{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "WEB003", "name": "Public web service has no security.txt", "shortDescription": {"text": "Public web service has no security.txt"}, "fullDescription": {"text": "security.txt gives researchers and customers a safe disclosure channel. Public web apps and APIs should publish it under /.well-known/security.txt."}, "properties": {"scanner": "repobility-web-presence", "category": "quality", "severity": "medium", "confidence": 0.78, "cwe": "", "owasp": ""}}, {"id": "AUC012", "name": "[AUC012] FastAPI interactive docs may be exposed by framework defaults: FastAPI exposes /docs, /redoc, and /openapi.json", "shortDescription": {"text": "[AUC012] FastAPI interactive docs may be exposed by framework defaults: FastAPI exposes /docs, /redoc, and /openapi.json by default. Public production APIs should explicitly disable those defaults, protect them behind admin authentication, "}, "fullDescription": {"text": "FastAPI exposes /docs, /redoc, and /openapi.json by default. Public production APIs should explicitly disable those defaults, protect them behind admin authentication, or publish a reviewed OpenAPI spec with declared security requirements."}, "properties": {"scanner": "repobility-access-control", "category": "auth", "severity": "medium", "confidence": 0.72, "cwe": "CWE-285", "owasp": "WSTG-AUTHZ"}}, {"id": "AUC002", "name": "[AUC002] Low visible authorization coverage in route inventory: Only 33.3% of discovered routes show nearby authenticati", "shortDescription": {"text": "[AUC002] Low visible authorization coverage in route inventory: Only 33.3% of discovered routes show nearby authentication, authorization, middleware, or public-route evidence."}, "fullDescription": {"text": "Only 33.3% of discovered routes show nearby authentication, authorization, middleware, or public-route evidence."}, "properties": {"scanner": "repobility-access-control", "category": "auth", "severity": "medium", "confidence": 0.74, "cwe": "CWE-285", "owasp": "WSTG-AUTHZ"}}, {"id": "AUC001", "name": "[AUC001] No Repobility access matrix policy found: The repository uses web/API frameworks but does not define .repobilit", "shortDescription": {"text": "[AUC001] No Repobility access matrix policy found: The repository uses web/API frameworks but does not define .repobility/access.yml or equivalent authorization documentation."}, "fullDescription": {"text": "The repository uses web/API frameworks but does not define .repobility/access.yml or equivalent authorization documentation."}, "properties": {"scanner": "repobility-access-control", "category": "auth", "severity": "medium", "confidence": 0.92, "cwe": "CWE-285", "owasp": "WSTG-AUTHZ"}}, {"id": "MINED124", "name": "requirements.txt: `watchfiles` has no version pin", "shortDescription": {"text": "requirements.txt: `watchfiles` has no version pin"}, "fullDescription": {"text": "Unpinned pip requirement means every fresh install may resolve a different version. Newer releases can introduce malicious code (typosquats, account compromises). Reproducible installs need exact pins."}, "properties": {"scanner": "repobility-supply-chain", "category": "dependency", "severity": "medium", "confidence": 0.9, "cwe": "", "owasp": ""}}, {"id": "AUC005", "name": "[AUC005] No authorization-focused tests detected: No test files with common authorization, ownership, 403, admin, or sup", "shortDescription": {"text": "[AUC005] No authorization-focused tests detected: No test files with common authorization, ownership, 403, admin, or super_admin assertions were found."}, "fullDescription": {"text": "No test files with common authorization, ownership, 403, admin, or super_admin assertions were found."}, "properties": {"scanner": "repobility-access-control", "category": "auth", "severity": "low", "confidence": 0.76, "cwe": "CWE-285", "owasp": "WSTG-AUTHZ"}}, {"id": "SEC006", "name": "[SEC006] XSS Risk: Direct HTML injection without sanitization.", "shortDescription": {"text": "[SEC006] XSS Risk: Direct HTML injection without sanitization."}, "fullDescription": {"text": "Use textContent instead of innerHTML. Sanitize with DOMPurify."