", "shortDescription": {"text": "Insecure pattern 'domparser_html_parse' in frontend/src/utils/clipboard.ts:41"}, "fullDescription": {"text": "Found a known-risky pattern (domparser_html_parse). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-49d4a7dc35ec654c", "name": "Insecure pattern 'direct_innerhtml_assignment' in frontend/src/surfaces/editor/CenterStage.tsx:726", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in frontend/src/surfaces/editor/CenterStage.tsx:726"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-bd1af13ae2650ad3", "name": "Insecure pattern 'domparser_html_parse' in frontend/src/surfaces/editor/CenterStage.tsx:87", "shortDescription": {"text": "Insecure pattern 'domparser_html_parse' in frontend/src/surfaces/editor/CenterStage.tsx:87"}, "fullDescription": {"text": "Found a known-risky pattern (domparser_html_parse). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-727cfb4f04a53e76", "name": "Insecure pattern 'direct_innerhtml_assignment' in frontend/src/surfaces/editor/CenterStage.test.tsx:262", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in frontend/src/surfaces/editor/CenterStage.test.tsx:262"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-cd98681938a65c05", "name": "Insecure pattern 'domparser_html_parse' in frontend/src/surfaces/editor/utils/htmlSanitize.ts:21", "shortDescription": {"text": "Insecure pattern 'domparser_html_parse' in frontend/src/surfaces/editor/utils/htmlSanitize.ts:21"}, "fullDescription": {"text": "Found a known-risky pattern (domparser_html_parse). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6372cebde0220094", "name": "No auth library detected", "shortDescription": {"text": "No auth library detected"}, "fullDescription": {"text": "The scanner did not find any standard auth library (JWT, OAuth, NextAuth, Auth0, etc.). The repo has auth/admin/session surface indicators, so auth may live in custom code, in a separate service, or be missing."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-28c4a04bd807da0c", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ad6701f0a8405e22", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-167eb0368dfd68ae", "name": "Very large file: frontend/src/surfaces/editor/CenterStage.tsx (1421 lines)", "shortDescription": {"text": "Very large file: frontend/src/surfaces/editor/CenterStage.tsx (1421 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 66 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-72b2a6250083a784", "name": "Placeholder or mock-heavy implementation detected", "shortDescription": {"text": "Placeholder or mock-heavy implementation detected"}, "fullDescription": {"text": "Found 37 placeholder/mock markers across 13 source files. This often means the repo looks complete while core flows still use generated scaffolding or fake data."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9d79c4077342a7d0", "name": "Runtime service client appears to use placeholder configuration", "shortDescription": {"text": "Runtime service client appears to use placeholder configuration"}, "fullDescription": {"text": "A runtime source file appears to wire Supabase/Firebase/AI/payment-style clients to placeholder URLs, keys, or fallback values. In the Fable corpus this often means the UI/API shape is present while the backend service is not actually configured."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e511c7483a0ac8a3", "name": "Legacy-named symbol `process_html_for_copy` in backend/app/api/v1/publish.py:94", "shortDescription": {"text": "Legacy-named symbol `process_html_for_copy` in backend/app/api/v1/publish.py:94"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2b7bd35bd2bc896e", "name": "Commented-code block (5 lines) in backend/app/api/v1/publish.py:95", "shortDescription": {"text": "Commented-code block (5 lines) in backend/app/api/v1/publish.py:95"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-9bcb8ed346928ecf", "name": "Commented-code block (8 lines) in backend/app/services/agent_svg_prompt.py:59", "shortDescription": {"text": "Commented-code block (8 lines) in backend/app/services/agent_svg_prompt.py:59"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-8475284ff144b6a8", "name": "Commented-code block (5 lines) in backend/app/services/article_to_mbdoc.py:40", "shortDescription": {"text": "Commented-code block (5 lines) in backend/app/services/article_to_mbdoc.py:40"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-a292d174bc76c899", "name": "Commented-code block (5 lines) in backend/app/services/effect_registry.py:85", "shortDescription": {"text": "Commented-code block (5 lines) in backend/app/services/effect_registry.py:85"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-c729be22abfff0d4", "name": "Commented-code block (11 lines) in backend/app/services/svg_validator.py:30", "shortDescription": {"text": "Commented-code block (11 lines) in backend/app/services/svg_validator.py:30"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-948cb5ddb1db85b9", "name": "Commented-code block (7 lines) in backend/app/services/wechat_sanitize.py:162", "shortDescription": {"text": "Commented-code block (7 lines) in backend/app/services/wechat_sanitize.py:162"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-278d07a0eba406b8", "name": "Commented-code block (7 lines) in backend/app/services/css_inline.py:21", "shortDescription": {"text": "Commented-code block (7 lines) in backend/app/services/css_inline.py:21"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-7d92da9c265089e8", "name": "Legacy-named symbol `process_html_for_copy` in backend/app/services/publish_adapter.py:14", "shortDescription": {"text": "Legacy-named symbol `process_html_for_copy` in backend/app/services/publish_adapter.py:14"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-45a917cf7517e65b", "name": "Commented-code block (5 lines) in