{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-bead75b0f9233e05", "name": "No API endpoints detected", "shortDescription": {"text": "No API endpoints detected"}, "fullDescription": {"text": "The scanner did not find FastAPI/Flask/Express/NestJS/GraphQL/gRPC routes. If this repo exposes APIs, the framework may be unsupported."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "info", "confidence": 1.0}}, {"id": "scanner-8061115be7dbdb88", "name": "`dangerouslySetInnerHTML` used in a React component \u2014 website/app/layout.tsx:218", "shortDescription": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 website/app/layout.tsx:218"}, "fullDescription": {"text": "Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library.\n\nWhy: OWASP basics. Already partially flagged by the security analyzer.\nRule id: fq.dangerous-html"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a6b9b21a490d0879", "name": "`dangerouslySetInnerHTML` used in a React component \u2014 website/app/about/page.tsx:118", "shortDescription": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 website/app/about/page.tsx:118"}, "fullDescription": {"text": "Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library.\n\nWhy: OWASP basics. Already partially flagged by the security analyzer.\nRule id: fq.dangerous-html"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4d2c3e8c36586ba0", "name": "`dangerouslySetInnerHTML` used in a React component \u2014 website/app/agent-instructions/page.tsx:128", "shortDescription": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 website/app/agent-instructions/page.tsx:128"}, "fullDescription": {"text": "Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library.\n\nWhy: OWASP basics. Already partially flagged by the security analyzer.\nRule id: fq.dangerous-html"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-fe374d44616d6ff4", "name": "`dangerouslySetInnerHTML` used in a React component \u2014 website/app/agent/page.tsx:127", "shortDescription": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 website/app/agent/page.tsx:127"}, "fullDescription": {"text": "Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library.\n\nWhy: OWASP basics. Already partially flagged by the security analyzer.\nRule id: fq.dangerous-html"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9441c23abd2091be", "name": "`dangerouslySetInnerHTML` used in a React component \u2014 website/app/compare/page.tsx:180", "shortDescription": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 website/app/compare/page.tsx:180"}, "fullDescription": {"text": "Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library.\n\nWhy: OWASP basics. Already partially flagged by the security analyzer.\nRule id: fq.dangerous-html"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e8b947c68a121da6", "name": "`dangerouslySetInnerHTML` used in a React component \u2014 website/app/auth/page.tsx:70", "shortDescription": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 website/app/auth/page.tsx:70"}, "fullDescription": {"text": "Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library.\n\nWhy: OWASP basics. Already partially flagged by the security analyzer.\nRule id: fq.dangerous-html"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-35946e7588dd2fa0", "name": "`dangerouslySetInnerHTML` used in a React component \u2014 website/app/webhooks/page.tsx:73", "shortDescription": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 website/app/webhooks/page.tsx:73"}, "fullDescription": {"text": "Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library.\n\nWhy: OWASP basics. Already partially flagged by the security analyzer.\nRule id: fq.dangerous-html"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4b643b0aa66165bd", "name": "\"active\" state uses light bg in a dark theme \u2014 website/app/components/Donate/DonateModal.tsx:119", "shortDescription": {"text": "\"active\" state uses light bg in a dark theme \u2014 website/app/components/Donate/DonateModal.tsx:119"}, "fullDescription": {"text": "A ternary like `active ? 'bg-white' : '...'` (or bg-gray-100/200) on a dark theme produces jarring white pills. Use a dark-emphasized active state instead \u2014 border + ring or slightly brighter dark bg. Example: `active ? 'bg-gray-800 border-gray-500 ring-1 ring-blue-500/30' : '\u2026'`.\n\nWhy: P-E in CHECKLIST.md \u2014 light bg in a dark theme is a class of regression.\nRule id: fq.active-light-bg"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7f032a53af69482d", "name": "`truncate` class without `title=` for hover reveal \u2014 website/app/components/Wall/WallReview.tsx:338", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 website/app/components/Wall/WallReview.tsx:338"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-ea80cc92f5c619f3", "name": "`truncate` class without `title=` for hover reveal \u2014 website/app/components/Wall/StickyNote.tsx:453", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 website/app/components/Wall/StickyNote.tsx:453"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-deefa37137d018ec", "name": "`dangerouslySetInnerHTML` used in a React component \u2014 website/app/rate-limits/page.tsx:62", "shortDescription": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 website/app/rate-limits/page.tsx:62"}, "fullDescription": {"text": "Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library.