{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-bead75b0f9233e05", "name": "No API endpoints detected", "shortDescription": {"text": "No API endpoints detected"}, "fullDescription": {"text": "The scanner did not find FastAPI/Flask/Express/NestJS/GraphQL/gRPC routes. If this repo exposes APIs, the framework may be unsupported."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "info", "confidence": 1.0}}, {"id": "scanner-5ebe418f614925cf", "name": "TODO/FIXME marker in shipping code \u2014 webclient/app/components/CalendarRoomSelector.vue:55", "shortDescription": {"text": "TODO/FIXME marker in shipping code \u2014 webclient/app/components/CalendarRoomSelector.vue:55"}, "fullDescription": {"text": "Track in /reviews or /issues, not as a code comment that rots.\n\nWhy: Drift control \u2014 shouldn't be the same as Quality TODO scanner.\nRule id: fq.todo-marker"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-a78581f414a8a62f", "name": "Privileged port 1000 in use", "shortDescription": {"text": "Privileged port 1000 in use"}, "fullDescription": {"text": "Port 1000 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4c88bda71776c73e", "name": "Docker base image is tag-pinned but not digest-pinned: ghcr.io/astral-sh/uv:python3.14-bookworm", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: ghcr.io/astral-sh/uv:python3.14-bookworm"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a4f7f5b126eeedfb", "name": "Docker base image is tag-pinned but not digest-pinned: rust:1.96-alpine", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: rust:1.96-alpine"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4528647d413dd6cc", "name": "Docker base image is tag-pinned but not digest-pinned: alpine:3.24", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: alpine:3.24"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-18aa270fc77ac4c7", "name": "Dockerfile runs as root: webclient/Dockerfile", "shortDescription": {"text": "Dockerfile runs as root: webclient/Dockerfile"}, "fullDescription": {"text": "No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a968681345823803", "name": "Docker base image is tag-pinned but not digest-pinned: node:24-alpine3.23", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: node:24-alpine3.23"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-75ee012522067abc", "name": "Dockerfile runs as root: map/martin/Dockerfile", "shortDescription": {"text": "Dockerfile runs as root: map/martin/Dockerfile"}, "fullDescription": {"text": "No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7cee9d59e9f96545", "name": "Docker base image is tag-pinned but not digest-pinned: ghcr.io/maplibre/martin:nightly", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: ghcr.io/maplibre/martin:nightly"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-aa5acaa49eb8315b", "name": "Containers defined but no K8s/orchestration manifest found", "shortDescription": {"text": "Containers defined but no K8s/orchestration manifest found"}, "fullDescription": {"text": "Repo has Dockerfiles/compose but no Kubernetes/Nomad manifests. If the target deployment is K8s, the manifests may live in a separate ops repo."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-700bafa7260e6531", "name": "Runtime dotenv file present in repo: .env", "shortDescription": {"text": "Runtime dotenv file present in repo: .env"}, "fullDescription": {"text": "`.env` looks like a runtime dotenv file. No high-confidence secret value was matched, but runtime dotenv files often drift into live credentials. Move real values to a secret manager and keep only `.env.example` style templates in source control."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-0047a24f20e650bb", "name": "Insecure pattern 'direct_innerhtml_assignment' in webclient/app/composables/FloorControl.ts:45", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in webclient/app/composables/FloorControl.ts:45"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9c2a06ff174cc5a3", "name": "Insecure pattern 'vue_v_html' in webclient/app/components/LocationResultContent.vue:28", "shortDescription": {"text": "Insecure pattern 'vue_v_html' in webclient/app/components/LocationResultContent.vue:28"}, "fullDescription": {"text": "Found a known-risky pattern (vue_v_html). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-cac8080152c63687", "name": "Insecure pattern 'vue_v_html' in webclient/app/components/SearchFilterChips.vue:386", "shortDescription": {"text": "Insecure pattern 'vue_v_html' in webclient/app/components/SearchFilterChips.vue:386"}, "fullDescription": {"text": "Found a known-risky pattern (vue_v_html). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b7d412452b690916", "name": "Insecure pattern 'vue_v_html' in webclient/app/components/AddressResultContent.vue:19", "shortDescription": {"text": "Insecure pattern 'vue_v_html' in webclient/app/components/AddressResultContent.vue:19"}, "fullDescription": {"text": "Found a known-risky pattern (vue_v_html). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2a9cf8a31a3fc183", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6d343846004595cc", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ac8d1687051e96c8", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-689177a4a97bdc3d", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3bc65d187a22044c", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-45b5633441a2ab85", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f1739c4ee473a47c", "name": "package.json defines install-time lifecycle scripts", "shortDescription": {"text": "package.json defines install-time lifecycle scripts"}, "fullDescription": {"text": "preinstall/install/postinstall/prepare scripts execute during dependency installation. Review them carefully for network calls, obfuscation, shell execution, or credential access."