backend/app/services/publish_adapter.py:22", "shortDescription": {"text": "Commented-code block (5 lines) in backend/app/services/publish_adapter.py:22"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-3960a02e76327f85", "name": "Legacy-named symbol `process_html_for_copy` in backend/app/services/wechat_copy_images.py:17", "shortDescription": {"text": "Legacy-named symbol `process_html_for_copy` in backend/app/services/wechat_copy_images.py:17"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-40f586be5b9d3e53", "name": "Commented-code block (5 lines) in backend/app/services/wechat_copy_images.py:52", "shortDescription": {"text": "Commented-code block (5 lines) in backend/app/services/wechat_copy_images.py:52"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-87e42c2930cf99b7", "name": "Commented-code block (21 lines) in backend/app/services/renderers/heading_paragraph.py:22", "shortDescription": {"text": "Commented-code block (21 lines) in backend/app/services/renderers/heading_paragraph.py:22"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-94232532b113a3da", "name": "Commented-code block (6 lines) in backend/app/services/renderers/markdown_renderer.py:116", "shortDescription": {"text": "Commented-code block (6 lines) in backend/app/services/renderers/markdown_renderer.py:116"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-c3607ade016e7e63", "name": "Commented-code block (5 lines) in backend/tests/test_wechat_safe_sanitizer.py:461", "shortDescription": {"text": "Commented-code block (5 lines) in backend/tests/test_wechat_safe_sanitizer.py:461"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-dd3e7034286728e4", "name": "Commented-code block (8 lines) in backend/tests/test_svg_validator.py:717", "shortDescription": {"text": "Commented-code block (8 lines) in backend/tests/test_svg_validator.py:717"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-269db4af1d0296e5", "name": "Legacy-named symbol `test_export_legacy` in backend/tests/test_export_legacy.py:1", "shortDescription": {"text": "Legacy-named symbol `test_export_legacy` in backend/tests/test_export_legacy.py:1"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-dc3dce996df608cb", "name": "Legacy-named symbol `test_process_for_copy` in backend/tests/test_api_publish.py:18", "shortDescription": {"text": "Legacy-named symbol `test_process_for_copy` in backend/tests/test_api_publish.py:18"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-305f89708344c326", "name": "Commented-code block (7 lines) in backend/tests/test_api_publish.py:80", "shortDescription": {"text": "Commented-code block (7 lines) in backend/tests/test_api_publish.py:80"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-a5cb13a6266cd132", "name": "Commented-code block (13 lines) in backend/tests/visual/infrastructure.py:50", "shortDescription": {"text": "Commented-code block (13 lines) in backend/tests/visual/infrastructure.py:50"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-2759b3c0a875c847", "name": "Network/subprocess call without timeout or try/except \u2014 scripts/verify_nas_wysiwyg_styled.py:32", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/verify_nas_wysiwyg_styled.py:32"}, "fullDescription": {"text": "`urllib.request.urlopen(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8a08bd4c64c73a1f", "name": "Network/subprocess call without timeout or try/except \u2014 scripts/verify_nas_delete_button.py:29", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/verify_nas_delete_button.py:29"}, "fullDescription": {"text": "`urllib.request.urlopen(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2833159d92deac75", "name": "Network/subprocess call without timeout or try/except \u2014 scripts/verify_nas_wysiwyg.py:29", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/verify_nas_wysiwyg.py:29"}, "fullDescription": {"text": "`urllib.request.urlopen(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ba8f217d61436155", "name": "Network/subprocess call without timeout or try/except \u2014 scripts/reseed_nas_articles.py:33", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/reseed_nas_articles.py:33"}, "fullDescription": {"text": "`urllib.request.urlopen(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4eba79a0f60a1c5d", "name": "Commented-code block (6 lines) in frontend/src/utils/clipboard.test.ts:166", "shortDescription": {"text": "Commented-code block (6 lines) in frontend/src/utils/clipboard.test.ts:166"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-cfacb11ff27333fa", "name": "Commented-code block (7 lines) in frontend/src/utils/clipboard.ts:43", "shortDescription": {"text": "Commented-code block (7 lines) in frontend/src/utils/clipboard.ts:43"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-b588fa2e89d74465", "name": "Commented-code block (5 lines) in frontend/src/components/validation/ValidationBlockDialog.tsx:4", "shortDescription": {"text": "Commented-code block (5 lines) in frontend/src/components/validation/ValidationBlockDialog.tsx:4"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-870baff034bc203d", "name": "Commented-code block (5 lines) in frontend/src/features/editor/lint/LintSidebar.tsx:3", "shortDescription": {"text": "Commented-code block (5 lines) in frontend/src/features/editor/lint/LintSidebar.tsx:3"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-4e3f2d2e022a2772", "name": "Commented-code block (5 lines) in frontend/src/features/editor/template-gallery/templates.ts:3", "shortDescription": {"text": "Commented-code block (5 lines) in frontend/src/features/editor/template-gallery/templates.ts:3"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-d146096a2c89d796", "name": "Commented-code block (5 lines) in frontend/src/lib/legacyEndpoints.test.ts:19", "shortDescription": {"text": "Commented-code block (5 lines) in frontend/src/lib/legacyEndpoints.test.ts:19"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-78f7ac4a384bf82d", "name": "Commented-code