\n\nWhy: OWASP basics. Already partially flagged by the security analyzer.\nRule id: fq.dangerous-html"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e470bdc10a5c6dfc", "name": "`dangerouslySetInnerHTML` used in a React component \u2014 website/app/mcp/page.tsx:66", "shortDescription": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 website/app/mcp/page.tsx:66"}, "fullDescription": {"text": "Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library.\n\nWhy: OWASP basics. Already partially flagged by the security analyzer.\nRule id: fq.dangerous-html"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-cb2d22ec82597620", "name": "`dangerouslySetInnerHTML` used in a React component \u2014 website/app/errors/page.tsx:63", "shortDescription": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 website/app/errors/page.tsx:63"}, "fullDescription": {"text": "Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library.\n\nWhy: OWASP basics. Already partially flagged by the security analyzer.\nRule id: fq.dangerous-html"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-fa775df3a20fc95e", "name": "`dangerouslySetInnerHTML` used in a React component \u2014 website/app/api-docs/page.tsx:108", "shortDescription": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 website/app/api-docs/page.tsx:108"}, "fullDescription": {"text": "Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library.\n\nWhy: OWASP basics. Already partially flagged by the security analyzer.\nRule id: fq.dangerous-html"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-bd6f6b32c7c6d87f", "name": "`dangerouslySetInnerHTML` used in a React component \u2014 website/app/developers/page.tsx:128", "shortDescription": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 website/app/developers/page.tsx:128"}, "fullDescription": {"text": "Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library.\n\nWhy: OWASP basics. Already partially flagged by the security analyzer.\nRule id: fq.dangerous-html"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-5db62aa98d9a5b3c", "name": "`dangerouslySetInnerHTML` used in a React component \u2014 website/app/privacy/page.tsx:92", "shortDescription": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 website/app/privacy/page.tsx:92"}, "fullDescription": {"text": "Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library.\n\nWhy: OWASP basics. Already partially flagged by the security analyzer.\nRule id: fq.dangerous-html"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-56b7ffe65e340c8b", "name": "`dangerouslySetInnerHTML` used in a React component \u2014 website/app/contact/page.tsx:93", "shortDescription": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 website/app/contact/page.tsx:93"}, "fullDescription": {"text": "Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library.\n\nWhy: OWASP basics. Already partially flagged by the security analyzer.\nRule id: fq.dangerous-html"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-293d934269ac573a", "name": "Stray `console.log` in TS/JS \u2014 website/server/src/index.ts:67", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 website/server/src/index.ts:67"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3e0857cb39aeee53", "name": "Insecure pattern 'dangerous_innerhtml' in website/app/layout.tsx:218", "shortDescription": {"text": "Insecure pattern 'dangerous_innerhtml' in website/app/layout.tsx:218"}, "fullDescription": {"text": "Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-fa900b2bbf2bbd06", "name": "Insecure pattern 'dangerous_innerhtml' in website/app/about/page.tsx:118", "shortDescription": {"text": "Insecure pattern 'dangerous_innerhtml' in website/app/about/page.tsx:118"}, "fullDescription": {"text": "Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d3b5ca33acd5b4d3", "name": "Insecure pattern 'dangerous_innerhtml' in website/app/agent-instructions/page.tsx:128", "shortDescription": {"text": "Insecure pattern 'dangerous_innerhtml' in website/app/agent-instructions/page.tsx:128"}, "fullDescription": {"text": "Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-fc4f33f35b752dec", "name": "Insecure pattern 'dangerous_innerhtml' in website/app/agent/page.tsx:127", "shortDescription": {"text": "Insecure pattern 'dangerous_innerhtml' in website/app/agent/page.tsx:127"}, "fullDescription": {"text": "Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-63e919c1216a7eba", "name": "Insecure pattern 'dangerous_innerhtml' in website/app/compare/page.tsx:180", "shortDescription": {"text": "Insecure