}, "properties": {"scanner": "repobility-threat-engine", "category": "injection", "severity": "low", "confidence": 0.4, "cwe": "", "owasp": ""}}, {"id": "MINED044", "name": "[MINED044] Js Console Log Prod: console.log left in code. Should be replaced with logger or removed.", "shortDescription": {"text": "[MINED044] Js Console Log Prod: console.log left in code. Should be replaced with logger or removed."}, "fullDescription": {"text": "Review and fix per the pattern semantics. See CWE-532 /  for context."}, "properties": {"scanner": "repobility-threat-engine", "category": "quality", "severity": "info", "confidence": 1.0, "cwe": "", "owasp": ""}}, {"id": "CORE_NO_TESTS", "name": "No test files found in a documentation, catalog, or template-heavy repository", "shortDescription": {"text": "No test files found in a documentation, catalog, or template-heavy repository"}, "fullDescription": {"text": "If this repository ships runnable code, add focused tests for those examples or templates. If it is documentation/catalog content only, mark the finding as accepted or add a .repobilityignore note."}, "properties": {"scanner": "repobility-core", "category": "testing", "severity": "info", "confidence": 0.35, "cwe": "", "owasp": ""}}, {"id": "SEC040", "name": "[SEC040] innerHTML XSS \u2014 template literal with server-supplied data: Setting .innerHTML with a template literal that int", "shortDescription": {"text": "[SEC040] innerHTML XSS \u2014 template literal with server-supplied data: Setting .innerHTML with a template literal that interpolates server-supplied or user-supplied data is the canonical stored/reflected XSS vector. The browser parses the HTM"}, "fullDescription": {"text": "For plain text: use el.textContent = data.value (auto-escapes).\nFor HTML you need to render: el.innerHTML = DOMPurify.sanitize(html).\nFor React/Vue/Svelte: stop using innerHTML; use the framework's binding.\nWhen data comes from CV/PDF parsers, sanitize at the parser boundary too."}, "properties": {"scanner": "repobility-threat-engine", "category": "xss", "severity": "high", "confidence": 1.0, "cwe": "", "owasp": ""}}, {"id": "SEC135", "name": "[SEC135] Auth/permission check missing on AI-generated endpoint: Mutating HTTP endpoint generated by an AI agent without", "shortDescription": {"text": "[SEC135] Auth/permission check missing on AI-generated endpoint: Mutating HTTP endpoint generated by an AI agent without an auth decorator or middleware. The number-one production-incident pattern we see in AI-generated SaaS code: the AI bu"}, "fullDescription": {"text": "Add the project's auth decorator/middleware: `@login_required` (Django/Flask), `@permission_classes([IsAuthenticated])` (DRF), `Depends(get_current_user)` (FastAPI), `requireAuth` middleware (Express). For genuinely public endpoints, add a `# public-endpoint` marker comment so future scans skip them."}, "properties": {"scanner": "repobility-threat-engine", "category": "quality", "severity": "high", "confidence": 1.0, "cwe": "", "owasp": ""}}, {"id": "MINED115", "name": "Action `GrantBirki/comment` pinned to mutable ref `@v2.1.1`", "shortDescription": {"text": "Action `GrantBirki/comment` pinned to mutable ref `@v2.1.1`"}, "fullDescription": {"text": "`uses: GrantBirki/comment@v2.1.1` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-actions/changed-files compromise (2025) instantly affect ~23K repos. Pin to a 40-char commit SHA + lock with Dependabot or renovate."}, "properties": {"scanner": "repobility-supply-chain", "category": "dependency", "severity": "high", "confidence": 0.9, "cwe": "", "owasp": ""}}, {"id": "MINED112", "name": "FastAPI POST /activities/{activity_name}/signup has no auth", "shortDescription": {"text": "FastAPI POST /activities/{activity_name}/signup has no auth"}, "fullDescription": {"text": "Handler `signup_for_activity` is registered with router/app.post(...) but no Depends/Security parameter is declared and no auth marker appears in the function body."