block (5 lines) in frontend/src/surfaces/editor/CenterStage.tsx:92", "shortDescription": {"text": "Commented-code block (5 lines) in frontend/src/surfaces/editor/CenterStage.tsx:92"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-1637697eeb300254", "name": "Commented-code block (5 lines) in frontend/src/surfaces/editor/CenterStage.test.tsx:853", "shortDescription": {"text": "Commented-code block (5 lines) in frontend/src/surfaces/editor/CenterStage.test.tsx:853"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-6be3050b7a2b8f51", "name": "Commented-code block (6 lines) in frontend/src/surfaces/editor/utils/rawPreview.ts:17", "shortDescription": {"text": "Commented-code block (6 lines) in frontend/src/surfaces/editor/utils/rawPreview.ts:17"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-03815d4c933147c1", "name": "Commented-code block (5 lines) in frontend/src/surfaces/editor/svg-panel/useSvgPatch.ts:5", "shortDescription": {"text": "Commented-code block (5 lines) in frontend/src/surfaces/editor/svg-panel/useSvgPatch.ts:5"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-aed501445ae3b87c", "name": "Commented-code block (5 lines) in frontend/src/surfaces/editor/svg-panel/SvgEditPanel.tsx:15", "shortDescription": {"text": "Commented-code block (5 lines) in frontend/src/surfaces/editor/svg-panel/SvgEditPanel.tsx:15"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-48c86888bed15786", "name": "Commented-code block (5 lines) in frontend/src/surfaces/editor/svg-panel/svgParse.ts:3", "shortDescription": {"text": "Commented-code block (5 lines) in frontend/src/surfaces/editor/svg-panel/svgParse.ts:3"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-853e819ba38e7332", "name": "Commented-code block (5 lines) in frontend/src/surfaces/editor/services/editorApi.test.ts:6", "shortDescription": {"text": "Commented-code block (5 lines) in frontend/src/surfaces/editor/services/editorApi.test.ts:6"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-319e66a630e14977", "name": "2 env vars used in code but missing from .env.example", "shortDescription": {"text": "2 env vars used in code but missing from .env.example"}, "fullDescription": {"text": "Drift between code and config docs. The first few: `MBEDITOR_API`, `MBEDITOR_FRONTEND`. Add them (with a placeholder/comment) to .env.example so onboarding doesn't break."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-2c04133e54348533", "name": "Near-duplicate function bodies in 2 places", "shortDescription": {"text": "Near-duplicate function bodies in 2 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nbackend/app/services/renderers/heading_paragraph.py:render, backend/app/services/renderers/heading_paragraph.py:render\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-be46ea126aa5d8dc", "name": "Near-duplicate function bodies in 3 places", "shortDescription": {"text": "Near-duplicate function bodies in 3 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nscripts/verify_nas_wysiwyg_styled.py:api, scripts/verify_nas_delete_button.py:api, scripts/reseed_nas_articles.py:api\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9bf88a28cca60034", "name": "FastAPI POST `render_effect_endpoint` without auth dependency \u2014 backend/app/api/v1/effects.py:35", "shortDescription": {"text": "FastAPI POST `render_effect_endpoint` without auth dependency \u2014 backend/app/api/v1/effects.py:35"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-80819623238bef47", "name": "FastAPI POST `generate_svg` without auth dependency \u2014 backend/app/api/v1/agent_generate.py:22", "shortDescription": {"text": "FastAPI POST `generate_svg` without auth dependency \u2014 backend/app/api/v1/agent_generate.py:22"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-0ff6dcc3ad1b7178", "name": "FastAPI POST `validate_wechat_html` without auth dependency \u2014 backend/app/api/v1/validate.py:20", "shortDescription": {"text": "FastAPI POST `validate_wechat_html` without auth dependency \u2014 backend/app/api/v1/validate.py:20"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-97ccd46618b1ae50", "name": "FastAPI POST `test_connection` without auth dependency \u2014 backend/app/api/v1/wechat_stateless.py:36", "shortDescription": {"text": "FastAPI POST `test_connection` without auth dependency \u2014 backend/app/api/v1/wechat_stateless.py:36"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-9ab3d10d6e9fc4b8", "name": "FastAPI POST `upload_image` without auth dependency \u2014 backend/app/api/v1/wechat_stateless.py:42", "shortDescription": {"text": "FastAPI POST `upload_image` without auth dependency \u2014 backend/app/api/v1/wechat_stateless.py:42"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-863c90c7930e3901", "name": "FastAPI POST `create_draft` without auth dependency \u2014 backend/app/api/v1/wechat_stateless.py:54", "shortDescription": {"text": "FastAPI POST `create_draft` without auth dependency \u2014 backend/app/api/v1/wechat_stateless.py:54"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-5b24b32467d47d90", "name": "FastAPI POST `import_html` without auth dependency \u2014 backend/app/api/v1/publish.py:62", "shortDescription": {"text": "FastAPI POST `import_html` without auth dependency \u2014 backend/app/api/v1/publish.py:62"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-30f91264a92b0897", "name": "FastAPI POST `preview_wechat` without auth dependency \u2014 backend/app/api/v1/publish.py:88", "shortDescription": {"text": "FastAPI POST `preview_wechat` without auth dependency \u2014 backend/app/api/v1/publish.py:88"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-a2eac5f08cab65b1", "name": "FastAPI POST `process_html_for_copy` without auth dependency \u2014 backend/app/api/v1/publish.py:93", "shortDescription": {"text": "FastAPI POST `process_html_for_copy` without auth dependency \u2014 