pattern 'dangerous_innerhtml' in website/app/compare/page.tsx:180"}, "fullDescription": {"text": "Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3d8dc4f36d78f8cd", "name": "Insecure pattern 'dangerous_innerhtml' in website/app/auth/page.tsx:70", "shortDescription": {"text": "Insecure pattern 'dangerous_innerhtml' in website/app/auth/page.tsx:70"}, "fullDescription": {"text": "Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ff24d9891e4ee389", "name": "Insecure pattern 'dangerous_innerhtml' in website/app/webhooks/page.tsx:73", "shortDescription": {"text": "Insecure pattern 'dangerous_innerhtml' in website/app/webhooks/page.tsx:73"}, "fullDescription": {"text": "Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-dfc8334364c46a40", "name": "Insecure pattern 'dangerous_innerhtml' in website/app/rate-limits/page.tsx:62", "shortDescription": {"text": "Insecure pattern 'dangerous_innerhtml' in website/app/rate-limits/page.tsx:62"}, "fullDescription": {"text": "Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-5083522389586d5b", "name": "Insecure pattern 'dangerous_innerhtml' in website/app/mcp/page.tsx:66", "shortDescription": {"text": "Insecure pattern 'dangerous_innerhtml' in website/app/mcp/page.tsx:66"}, "fullDescription": {"text": "Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-907720f8cd9065cd", "name": "Insecure pattern 'dangerous_innerhtml' in website/app/errors/page.tsx:63", "shortDescription": {"text": "Insecure pattern 'dangerous_innerhtml' in website/app/errors/page.tsx:63"}, "fullDescription": {"text": "Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-32ce48151db1cecf", "name": "Insecure pattern 'dangerous_innerhtml' in website/app/api-docs/page.tsx:108", "shortDescription": {"text": "Insecure pattern 'dangerous_innerhtml' in website/app/api-docs/page.tsx:108"}, "fullDescription": {"text": "Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a35c4f0196b4b4b0", "name": "Insecure pattern 'dangerous_innerhtml' in website/app/developers/page.tsx:128", "shortDescription": {"text": "Insecure pattern 'dangerous_innerhtml' in website/app/developers/page.tsx:128"}, "fullDescription": {"text": "Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-28b967101a760395", "name": "Insecure pattern 'dangerous_innerhtml' in website/app/privacy/page.tsx:92", "shortDescription": {"text": "Insecure pattern 'dangerous_innerhtml' in website/app/privacy/page.tsx:92"}, "fullDescription": {"text": "Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3c6e60cd728668d7", "name": "Insecure pattern 'dangerous_innerhtml' in website/app/contact/page.tsx:93", "shortDescription": {"text": "Insecure pattern 'dangerous_innerhtml' in website/app/contact/page.tsx:93"}, "fullDescription": {"text": "Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e4f658c0c00de0d4", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-448d8837178ae57a", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6893a6c8b0861585", "name": "Very low test-to-source ratio", "shortDescription": {"text": "Very low test-to-source ratio"}, "fullDescription": {"text": "4 test file(s) for 89 source file(s) (ratio 0.04). Consider adding integration or unit tests for critical paths."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b08046b106344907", "name": "Node manifest has dependencies but no lockfile: website/archive/v1/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: website/archive/v1/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 5 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-749d4bc1bd66df5f", "name": "Agent instructions exist but release-hardening basics are missing", "shortDescription": {"text": "Agent instructions exist but release-hardening basics are missing"}, "fullDescription": {"text": "AI-coder instruction files were found, but the repo is missing lockfile. Treat this as a contract gap: the agent is guided, but the generated output is not yet guarded by the controls that make it repeatable."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e725d2ab884fbd49", "name": "Multiple root agent instruction files without precedence", "shortDescription": {"text": "Multiple root agent instruction files without precedence"}, "fullDescription": {"text": "The repo has multiple top-level AI-coder instruction files. Without precedence rules, different agents may follow different policies."