{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-e90ec0b90cc1b83e", "name": "Stray `console.log` in TS/JS \u2014 web/src/lib/ws.ts:62", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 web/src/lib/ws.ts:62"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4466917fe5d0be6b", "name": "Stray `console.log` in TS/JS \u2014 examples/demo/api/index.ts:159", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 examples/demo/api/index.ts:159"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-dc9a707958fb19a2", "name": "Stray `console.log` in TS/JS \u2014 examples/demo/loadgen/index.ts:44", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 examples/demo/loadgen/index.ts:44"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-309568c3ab58459b", "name": "Stray `console.log` in TS/JS \u2014 examples/demo/web/index.ts:126", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 examples/demo/web/index.ts:126"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8e7bf2363169d06b", "name": "Stray `console.log` in TS/JS \u2014 examples/telemetry-generator/src/index.ts:39", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 examples/telemetry-generator/src/index.ts:39"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-dcd40781fd8d5071", "name": "Stray `console.log` in TS/JS \u2014 e2e/update-readme-hashes.ts:53", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 e2e/update-readme-hashes.ts:53"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1886c6bf1fc6d781", "name": "Insecure pattern 'node_child_process' in pipeline/src/notify.ts:1", "shortDescription": {"text": "Insecure pattern 'node_child_process' in pipeline/src/notify.ts:1"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6d635614540c2ad8", "name": "Insecure pattern 'node_child_process' in pipeline/src/pipeline.ts:1", "shortDescription": {"text": "Insecure pattern 'node_child_process' in pipeline/src/pipeline.ts:1"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d32074c550c6689c", "name": "Insecure pattern 'node_child_process' in e2e/helpers.ts:1", "shortDescription": {"text": "Insecure pattern 'node_child_process' in e2e/helpers.ts:1"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-38b10c82db96e431", "name": "Insecure pattern 'node_child_process' in e2e/dashboard/screenshots.test.ts:4", "shortDescription": {"text": "Insecure pattern 'node_child_process' in e2e/dashboard/screenshots.test.ts:4"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-46c644c6227e4d4a", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "goreleaser/goreleaser-action@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1838a141491ce38c", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 16 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-485b8bfd39e7b4bf", "name": "Agent authority lacks a verifier contract: skill/claude-code/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: skill/claude-code/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-70c57d5d5a835dbb", "name": "`fetch()` without try/.catch or AbortSignal \u2014 web/src/api/index.ts:134", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 web/src/api/index.ts:134"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e32ddc012cc7f9d9", "name": "`fetch()` without try/.catch or AbortSignal \u2014 examples/demo/loadgen/index.ts:15", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 examples/demo/loadgen/index.ts:15"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a71b10422cd62e78", "name": "`fetch()` without try/.catch or AbortSignal \u2014 examples/demo/web/index.ts:73", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 examples/demo/web/index.ts:73"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/20333"}, "properties": {"repository": "steveyackey/devrig", "repoUrl": "https://github.com/steveyackey/devrig", "branch": "main"}, "results": [{"ruleId": "scanner-e90ec0b90cc1b83e", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 web/src/lib/ws.ts:62"}, "properties": {"repobilityId": "fe96c1dda4427fad", "scanner": "scanner-primary", "fingerprint": "e90ec0b90cc1b83e", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-4466917fe5d0be6b", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 examples/demo/api/index.ts:159"}, "properties": {"repobilityId": "f832328f161bf5e1", "scanner": "scanner-primary", "fingerprint": "4466917fe5d0be6b", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-dc9a707958fb19a2", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 examples/demo/loadgen/index.ts:44"}, "properties": {"repobilityId": "e4a136a83d30e9e8", "scanner": "scanner-primary", "fingerprint": "dc9a707958fb19a2", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-309568c3ab58459b", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 examples/demo/web/index.ts:126"}, "properties": {"repobilityId": "8ac05de56710c60c", "scanner": "scanner-primary", "fingerprint": "309568c3ab58459b", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-8e7bf2363169d06b", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 examples/telemetry-generator/src/index.ts:39"}, "properties": {"repobilityId": "4ab26f64e568ad34", "scanner": "scanner-primary", "fingerprint": "8e7bf2363169d06b", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-dcd40781fd8d5071", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 e2e/update-readme-hashes.ts:53"}, "properties": {"repobilityId": "b755fe23b4f66158", "scanner": "scanner-primary", "fingerprint": "dcd40781fd8d5071", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-1886c6bf1fc6d781", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in pipeline/src/notify.ts:1"}, "properties": {"repobilityId": "6f6c05ad4ee79dae", "scanner": "scanner-primary", "fingerprint": "1886c6bf1fc6d781", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pipeline/src/notify.ts"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6d635614540c2ad8", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in pipeline/src/pipeline.ts:1"}, "properties": {"repobilityId": "c0ddf3cd61216a54", "scanner": "scanner-primary", "fingerprint": "6d635614540c2ad8", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pipeline/src/pipeline.ts"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d32074c550c6689c", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in e2e/helpers.ts:1"}, "properties": {"repobilityId": "16ee504fec6aaf7c", "scanner": "scanner-primary", "fingerprint": "d32074c550c6689c", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "e2e/helpers.ts"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-38b10c82db96e431", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in e2e/dashboard/screenshots.test.ts:4"}, "properties": {"repobilityId": "66d336fdeee969e2", "scanner": "scanner-primary", "fingerprint": "38b10c82db96e431", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "e2e/dashboard/screenshots.test.ts"}, "region": {"startLine": 4}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "4db2bd54c70f0e96", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 30}}}]}, {"ruleId": "scanner-1838a141491ce38c", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "b8fd4f5048f96576", "scanner": "scanner-primary", "fingerprint": "1838a141491ce38c", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "4669ce906991e0fa", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "67bea1d4e9a07aad", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "f670aa1efb09309f", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-485b8bfd39e7b4bf", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: skill/claude-code/SKILL.md"}, "properties": {"repobilityId": "5d6b8b85163191d8", "scanner": "scanner-primary", "fingerprint": "485b8bfd39e7b4bf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skill/claude-code/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-70c57d5d5a835dbb", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 web/src/api/index.ts:134"}, "properties": {"repobilityId": "b96f8625ed5fca4b", "scanner": "scanner-primary", "fingerprint": "70c57d5d5a835dbb", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-e32ddc012cc7f9d9", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 examples/demo/loadgen/index.ts:15"}, "properties": {"repobilityId": "13d0f7afe91325f9", "scanner": "scanner-primary", "fingerprint": "e32ddc012cc7f9d9", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-a71b10422cd62e78", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 examples/demo/web/index.ts:73"}, "properties": {"repobilityId": "fe3d98211e2f7aa1", "scanner": "scanner-primary", "fingerprint": "a71b10422cd62e78", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}]}]}