{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-f0a42032c1068e3b", "name": "`dangerouslySetInnerHTML` used in a React component \u2014 resources/js/Pages/CasPratiques.tsx:97", "shortDescription": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 resources/js/Pages/CasPratiques.tsx:97"}, "fullDescription": {"text": "Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library.\n\nWhy: OWASP basics. Already partially flagged by the security analyzer.\nRule id: fq.dangerous-html"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a2ae6543b63c0af7", "name": "`dangerouslySetInnerHTML` used in a React component \u2014 resources/js/Pages/MobiCasPratiques.tsx:81", "shortDescription": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 resources/js/Pages/MobiCasPratiques.tsx:81"}, "fullDescription": {"text": "Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library.\n\nWhy: OWASP basics. Already partially flagged by the security analyzer.\nRule id: fq.dangerous-html"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-39660190c6706ffa", "name": "`dangerouslySetInnerHTML` used in a React component \u2014 resources/js/Pages/Knowledge/components/article-content.tsx:159", "shortDescription": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 resources/js/Pages/Knowledge/components/article-content.tsx:159"}, "fullDescription": {"text": "Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library.\n\nWhy: OWASP basics. Already partially flagged by the security analyzer.\nRule id: fq.dangerous-html"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3652919456fd7bdc", "name": "`dangerouslySetInnerHTML` used in a React component \u2014 resources/js/layouts/components/notifications-drawer/notification-", "shortDescription": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 resources/js/layouts/components/notifications-drawer/notification-item.tsx:32"}, "fullDescription": {"text": "Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library.\n\nWhy: OWASP basics. Already partially flagged by the security analyzer.\nRule id: fq.dangerous-html"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-cdc32c9f6786282b", "name": "Privileged port 10 in use", "shortDescription": {"text": "Privileged port 10 in use"}, "fullDescription": {"text": "Port 10 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-50938cd4cf25faf7", "name": "Possible secret in docs/scripts/Pnm-Verif-Bascule-MOBI.sh", "shortDescription": {"text": "Possible secret in docs/scripts/Pnm-Verif-Bascule-MOBI.sh"}, "fullDescription": {"text": "Detected pattern matching password_literal. Rotate the credential and move to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-fe502bb913e12058", "name": "Possible secret in docs/scripts/Pnm-Restitutions-Sortantes-Bascule.sh", "shortDescription": {"text": "Possible secret in docs/scripts/Pnm-Restitutions-Sortantes-Bascule.sh"}, "fullDescription": {"text": "Detected pattern matching password_literal. Rotate the credential and move to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-4cc82d9536d7cd60", "name": "Possible secret in docs/scripts/Pnm-Restitutions-Sortantes-Tickets-ratp.sh", "shortDescription": {"text": "Possible secret in docs/scripts/Pnm-Restitutions-Sortantes-Tickets-ratp.sh"}, "fullDescription": {"text": "Detected pattern matching password_literal. Rotate the credential and move to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-991927b39d7ab959", "name": "Possible secret in docs/scripts/Pnm-Restitutions-Sortantes-Tickets.sh", "shortDescription": {"text": "Possible secret in docs/scripts/Pnm-Restitutions-Sortantes-Tickets.sh"}, "fullDescription": {"text": "Detected pattern matching password_literal. Rotate the credential and move to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-bab6a7ea09b45892", "name": "Possible secret in docs/scripts/Pnm-Verif-Bascule-MOBI_CCA.sh", "shortDescription": {"text": "Possible secret in docs/scripts/Pnm-Verif-Bascule-MOBI_CCA.sh"}, "fullDescription": {"text": "Detected pattern matching password_literal. Rotate the credential and move to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-d0f1c1895ab83342", "name": "Possible secret in docs/scripts/Pnm-Restitutions-Entrantes-Bascule.sh", "shortDescription": {"text": "Possible secret in docs/scripts/Pnm-Restitutions-Entrantes-Bascule.sh"}, "fullDescription": {"text": "Detected pattern matching password_literal. Rotate the credential and move to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-2666e27572da1bf7", "name": "Possible secret in resources/js/auth/view/jwt/jwt-sign-up-view.tsx", "shortDescription": {"text": "Possible secret in resources/js/auth/view/jwt/jwt-sign-up-view.tsx"}, "fullDescription": {"text": "Detected pattern matching password_literal. Rotate the credential and move to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-039261a4021c07c1", "name": "Possible secret in resources/js/auth/view/jwt/jwt-sign-in-view.tsx", "shortDescription": {"text": "Possible secret in resources/js/auth/view/jwt/jwt-sign-in-view.tsx"}, "fullDescription": {"text": "Detected pattern matching password_literal. Rotate the credential and move to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-2f8bc25256542ac2", "name": "Insecure pattern 'weak_hash' in resources/js/lib/pnm-code-dictionary.ts:148", "shortDescription": {"text": "Insecure pattern 'weak_hash' in resources/js/lib/pnm-code-dictionary.ts:148"}, "fullDescription": {"text": "Found a known-risky pattern (weak_hash). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-76e89f9120cee9a4", "name": "Possible secret in resources/js/routes/paths.ts", "shortDescription": {"text": "Possible secret in resources/js/routes/paths.ts"}, "fullDescription": {"text": "Detected pattern matching password_literal. Rotate the credential and move to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-794626a3f8982514", "name": "Insecure pattern 'weak_hash' in resources/js/Pages/CasPratiquesPdf.tsx:327", "shortDescription": {"text": "Insecure pattern 'weak_hash' in resources/js/Pages/CasPratiquesPdf.tsx:327"}, "fullDescription": {"text": "Found a known-risky pattern (weak_hash). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-96885e345dd4693f", "name": "Insecure pattern 'dangerous_innerhtml' in resources/js/Pages/CasPratiques.tsx:97", "shortDescription": {"text": "Insecure pattern 'dangerous_innerhtml' in resources/js/Pages/CasPratiques.tsx:97"}, "fullDescription": {"text": "Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-85d5d7279a0d03b8", "name": "Insecure pattern 'weak_hash' in resources/js/Pages/CasPratiques.tsx:402", "shortDescription": {"text": "Insecure pattern 'weak_hash' in resources/js/Pages/CasPratiques.tsx:402"}, "fullDescription": {"text": "Found a known-risky pattern (weak_hash). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-bad107c22f070fbb", "name": "Insecure pattern 'dangerous_innerhtml' in resources/js/Pages/MobiCasPratiques.tsx:81", "shortDescription": {"text": "Insecure pattern 'dangerous_innerhtml' in resources/js/Pages/MobiCasPratiques.tsx:81"}, "fullDescription": {"text": "Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-57b93046c50ccc1f", "name": "Insecure pattern 'weak_hash' in resources/js/Pages/Changelog.tsx:156", "shortDescription": {"text": "Insecure pattern 'weak_hash' in resources/js/Pages/Changelog.tsx:156"}, "fullDescription": {"text": "Found a known-risky pattern (weak_hash). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-914b5c586c6a49fc", "name": "Insecure pattern 'direct_innerhtml_assignment' in resources/js/Pages/Diagrams/Index.tsx:139", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in resources/js/Pages/Diagrams/Index.tsx:139"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e94b3f70550fb18c", "name": "Insecure pattern 'dangerous_innerhtml' in resources/js/Pages/Knowledge/components/article-content.tsx:159", "shortDescription": {"text": "Insecure pattern 'dangerous_innerhtml' in resources/js/Pages/Knowledge/components/article-content.tsx:159"}, "fullDescription": {"text": "Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7d3c472823a34ee7", "name": "Insecure pattern 'direct_innerhtml_assignment' in resources/js/Pages/Knowledge/components/article-content.tsx:34", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in resources/js/Pages/Knowledge/components/article-content.tsx:34"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-858897cf2c6373e6", "name": "Insecure pattern 'weak_hash' in resources/js/Pages/Verify/Index.tsx:39", "shortDescription": {"text": "Insecure pattern 'weak_hash' in resources/js/Pages/Verify/Index.tsx:39"}, "fullDescription": {"text": "Found a known-risky pattern (weak_hash). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-dd4dadcbd5c7e7a7", "name": "Insecure pattern 'weak_hash' in resources/js/Pages/Verify/FilenameDecoder.tsx:730", "shortDescription": {"text": "Insecure pattern 'weak_hash' in resources/js/Pages/Verify/FilenameDecoder.tsx:730"}, "fullDescription": {"text": "Found a known-risky pattern (weak_hash). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e9850e9dbd6b42ac", "name": "Insecure pattern 'weak_hash' in resources/js/Pages/Verify/PortageId.tsx:57", "shortDescription": {"text": "Insecure pattern 'weak_hash' in resources/js/Pages/Verify/PortageId.tsx:57"}, "fullDescription": {"text": "Found a known-risky pattern (weak_hash). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d3a8adbf0d86db27", "name": "Insecure pattern 'weak_hash' in resources/js/Pages/Resolve/Incidents.tsx:911", "shortDescription": {"text": "Insecure pattern 'weak_hash' in resources/js/Pages/Resolve/Incidents.tsx:911"}, "fullDescription": {"text": "Found a known-risky pattern (weak_hash). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-813d6a861f90aaeb", "name": "Insecure pattern 'direct_innerhtml_assignment' in resources/js/hooks/use-mermaid.ts:36", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in resources/js/hooks/use-mermaid.ts:36"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-33dd64e5a7c16cf4", "name": "Insecure pattern 'dangerous_innerhtml' in resources/js/layouts/components/notifications-drawer/notification-item.tsx:32", "shortDescription": {"text": "Insecure pattern 'dangerous_innerhtml' in resources/js/layouts/components/notifications-drawer/notification-item.tsx:32"}, "fullDescription": {"text": "Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4601e3ad3bb28677", "name": "No CI/CD pipelines detected", "shortDescription": {"text": "No CI/CD pipelines detected"}, "fullDescription": {"text": "No GitHub Actions, GitLab CI, or CircleCI configs found. Without CI you can't gate deploys on tests/lints."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-53144ba036afd62f", "name": "Very large file: resources/js/lib/pnm-utils.ts (2328 lines)", "shortDescription": {"text": "Very large file: resources/js/lib/pnm-utils.ts (2328 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-37f99258d91c3fd6", "name": "Very large file: resources/js/Pages/OperationsGuide.tsx (1894 lines)", "shortDescription": {"text": "Very large file: resources/js/Pages/OperationsGuide.tsx (1894 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-21c8a3b458bd1956", "name": "Very large file: resources/js/Pages/RequetesPnm.tsx (1316 lines)", "shortDescription": {"text": "Very large file: resources/js/Pages/RequetesPnm.tsx (1316 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0f04f7944bc5bad6", "name": "Very large file: resources/js/Pages/CasPratiquesPdf.tsx (3115 lines)", "shortDescription": {"text": "Very large file: resources/js/Pages/CasPratiquesPdf.tsx (3115 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9ac1c04d3db143fd", "name": "Very large file: resources/js/Pages/CasPratiques.tsx (4042 lines)", "shortDescription": {"text": "Very large file: resources/js/Pages/CasPratiques.tsx (4042 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ca8c72588bf9d0be", "name": "Very large file: resources/js/Pages/MobiCrm.tsx (1973 lines)", "shortDescription": {"text": "Very large file: resources/js/Pages/MobiCrm.tsx (1973 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6073cdad3baed4b1", "name": "Very large file: resources/js/Pages/TicketsKnowledge.tsx (1195 lines)", "shortDescription": {"text": "Very large file: resources/js/Pages/TicketsKnowledge.tsx (1195 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5de86f00d325857a", "name": "Very large file: resources/js/Pages/Resolve/Incidents.tsx (1202 lines)", "shortDescription": {"text": "Very large file: resources/js/Pages/Resolve/Incidents.tsx (1202 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6893a6c8b0861585", "name": "Very low test-to-source ratio", "shortDescription": {"text": "Very low test-to-source ratio"}, "fullDescription": {"text": "0 test file(s) for 412 source file(s) (ratio 0.00). Consider adding integration or unit tests for critical paths."