}, "properties": {"scanner": "repobility-route-auth", "category": "quality", "severity": "high", "confidence": 0.8, "cwe": "", "owasp": ""}}]}}, "automationDetails": {"id": "repobility/656"}, "properties": {"repository": "yashwanththatavarti/skills-getting-started-with-github-copilot", "repoUrl": "https://github.com/yashwanththatavarti/skills-getting-started-with-github-copilot.git", "branch": "main"}, "results": [{"ruleId": "WEB003", "level": "warning", "message": {"text": "Public web service has no security.txt"}, "properties": {"repobilityId": 44971, "scanner": "repobility-web-presence", "fingerprint": "5cd26606c5a53c9f403ff7a92a6917c19cf440a23ce03e2b90e8c493312ef8cd", "category": "quality", "severity": "medium", "confidence": 0.78, "triageState": "open", "verdict": "likely", "isResolved": false, "reason": "Repository looks like a public web app/API but no security.txt file or route was discovered.", "evidence": {"rule_id": "WEB003", "scanner": "repobility-web-presence", "references": ["https://www.rfc-editor.org/rfc/rfc9116", "https://github.com/Lissy93/web-check"], "correlation_key": "fp|5cd26606c5a53c9f403ff7a92a6917c19cf440a23ce03e2b90e8c493312ef8cd"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".well-known/security.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "AUC012", "level": "warning", "message": {"text": "[AUC012] FastAPI interactive docs may be exposed by framework defaults: FastAPI exposes /docs, /redoc, and /openapi.json by default. Public production APIs should explicitly disable those defaults, protect them behind admin authentication, or publish a reviewed OpenAPI spec with declared security requirements."}, "properties": {"repobilityId": 44969, "scanner": "repobility-access-control", "fingerprint": "27f8c50db94c1d5138790446654bd4d0b5823ce185d040059e5a7502358b5899", "category": "auth", "severity": "medium", "confidence": 0.72, "triageState": "open", "verdict": "needs_review", "isResolved": false, "reason": "Static route and framework evidence require project-owner confirmation.", "evidence": {"apps": [{"line": 14, "file_path": "src/app.py", "docs_url_disabled": false, "redoc_url_disabled": false, "openapi_url_disabled": false}], "scanner": "repobility-access-control", "correlation_key": "fp|27f8c50db94c1d5138790446654bd4d0b5823ce185d040059e5a7502358b5899"}}}, {"ruleId": "AUC002", "level": "warning", "message": {"text": "[AUC002] Low visible authorization coverage in route inventory: Only 33.3% of discovered routes show nearby authentication, authorization, middleware, or public-route evidence."}, "properties": {"repobilityId": 44968, "scanner": "repobility-access-control", "fingerprint": "428bba7e78ca5dadacd769b0ae359888a4bbbdef443ba24eb50394e8f889518f", "category": "auth", "severity": "medium", "confidence": 0.74, "triageState": "open", "verdict": "needs_review", "isResolved": false, "reason": "Static route and framework evidence require project-owner confirmation.", "evidence": {"scanner": "repobility-access-control", "endpoint_count": 3, "correlation_key": "fp|428bba7e78ca5dadacd769b0ae359888a4bbbdef443ba24eb50394e8f889518f", "auth_visible_percent": 33.3}}}, {"ruleId": "AUC001", "level": "warning", "message": {"text": "[AUC001] No Repobility access matrix policy found: The repository uses web/API frameworks but does not define .repobility/access.yml or equivalent authorization documentation."}, "properties": {"repobilityId": 44967, "scanner": "repobility-access-control", "fingerprint": "f1305052c3ba1e6c1cdb5dccc19e58a8168cf78b176658f32b1fc823df3e9d10", "category": "auth", "severity": "medium", "confidence": 0.92, "triageState": "open", "verdict": "likely", "isResolved": false, "reason": "Static route and framework evidence require project-owner confirmation.", "evidence": {"scanner": "repobility-access-control", "frameworks": ["FastAPI"], "expected_files": [".repobility/access.yml", ".repobility/access.yaml", ".repobility/access.json", ".repobility/authorization.yml"], "correlation_key": "fp|f1305052c3ba1e6c1cdb5dccc19e58a8168cf78b176658f32b1fc823df3e9d10"}}}, {"ruleId": "MINED124", "level": "warning", "message": {"text": "requirements.txt: `watchfiles` has no version pin"}, "properties": {"repobilityId": 44937, "scanner": "repobility-supply-chain", "fingerprint": "d42815eae07df9f8b0055db7a9bf7d6cd558e4e4b834473e23239a232f70474b", "category": "dependency", "severity": "medium", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "unpinned-pip-requirement", "owasp": null, "cwe_ids": ["CWE-1357"], "languages": ["python"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|d42815eae07df9f8b0055db7a9bf7d6cd558e4e4b834473e23239a232f70474b"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "requirements.txt"}, "region": {"startLine": 