{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-1d6e239b4f317602", "name": "`dangerouslySetInnerHTML` used in a React component \u2014 src/App.jsx:56", "shortDescription": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 src/App.jsx:56"}, "fullDescription": {"text": "Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library.\n\nWhy: OWASP basics. Already partially flagged by the security analyzer.\nRule id: fq.dangerous-html"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ac5343c298320ca1", "name": "Insecure pattern 'dangerous_innerhtml' in src/App.jsx:56", "shortDescription": {"text": "Insecure pattern 'dangerous_innerhtml' in src/App.jsx:56"}, "fullDescription": {"text": "Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-226e25827fc0067c", "name": "Insecure pattern 'direct_innerhtml_assignment' in src/legacy/rendering.js:8", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in src/legacy/rendering.js:8"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b87fe4315a9c8489", "name": "Insecure pattern 'direct_innerhtml_assignment' in src/legacy/learning.js:1400", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in src/legacy/learning.js:1400"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4d2910d69caacdf7", "name": "Insecure pattern 'direct_innerhtml_assignment' in src/legacy/core.js:393", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in src/legacy/core.js:393"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0699d9627b64b1d9", "name": "Insecure pattern 'direct_innerhtml_assignment' in src/legacy/simulation.js:366", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in src/legacy/simulation.js:366"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6c3881111f2232b4", "name": "Insecure pattern 'direct_innerhtml_assignment' in src/legacy/interactions.js:108", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in src/legacy/interactions.js:108"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6372cebde0220094", "name": "No auth library detected", "shortDescription": {"text": "No auth library detected"}, "fullDescription": {"text": "The scanner did not find any standard auth library (JWT, OAuth, NextAuth, Auth0, etc.). The repo has auth/admin/session surface indicators, so auth may live in custom code, in a separate service, or be missing."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4601e3ad3bb28677", "name": "No CI/CD pipelines detected", "shortDescription": {"text": "No CI/CD pipelines detected"}, "fullDescription": {"text": "No GitHub Actions, GitLab CI, or CircleCI configs found. Without CI you can't gate deploys on tests/lints."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2e8eba8428a13b4c", "name": "Very large file: src/legacy/rendering.js (2187 lines)", "shortDescription": {"text": "Very large file: src/legacy/rendering.js (2187 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9713a091456fcf4d", "name": "Very large file: src/legacy/learning.js (1839 lines)", "shortDescription": {"text": "Very large file: src/legacy/learning.js (1839 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ccfdc1a8036f037e", "name": "Very large file: src/legacy/core.js (1426 lines)", "shortDescription": {"text": "Very large file: src/legacy/core.js (1426 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f3b88c4f7aceb407", "name": "Very large file: src/legacy/simulation.js (1639 lines)", "shortDescription": {"text": "Very large file: src/legacy/simulation.js (1639 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6893a6c8b0861585", "name": "Very low test-to-source ratio", "shortDescription": {"text": "Very low test-to-source ratio"}, "fullDescription": {"text": "0 test file(s) for 9 source file(s) (ratio 0.00). Consider adding integration or unit tests for critical paths."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-141b30a41e03817b", "name": "No license file detected", "shortDescription": {"text": "No license file detected"}, "fullDescription": {"text": "No LICENSE/COPYING/NOTICE file was found. Generated repositories often omit licensing, which blocks reuse and automated intake."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b9088664ace7f748", "name": "Composite production-readiness gap", "shortDescription": {"text": "Composite production-readiness gap"}, "fullDescription": {"text": "Multiple low-cost hardening controls are missing together: license, ci, tests. Opus verification showed these co-occurring gaps are a better readiness signal than reading each flag in isolation."