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-141b30a41e03817b", "name": "No license file detected", "shortDescription": {"text": "No license file detected"}, "fullDescription": {"text": "No LICENSE/COPYING/NOTICE file was found. Generated repositories often omit licensing, which blocks reuse and automated intake."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-01f96f71d9907a8c", "name": "README lacks setup or run instructions", "shortDescription": {"text": "README lacks setup or run instructions"}, "fullDescription": {"text": "A README exists, but it does not contain common install/setup/run markers. This matches a frequent generated-code pattern: UI is present, operational handoff is thin."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-72b2a6250083a784", "name": "Placeholder or mock-heavy implementation detected", "shortDescription": {"text": "Placeholder or mock-heavy implementation detected"}, "fullDescription": {"text": "Found 69 placeholder/mock markers across 32 source files. This often means the repo looks complete while core flows still use generated scaffolding or fake data."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b9088664ace7f748", "name": "Composite production-readiness gap", "shortDescription": {"text": "Composite production-readiness gap"}, "fullDescription": {"text": "Multiple low-cost hardening controls are missing together: license, ci, tests, operator-readme. Opus verification showed these co-occurring gaps are a better readiness signal than reading each flag in isolation."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-749d4bc1bd66df5f", "name": "Agent instructions exist but release-hardening basics are missing", "shortDescription": {"text": "Agent instructions exist but release-hardening basics are missing"}, "fullDescription": {"text": "AI-coder instruction files were found, but the repo is missing license, ci, tests, operator-readme. Treat this as a contract gap: the agent is guided, but the generated output is not yet guarded by the controls that make it repeatable."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-764f25c9367f9904", "name": "Commented-code block (11 lines) in resources/js/components/hook-form/schema-utils.ts:166", "shortDescription": {"text": "Commented-code block (11 lines) in resources/js/components/hook-form/schema-utils.ts:166"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-2eafc3188c36bb02", "name": "3 env vars used in code but missing from .env.example", "shortDescription": {"text": "3 env vars used in code but missing from .env.example"}, "fullDescription": {"text": "Drift between code and config docs. The first few: `NODE_ENV`, `VITE_ASSETS_DIR`, `VITE_SERVER_URL`. Add them (with a placeholder/comment) to .env.example so onboarding doesn't break."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-2c04133e54348533", "name": "Near-duplicate function bodies in 2 places", "shortDescription": {"text": "Near-duplicate function bodies in 2 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\ndocs/scripts/md2word.py:main, docs/scripts/md2onenote.py:main\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c5b18ec76f450e02", "name": "Dangling fetch: GET /api/chat/conversations (resources/js/components/chat-panel.tsx:77)", "shortDescription": {"text": "Dangling fetch: GET /api/chat/conversations (resources/js/components/chat-panel.tsx:77)"}, "fullDescription": {"text": "`resources/js/components/chat-panel.tsx:77` calls `GET /api/chat/conversations` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/chat/conversations`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-0e21492c83053b6a", "name": "Dangling fetch: GET /api/chat/conversations/${conv.id} (resources/js/components/chat-panel.tsx:92)", "shortDescription": {"text": "Dangling fetch: GET /api/chat/conversations/${conv.id} (resources/js/components/chat-panel.tsx:92)"}, "fullDescription": {"text": "`resources/js/components/chat-panel.tsx:92` calls `GET /api/chat/conversations/${conv.id}` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/chat/conversations/<p>`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-af13b625ca47a3e2", "name": "Dangling fetch: DELETE /api/chat/conversations/${id} (resources/js/components/chat-panel.tsx:113)", "shortDescription": {"text": "Dangling fetch: DELETE /api/chat/conversations/${id} (resources/js/components/chat-panel.tsx:113)"}, "fullDescription": {"text": "`resources/js/components/chat-panel.tsx:113` calls `DELETE /api/chat/conversations/${id}` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/chat/conversations/<p>`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-5ae615c4b912a5dc", "name": "Dangling fetch: POST /api/sql-playground (resources/js/Pages/SqlScenarios.tsx:104)", "shortDescription": {"text": "Dangling fetch: POST /api/sql-playground (resources/js/Pages/SqlScenarios.tsx:104)"}, "fullDescription": {"text": "`resources/js/Pages/SqlScenarios.tsx:104` calls `POST /api/sql-playground` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: axios\nNormalized path used for matching: `/sql-playground`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-820f95b24bc0d3bc", "name": "Dangling fetch: POST /api/sql-playground (resources/js/Pages/SqlPlayground.tsx:105)", "shortDescription": {"text": "Dangling fetch: POST /api/sql-playground (resources/js/Pages/SqlPlayground.tsx:105)"}, "fullDescription": {"text": "`resources/js/Pages/SqlPlayground.tsx:105` calls `POST /api/sql-playground` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: axios\nNormalized path used for matching: `/sql-playground`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-4c28d1d2663471eb", "name": "Dangling fetch: GET /api/monitoring?date=${date} (resources/js/Pages/Dashboard/components/monitoring/monitoring-timeline", "shortDescription": {"text": "Dangling fetch: GET /api/monitoring?date=${date} (resources/js/Pages/Dashboard/components/monitoring/monitoring-timeline.tsx:76)"}, "fullDescription": {"text": "`resources/js/Pages/Dashboard/components/monitoring/monitoring-timeline.tsx:76` calls `GET /api/monitoring?date=${date}` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/monitoring`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-a3110f689efb8423", "name": "Dangling fetch: POST /api/monitoring (resources/js/Pages/Dashboard/components/monitoring/monitoring-timeline.tsx:123)", "shortDescription": {"text": "Dangling fetch: POST /api/monitoring (resources/js/Pages/Dashboard/components/monitoring/monitoring-timeline.tsx:123)"}, "fullDescription": {"text": "`resources/js/Pages/Dashboard/components/monitoring/monitoring-timeline.tsx:123` calls `POST /api/monitoring` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/monitoring`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-06f658f33b3fda83", "name": "Dangling fetch: GET /api/monitoring?date=${date} (resources/js/Pages/Dashboard/components/monitoring/monitoring-history-", "shortDescription": {"text": "Dangling fetch: GET /api/monitoring?date=${date} (resources/js/Pages/Dashboard/components/monitoring/monitoring-history-drawer.tsx:39)"}, "fullDescription": {"text": "`resources/js/Pages/Dashboard/components/monitoring/monitoring-history-drawer.tsx:39` calls `GET /api/monitoring?date=${date}` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/monitoring`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-20eb650f574d01cc", "name": "Dangling fetch: GET /api/monitoring/report?date=${date} (resources/js/Pages/Dashboard/components/monitoring/daily-report", "shortDescription": {"text": "Dangling fetch: GET /api/monitoring/report?date=${date} (resources/js/Pages/Dashboard/components/monitoring/daily-report.tsx:257)"}, "fullDescription": {"text": "`resources/js/Pages/Dashboard/components/monitoring/daily-report.tsx:257` calls `GET /api/monitoring/report?date=${date}` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/monitoring/report`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-a3fe881d374b9628", "name": "Dangling fetch: POST /api/sql-playground (resources/js/Pages/Knowledge/components/sql-try-it.tsx:40)", "shortDescription": {"text": "Dangling fetch: POST /api/sql-playground (resources/js/Pages/Knowledge/components/sql-try-it.tsx:40)"}, "fullDescription": {"text": "`resources/js/Pages/Knowledge/components/sql-try-it.tsx:40` calls `POST /api/sql-playground` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: axios\nNormalized path used for matching: `/sql-playground`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-64ab73876eed99bc", "name": "Dangling fetch: POST /api/chat/stream (resources/js/hooks/use-chat-stream.ts:39)", "shortDescription": {"text": "Dangling fetch: POST /api/chat/stream (resources/js/hooks/use-chat-stream.ts:39)"}, "fullDescription": {"text": "`resources/js/hooks/use-chat-stream.ts:39` calls `POST /api/chat/stream` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/chat/stream`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-59a1cc885f47e39f", "name": "Unused endpoint: PATCH /profile", "shortDescription": {"text": "Unused endpoint: PATCH /profile"}, "fullDescription": {"text": "`resources/js/Pages/Profile/Edit.tsx` declares `PATCH /profile` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a569171ffb8378de", "name": "Unused endpoint: PUT /password", "shortDescription": {"text": "Unused endpoint: PUT /password"}, "fullDescription": {"text": "`resources/js/Pages/Profile/Edit.tsx` declares `PUT /password` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9e252ca100b9b6bd", "name": "Unused endpoint: DELETE /profile", "shortDescription": {"text": "Unused endpoint: DELETE /profile"}, "fullDescription": {"text": "`resources/js/Pages/Profile/Edit.tsx` declares `DELETE /profile` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-11067f3f963489e2", "name": "Unused endpoint: GET /glossary", "shortDescription": {"text": "Unused endpoint: GET /glossary"}, "fullDescription": {"text": "`resources/js/Pages/Glossary/Index.tsx` declares `GET /glossary` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-60a71841be4dbc4a", "name": "Unused endpoint: GET /resolve/codes", "shortDescription": {"text": "Unused endpoint: GET /resolve/codes"}, "fullDescription": {"text": "`resources/js/Pages/Resolve/Codes/Index.tsx` declares `GET /resolve/codes` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-99fc36db98c134ce", "name": "Unused endpoint: POST /logout", "shortDescription": {"text": "Unused endpoint: POST /logout"}, "fullDescription": {"text": "`resources/js/layouts/components/sign-out-button.tsx` declares `POST /logout` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/20282"}, "properties": {"repository": "steeven-js/pnm-app", "repoUrl": "https://github.com/steeven-js/pnm-app", "branch": "main"}, "results": [{"ruleId": "scanner-f0a42032c1068e3b", "level": "warning", "message": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 resources/js/Pages/CasPratiques.tsx:97"}, "properties": {"repobilityId": "c7866c2ce5605a81", "scanner": "scanner-primary", "fingerprint": "f0a42032c1068e3b", "layer": "frontend", "severity": "medium", "confidence": 1.0, "tags": ["frontend-quality", "fq.dangerous-html"]}}, {"ruleId": "scanner-a2ae6543b63c0af7", "level": "warning", "message": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 resources/js/Pages/MobiCasPratiques.tsx:81"}, "properties": {"repobilityId": "110da0f2d08dfa98", "scanner": "scanner-primary", "fingerprint": "a2ae6543b63c0af7", "layer": "frontend", "severity": "medium", "confidence": 1.0, "tags": ["frontend-quality", "fq.dangerous-html"]}}, {"ruleId": "scanner-39660190c6706ffa", "level": "warning", "message": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 