4}}}]}, {"ruleId": "MINED124", "level": "warning", "message": {"text": "requirements.txt: `httpx` has no version pin"}, "properties": {"repobilityId": 44936, "scanner": "repobility-supply-chain", "fingerprint": "fcf553ca9172bec11edb3e85593beba9f2bbec6dcdc9366d995e835eac45b9a0", "category": "dependency", "severity": "medium", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "unpinned-pip-requirement", "owasp": null, "cwe_ids": ["CWE-1357"], "languages": ["python"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|fcf553ca9172bec11edb3e85593beba9f2bbec6dcdc9366d995e835eac45b9a0"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "requirements.txt"}, "region": {"startLine": 3}}}]}, {"ruleId": "MINED124", "level": "warning", "message": {"text": "requirements.txt: `uvicorn` has no version pin"}, "properties": {"repobilityId": 44935, "scanner": "repobility-supply-chain", "fingerprint": "748c4a38e5ef9a8b8e211e16ab96848ffc5954720aa3fb5667ca47b33960bf4a", "category": "dependency", "severity": "medium", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "unpinned-pip-requirement", "owasp": null, "cwe_ids": ["CWE-1357"], "languages": ["python"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|748c4a38e5ef9a8b8e211e16ab96848ffc5954720aa3fb5667ca47b33960bf4a"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "requirements.txt"}, "region": {"startLine": 2}}}]}, {"ruleId": "MINED124", "level": "warning", "message": {"text": "requirements.txt: `fastapi` has no version pin"}, "properties": {"repobilityId": 44934, "scanner": "repobility-supply-chain", "fingerprint": "17152be1fffa220d3cb3bcc1bcb572a47114c047e61989e599e37910a6c409b5", "category": "dependency", "severity": "medium", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "unpinned-pip-requirement", "owasp": null, "cwe_ids": ["CWE-1357"], "languages": ["python"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|17152be1fffa220d3cb3bcc1bcb572a47114c047e61989e599e37910a6c409b5"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "AUC005", "level": "note", "message": {"text": "[AUC005] No authorization-focused tests detected: No test files with common authorization, ownership, 403, admin, or super_admin assertions were found."}, "properties": {"repobilityId": 44970, "scanner": "repobility-access-control", "fingerprint": "c58bb88e6682225dc480b3036f30153044953a3d94f500396678a77324e8d30e", "category": "auth", "severity": "low", "confidence": 0.76, "triageState": "open", "verdict": "needs_review", "isResolved": false, "reason": "Static route and framework evidence require project-owner confirmation.", "evidence": {"scanner": "repobility-access-control", "frameworks": ["FastAPI"], "correlation_key": "fp|c58bb88e6682225dc480b3036f30153044953a3d94f500396678a77324e8d30e"}}}, {"ruleId": "SEC006", "level": "note", "message": {"text": "[SEC006] XSS Risk: Direct HTML injection without sanitization."}, "properties": {"repobilityId": 44964, "scanner": "repobility-threat-engine", "fingerprint": "e67eef4acc14e0e058ef8ed1225fa78e388d93354e046d7f7477e254b00d0a9f", "category": "injection", "severity": "low", "confidence": 0.4, "triageState": "false_positive", "verdict": "likely_fp", "isResolved": true, "reason": "No user-input source (request/query/fetch/URL) found \u2014 may be static content", "evidence": {"match": ".innerHTML = `", "reason": "No user-input source (request/query/fetch/URL) found \u2014 may be static content", "rule_id": "SEC006", "scanner": "repobility-threat-engine", "confidence": 0.4, "correlation_key": "code|injection|src/static/app.js|23|sec006"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/static/app.js"}, "region": {"startLine": 23}}}]}, {"ruleId": "MINED044", "level": "none", "message": {"text": "[MINED044] Js Console Log Prod: console.log left in code. Should be replaced with logger or removed."