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-037fc44586e61302", "name": "Legacy-named symbol `_dragTermOld` in src/legacy/rendering.js:1695", "shortDescription": {"text": "Legacy-named symbol `_dragTermOld` in src/legacy/rendering.js:1695"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-044df5f86c3b0370", "name": "Commented-code block (7 lines) in src/legacy/rendering.js:54", "shortDescription": {"text": "Commented-code block (7 lines) in src/legacy/rendering.js:54"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-5ce89a63982c0069", "name": "Commented-code block (7 lines) in src/legacy/learning.js:761", "shortDescription": {"text": "Commented-code block (7 lines) in src/legacy/learning.js:761"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-45ffe17497087785", "name": "Legacy-named symbol `_dragTermOld` in src/legacy/core.js:17", "shortDescription": {"text": "Legacy-named symbol `_dragTermOld` in src/legacy/core.js:17"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f625b4a2539ed55b", "name": "Commented-code block (10 lines) in src/legacy/core.js:153", "shortDescription": {"text": "Commented-code block (10 lines) in src/legacy/core.js:153"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-9455312ffc8a6bc2", "name": "Commented-code block (7 lines) in src/legacy/bootstrap.js:10", "shortDescription": {"text": "Commented-code block (7 lines) in src/legacy/bootstrap.js:10"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-611e7c6b7777cd05", "name": "Commented-code block (5 lines) in src/legacy/simulation.js:100", "shortDescription": {"text": "Commented-code block (5 lines) in src/legacy/simulation.js:100"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-d35e86a6d1753874", "name": "Legacy-named symbol `_dragTermOld` in src/legacy/interactions.js:89", "shortDescription": {"text": "Legacy-named symbol `_dragTermOld` in src/legacy/interactions.js:89"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/17804"}, "properties": {"repository": "ranfomshi/elec-sim", "repoUrl": "https://github.com/ranfomshi/elec-sim", "branch": "main"}, "results": [{"ruleId": "scanner-1d6e239b4f317602", "level": "warning", "message": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 src/App.jsx:56"}, "properties": {"repobilityId": "069f3e2ddc64e1ab", "scanner": "scanner-primary", "fingerprint": "1d6e239b4f317602", "layer": "frontend", "severity": "medium", "confidence": 1.0, "tags": ["frontend-quality", "fq.dangerous-html"]}}, {"ruleId": "scanner-ac5343c298320ca1", "level": "warning", "message": {"text": "Insecure pattern 'dangerous_innerhtml' in src/App.jsx:56"}, "properties": {"repobilityId": "8f1f648f5e96efb5", "scanner": "scanner-primary", "fingerprint": "ac5343c298320ca1", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "dangerous_innerhtml"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/App.jsx"}, "region": {"startLine": 56}}}]}, {"ruleId": "scanner-226e25827fc0067c", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in src/legacy/rendering.js:8"}, "properties": {"repobilityId": "7b288a562f083d96", "scanner": "scanner-primary", "fingerprint": "226e25827fc0067c", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/legacy/rendering.js"}, "region": {"startLine": 8}}}]}, {"ruleId": "scanner-b87fe4315a9c8489", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in src/legacy/learning.js:1400"}, "properties": {"repobilityId": "0650b65b7f10746c", "scanner": "scanner-primary", "fingerprint": "b87fe4315a9c8489", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/legacy/learning.js"}, "region": {"startLine": 1400}}}]}, {"ruleId": "scanner-4d2910d69caacdf7", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in src/legacy/core.js:393"}, "properties": {"repobilityId": "f593a034654b76a8", "scanner": "scanner-primary", "fingerprint": "4d2910d69caacdf7", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/legacy/core.js"}, "region": {"startLine": 393}}}]}, {"ruleId": "scanner-0699d9627b64b1d9", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in src/legacy/simulation.js:366"}, "properties": {"repobilityId": "4b1f5e27419b6c64", "scanner": "scanner-primary", "fingerprint": "0699d9627b64b1d9", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/legacy/simulation.js"}, "region": {"startLine": 366}}}]}, {"ruleId": "scanner-6c3881111f2232b4", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in src/legacy/interactions.js:108"}, "properties": {"repobilityId": "73da60e8ed0f9621", "scanner": "scanner-primary", "fingerprint": "6c3881111f2232b4", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/legacy/interactions.js"}, "region": {"startLine": 108}}}]}, {"ruleId": "scanner-6372cebde0220094", "level": "warning", "message": {"text": "No auth library detected"}, "properties": {"repobilityId": "a5b6035a5bbf8054", "scanner": "scanner-primary", "fingerprint": "6372cebde0220094", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["coverage", "auth"]}}, {"ruleId": "scanner-4601e3ad3bb28677", "level": "warning", "message": {"text": "No