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-23aa3a844bffbac5", "name": "Commented-code block (5 lines) in website/app/page.tsx:142", "shortDescription": {"text": "Commented-code block (5 lines) in website/app/page.tsx:142"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-4b1018ccfe124893", "name": "Commented-code block (6 lines) in website/app/hooks/useWallAdmin.ts:11", "shortDescription": {"text": "Commented-code block (6 lines) in website/app/hooks/useWallAdmin.ts:11"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-318e5fb8696233c9", "name": "Commented-code block (6 lines) in website/app/wall/wall-client.tsx:136", "shortDescription": {"text": "Commented-code block (6 lines) in website/app/wall/wall-client.tsx:136"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-7d3e8c0b881ef8d3", "name": "Commented-code block (6 lines) in website/app/components/Wall/WallHeader.tsx:49", "shortDescription": {"text": "Commented-code block (6 lines) in website/app/components/Wall/WallHeader.tsx:49"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-f6909aa4754df91d", "name": "Commented-code block (5 lines) in website/app/components/Wall/StickyNote.tsx:234", "shortDescription": {"text": "Commented-code block (5 lines) in website/app/components/Wall/StickyNote.tsx:234"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-1c2b04baf5e3c305", "name": "Commented-code block (5 lines) in website/app/services/wall.ts:25", "shortDescription": {"text": "Commented-code block (5 lines) in website/app/services/wall.ts:25"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-b5533ab0afa7d08e", "name": "`fetch()` without try/.catch or AbortSignal \u2014 website/app/services/wall.ts:351", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 website/app/services/wall.ts:351"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2b67a4daeef13010", "name": "`fetch()` without try/.catch or AbortSignal \u2014 website/app/services/utils.ts:2", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 website/app/services/utils.ts:2"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4caa483d0c21f7ee", "name": "`fetch()` without try/.catch or AbortSignal \u2014 website/server/src/index.ts:13", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 website/server/src/index.ts:13"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-127a0ff2a7b9b487", "name": "Commented-code block (6 lines) in website/server/src/features/wall.ts:267", "shortDescription": {"text": "Commented-code block (6 lines) in website/server/src/features/wall.ts:267"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-4e16f57ed70bbf78", "name": "Commented-code block (6 lines) in website/server/src/lib/moderation.ts:1", "shortDescription": {"text": "Commented-code block (6 lines) in website/server/src/lib/moderation.ts:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-21336fb4b862dac2", "name": "Commented-code block (8 lines) in website/server/src/lib/geo.ts:1", "shortDescription": {"text": "Commented-code block (8 lines) in website/server/src/lib/geo.ts:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-db2a1b96f614fe76", "name": "Commented-code block (5 lines) in website/server/src/lib/aiJudge.ts:1", "shortDescription": {"text": "Commented-code block (5 lines) in website/server/src/lib/aiJudge.ts:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-fbe507dfdce17bf4", "name": "`fetch()` without try/.catch or AbortSignal \u2014 website/server/src/lib/turnstile.ts:9", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 website/server/src/lib/turnstile.ts:9"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-5598b4a174eb7b70", "name": "Commented-code block (6 lines) in website/server/src/lib/admin.ts:1", "shortDescription": {"text": "Commented-code block (6 lines) in website/server/src/lib/admin.ts:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-51e9ba4926c96fdd", "name": "`fetch()` without try/.catch or AbortSignal \u2014 website/archive/v1/src/releases/index.js:8", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 website/archive/v1/src/releases/index.js:8"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/24800"}, "properties": {"repository": "Caldis/Mos", "repoUrl": "https://github.com/Caldis/Mos", "branch": "main"}, "results": [{"ruleId": "scanner-bead75b0f9233e05", "level": "none", "message": {"text": "No API endpoints detected"}, "properties": {"repobilityId": "0f8bb852027c38f8", "scanner": "scanner-primary", "fingerprint": "bead75b0f9233e05", "layer": "api", "severity": "info", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-8061115be7dbdb88", "level": "warning", "message": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 website/app/layout.tsx:218"}, "properties": {"repobilityId": "9829bb285f86c1da", "scanner": "scanner-primary", "fingerprint": "8061115be7dbdb88", "layer": "frontend", "severity": "medium", "confidence": 1.0, "tags": ["frontend-quality", "fq.dangerous-html"]}}, {"ruleId": "scanner-a6b9b21a490d0879", "level": "warning", "message": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 website/app/about/page.tsx:118"}, "properties": {"repobilityId": "78569d0d67c98308", "scanner": "scanner-primary", "fingerprint": "a6b9b21a490d0879", "layer": "frontend", "severity": "medium", "confidence": 1.0, "tags": ["frontend-quality", "fq.dangerous-html"]}}, {"ruleId": "scanner-4d2c3e8c36586ba0", "level": "warning", "message": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 website/app/agent-instructions/page.tsx:128"}, "properties": {"repobilityId": "3461a350c32e95af", "scanner": "scanner-primary", "fingerprint": "4d2c3e8c36586ba0", "layer": "frontend", "severity": "medium", "confidence": 