resources/js/Pages/Knowledge/components/article-content.tsx:159"}, "properties": {"repobilityId": "16192f8901b11294", "scanner": "scanner-primary", "fingerprint": "39660190c6706ffa", "layer": "frontend", "severity": "medium", "confidence": 1.0, "tags": ["frontend-quality", "fq.dangerous-html"]}}, {"ruleId": "scanner-3652919456fd7bdc", "level": "warning", "message": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 resources/js/layouts/components/notifications-drawer/notification-item.tsx:32"}, "properties": {"repobilityId": "3a429a7b695c84e3", "scanner": "scanner-primary", "fingerprint": "3652919456fd7bdc", "layer": "frontend", "severity": "medium", "confidence": 1.0, "tags": ["frontend-quality", "fq.dangerous-html"]}}, {"ruleId": "scanner-cdc32c9f6786282b", "level": "warning", "message": {"text": "Privileged port 10 in use"}, "properties": {"repobilityId": "735372d6b5594915", "scanner": "scanner-primary", "fingerprint": "cdc32c9f6786282b", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docs/scripts/Pnm-Restitutions-Sortantes-Tickets-ratp.sh"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-50938cd4cf25faf7", "level": "error", "message": {"text": "Possible secret in docs/scripts/Pnm-Verif-Bascule-MOBI.sh"}, "properties": {"repobilityId": "94d092b67b20ca39", "scanner": "scanner-primary", "fingerprint": "50938cd4cf25faf7", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docs/scripts/Pnm-Verif-Bascule-MOBI.sh"}, "region": {"startLine": 40}}}]}, {"ruleId": "scanner-fe502bb913e12058", "level": "error", "message": {"text": "Possible secret in docs/scripts/Pnm-Restitutions-Sortantes-Bascule.sh"}, "properties": {"repobilityId": "8b6d5f1911d63e7d", "scanner": "scanner-primary", "fingerprint": "fe502bb913e12058", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docs/scripts/Pnm-Restitutions-Sortantes-Bascule.sh"}, "region": {"startLine": 47}}}]}, {"ruleId": "scanner-4cc82d9536d7cd60", "level": "error", "message": {"text": "Possible secret in docs/scripts/Pnm-Restitutions-Sortantes-Tickets-ratp.sh"}, "properties": {"repobilityId": "8d92deec387b2807", "scanner": "scanner-primary", "fingerprint": "4cc82d9536d7cd60", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docs/scripts/Pnm-Restitutions-Sortantes-Tickets-ratp.sh"}, "region": {"startLine": 42}}}]}, {"ruleId": "scanner-991927b39d7ab959", "level": "error", "message": {"text": "Possible secret in docs/scripts/Pnm-Restitutions-Sortantes-Tickets.sh"}, "properties": {"repobilityId": "2640ce2c41377eba", "scanner": "scanner-primary", "fingerprint": "991927b39d7ab959", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docs/scripts/Pnm-Restitutions-Sortantes-Tickets.sh"}, "region": {"startLine": 42}}}]}, {"ruleId": "scanner-bab6a7ea09b45892", "level": "error", "message": {"text": "Possible secret in docs/scripts/Pnm-Verif-Bascule-MOBI_CCA.sh"}, "properties": {"repobilityId": "c05a42431996c04c", "scanner": "scanner-primary", "fingerprint": "bab6a7ea09b45892", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docs/scripts/Pnm-Verif-Bascule-MOBI_CCA.sh"}, "region": {"startLine": 32}}}]}, {"ruleId": "scanner-d0f1c1895ab83342", "level": "error", "message": {"text": "Possible secret in docs/scripts/Pnm-Restitutions-Entrantes-Bascule.sh"}, "properties": {"repobilityId": "d7241bd514966691", "scanner": "scanner-primary", "fingerprint": "d0f1c1895ab83342", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docs/scripts/Pnm-Restitutions-Entrantes-Bascule.sh"}, "region": {"startLine": 54}}}]}, {"ruleId": "scanner-2666e27572da1bf7", "level": "error", "message": {"text": "Possible secret in resources/js/auth/view/jwt/jwt-sign-up-view.tsx"}, "properties": {"repobilityId": "5ada81e4152e0897", "scanner": "scanner-primary", "fingerprint": "2666e27572da1bf7", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "resources/js/auth/view/jwt/jwt-sign-up-view.tsx"}, "region": {"startLine": 56}}}]}, {"ruleId": "scanner-039261a4021c07c1", "level": "error", "message": {"text": "Possible secret in resources/js/auth/view/jwt/jwt-sign-in-view.tsx"}, "properties": {"repobilityId": "03a1c2801e5dc885", "scanner": "scanner-primary", "fingerprint": "039261a4021c07c1", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "resources/js/auth/view/jwt/jwt-sign-in-view.tsx"}, "region": {"startLine": 51}}}]}, {"ruleId": "scanner-2f8bc25256542ac2", "level": "warning", "message": {"text": "Insecure pattern 'weak_hash' in resources/js/lib/pnm-code-dictionary.ts:148"}, "properties": {"repobilityId": "6fea35c62d272362", "scanner": "scanner-primary", "fingerprint": "2f8bc25256542ac2", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "weak_hash"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "resources/js/lib/pnm-code-dictionary.ts"}, "region": {"startLine": 148}}}]}, {"ruleId": "scanner-76e89f9120cee9a4", "level": "error", "message": {"text": "Possible secret in resources/js/routes/paths.ts"}, "properties": {"repobilityId": "63c922703eae7925", "scanner": "scanner-primary", "fingerprint": "76e89f9120cee9a4", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "resources/js/routes/paths.ts"}, "region": {"startLine": 16}}}]}, {"ruleId": "scanner-76e89f9120cee9a4", "level": "error", "message": {"text": "Possible secret in resources/js/routes/paths.ts"}, "properties": {"repobilityId": "63c922703eae7925", "scanner": "scanner-primary", "fingerprint": "76e89f9120cee9a4", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "resources/js/routes/paths.ts"}, "region": {"startLine": 17}}}]}, {"ruleId": "scanner-76e89f9120cee9a4", "level": "error", "message": {"text": "Possible secret in resources/js/routes/paths.ts"}, "properties": {"repobilityId": "63c922703eae7925", "scanner": "scanner-primary", "fingerprint": "76e89f9120cee9a4", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "resources/js/routes/paths.ts"}, "region": {"startLine": 26}}}]}, {"ruleId": "scanner-76e89f9120cee9a4", "level": "error", "message": {"text": "Possible secret in resources/js/routes/paths.ts"}, "properties": {"repobilityId": "63c922703eae7925", "scanner": "scanner-primary", "fingerprint": "76e89f9120cee9a4", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "resources/js/routes/paths.ts"}, "region": {"startLine": 