CI/CD pipelines detected"}, "properties": {"repobilityId": "c3ee439bce2bc51e", "scanner": "scanner-primary", "fingerprint": "4601e3ad3bb28677", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-2e8eba8428a13b4c", "level": "note", "message": {"text": "Very large file: src/legacy/rendering.js (2187 lines)"}, "properties": {"repobilityId": "790d70f33938aa45", "scanner": "scanner-primary", "fingerprint": "2e8eba8428a13b4c", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-9713a091456fcf4d", "level": "note", "message": {"text": "Very large file: src/legacy/learning.js (1839 lines)"}, "properties": {"repobilityId": "98680d43e776355c", "scanner": "scanner-primary", "fingerprint": "9713a091456fcf4d", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-ccfdc1a8036f037e", "level": "note", "message": {"text": "Very large file: src/legacy/core.js (1426 lines)"}, "properties": {"repobilityId": "9d398c5ffaccb9e4", "scanner": "scanner-primary", "fingerprint": "ccfdc1a8036f037e", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-f3b88c4f7aceb407", "level": "note", "message": {"text": "Very large file: src/legacy/simulation.js (1639 lines)"}, "properties": {"repobilityId": "a752e930c1da8373", "scanner": "scanner-primary", "fingerprint": "f3b88c4f7aceb407", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-6893a6c8b0861585", "level": "warning", "message": {"text": "Very low test-to-source ratio"}, "properties": {"repobilityId": "54a7de3f06314bf0", "scanner": "scanner-primary", "fingerprint": "6893a6c8b0861585", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["tests", "coverage"]}}, {"ruleId": "scanner-141b30a41e03817b", "level": "note", "message": {"text": "No license file detected"}, "properties": {"repobilityId": "9b2bf97dabaf8d65", "scanner": "scanner-primary", "fingerprint": "141b30a41e03817b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["license", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-b9088664ace7f748", "level": "warning", "message": {"text": "Composite production-readiness gap"}, "properties": {"repobilityId": "4dadaace494dff12", "scanner": "scanner-primary", "fingerprint": "b9088664ace7f748", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["production-readiness", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "e189acd9a953d663", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "631364a71fdd0e64", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-037fc44586e61302", "level": "note", "message": {"text": "Legacy-named symbol `_dragTermOld` in src/legacy/rendering.js:1695"}, "properties": {"repobilityId": "8ce2dbcc9ad66427", "scanner": "scanner-primary", "fingerprint": "037fc44586e61302", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-044df5f86c3b0370", "level": "none", "message": {"text": "Commented-code block (7 lines) in src/legacy/rendering.js:54"}, "properties": {"repobilityId": "c7930f815ff402f3", "scanner": "scanner-primary", "fingerprint": "044df5f86c3b0370", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-5ce89a63982c0069", "level": "none", "message": {"text": "Commented-code block (7 lines) in src/legacy/learning.js:761"}, "properties": {"repobilityId": "4cb5e9721981e71c", "scanner": "scanner-primary", "fingerprint": "5ce89a63982c0069", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-45ffe17497087785", "level": "note", "message": {"text": "Legacy-named symbol `_dragTermOld` in src/legacy/core.js:17"}, "properties": {"repobilityId": "99f09a508dfda19b", "scanner": "scanner-primary", "fingerprint": "45ffe17497087785", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-f625b4a2539ed55b", "level": "none", "message": {"text": "Commented-code block (10 lines) in src/legacy/core.js:153"}, "properties": {"repobilityId": "7b077230d1113313", "scanner": "scanner-primary", "fingerprint": "f625b4a2539ed55b", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-9455312ffc8a6bc2", "level": "none", "message": {"text": "Commented-code block (7 lines) in src/legacy/bootstrap.js:10"}, "properties": {"repobilityId": "5f126e53a51e7289", "scanner": "scanner-primary", "fingerprint": "9455312ffc8a6bc2", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-611e7c6b7777cd05", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/legacy/simulation.js:100"}, "properties": {"repobilityId": "9e931b6c75698dff", "scanner": "scanner-primary", "fingerprint": "611e7c6b7777cd05", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-d35e86a6d1753874", "level": "note", "message": {"text": "Legacy-named symbol `_dragTermOld` in src/legacy/interactions.js:89"}, "properties": {"repobilityId": "e6e7acfa38d002d1", "scanner": "scanner-primary", "fingerprint": "d35e86a6d1753874", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}]}]}