1.0, "tags": ["frontend-quality", "fq.dangerous-html"]}}, {"ruleId": "scanner-fe374d44616d6ff4", "level": "warning", "message": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 website/app/agent/page.tsx:127"}, "properties": {"repobilityId": "8531c66d0d90b096", "scanner": "scanner-primary", "fingerprint": "fe374d44616d6ff4", "layer": "frontend", "severity": "medium", "confidence": 1.0, "tags": ["frontend-quality", "fq.dangerous-html"]}}, {"ruleId": "scanner-9441c23abd2091be", "level": "warning", "message": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 website/app/compare/page.tsx:180"}, "properties": {"repobilityId": "316e7b34cde7e780", "scanner": "scanner-primary", "fingerprint": "9441c23abd2091be", "layer": "frontend", "severity": "medium", "confidence": 1.0, "tags": ["frontend-quality", "fq.dangerous-html"]}}, {"ruleId": "scanner-e8b947c68a121da6", "level": "warning", "message": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 website/app/auth/page.tsx:70"}, "properties": {"repobilityId": "ed7bfaf1e8f65166", "scanner": "scanner-primary", "fingerprint": "e8b947c68a121da6", "layer": "frontend", "severity": "medium", "confidence": 1.0, "tags": ["frontend-quality", "fq.dangerous-html"]}}, {"ruleId": "scanner-35946e7588dd2fa0", "level": "warning", "message": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 website/app/webhooks/page.tsx:73"}, "properties": {"repobilityId": "e1ab1a250f7d4b66", "scanner": "scanner-primary", "fingerprint": "35946e7588dd2fa0", "layer": "frontend", "severity": "medium", "confidence": 1.0, "tags": ["frontend-quality", "fq.dangerous-html"]}}, {"ruleId": "scanner-4b643b0aa66165bd", "level": "note", "message": {"text": "\"active\" state uses light bg in a dark theme \u2014 website/app/components/Donate/DonateModal.tsx:119"}, "properties": {"repobilityId": "bd331b8e7ede5b68", "scanner": "scanner-primary", "fingerprint": "4b643b0aa66165bd", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.active-light-bg"]}}, {"ruleId": "scanner-7f032a53af69482d", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 website/app/components/Wall/WallReview.tsx:338"}, "properties": {"repobilityId": "afc80d939d591cf0", "scanner": "scanner-primary", "fingerprint": "7f032a53af69482d", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-ea80cc92f5c619f3", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 website/app/components/Wall/StickyNote.tsx:453"}, "properties": {"repobilityId": "6e8e3823e1304b96", "scanner": "scanner-primary", "fingerprint": "ea80cc92f5c619f3", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-deefa37137d018ec", "level": "warning", "message": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 website/app/rate-limits/page.tsx:62"}, "properties": {"repobilityId": "f403458732811156", "scanner": "scanner-primary", "fingerprint": "deefa37137d018ec", "layer": "frontend", "severity": "medium", "confidence": 1.0, "tags": ["frontend-quality", "fq.dangerous-html"]}}, {"ruleId": "scanner-e470bdc10a5c6dfc", "level": "warning", "message": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 website/app/mcp/page.tsx:66"}, "properties": {"repobilityId": "c86a4b9464d36565", "scanner": "scanner-primary", "fingerprint": "e470bdc10a5c6dfc", "layer": "frontend", "severity": "medium", "confidence": 1.0, "tags": ["frontend-quality", "fq.dangerous-html"]}}, {"ruleId": "scanner-cb2d22ec82597620", "level": "warning", "message": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 website/app/errors/page.tsx:63"}, "properties": {"repobilityId": "3f2b01107576fe70", "scanner": "scanner-primary", "fingerprint": "cb2d22ec82597620", "layer": "frontend", "severity": "medium", "confidence": 1.0, "tags": ["frontend-quality", "fq.dangerous-html"]}}, {"ruleId": "scanner-fa775df3a20fc95e", "level": "warning", "message": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 website/app/api-docs/page.tsx:108"}, "properties": {"repobilityId": "89c5e36c1231376a", "scanner": "scanner-primary", "fingerprint": "fa775df3a20fc95e", "layer": "frontend", "severity": "medium", "confidence": 1.0, "tags": ["frontend-quality", "fq.dangerous-html"]}}, {"ruleId": "scanner-bd6f6b32c7c6d87f", "level": "warning", "message": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 website/app/developers/page.tsx:128"}, "properties": {"repobilityId": "5a882283ae3860e8", "scanner": "scanner-primary", "fingerprint": "bd6f6b32c7c6d87f", "layer": "frontend", "severity": "medium", "confidence": 1.0, "tags": ["frontend-quality", "fq.dangerous-html"]}}, {"ruleId": "scanner-5db62aa98d9a5b3c", "level": "warning", "message": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 website/app/privacy/page.tsx:92"}, "properties": {"repobilityId": "4a907efba45bd00f", "scanner": "scanner-primary", "fingerprint": "5db62aa98d9a5b3c", "layer": "frontend", "severity": "medium", "confidence": 