32}}}]}, {"ruleId": "scanner-76e89f9120cee9a4", "level": "error", "message": {"text": "Possible secret in resources/js/routes/paths.ts"}, "properties": {"repobilityId": "63c922703eae7925", "scanner": "scanner-primary", "fingerprint": "76e89f9120cee9a4", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "resources/js/routes/paths.ts"}, "region": {"startLine": 33}}}]}, {"ruleId": "scanner-76e89f9120cee9a4", "level": "error", "message": {"text": "Possible secret in resources/js/routes/paths.ts"}, "properties": {"repobilityId": "63c922703eae7925", "scanner": "scanner-primary", "fingerprint": "76e89f9120cee9a4", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "resources/js/routes/paths.ts"}, "region": {"startLine": 42}}}]}, {"ruleId": "scanner-76e89f9120cee9a4", "level": "error", "message": {"text": "Possible secret in resources/js/routes/paths.ts"}, "properties": {"repobilityId": "63c922703eae7925", "scanner": "scanner-primary", "fingerprint": "76e89f9120cee9a4", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "resources/js/routes/paths.ts"}, "region": {"startLine": 43}}}]}, {"ruleId": "scanner-794626a3f8982514", "level": "warning", "message": {"text": "Insecure pattern 'weak_hash' in resources/js/Pages/CasPratiquesPdf.tsx:327"}, "properties": {"repobilityId": "c2a289499228cf3d", "scanner": "scanner-primary", "fingerprint": "794626a3f8982514", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "weak_hash"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "resources/js/Pages/CasPratiquesPdf.tsx"}, "region": {"startLine": 327}}}]}, {"ruleId": "scanner-96885e345dd4693f", "level": "warning", "message": {"text": "Insecure pattern 'dangerous_innerhtml' in resources/js/Pages/CasPratiques.tsx:97"}, "properties": {"repobilityId": "754ce0518c199fc4", "scanner": "scanner-primary", "fingerprint": "96885e345dd4693f", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "dangerous_innerhtml"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "resources/js/Pages/CasPratiques.tsx"}, "region": {"startLine": 97}}}]}, {"ruleId": "scanner-85d5d7279a0d03b8", "level": "warning", "message": {"text": "Insecure pattern 'weak_hash' in resources/js/Pages/CasPratiques.tsx:402"}, "properties": {"repobilityId": "586651e971289f00", "scanner": "scanner-primary", "fingerprint": "85d5d7279a0d03b8", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "weak_hash"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "resources/js/Pages/CasPratiques.tsx"}, "region": {"startLine": 402}}}]}, {"ruleId": "scanner-bad107c22f070fbb", "level": "warning", "message": {"text": "Insecure pattern 'dangerous_innerhtml' in resources/js/Pages/MobiCasPratiques.tsx:81"}, "properties": {"repobilityId": "ac3aa9adfa71bd42", "scanner": "scanner-primary", "fingerprint": "bad107c22f070fbb", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "dangerous_innerhtml"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "resources/js/Pages/MobiCasPratiques.tsx"}, "region": {"startLine": 81}}}]}, {"ruleId": "scanner-57b93046c50ccc1f", "level": "warning", "message": {"text": "Insecure pattern 'weak_hash' in resources/js/Pages/Changelog.tsx:156"}, "properties": {"repobilityId": "396631177fda73f5", "scanner": "scanner-primary", "fingerprint": "57b93046c50ccc1f", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "weak_hash"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "resources/js/Pages/Changelog.tsx"}, "region": {"startLine": 156}}}]}, {"ruleId": "scanner-914b5c586c6a49fc", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in resources/js/Pages/Diagrams/Index.tsx:139"}, "properties": {"repobilityId": "620d61f55a92e228", "scanner": "scanner-primary", "fingerprint": "914b5c586c6a49fc", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "resources/js/Pages/Diagrams/Index.tsx"}, "region": {"startLine": 139}}}]}, {"ruleId": "scanner-e94b3f70550fb18c", "level": "warning", "message": {"text": "Insecure pattern 'dangerous_innerhtml' in resources/js/Pages/Knowledge/components/article-content.tsx:159"}, "properties": {"repobilityId": "62126738dbd78093", "scanner": "scanner-primary", "fingerprint": "e94b3f70550fb18c", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "dangerous_innerhtml"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "resources/js/Pages/Knowledge/components/article-content.tsx"}, "region": {"startLine": 159}}}]}, {"ruleId": "scanner-7d3c472823a34ee7", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in resources/js/Pages/Knowledge/components/article-content.tsx:34"}, "properties": {"repobilityId": "c4ad78a304e8429d", "scanner": "scanner-primary", "fingerprint": "7d3c472823a34ee7", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "resources/js/Pages/Knowledge/components/article-content.tsx"}, "region": {"startLine": 34}}}]}, {"ruleId": "scanner-858897cf2c6373e6", "level": "warning", "message": {"text": "Insecure pattern 'weak_hash' in resources/js/Pages/Verify/Index.tsx:39"}, "properties": {"repobilityId": "ec05be65416cefbf", "scanner": "scanner-primary", "fingerprint": "858897cf2c6373e6", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "weak_hash"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "resources/js/Pages/Verify/Index.tsx"}, "region": {"startLine": 39}}}]}, {"ruleId": "scanner-dd4dadcbd5c7e7a7", "level": "warning", "message": {"text": "Insecure pattern 'weak_hash' in resources/js/Pages/Verify/FilenameDecoder.tsx:730"}, "properties": {"repobilityId": "a5fb2185351f8090", "scanner": "scanner-primary", "fingerprint": "dd4dadcbd5c7e7a7", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "weak_hash"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "resources/js/Pages/Verify/FilenameDecoder.tsx"}, "region": {"startLine": 730}}}]}, {"ruleId": "scanner-e9850e9dbd6b42ac", "level": "warning", "message": {"text": "Insecure pattern 'weak_hash' in resources/js/Pages/Verify/PortageId.tsx:57"}, "properties": {"repobilityId": "9921608ff2d98cf5", "scanner": "scanner-primary", "fingerprint": "e9850e9dbd6b42ac", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "weak_hash"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "resources/js/Pages/Verify/PortageId.tsx"}, "region": {"startLine": 