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2900bc0718e22b88", "name": "Very large file: server/src/search_executor/mod.rs (1963 lines)", "shortDescription": {"text": "Very large file: server/src/search_executor/mod.rs (1963 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9863fb0d5f679100", "name": "Very large file: motis-openapi-progenitor/src/lib.rs (12553 lines)", "shortDescription": {"text": "Very large file: motis-openapi-progenitor/src/lib.rs (12553 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-95970d1566b6ef00", "name": "Very large file: webclient/app/api_types/index.ts (3254 lines)", "shortDescription": {"text": "Very large file: webclient/app/api_types/index.ts (3254 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ea3b5e389d8c9c0f", "name": "Low test-to-source ratio", "shortDescription": {"text": "Low test-to-source ratio"}, "fullDescription": {"text": "26 tests / 132 src (ratio 0.20)."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-008b9ae349a861d1", "name": "Commented-code block (6 lines) in tests/specs/details.ui.spec.ts:26", "shortDescription": {"text": "Commented-code block (6 lines) in tests/specs/details.ui.spec.ts:26"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-83b46cd7de357972", "name": "Commented-code block (5 lines) in tests/specs/navigation.ui.spec.ts:16", "shortDescription": {"text": "Commented-code block (5 lines) in tests/specs/navigation.ui.spec.ts:16"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-0a62f28dcda19b83", "name": "Commented-code block (6 lines) in tests/specs/server.api.spec.ts:240", "shortDescription": {"text": "Commented-code block (6 lines) in tests/specs/server.api.spec.ts:240"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-d0a87d3289eeaa1b", "name": "Commented-code block (7 lines) in webclient/nuxt.config.ts:19", "shortDescription": {"text": "Commented-code block (7 lines) in webclient/nuxt.config.ts:19"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-3c2659dee52ead62", "name": "`fetch()` without try/.catch or AbortSignal \u2014 webclient/nuxt.config.ts:77", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 webclient/nuxt.config.ts:77"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6d0a8d6090a9ce2c", "name": "Commented-code block (5 lines) in webclient/app/composables/searchFilters.ts:38", "shortDescription": {"text": "Commented-code block (5 lines) in webclient/app/composables/searchFilters.ts:38"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-431529430b0f314a", "name": "`fetch()` without try/.catch or AbortSignal \u2014 webclient/app/composables/feedbackToken.ts:36", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 webclient/app/composables/feedbackToken.ts:36"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b9a7f20a01f3e92c", "name": "Commented-code block (5 lines) in webclient/app/utils/eatApiLabels.ts:1", "shortDescription": {"text": "Commented-code block (5 lines) in webclient/app/utils/eatApiLabels.ts:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-04bcbdb1d58060d0", "name": "Commented-code block (5 lines) in webclient/app/plugins/maplibre.client.ts:1", "shortDescription": {"text": "Commented-code block (5 lines) in webclient/app/plugins/maplibre.client.ts:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-ca8250cc75ab45ca", "name": "`fetch()` without try/.catch or AbortSignal \u2014 webclient/server/plugins/user-agent.ts:2", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 webclient/server/plugins/user-agent.ts:2"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/21736"}, "properties": {"repository": "TUM-Dev/NavigaTUM", "repoUrl": "https://github.com/TUM-Dev/NavigaTUM", "branch": "main"}, "results": [{"ruleId": "scanner-bead75b0f9233e05", "level": "none", "message": {"text": "No API endpoints detected"}, "properties": {"repobilityId": "0f8bb852027c38f8", "scanner": "scanner-primary", "fingerprint": "bead75b0f9233e05", "layer": "api", "severity": "info", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-5ebe418f614925cf", "level": "none", "message": {"text": "TODO/FIXME marker in shipping code \u2014 webclient/app/components/CalendarRoomSelector.vue:55"}, "properties": {"repobilityId": "13a681340b8dc400", "scanner": "scanner-primary", "fingerprint": "5ebe418f614925cf", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.todo-marker"]}}, {"ruleId": "scanner-a78581f414a8a62f", "level": "warning", "message": {"text": "Privileged port 1000 in use"}, "properties": {"repobilityId": "5ac9fc9372cfe169", "scanner": "scanner-primary", "fingerprint": "a78581f414a8a62f", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "compose.local.