1.0, "tags": ["frontend-quality", "fq.dangerous-html"]}}, {"ruleId": "scanner-56b7ffe65e340c8b", "level": "warning", "message": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 website/app/contact/page.tsx:93"}, "properties": {"repobilityId": "35b1877fbbdfbef4", "scanner": "scanner-primary", "fingerprint": "56b7ffe65e340c8b", "layer": "frontend", "severity": "medium", "confidence": 1.0, "tags": ["frontend-quality", "fq.dangerous-html"]}}, {"ruleId": "scanner-293d934269ac573a", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 website/server/src/index.ts:67"}, "properties": {"repobilityId": "ee01919a6c6f41da", "scanner": "scanner-primary", "fingerprint": "293d934269ac573a", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-3e0857cb39aeee53", "level": "warning", "message": {"text": "Insecure pattern 'dangerous_innerhtml' in website/app/layout.tsx:218"}, "properties": {"repobilityId": "449d119062019ae4", "scanner": "scanner-primary", "fingerprint": "3e0857cb39aeee53", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "dangerous_innerhtml"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "website/app/layout.tsx"}, "region": {"startLine": 218}}}]}, {"ruleId": "scanner-fa900b2bbf2bbd06", "level": "warning", "message": {"text": "Insecure pattern 'dangerous_innerhtml' in website/app/about/page.tsx:118"}, "properties": {"repobilityId": "49e64c9c2514dba7", "scanner": "scanner-primary", "fingerprint": "fa900b2bbf2bbd06", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "dangerous_innerhtml"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "website/app/about/page.tsx"}, "region": {"startLine": 118}}}]}, {"ruleId": "scanner-d3b5ca33acd5b4d3", "level": "warning", "message": {"text": "Insecure pattern 'dangerous_innerhtml' in website/app/agent-instructions/page.tsx:128"}, "properties": {"repobilityId": "75959ff903882228", "scanner": "scanner-primary", "fingerprint": "d3b5ca33acd5b4d3", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "dangerous_innerhtml"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "website/app/agent-instructions/page.tsx"}, "region": {"startLine": 128}}}]}, {"ruleId": "scanner-fc4f33f35b752dec", "level": "warning", "message": {"text": "Insecure pattern 'dangerous_innerhtml' in website/app/agent/page.tsx:127"}, "properties": {"repobilityId": "4b18a31de7039469", "scanner": "scanner-primary", "fingerprint": "fc4f33f35b752dec", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "dangerous_innerhtml"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "website/app/agent/page.tsx"}, "region": {"startLine": 127}}}]}, {"ruleId": "scanner-63e919c1216a7eba", "level": "warning", "message": {"text": "Insecure pattern 'dangerous_innerhtml' in website/app/compare/page.tsx:180"}, "properties": {"repobilityId": "f70b4c95789c2068", "scanner": "scanner-primary", "fingerprint": "63e919c1216a7eba", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "dangerous_innerhtml"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "website/app/compare/page.tsx"}, "region": {"startLine": 180}}}]}, {"ruleId": "scanner-3d8dc4f36d78f8cd", "level": "warning", "message": {"text": "Insecure pattern 'dangerous_innerhtml' in website/app/auth/page.tsx:70"}, "properties": {"repobilityId": "fc9c271f895bb250", "scanner": "scanner-primary", "fingerprint": "3d8dc4f36d78f8cd", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "dangerous_innerhtml"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "website/app/auth/page.tsx"}, "region": {"startLine": 70}}}]}, {"ruleId": "scanner-ff24d9891e4ee389", "level": "warning", "message": {"text": "Insecure pattern 'dangerous_innerhtml' in website/app/webhooks/page.tsx:73"}, "properties": {"repobilityId": "f133e4f2a2f09457", "scanner": "scanner-primary", "fingerprint": "ff24d9891e4ee389", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "dangerous_innerhtml"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "website/app/webhooks/page.tsx"}, "region": {"startLine": 73}}}]}, {"ruleId": "scanner-dfc8334364c46a40", "level": "warning", "message": {"text": "Insecure pattern 'dangerous_innerhtml' in website/app/rate-limits/page.tsx:62"}, "properties": {"repobilityId": "8338ff1a43977267", "scanner": "scanner-primary", "fingerprint": "dfc8334364c46a40", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "dangerous_innerhtml"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "website/app/rate-limits/page.tsx"}, "region": {"startLine": 62}}}]}, {"ruleId": "scanner-5083522389586d5b", "level": "warning", "message": {"text": "Insecure pattern 'dangerous_innerhtml' in website/app/mcp/page.tsx:66"}, "properties": {"repobilityId": "0e36279add219725", "scanner": "scanner-primary", "fingerprint": "5083522389586d5b", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "dangerous_innerhtml"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "website/app/mcp/page.tsx"}, "region": {"startLine": 66}}}]}, {"ruleId": "scanner-907720f8cd9065cd", "level": "warning", "message": {"text": "Insecure pattern 'dangerous_innerhtml' in