backend/app/api/v1/publish.py:93"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-63b77c487054fd8a", "name": "FastAPI POST `preview_mbdoc` without auth dependency \u2014 backend/app/api/v1/publish.py:116", "shortDescription": {"text": "FastAPI POST `preview_mbdoc` without auth dependency \u2014 backend/app/api/v1/publish.py:116"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-985d8dc1ef45d950", "name": "FastAPI POST `process_mbdoc_for_copy` without auth dependency \u2014 backend/app/api/v1/publish.py:139", "shortDescription": {"text": "FastAPI POST `process_mbdoc_for_copy` without auth dependency \u2014 backend/app/api/v1/publish.py:139"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-0e88cea3dd6b8b86", "name": "FastAPI POST `create_document` without auth dependency \u2014 backend/app/api/v1/mbdocs.py:49", "shortDescription": {"text": "FastAPI POST `create_document` without auth dependency \u2014 backend/app/api/v1/mbdocs.py:49"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-7913708d126ff308", "name": "FastAPI PUT `update_document` without auth dependency \u2014 backend/app/api/v1/mbdocs.py:69", "shortDescription": {"text": "FastAPI PUT `update_document` without auth dependency \u2014 backend/app/api/v1/mbdocs.py:69"}, "fullDescription": {"text": "`@router.put` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-e8380e45b5fdcb62", "name": "FastAPI DELETE `delete_document` without auth dependency \u2014 backend/app/api/v1/mbdocs.py:91", "shortDescription": {"text": "FastAPI DELETE `delete_document` without auth dependency \u2014 backend/app/api/v1/mbdocs.py:91"}, "fullDescription": {"text": "`@router.delete` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/23831"}, "properties": {"repository": "AAAAAnson/mbeditor", "repoUrl": "https://github.com/AAAAAnson/mbeditor", "branch": "main"}, "results": [{"ruleId": "scanner-8defa3b4232dc516", "level": "note", "message": {"text": "Possibly dead Python function: process_html_images"}, "properties": {"repobilityId": "856e668838cff8e7", "scanner": "scanner-primary", "fingerprint": "8defa3b4232dc516", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/services/wechat_service.py:117"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b5a16561a7ffb2e3", "level": "note", "message": {"text": "Possibly dead Python function: replace_src"}, "properties": {"repobilityId": "6fbf4387590e32cb", "scanner": "scanner-primary", "fingerprint": "b5a16561a7ffb2e3", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/services/wechat_service.py:127"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-264d5c1797f6a26b", "level": "note", "message": {"text": "Possibly dead Python function: repl"}, "properties": {"repobilityId": "6f5d3779bbb8be8b", "scanner": "scanner-primary", "fingerprint": "264d5c1797f6a26b", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/services/raster_worker.py:58"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-20af93a42ce2dc7c", "level": "note", "message": {"text": "Possibly dead Python function: replace_src"}, "properties": {"repobilityId": "6fbf4387590e32cb", "scanner": "scanner-primary", "fingerprint": "20af93a42ce2dc7c", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/services/local_imgbed_service.py:104"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d8f51b039c1779d9", "level": "note", "message": {"text": "Possibly dead Python function: repl"}, "properties": {"repobilityId": "6f5d3779bbb8be8b", "scanner": "scanner-primary", "fingerprint": "d8f51b039c1779d9", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/services/css_inline.py:80"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f613a4612a84e35b", "level": "note", "message": {"text": "Possibly dead Python function: publish_draft_sync"}, "properties": {"repobilityId": "335d8494bc7001c4", "scanner": "scanner-primary", "fingerprint": "f613a4612a84e35b", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/services/publish_adapter.py:33"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-9c82be02aedb74df", "level": "note", "message": {"text": "Possibly dead Python function: rewrite"}, "properties": {"repobilityId": "b5937c294869f30f", "scanner": "scanner-primary", "fingerprint": "9c82be02aedb74df", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/services/wechat_copy_images.py:78"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ecd2a82111ceb9cf", "level": "note", "message": {"text": "Possibly dead Python function: rewrite_img_tag"}, "properties": {"repobilityId": "98b1a77e1f7dde6c", "scanner": "scanner-primary", "fingerprint": "ecd2a82111ceb9cf", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/services/wechat_copy_images.py:126"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-bf3bac405c3826ed", "level": "note", "message": {"text": "Possibly dead Python function: handle_github"}, "properties": {"repobilityId": "5c5c44ad8d8af032", "scanner": "scanner-primary", "fingerprint": "bf3bac405c3826ed", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/verify_image_host_settings.py:33"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-8cd20d539467d2c5", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: python:3.11-slim"}, "properties": {"repobilityId": "06b87ac9439092d6", "scanner": "scanner-primary", "fingerprint": "8cd20d539467d2c5", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/Dockerfile"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-faa134129e5545ff", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: node:20-alpine"}, "properties": {"repobilityId": "3e90d440e1f9ece1", "scanner": "scanner-primary", "fingerprint": "faa134129e5545ff", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/Dockerfile"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b048d166901fd868", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: nginx:alpine"}, "properties": {"repobilityId": "bdb9129d0374cdf5", "scanner": "scanner-primary", "fingerprint": "b048d166901fd868", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/Dockerfile"}, "region": {"startLine": 10}}}]}, {"ruleId": "scanner-186d15298c024e7d", "level": "warning", "message": {"text": "Insecure pattern 'weak_hash' in README.md:282"}, "properties": {"repobilityId": "5388562008acceec", "scanner": "scanner-primary", "fingerprint": "186d15298c024e7d", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "weak_hash"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "README.md"}, "region": {"startLine": 282}}}]}, {"ruleId": "scanner-f86fbe286dd98d0a", "level": "warning", "message": {"text": "Insecure pattern 'domparser_html_parse' in frontend/src/utils/clipboard.ts:41"}, "properties": {"repobilityId": "5cc2e16b604e89f2", "scanner": "scanner-primary", "fingerprint": "f86fbe286dd98d0a", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "domparser_html_parse"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/utils/clipboard.ts"}, "region": {"startLine": 41}}}]}, {"ruleId": "scanner-49d4a7dc35ec654c", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in frontend/src/surfaces/editor/CenterStage.tsx:726"}, "properties": {"repobilityId": "18d4a285c66fde4a", "scanner": "scanner-primary", "fingerprint": "49d4a7dc35ec654c", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/surfaces/editor/CenterStage.tsx"}, "region": {"startLine": 726}}}]}, {"ruleId": "scanner-bd1af13ae2650ad3", "level": "warning", "message": {"text": "Insecure pattern 'domparser_html_parse' in frontend/src/surfaces/editor/CenterStage.tsx:87"}, "properties": {"repobilityId": "09292703e0eb0a8e", "scanner": "scanner-primary", "fingerprint": "bd1af13ae2650ad3", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "domparser_html_parse"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/surfaces/editor/CenterStage.tsx"}, "region": {"startLine": 87}}}]}, {"ruleId": "scanner-727cfb4f04a53e76", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in frontend/src/surfaces/editor/CenterStage.test.tsx:262"}, "properties": {"repobilityId": "d047bbec7e79ce0c", "scanner": "scanner-primary", "fingerprint": "727cfb4f04a53e76", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/surfaces/editor/CenterStage.test.tsx"}, "region": {"startLine": 262}}}]}, {"ruleId": "scanner-cd98681938a65c05", "level": "warning", "message": {"text": "Insecure pattern 'domparser_html_parse' in frontend/src/surfaces/editor/utils/htmlSanitize.ts:21"}, "properties": {"repobilityId": "7384dccef0b13aa7", "scanner": "scanner-primary", "fingerprint": "cd98681938a65c05", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "domparser_html_parse"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/surfaces/editor/utils/htmlSanitize.ts"}, "region": {"startLine": 21}}}]}, {"ruleId": "scanner-6372cebde0220094", "level": "warning", "message": {"text": "No auth library detected"}, "properties": {"repobilityId": "a5b6035a5bbf8054", "scanner": "scanner-primary", "fingerprint": "6372cebde0220094", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["coverage", "auth"]}}, {"ruleId": "scanner-28c4a04bd807da0c", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "2aee2e2d969c7c6b", "scanner": "scanner-primary", "fingerprint": "28c4a04bd807da0c", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/deploy.yml"}, "region": {"startLine": 26}}}]}, {"ruleId": "scanner-28c4a04bd807da0c", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "cdd488c07b90bf4b", "scanner": "scanner-primary", "fingerprint": "28c4a04bd807da0c", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/deploy.yml"}, "region": {"startLine": 33}}}]}, {"ruleId": "scanner-28c4a04bd807da0c", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "5206950cf3c3cb8f", "scanner": "scanner-primary", "fingerprint": "28c4a04bd807da0c", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/deploy.yml"}, "region": {"startLine": 36}}}]}, {"ruleId": "scanner-28c4a04bd807da0c", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "b5ff68ae3a5989fc", "scanner": "scanner-primary", "fingerprint": "28c4a04bd807da0c", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/deploy.yml"}, "region": {"startLine": 43}}}]}, {"ruleId": "scanner-28c4a04bd807da0c", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "b5ff68ae3a5989fc", "scanner": "scanner-primary", "fingerprint": "28c4a04bd807da0c", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/deploy.yml"}, "region": {"startLine": 54}}}]}, {"ruleId": "scanner-ad6701f0a8405e22", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "8384c23520d55657", "scanner": "scanner-primary", "fingerprint": "ad6701f0a8405e22", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/deploy.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-167eb0368dfd68ae", "level": "note", "message": {"text": "Very large file: frontend/src/surfaces/editor/CenterStage.tsx (1421 lines)"}, "properties": {"repobilityId": "c73f2a92a1dd4ff9", "scanner": "scanner-primary", "fingerprint": "167eb0368dfd68ae", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "a2b74cbba1cfe2b1", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-72b2a6250083a784", "level": "warning", "message": {"text": "Placeholder or mock-heavy implementation detected"}, "properties": {"repobilityId": "b038854ad76a8e13", "scanner": "scanner-primary", "fingerprint": "72b2a6250083a784", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "incomplete", "generated-repo-pattern"]}}, {"ruleId": "scanner-9d79c4077342a7d0", "level": "warning", "message": {"text": "Runtime service client appears to use placeholder configuration"}, "properties": {"repobilityId": "e293f70b06b09b78", "scanner": "scanner-primary", "fingerprint": "9d79c4077342a7d0", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "runtime-config", "service-client", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "992678094fc27a38", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-e511c7483a0ac8a3", "level": "note", "message": {"text": "Legacy-named