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-4c88bda71776c73e", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: ghcr.io/astral-sh/uv:python3.14-bookworm"}, "properties": {"repobilityId": "32e3fb9f4bde5225", "scanner": "scanner-primary", "fingerprint": "4c88bda71776c73e", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server/Dockerfile"}, "region": {"startLine": 5}}}]}, {"ruleId": "scanner-a4f7f5b126eeedfb", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: rust:1.96-alpine"}, "properties": {"repobilityId": "c113873f10c4d6e2", "scanner": "scanner-primary", "fingerprint": "a4f7f5b126eeedfb", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server/Dockerfile"}, "region": {"startLine": 38}}}]}, {"ruleId": "scanner-4528647d413dd6cc", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: alpine:3.24"}, "properties": {"repobilityId": "6afc6ed6759e4160", "scanner": "scanner-primary", "fingerprint": "4528647d413dd6cc", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server/Dockerfile"}, "region": {"startLine": 97}}}]}, {"ruleId": "scanner-18aa270fc77ac4c7", "level": "warning", "message": {"text": "Dockerfile runs as root: webclient/Dockerfile"}, "properties": {"repobilityId": "89ab3558911d443d", "scanner": "scanner-primary", "fingerprint": "18aa270fc77ac4c7", "layer": "hardware", "severity": "medium", "confidence": 1.0, "tags": ["security", "container"]}}, {"ruleId": "scanner-a968681345823803", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: node:24-alpine3.23"}, "properties": {"repobilityId": "d0b35b1ac94aab59", "scanner": "scanner-primary", "fingerprint": "a968681345823803", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "webclient/Dockerfile"}, "region": {"startLine": 3}}}]}, {"ruleId": "scanner-75ee012522067abc", "level": "warning", "message": {"text": "Dockerfile runs as root: map/martin/Dockerfile"}, "properties": {"repobilityId": "85e8e72a92e3907f", "scanner": "scanner-primary", "fingerprint": "75ee012522067abc", "layer": "hardware", "severity": "medium", "confidence": 1.0, "tags": ["security", "container"]}}, {"ruleId": "scanner-7cee9d59e9f96545", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: ghcr.io/maplibre/martin:nightly"}, "properties": {"repobilityId": "38a3d54d09766164", "scanner": "scanner-primary", "fingerprint": "7cee9d59e9f96545", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "map/martin/Dockerfile"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-aa5acaa49eb8315b", "level": "note", "message": {"text": "Containers defined but no K8s/orchestration manifest found"}, "properties": {"repobilityId": "b230ea9b68736081", "scanner": "scanner-primary", "fingerprint": "aa5acaa49eb8315b", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["coverage", "deployment"]}}, {"ruleId": "scanner-700bafa7260e6531", "level": "error", "message": {"text": "Runtime dotenv file present in repo: .env"}, "properties": {"repobilityId": "4b9c737a445874ba", "scanner": "scanner-primary", "fingerprint": "700bafa7260e6531", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["secrets", "config", "env-file", "runtime-env"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".env"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-0047a24f20e650bb", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in webclient/app/composables/FloorControl.ts:45"}, "properties": {"repobilityId": "57f0823fb3e6dc58", "scanner": "scanner-primary", "fingerprint": "0047a24f20e650bb", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "webclient/app/composables/FloorControl.ts"}, "region": {"startLine": 45}}}]}, {"ruleId": "scanner-9c2a06ff174cc5a3", "level": "warning", "message": {"text": "Insecure pattern 'vue_v_html' in webclient/app/components/LocationResultContent.vue:28"}, "properties": {"repobilityId": "004de7c840e434ce", "scanner": "scanner-primary", "fingerprint": "9c2a06ff174cc5a3", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "vue_v_html"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "webclient/app/components/LocationResultContent.vue"}, "region": {"startLine": 28}}}]}, {"ruleId": "scanner-cac8080152c63687", "level": "warning", "message": {"text": "Insecure pattern 'vue_v_html' in webclient/app/components/SearchFilterChips.vue:386"}, "properties": {"repobilityId": "7e6b88912e6baa67", "scanner": "scanner-primary", "fingerprint": "cac8080152c63687", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "vue_v_html"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "webclient/app/components/SearchFilterChips.vue"}, "region": {"startLine": 386}}}]}, {"ruleId": "scanner-b7d412452b690916", "level": "warning", "message": {"text": "Insecure pattern 'vue_v_html' in webclient/app/components/AddressResultContent.vue:19"}, "properties": {"repobilityId": "083ac7d8d920ce90", "scanner": "scanner-primary", "fingerprint": "b7d412452b690916", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "vue_v_html"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "webclient/app/components/AddressResultContent.vue"}, "region": {"startLine": 19}}}]}, {"ruleId": "scanner-2a9cf8a31a3fc183", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "9db1eb6cabfa5d97", "scanner": "scanner-primary", "fingerprint": "2a9cf8a31a3fc183", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6d343846004595cc", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "ec686f6d8dedf906", "scanner": "scanner-primary", "fingerprint": "6d343846004595cc", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/_docker-build.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ac8d1687051e96c8", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "ac9813e39993734c", "scanner": "scanner-primary", "fingerprint": "ac8d1687051e96c8", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/webclient-cicd.