website/app/errors/page.tsx:63"}, "properties": {"repobilityId": "e5ef8b7660002091", "scanner": "scanner-primary", "fingerprint": "907720f8cd9065cd", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "dangerous_innerhtml"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "website/app/errors/page.tsx"}, "region": {"startLine": 63}}}]}, {"ruleId": "scanner-32ce48151db1cecf", "level": "warning", "message": {"text": "Insecure pattern 'dangerous_innerhtml' in website/app/api-docs/page.tsx:108"}, "properties": {"repobilityId": "b0b08f57079f0ba2", "scanner": "scanner-primary", "fingerprint": "32ce48151db1cecf", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "dangerous_innerhtml"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "website/app/api-docs/page.tsx"}, "region": {"startLine": 108}}}]}, {"ruleId": "scanner-a35c4f0196b4b4b0", "level": "warning", "message": {"text": "Insecure pattern 'dangerous_innerhtml' in website/app/developers/page.tsx:128"}, "properties": {"repobilityId": "72567704169ba3d1", "scanner": "scanner-primary", "fingerprint": "a35c4f0196b4b4b0", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "dangerous_innerhtml"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "website/app/developers/page.tsx"}, "region": {"startLine": 128}}}]}, {"ruleId": "scanner-28b967101a760395", "level": "warning", "message": {"text": "Insecure pattern 'dangerous_innerhtml' in website/app/privacy/page.tsx:92"}, "properties": {"repobilityId": "9d9ad556cd5c5060", "scanner": "scanner-primary", "fingerprint": "28b967101a760395", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "dangerous_innerhtml"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "website/app/privacy/page.tsx"}, "region": {"startLine": 92}}}]}, {"ruleId": "scanner-3c6e60cd728668d7", "level": "warning", "message": {"text": "Insecure pattern 'dangerous_innerhtml' in website/app/contact/page.tsx:93"}, "properties": {"repobilityId": "f07f9a7720505c55", "scanner": "scanner-primary", "fingerprint": "3c6e60cd728668d7", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "dangerous_innerhtml"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "website/app/contact/page.tsx"}, "region": {"startLine": 93}}}]}, {"ruleId": "scanner-e4f658c0c00de0d4", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "39d5b9c59fffea83", "scanner": "scanner-primary", "fingerprint": "e4f658c0c00de0d4", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/pages.yml"}, "region": {"startLine": 28}}}]}, {"ruleId": "scanner-e4f658c0c00de0d4", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "0a1d8846d20526c1", "scanner": "scanner-primary", "fingerprint": "e4f658c0c00de0d4", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/pages.yml"}, "region": {"startLine": 31}}}]}, {"ruleId": "scanner-e4f658c0c00de0d4", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "c033b939d10b77a4", "scanner": "scanner-primary", "fingerprint": "e4f658c0c00de0d4", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/pages.yml"}, "region": {"startLine": 38}}}]}, {"ruleId": "scanner-e4f658c0c00de0d4", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "e1a9cc0aa0ef1a08", "scanner": "scanner-primary", "fingerprint": "e4f658c0c00de0d4", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/pages.yml"}, "region": {"startLine": 59}}}]}, {"ruleId": "scanner-e4f658c0c00de0d4", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "3d5c6f08903dde90", "scanner": "scanner-primary", "fingerprint": "e4f658c0c00de0d4", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/pages.yml"}, "region": {"startLine": 74}}}]}, {"ruleId": "scanner-448d8837178ae57a", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "13af6451e15656fc", "scanner": "scanner-primary", "fingerprint": "448d8837178ae57a", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/pages.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6893a6c8b0861585", "level": "warning", "message": {"text": "Very low test-to-source ratio"}, "properties": {"repobilityId": "54a7de3f06314bf0", "scanner": "scanner-primary", "fingerprint": "6893a6c8b0861585", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["tests", "coverage"]}}, {"ruleId": "scanner-b08046b106344907", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: website/archive/v1/package.json"}, "properties": {"repobilityId": "3a51071319be0006", "scanner": "scanner-primary", "fingerprint": "b08046b106344907", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "website/archive/v1/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "d84fd3696f3fb1f2", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "e36fff53c8457ed2", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-749d4bc1bd66df5f", "level": "warning", "message": {"text": "Agent instructions exist but release-hardening basics are missing"}, "properties": {"repobilityId": "a76f0074dad6901a", "scanner": "scanner-primary", "fingerprint": "749d4bc1bd66df5f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-e725d2ab884fbd49", "level": "note", "message": {"text": "Multiple