symbol `process_html_for_copy` in backend/app/api/v1/publish.py:94"}, "properties": {"repobilityId": "15770b0bd1ebe1f1", "scanner": "scanner-primary", "fingerprint": "e511c7483a0ac8a3", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-2b7bd35bd2bc896e", "level": "none", "message": {"text": "Commented-code block (5 lines) in backend/app/api/v1/publish.py:95"}, "properties": {"repobilityId": "0f9018125b0ddbbe", "scanner": "scanner-primary", "fingerprint": "2b7bd35bd2bc896e", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-9bcb8ed346928ecf", "level": "none", "message": {"text": "Commented-code block (8 lines) in backend/app/services/agent_svg_prompt.py:59"}, "properties": {"repobilityId": "8dc08c163b5439a1", "scanner": "scanner-primary", "fingerprint": "9bcb8ed346928ecf", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-8475284ff144b6a8", "level": "none", "message": {"text": "Commented-code block (5 lines) in backend/app/services/article_to_mbdoc.py:40"}, "properties": {"repobilityId": "8400d18f5c599321", "scanner": "scanner-primary", "fingerprint": "8475284ff144b6a8", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-a292d174bc76c899", "level": "none", "message": {"text": "Commented-code block (5 lines) in backend/app/services/effect_registry.py:85"}, "properties": {"repobilityId": "0c69a39ff7a7383f", "scanner": "scanner-primary", "fingerprint": "a292d174bc76c899", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-c729be22abfff0d4", "level": "none", "message": {"text": "Commented-code block (11 lines) in backend/app/services/svg_validator.py:30"}, "properties": {"repobilityId": "b959435fa9313131", "scanner": "scanner-primary", "fingerprint": "c729be22abfff0d4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-948cb5ddb1db85b9", "level": "none", "message": {"text": "Commented-code block (7 lines) in backend/app/services/wechat_sanitize.py:162"}, "properties": {"repobilityId": "c4df4eac5c664761", "scanner": "scanner-primary", "fingerprint": "948cb5ddb1db85b9", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-278d07a0eba406b8", "level": "none", "message": {"text": "Commented-code block (7 lines) in backend/app/services/css_inline.py:21"}, "properties": {"repobilityId": "b4efc44af8a1c722", "scanner": "scanner-primary", "fingerprint": "278d07a0eba406b8", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-7d92da9c265089e8", "level": "note", "message": {"text": "Legacy-named symbol `process_html_for_copy` in backend/app/services/publish_adapter.py:14"}, "properties": {"repobilityId": "3cf2639bf8d338ec", "scanner": "scanner-primary", "fingerprint": "7d92da9c265089e8", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-45a917cf7517e65b", "level": "none", "message": {"text": "Commented-code block (5 lines) in backend/app/services/publish_adapter.py:22"}, "properties": {"repobilityId": "3a610ba91691b749", "scanner": "scanner-primary", "fingerprint": "45a917cf7517e65b", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-3960a02e76327f85", "level": "note", "message": {"text": "Legacy-named symbol `process_html_for_copy` in backend/app/services/wechat_copy_images.py:17"}, "properties": {"repobilityId": "b3826077187be4ab", "scanner": "scanner-primary", "fingerprint": "3960a02e76327f85", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-40f586be5b9d3e53", "level": "none", "message": {"text": "Commented-code block (5 lines) in backend/app/services/wechat_copy_images.py:52"}, "properties": {"repobilityId": "10f35e66264ae163", "scanner": "scanner-primary", "fingerprint": "40f586be5b9d3e53", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-87e42c2930cf99b7", "level": "none", "message": {"text": "Commented-code block (21 lines) in backend/app/services/renderers/heading_paragraph.py:22"}, "properties": {"repobilityId": "6e007e2686ea76bc", "scanner": "scanner-primary", "fingerprint": "87e42c2930cf99b7", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-94232532b113a3da", "level": "none", "message": {"text": "Commented-code block (6 lines) in backend/app/services/renderers/markdown_renderer.py:116"}, "properties": {"repobilityId": "0c4c89f8bf5125cb", "scanner": "scanner-primary", "fingerprint": "94232532b113a3da", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-c3607ade016e7e63", "level": "none", "message": {"text": "Commented-code block (5 lines) in backend/tests/test_wechat_safe_sanitizer.py:461"}, "properties": {"repobilityId": "7c611b675c11362f", "scanner": "scanner-primary", "fingerprint": "c3607ade016e7e63", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-dd3e7034286728e4", "level": "none", "message": {"text": "Commented-code block (8 lines) in backend/tests/test_svg_validator.py:717"}, "properties": {"repobilityId": "6ce3c9d392fb750f", "scanner": "scanner-primary", "fingerprint": "dd3e7034286728e4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-269db4af1d0296e5", "level": "note", "message": {"text": "Legacy-named symbol `test_export_legacy` in backend/tests/test_export_legacy.py:1"}, "properties": {"repobilityId": "80386d9fe649cfd7", "scanner": "scanner-primary", "fingerprint": "269db4af1d0296e5", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-dc3dce996df608cb", "level": "note", "message": {"text": "Legacy-named symbol `test_process_for_copy` in backend/tests/test_api_publish.py:18"}, "properties": {"repobilityId": "b71b047315e9d478", "scanner": "scanner-primary", "fingerprint": "dc3dce996df608cb", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-305f89708344c326", "level": "none", "message": {"text": "Commented-code block (7 lines) in backend/tests/test_api_publish.py:80"}, "properties": {"repobilityId": "86a7017253ca0741", "scanner": "scanner-primary", "fingerprint": "305f89708344c326", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-a5cb13a6266cd132", "level": "none", "message": {"text": "Commented-code