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-689177a4a97bdc3d", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "787b81e588ef05dc", "scanner": "scanner-primary", "fingerprint": "689177a4a97bdc3d", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/server-cicd.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3bc65d187a22044c", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "6ae3bddea8f510df", "scanner": "scanner-primary", "fingerprint": "3bc65d187a22044c", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/martin-cicd.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-45b5633441a2ab85", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "7df56239597d2b8e", "scanner": "scanner-primary", "fingerprint": "45b5633441a2ab85", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/update-data.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f1739c4ee473a47c", "level": "note", "message": {"text": "package.json defines install-time lifecycle scripts"}, "properties": {"repobilityId": "c81258b67e3d0b2e", "scanner": "scanner-primary", "fingerprint": "f1739c4ee473a47c", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "npm", "install-scripts"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "webclient/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-2900bc0718e22b88", "level": "note", "message": {"text": "Very large file: server/src/search_executor/mod.rs (1963 lines)"}, "properties": {"repobilityId": "9ab2e3eea6e6503b", "scanner": "scanner-primary", "fingerprint": "2900bc0718e22b88", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-9863fb0d5f679100", "level": "note", "message": {"text": "Very large file: motis-openapi-progenitor/src/lib.rs (12553 lines)"}, "properties": {"repobilityId": "e4d367545d38eabe", "scanner": "scanner-primary", "fingerprint": "9863fb0d5f679100", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-95970d1566b6ef00", "level": "note", "message": {"text": "Very large file: webclient/app/api_types/index.ts (3254 lines)"}, "properties": {"repobilityId": "f7713bb1d4a5f8ee", "scanner": "scanner-primary", "fingerprint": "95970d1566b6ef00", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-ea3b5e389d8c9c0f", "level": "note", "message": {"text": "Low test-to-source ratio"}, "properties": {"repobilityId": "ef7b2552cc00a375", "scanner": "scanner-primary", "fingerprint": "ea3b5e389d8c9c0f", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["tests"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "83af573edba53242", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "7b006b07cde9e802", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-008b9ae349a861d1", "level": "none", "message": {"text": "Commented-code block (6 lines) in tests/specs/details.ui.spec.ts:26"}, "properties": {"repobilityId": "3be32fcf4bd4c6cd", "scanner": "scanner-primary", "fingerprint": "008b9ae349a861d1", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-83b46cd7de357972", "level": "none", "message": {"text": "Commented-code block (5 lines) in tests/specs/navigation.ui.spec.ts:16"}, "properties": {"repobilityId": "2d1062cf896d0745", "scanner": "scanner-primary", "fingerprint": "83b46cd7de357972", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-0a62f28dcda19b83", "level": "none", "message": {"text": "Commented-code block (6 lines) in tests/specs/server.api.spec.ts:240"}, "properties": {"repobilityId": "17bff5238fb1643f", "scanner": "scanner-primary", "fingerprint": "0a62f28dcda19b83", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-d0a87d3289eeaa1b", "level": "none", "message": {"text": "Commented-code block (7 lines) in webclient/nuxt.config.ts:19"}, "properties": {"repobilityId": "b31be45eb99bb720", "scanner": "scanner-primary", "fingerprint": "d0a87d3289eeaa1b", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-3c2659dee52ead62", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 webclient/nuxt.config.ts:77"}, "properties": {"repobilityId": "83a400276ec92f2a", "scanner": "scanner-primary", "fingerprint": "3c2659dee52ead62", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-6d0a8d6090a9ce2c", "level": "none", "message": {"text": "Commented-code block (5 lines) in webclient/app/composables/searchFilters.ts:38"}, "properties": {"repobilityId": "6af557fd2bc8ad8e", "scanner": "scanner-primary", "fingerprint": "6d0a8d6090a9ce2c", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-431529430b0f314a", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 webclient/app/composables/feedbackToken.ts:36"}, "properties": {"repobilityId": "bf3aaa06dec2b04c", "scanner": "scanner-primary", "fingerprint": "431529430b0f314a", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-b9a7f20a01f3e92c", "level": "none", "message": {"text": "Commented-code block (5 lines) in webclient/app/utils/eatApiLabels.ts:1"}, "properties": {"repobilityId": "cdb0e99b51a634e9", "scanner": "scanner-primary", "fingerprint": "b9a7f20a01f3e92c", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-04bcbdb1d58060d0", "level": "none", "message": {"text": "Commented-code block (5 lines) in webclient/app/plugins/maplibre.client.ts:1"}, "properties": {"repobilityId": "76044996e8233228", "scanner": "scanner-primary", "fingerprint": "04bcbdb1d58060d0", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-ca8250cc75ab45ca", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 webclient/server/plugins/user-agent.ts:2"}, "properties": {"repobilityId": "6f920f791c031495", "scanner": "scanner-primary", "fingerprint": "ca8250cc75ab45ca", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}]}]}