57}}}]}, {"ruleId": "scanner-d3a8adbf0d86db27", "level": "warning", "message": {"text": "Insecure pattern 'weak_hash' in resources/js/Pages/Resolve/Incidents.tsx:911"}, "properties": {"repobilityId": "82a6981ab5905d53", "scanner": "scanner-primary", "fingerprint": "d3a8adbf0d86db27", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "weak_hash"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "resources/js/Pages/Resolve/Incidents.tsx"}, "region": {"startLine": 911}}}]}, {"ruleId": "scanner-813d6a861f90aaeb", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in resources/js/hooks/use-mermaid.ts:36"}, "properties": {"repobilityId": "6300176a7d54e3e6", "scanner": "scanner-primary", "fingerprint": "813d6a861f90aaeb", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "resources/js/hooks/use-mermaid.ts"}, "region": {"startLine": 36}}}]}, {"ruleId": "scanner-33dd64e5a7c16cf4", "level": "warning", "message": {"text": "Insecure pattern 'dangerous_innerhtml' in resources/js/layouts/components/notifications-drawer/notification-item.tsx:32"}, "properties": {"repobilityId": "a9fe89fac496ac9d", "scanner": "scanner-primary", "fingerprint": "33dd64e5a7c16cf4", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "dangerous_innerhtml"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "resources/js/layouts/components/notifications-drawer/notification-item.tsx"}, "region": {"startLine": 32}}}]}, {"ruleId": "scanner-4601e3ad3bb28677", "level": "warning", "message": {"text": "No CI/CD pipelines detected"}, "properties": {"repobilityId": "c3ee439bce2bc51e", "scanner": "scanner-primary", "fingerprint": "4601e3ad3bb28677", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-53144ba036afd62f", "level": "note", "message": {"text": "Very large file: resources/js/lib/pnm-utils.ts (2328 lines)"}, "properties": {"repobilityId": "e2f0bc604f397ca6", "scanner": "scanner-primary", "fingerprint": "53144ba036afd62f", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-37f99258d91c3fd6", "level": "note", "message": {"text": "Very large file: resources/js/Pages/OperationsGuide.tsx (1894 lines)"}, "properties": {"repobilityId": "d18154ba237166d6", "scanner": "scanner-primary", "fingerprint": "37f99258d91c3fd6", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-21c8a3b458bd1956", "level": "note", "message": {"text": "Very large file: resources/js/Pages/RequetesPnm.tsx (1316 lines)"}, "properties": {"repobilityId": "625cd2dd99473346", "scanner": "scanner-primary", "fingerprint": "21c8a3b458bd1956", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-0f04f7944bc5bad6", "level": "note", "message": {"text": "Very large file: resources/js/Pages/CasPratiquesPdf.tsx (3115 lines)"}, "properties": {"repobilityId": "aea1642a86ba8f35", "scanner": "scanner-primary", "fingerprint": "0f04f7944bc5bad6", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-9ac1c04d3db143fd", "level": "note", "message": {"text": "Very large file: resources/js/Pages/CasPratiques.tsx (4042 lines)"}, "properties": {"repobilityId": "55aa384533eb18e7", "scanner": "scanner-primary", "fingerprint": "9ac1c04d3db143fd", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-ca8c72588bf9d0be", "level": "note", "message": {"text": "Very large file: resources/js/Pages/MobiCrm.tsx (1973 lines)"}, "properties": {"repobilityId": "b54e287ba0cc7fff", "scanner": "scanner-primary", "fingerprint": "ca8c72588bf9d0be", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-6073cdad3baed4b1", "level": "note", "message": {"text": "Very large file: resources/js/Pages/TicketsKnowledge.tsx (1195 lines)"}, "properties": {"repobilityId": "5b43f90717e882ed", "scanner": "scanner-primary", "fingerprint": "6073cdad3baed4b1", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-5de86f00d325857a", "level": "note", "message": {"text": "Very large file: resources/js/Pages/Resolve/Incidents.tsx (1202 lines)"}, "properties": {"repobilityId": "07b21c899ebcdc7d", "scanner": "scanner-primary", "fingerprint": "5de86f00d325857a", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-6893a6c8b0861585", "level": "warning", "message": {"text": "Very low test-to-source ratio"}, "properties": {"repobilityId": "54a7de3f06314bf0", "scanner": "scanner-primary", "fingerprint": "6893a6c8b0861585", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["tests", "coverage"]}}, {"ruleId": "scanner-141b30a41e03817b", "level": "note", "message": {"text": "No license file detected"}, "properties": {"repobilityId": "b97b38ef487cdf31", "scanner": "scanner-primary", "fingerprint": "141b30a41e03817b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["license", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-01f96f71d9907a8c", "level": "note", "message": {"text": "README lacks setup or run instructions"}, "properties": {"repobilityId": "4a425e45112d1b73", "scanner": "scanner-primary", "fingerprint": "01f96f71d9907a8c", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["docs", "readme", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-72b2a6250083a784", "level": "warning", "message": {"text": "Placeholder or mock-heavy implementation detected"}, "properties": {"repobilityId": "237d9f2eca18b742", "scanner": "scanner-primary", "fingerprint": "72b2a6250083a784", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "incomplete", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "c0f4db2c9570eec7", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-b9088664ace7f748", "level": "warning", "message": {"text": "Composite production-readiness gap"}, "properties": {"repobilityId": "9ff026453628de40", "scanner": "scanner-primary", "fingerprint": "b9088664ace7f748", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["production-readiness", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-749d4bc1bd66df5f", "level": "warning", "message": {"text": "Agent instructions exist but release-hardening basics are missing"}, "properties": {"repobilityId": "43b3b380e3251ae6", "scanner": "scanner-primary", "fingerprint": "749d4bc1bd66df5f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "dab0687b4c6e5ec2", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "3711b01601530fe8", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-764f25c9367f9904", "level": "none", "message": {"text": "Commented-code