block (13 lines) in backend/tests/visual/infrastructure.py:50"}, "properties": {"repobilityId": "69e1ed324a58d299", "scanner": "scanner-primary", "fingerprint": "a5cb13a6266cd132", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-2759b3c0a875c847", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/verify_nas_wysiwyg_styled.py:32"}, "properties": {"repobilityId": "d347a91ac525a056", "scanner": "scanner-primary", "fingerprint": "2759b3c0a875c847", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-8a08bd4c64c73a1f", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/verify_nas_delete_button.py:29"}, "properties": {"repobilityId": "511a4273f0c621c6", "scanner": "scanner-primary", "fingerprint": "8a08bd4c64c73a1f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-2833159d92deac75", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/verify_nas_wysiwyg.py:29"}, "properties": {"repobilityId": "9ad88374ba5b41b6", "scanner": "scanner-primary", "fingerprint": "2833159d92deac75", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-ba8f217d61436155", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/reseed_nas_articles.py:33"}, "properties": {"repobilityId": "14b228104b9b6f34", "scanner": "scanner-primary", "fingerprint": "ba8f217d61436155", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-4eba79a0f60a1c5d", "level": "none", "message": {"text": "Commented-code block (6 lines) in frontend/src/utils/clipboard.test.ts:166"}, "properties": {"repobilityId": "779dace78ff4953c", "scanner": "scanner-primary", "fingerprint": "4eba79a0f60a1c5d", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-cfacb11ff27333fa", "level": "none", "message": {"text": "Commented-code block (7 lines) in frontend/src/utils/clipboard.ts:43"}, "properties": {"repobilityId": "cdd25a48ef10fd2d", "scanner": "scanner-primary", "fingerprint": "cfacb11ff27333fa", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-b588fa2e89d74465", "level": "none", "message": {"text": "Commented-code block (5 lines) in frontend/src/components/validation/ValidationBlockDialog.tsx:4"}, "properties": {"repobilityId": "a93f0347fc9d44f6", "scanner": "scanner-primary", "fingerprint": "b588fa2e89d74465", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-870baff034bc203d", "level": "none", "message": {"text": "Commented-code block (5 lines) in frontend/src/features/editor/lint/LintSidebar.tsx:3"}, "properties": {"repobilityId": "bc2b38764652dc99", "scanner": "scanner-primary", "fingerprint": "870baff034bc203d", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-4e3f2d2e022a2772", "level": "none", "message": {"text": "Commented-code block (5 lines) in frontend/src/features/editor/template-gallery/templates.ts:3"}, "properties": {"repobilityId": "d6452fe006ec69de", "scanner": "scanner-primary", "fingerprint": "4e3f2d2e022a2772", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-d146096a2c89d796", "level": "none", "message": {"text": "Commented-code block (5 lines) in frontend/src/lib/legacyEndpoints.test.ts:19"}, "properties": {"repobilityId": "0c08bb166cb3ed72", "scanner": "scanner-primary", "fingerprint": "d146096a2c89d796", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-78f7ac4a384bf82d", "level": "none", "message": {"text": "Commented-code block (5 lines) in frontend/src/surfaces/editor/CenterStage.tsx:92"}, "properties": {"repobilityId": "80127431dec510a3", "scanner": "scanner-primary", "fingerprint": "78f7ac4a384bf82d", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-1637697eeb300254", "level": "none", "message": {"text": "Commented-code block (5 lines) in frontend/src/surfaces/editor/CenterStage.test.tsx:853"}, "properties": {"repobilityId": "42d6eb663f0d8be6", "scanner": "scanner-primary", "fingerprint": "1637697eeb300254", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-6be3050b7a2b8f51", "level": "none", "message": {"text": "Commented-code block (6 lines) in frontend/src/surfaces/editor/utils/rawPreview.ts:17"}, "properties": {"repobilityId": "24d6ab7a44e22e1a", "scanner": "scanner-primary", "fingerprint": "6be3050b7a2b8f51", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-03815d4c933147c1", "level": "none", "message": {"text": "Commented-code block (5 lines) in frontend/src/surfaces/editor/svg-panel/useSvgPatch.ts:5"}, "properties": {"repobilityId": "d332332e1fc9fb5e", "scanner": "scanner-primary", "fingerprint": "03815d4c933147c1", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-aed501445ae3b87c", "level": "none", "message": {"text": "Commented-code block (5 lines) in frontend/src/surfaces/editor/svg-panel/SvgEditPanel.tsx:15"}, "properties": {"repobilityId": "61eede76fd955479", "scanner": "scanner-primary", "fingerprint": "aed501445ae3b87c", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-48c86888bed15786", "level": "none", "message": {"text": "Commented-code block (5 lines) in frontend/src/surfaces/editor/svg-panel/svgParse.ts:3"}, "properties": {"repobilityId": "d6dc04ff294fabad", "scanner": "scanner-primary", "fingerprint": "48c86888bed15786", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-853e819ba38e7332", "level": "none", "message": {"text": "Commented-code block (5 lines) in frontend/src/surfaces/editor/services/editorApi.test.ts:6"}, "properties": {"repobilityId": "d56b288e2eb4a35a", "scanner": "scanner-primary", "fingerprint": "853e819ba38e7332", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-319e66a630e14977", "level": "none", "message": {"text": "2 env vars used in code but missing from .env.example"}, "properties": {"repobilityId": "d838d1fc5d8231c9", "scanner": "scanner-primary", "fingerprint": "319e66a630e14977", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "config-drift"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "885ba3591b2cd5a6", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "324bf8115260ac0f", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-be46ea126aa5d8dc", "level": "note", "message": {"text": "Near-duplicate