root agent instruction files without precedence"}, "properties": {"repobilityId": "1953db6c89508d22", "scanner": "scanner-primary", "fingerprint": "e725d2ab884fbd49", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["agent-instructions", "governance"]}}, {"ruleId": "scanner-23aa3a844bffbac5", "level": "none", "message": {"text": "Commented-code block (5 lines) in website/app/page.tsx:142"}, "properties": {"repobilityId": "8d40e7578a255fe7", "scanner": "scanner-primary", "fingerprint": "23aa3a844bffbac5", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-4b1018ccfe124893", "level": "none", "message": {"text": "Commented-code block (6 lines) in website/app/hooks/useWallAdmin.ts:11"}, "properties": {"repobilityId": "8fca694fa0e73814", "scanner": "scanner-primary", "fingerprint": "4b1018ccfe124893", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-318e5fb8696233c9", "level": "none", "message": {"text": "Commented-code block (6 lines) in website/app/wall/wall-client.tsx:136"}, "properties": {"repobilityId": "7493a32e249e64de", "scanner": "scanner-primary", "fingerprint": "318e5fb8696233c9", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-7d3e8c0b881ef8d3", "level": "none", "message": {"text": "Commented-code block (6 lines) in website/app/components/Wall/WallHeader.tsx:49"}, "properties": {"repobilityId": "12b0e73d74ec9717", "scanner": "scanner-primary", "fingerprint": "7d3e8c0b881ef8d3", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-f6909aa4754df91d", "level": "none", "message": {"text": "Commented-code block (5 lines) in website/app/components/Wall/StickyNote.tsx:234"}, "properties": {"repobilityId": "fa375bd4cc1a6784", "scanner": "scanner-primary", "fingerprint": "f6909aa4754df91d", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-1c2b04baf5e3c305", "level": "none", "message": {"text": "Commented-code block (5 lines) in website/app/services/wall.ts:25"}, "properties": {"repobilityId": "d0d5ac34e2919b2a", "scanner": "scanner-primary", "fingerprint": "1c2b04baf5e3c305", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-b5533ab0afa7d08e", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 website/app/services/wall.ts:351"}, "properties": {"repobilityId": "033d34a3b7c7d872", "scanner": "scanner-primary", "fingerprint": "b5533ab0afa7d08e", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-2b67a4daeef13010", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 website/app/services/utils.ts:2"}, "properties": {"repobilityId": "1e27aaaf5eb77212", "scanner": "scanner-primary", "fingerprint": "2b67a4daeef13010", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-4caa483d0c21f7ee", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 website/server/src/index.ts:13"}, "properties": {"repobilityId": "7dffee864ed736fa", "scanner": "scanner-primary", "fingerprint": "4caa483d0c21f7ee", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-127a0ff2a7b9b487", "level": "none", "message": {"text": "Commented-code block (6 lines) in website/server/src/features/wall.ts:267"}, "properties": {"repobilityId": "2e66f3a33037fdf1", "scanner": "scanner-primary", "fingerprint": "127a0ff2a7b9b487", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-4e16f57ed70bbf78", "level": "none", "message": {"text": "Commented-code block (6 lines) in website/server/src/lib/moderation.ts:1"}, "properties": {"repobilityId": "0680608798fd39b3", "scanner": "scanner-primary", "fingerprint": "4e16f57ed70bbf78", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-21336fb4b862dac2", "level": "none", "message": {"text": "Commented-code block (8 lines) in website/server/src/lib/geo.ts:1"}, "properties": {"repobilityId": "478d91351f9931ff", "scanner": "scanner-primary", "fingerprint": "21336fb4b862dac2", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-db2a1b96f614fe76", "level": "none", "message": {"text": "Commented-code block (5 lines) in website/server/src/lib/aiJudge.ts:1"}, "properties": {"repobilityId": "332a8c6123f2b6eb", "scanner": "scanner-primary", "fingerprint": "db2a1b96f614fe76", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-fbe507dfdce17bf4", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 website/server/src/lib/turnstile.ts:9"}, "properties": {"repobilityId": "80bdcbc923bdb9d0", "scanner": "scanner-primary", "fingerprint": "fbe507dfdce17bf4", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-5598b4a174eb7b70", "level": "none", "message": {"text": "Commented-code block (6 lines) in website/server/src/lib/admin.ts:1"}, "properties": {"repobilityId": "901d70ad9a167e6c", "scanner": "scanner-primary", "fingerprint": "5598b4a174eb7b70", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-51e9ba4926c96fdd", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 website/archive/v1/src/releases/index.js:8"}, "properties": {"repobilityId": "bfaddc75d29f683e", "scanner": "scanner-primary", "fingerprint": "51e9ba4926c96fdd", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}]}]}