block (11 lines) in resources/js/components/hook-form/schema-utils.ts:166"}, "properties": {"repobilityId": "478c67b016a7f158", "scanner": "scanner-primary", "fingerprint": "764f25c9367f9904", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-2eafc3188c36bb02", "level": "none", "message": {"text": "3 env vars used in code but missing from .env.example"}, "properties": {"repobilityId": "bd934ba112b02ffa", "scanner": "scanner-primary", "fingerprint": "2eafc3188c36bb02", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "config-drift"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "1324db31a8519b33", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-c5b18ec76f450e02", "level": "error", "message": {"text": "Dangling fetch: GET /api/chat/conversations (resources/js/components/chat-panel.tsx:77)"}, "properties": {"repobilityId": "559a32d7a8231f2d", "scanner": "scanner-primary", "fingerprint": "c5b18ec76f450e02", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-0e21492c83053b6a", "level": "error", "message": {"text": "Dangling fetch: GET /api/chat/conversations/${conv.id} (resources/js/components/chat-panel.tsx:92)"}, "properties": {"repobilityId": "28f6a9b8b68ac41b", "scanner": "scanner-primary", "fingerprint": "0e21492c83053b6a", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-af13b625ca47a3e2", "level": "error", "message": {"text": "Dangling fetch: DELETE /api/chat/conversations/${id} (resources/js/components/chat-panel.tsx:113)"}, "properties": {"repobilityId": "ea27cfb3055aefff", "scanner": "scanner-primary", "fingerprint": "af13b625ca47a3e2", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-5ae615c4b912a5dc", "level": "error", "message": {"text": "Dangling fetch: POST /api/sql-playground (resources/js/Pages/SqlScenarios.tsx:104)"}, "properties": {"repobilityId": "d3314ace7cf4bffe", "scanner": "scanner-primary", "fingerprint": "5ae615c4b912a5dc", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "axios"]}}, {"ruleId": "scanner-820f95b24bc0d3bc", "level": "error", "message": {"text": "Dangling fetch: POST /api/sql-playground (resources/js/Pages/SqlPlayground.tsx:105)"}, "properties": {"repobilityId": "534710ebffd918be", "scanner": "scanner-primary", "fingerprint": "820f95b24bc0d3bc", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "axios"]}}, {"ruleId": "scanner-4c28d1d2663471eb", "level": "error", "message": {"text": "Dangling fetch: GET /api/monitoring?date=${date} (resources/js/Pages/Dashboard/components/monitoring/monitoring-timeline.tsx:76)"}, "properties": {"repobilityId": "5ec2923d65a821f4", "scanner": "scanner-primary", "fingerprint": "4c28d1d2663471eb", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-a3110f689efb8423", "level": "error", "message": {"text": "Dangling fetch: POST /api/monitoring (resources/js/Pages/Dashboard/components/monitoring/monitoring-timeline.tsx:123)"}, "properties": {"repobilityId": "9c3640aa85d48f4c", "scanner": "scanner-primary", "fingerprint": "a3110f689efb8423", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-06f658f33b3fda83", "level": "error", "message": {"text": "Dangling fetch: GET /api/monitoring?date=${date} (resources/js/Pages/Dashboard/components/monitoring/monitoring-history-drawer.tsx:39)"}, "properties": {"repobilityId": "870aa9b9fceb8d30", "scanner": "scanner-primary", "fingerprint": "06f658f33b3fda83", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-20eb650f574d01cc", "level": "error", "message": {"text": "Dangling fetch: GET /api/monitoring/report?date=${date} (resources/js/Pages/Dashboard/components/monitoring/daily-report.tsx:257)"}, "properties": {"repobilityId": "a89e23d034347402", "scanner": "scanner-primary", "fingerprint": "20eb650f574d01cc", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-a3fe881d374b9628", "level": "error", "message": {"text": "Dangling fetch: POST /api/sql-playground (resources/js/Pages/Knowledge/components/sql-try-it.tsx:40)"}, "properties": {"repobilityId": "18dc72fdbd5e4a79", "scanner": "scanner-primary", "fingerprint": "a3fe881d374b9628", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "axios"]}}, {"ruleId": "scanner-64ab73876eed99bc", "level": "error", "message": {"text": "Dangling fetch: POST /api/chat/stream (resources/js/hooks/use-chat-stream.ts:39)"}, "properties": {"repobilityId": "dd2dfcb1e5a57156", "scanner": "scanner-primary", "fingerprint": "64ab73876eed99bc", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-59a1cc885f47e39f", "level": "note", "message": {"text": "Unused endpoint: PATCH /profile"}, "properties": {"repobilityId": "483975e6ab8cee60", "scanner": "scanner-primary", "fingerprint": "59a1cc885f47e39f", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-a569171ffb8378de", "level": "note", "message": {"text": "Unused endpoint: PUT /password"}, "properties": {"repobilityId": "7a92c3894e55cc32", "scanner": "scanner-primary", "fingerprint": "a569171ffb8378de", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-9e252ca100b9b6bd", "level": "note", "message": {"text": "Unused endpoint: DELETE /profile"}, "properties": {"repobilityId": "22202b6c3ac85add", "scanner": "scanner-primary", "fingerprint": "9e252ca100b9b6bd", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-11067f3f963489e2", "level": "note", "message": {"text": "Unused endpoint: GET /glossary"}, "properties": {"repobilityId": "a04e617e045472a9", "scanner": "scanner-primary", "fingerprint": "11067f3f963489e2", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-60a71841be4dbc4a", "level": "note", "message": {"text": "Unused endpoint: GET /resolve/codes"}, "properties": {"repobilityId": "60172702b593636d", "scanner": "scanner-primary", "fingerprint": "60a71841be4dbc4a", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-99fc36db98c134ce", "level": "note", "message": {"text": "Unused endpoint: POST /logout"}, "properties": {"repobilityId": "34a07a02876f154b", "scanner": "scanner-primary", "fingerprint": "99fc36db98c134ce", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}]}]}