function bodies in 3 places"}, "properties": {"repobilityId": "f7a7a57111eee8d4", "scanner": "scanner-primary", "fingerprint": "be46ea126aa5d8dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-9bf88a28cca60034", "level": "error", "message": {"text": "FastAPI POST `render_effect_endpoint` without auth dependency \u2014 backend/app/api/v1/effects.py:35"}, "properties": {"repobilityId": "0c05f91fabbd7277", "scanner": "scanner-primary", "fingerprint": "9bf88a28cca60034", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/api/v1/effects.py"}, "region": {"startLine": 35}}}]}, {"ruleId": "scanner-80819623238bef47", "level": "error", "message": {"text": "FastAPI POST `generate_svg` without auth dependency \u2014 backend/app/api/v1/agent_generate.py:22"}, "properties": {"repobilityId": "0ac2fdca39356a2a", "scanner": "scanner-primary", "fingerprint": "80819623238bef47", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/api/v1/agent_generate.py"}, "region": {"startLine": 22}}}]}, {"ruleId": "scanner-0ff6dcc3ad1b7178", "level": "error", "message": {"text": "FastAPI POST `validate_wechat_html` without auth dependency \u2014 backend/app/api/v1/validate.py:20"}, "properties": {"repobilityId": "9c0fe5b46fcbe0ac", "scanner": "scanner-primary", "fingerprint": "0ff6dcc3ad1b7178", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/api/v1/validate.py"}, "region": {"startLine": 20}}}]}, {"ruleId": "scanner-97ccd46618b1ae50", "level": "error", "message": {"text": "FastAPI POST `test_connection` without auth dependency \u2014 backend/app/api/v1/wechat_stateless.py:36"}, "properties": {"repobilityId": "7147d93fd4b5b93d", "scanner": "scanner-primary", "fingerprint": "97ccd46618b1ae50", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/api/v1/wechat_stateless.py"}, "region": {"startLine": 36}}}]}, {"ruleId": "scanner-9ab3d10d6e9fc4b8", "level": "error", "message": {"text": "FastAPI POST `upload_image` without auth dependency \u2014 backend/app/api/v1/wechat_stateless.py:42"}, "properties": {"repobilityId": "1343c3553bea137c", "scanner": "scanner-primary", "fingerprint": "9ab3d10d6e9fc4b8", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/api/v1/wechat_stateless.py"}, "region": {"startLine": 42}}}]}, {"ruleId": "scanner-863c90c7930e3901", "level": "error", "message": {"text": "FastAPI POST `create_draft` without auth dependency \u2014 backend/app/api/v1/wechat_stateless.py:54"}, "properties": {"repobilityId": "26d1618b1db2015c", "scanner": "scanner-primary", "fingerprint": "863c90c7930e3901", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/api/v1/wechat_stateless.py"}, "region": {"startLine": 54}}}]}, {"ruleId": "scanner-5b24b32467d47d90", "level": "error", "message": {"text": "FastAPI POST `import_html` without auth dependency \u2014 backend/app/api/v1/publish.py:62"}, "properties": {"repobilityId": "b435b3241de2c9d0", "scanner": "scanner-primary", "fingerprint": "5b24b32467d47d90", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/api/v1/publish.py"}, "region": {"startLine": 62}}}]}, {"ruleId": "scanner-30f91264a92b0897", "level": "error", "message": {"text": "FastAPI POST `preview_wechat` without auth dependency \u2014 backend/app/api/v1/publish.py:88"}, "properties": {"repobilityId": "ddece97d66ad7cbb", "scanner": "scanner-primary", "fingerprint": "30f91264a92b0897", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/api/v1/publish.py"}, "region": {"startLine": 88}}}]}, {"ruleId": "scanner-a2eac5f08cab65b1", "level": "error", "message": {"text": "FastAPI POST `process_html_for_copy` without auth dependency \u2014 backend/app/api/v1/publish.py:93"}, "properties": {"repobilityId": "d41b3d7bee8025e9", "scanner": "scanner-primary", "fingerprint": "a2eac5f08cab65b1", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/api/v1/publish.py"}, "region": {"startLine": 93}}}]}, {"ruleId": "scanner-63b77c487054fd8a", "level": "error", "message": {"text": "FastAPI POST `preview_mbdoc` without auth dependency \u2014 backend/app/api/v1/publish.py:116"}, "properties": {"repobilityId": "c08926147e52c322", "scanner": "scanner-primary", "fingerprint": "63b77c487054fd8a", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/api/v1/publish.py"}, "region": {"startLine": 116}}}]}, {"ruleId": "scanner-985d8dc1ef45d950", "level": "error", "message": {"text": "FastAPI POST `process_mbdoc_for_copy` without auth dependency \u2014 backend/app/api/v1/publish.py:139"}, "properties": {"repobilityId": "a3c216994a2a5638", "scanner": "scanner-primary", "fingerprint": "985d8dc1ef45d950", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/api/v1/publish.py"}, "region": {"startLine": 139}}}]}, {"ruleId": "scanner-0e88cea3dd6b8b86", "level": "error", "message": {"text": "FastAPI POST `create_document` without auth dependency \u2014 backend/app/api/v1/mbdocs.py:49"}, "properties": {"repobilityId": "a4f474bfec1b24fc", "scanner": "scanner-primary", "fingerprint": "0e88cea3dd6b8b86", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/api/v1/mbdocs.py"}, "region": {"startLine": 49}}}]}, {"ruleId": "scanner-7913708d126ff308", "level": "error", "message": {"text": "FastAPI PUT `update_document` without auth dependency \u2014 backend/app/api/v1/mbdocs.py:69"}, "properties": {"repobilityId": "575a37913fbb5d5e", "scanner": "scanner-primary", "fingerprint": "7913708d126ff308", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/api/v1/mbdocs.py"}, "region": {"startLine": 69}}}]}, {"ruleId": "scanner-e8380e45b5fdcb62", "level": "error", "message": {"text": "FastAPI DELETE `delete_document` without auth dependency \u2014 backend/app/api/v1/mbdocs.py:91"}, "properties": {"repobilityId": "9393296cea1917b0", "scanner": "scanner-primary", "fingerprint": "e8380e45b5fdcb62", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/api/v1/mbdocs.py"}, "region": {"startLine": 91}}}]}]}]}