}, "properties": {"repobilityId": 44966, "scanner": "repobility-threat-engine", "fingerprint": "e3601d286f1843b966abed98cf45e7e640f591ef3800a6484440a28a31abc503", "category": "quality", "severity": "info", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "js-console-log-prod", "owasp": null, "cwe_ids": ["CWE-532"], "languages": ["javascript", "typescript", "tsx", "jsx"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.348003+00:00", "triaged_in_corpus": 10, "observations_count": 1940833, "ai_coder_pattern_id": 102}, "scanner": "repobility-threat-engine", "correlation_key": "fp|e3601d286f1843b966abed98cf45e7e640f591ef3800a6484440a28a31abc503"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/static/app.js"}, "region": {"startLine": 40}}}]}, {"ruleId": "CORE_NO_TESTS", "level": "none", "message": {"text": "No test files found in a documentation, catalog, or template-heavy repository"}, "properties": {"repobilityId": 44932, "scanner": "repobility-core", "fingerprint": "69cfb3536a8ccff500ccafcd681fc8d4bc9f4eda6689da02ddec81654bd9fd15", "category": "testing", "severity": "info", "confidence": 0.35, "triageState": "false_positive", "verdict": "likely_fp", "isResolved": true, "reason": "Repository shape is documentation, catalog, skill, or template-heavy rather than a conventional runnable application.", "evidence": {"reason": "Repository shape is documentation, catalog, skill, or template-heavy rather than a conventional runnable application.", "rule_id": "CORE_NO_TESTS", "scanner": "repobility-core", "confidence": 0.35, "correlation_key": "repo|testing|core_no_tests"}}}, {"ruleId": "SEC040", "level": "error", "message": {"text": "[SEC040] innerHTML XSS \u2014 template literal with server-supplied data: Setting .innerHTML with a template literal that interpolates server-supplied or user-supplied data is the canonical stored/reflected XSS vector. The browser parses the HTML and executes any <script> or event-handler attributes in the data. CWE-79. Especially dangerous when the data comes from a CV parser, profile field, or any user-input pipeline."}, "properties": {"repobilityId": 44965, "scanner": "repobility-threat-engine", "fingerprint": "69ee62da707185150dfcdb8847001e99fcabf455a9fdfaf953f6e58ad0cc4200", "category": "xss", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": ".innerHTML = `\n          <h4>${name}</h4>\n          <p>${details.description}</p>\n          <p><stro", "reason": "Pattern matched with no mitigating context found", "rule_id": "SEC040", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "fp|69ee62da707185150dfcdb8847001e99fcabf455a9fdfaf953f6e58ad0cc4200"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/static/app.js"}, "region": {"startLine": 23}}}]}, {"ruleId": "SEC135", "level": "error", "message": {"text": "[SEC135] Auth/permission check missing on AI-generated endpoint: Mutating HTTP endpoint generated by an AI agent without an auth decorator or middleware. The number-one production-incident pattern we see in AI-generated SaaS code: the AI builds the route, builds the handler, and forgets to wire the auth check that the rest of the codebase uses. CWE-862 (missing authorization). High-severity because the route is fully functional, just unprotected \u2014 attackers can call it directly."}, "properties": {"repobilityId": 44963, "scanner": "repobility-threat-engine", "fingerprint": "828572b9a09a589432ec87cee4b47453e7364428ed1f0ac05eacbd2de6fdf59c", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": "@app.post(\"/activities/{activity_name}/signup\")\ndef signup_for_activity(activity_name: str, email: s", "reason": "Pattern matched with no mitigating context found", "rule_id": "SEC135", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "fp|828572b9a09a589432ec87cee4b47453e7364428ed1f0ac05eacbd2de6fdf59c"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/app.py"}, "region": {"startLine": 55}}}]}, {"ruleId": "MINED115", "level": "error", "message": {"text": "Action `GrantBirki/comment` pinned to mutable ref `@v2.1.1`"}, "properties": {"repobilityId": 44962, "scanner": "repobility-supply-chain", "fingerprint": "26102aa42d9ab833eb1d38ea1a55ca42c4a5c530b1e4591fe24f0553d655d3c2", "category": "dependency", "severity": "high", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "gha-mutable-ref", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|26102aa42d9ab833eb1d38ea1a55ca42c4a5c530b1e4591fe24f0553d655d3c2"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/2-step.yml"}, "region": {"startLine": 71}}}]}, {"ruleId": "MINED115", "level": "error", "message": {"text": "Action `skills/action-keyphrase-checker` pinned to mutable ref `@v1`"}, "properties": {"repobilityId": 44961, "scanner": "repobility-supply-chain", "fingerprint": "b755a3331ab2ef9c416ef919a93738e3027c17079e3cd73cb7fe345e181b723f", "category": "dependency", "severity": "high", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "gha-mutable-ref", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|b755a3331ab2ef9c416ef919a93738e3027c17079e3cd73cb7fe345e181b723f"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/2-step.yml"}, "region": {"startLine": 63}}}]}, {"ruleId": "MINED115", "level": "error", "message": {"text": "Action `GrantBirki/comment` pinned to mutable ref `@v2.1.1`"}, "properties": {"repobilityId": 44960, "scanner": "repobility-supply-chain", "fingerprint": "4ec18ada9af609c3f87f63886bb8f50c86c3cfacdc4fc5bc06d9cac226635439", "category": "dependency", "severity": "high", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "gha-mutable-ref", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|4ec18ada9af609c3f87f63886bb8f50c86c3cfacdc4fc5bc06d9cac226635439"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/2-step.yml"}, "region": {"startLine": 50}}}]}, {"ruleId": "MINED115", "level": "error", "message": {"text": "Action `peter-evans/find-comment` pinned to mutable ref `@v3`"}, "properties": {"repobilityId": 44959, "scanner": "repobility-supply-chain", "fingerprint": "efcdfed52f3b07fa4832714f7bf51e2eb42a32329ea2f97c793114a2ad834b4f", "category": "dependency", "severity": "high", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "gha-mutable-ref", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|efcdfed52f3b07fa4832714f7bf51e2eb42a32329ea2f97c793114a2ad834b4f"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/2-step.yml"}, "region": {"startLine": 43}}}]}, {"ruleId": "MINED115", "level": "error", "message": {"text": "Action `actions/checkout` pinned to mutable ref `@v5`"}, "properties": {"repobilityId": 44958, "scanner": "repobility-supply-chain", "fingerprint": "d61b3db1dc8eab17b24a501686bdbe8cedb55a34eb95e0ebdae2d7f041a1d3e0", "category": "dependency", "severity": "high", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "gha-mutable-ref", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|d61b3db1dc8eab17b24a501686bdbe8cedb55a34eb95e0ebdae2d7f041a1d3e0"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/2-step.yml"}, "region": {"startLine": 35}}}]}, {"ruleId": "MINED115", "level": "error", "message": {"text": "Action `actions/checkout` pinned to mutable ref `@v5`"}, "properties": {"repobilityId": 44957, "scanner": "repobility-supply-chain", "fingerprint": "0da3730fcbf19a308a044bb137aeb86f9c756d5a433408fbd518d983a3340702", "category": "dependency", "severity": "high", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "gha-mutable-ref", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|0da3730fcbf19a308a044bb137aeb86f9c756d5a433408fbd518d983a3340702"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/2-step.yml"}, "region": {"startLine": 32}}}]}, {"ruleId": "MINED115", "level": "error", "message": {"text": "Action `skills/exercise-toolkit/.github/workflows/find-exercise-issue.yml` pinned to mutable ref `@v0.8.1`"}, "properties": {"repobilityId": 44956, "scanner": "repobility-supply-chain", "fingerprint": "8e0410d3259809f02c35417f4dab3caeb6090690376aefab7f48221a1ac84470", "category": "dependency", "severity": "high", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "gha-mutable-ref", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|8e0410d3259809f02c35417f4dab3caeb6090690376aefab7f48221a1ac84470"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/2-step.yml"}, "region": {"startLine": 20}}}]}, {"ruleId": "MINED115", "level": "error", "message": {"text": "Action `skills/exercise-toolkit/.github/workflows/finish-exercise.yml` pinned to mutable ref `@v0.8.1`"}, "properties": {"repobilityId": 44955, "scanner": "repobility-supply-chain", "fingerprint": "5391c5a6ce61139f2b5c62ff0017fb126eadd291721143cf85c422f1eb4018e9", "category": "dependency", "severity": "high", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "gha-mutable-ref", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|5391c5a6ce61139f2b5c62ff0017fb126eadd291721143cf85c422f1eb4018e9"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/5-step.yml"}, "region": {"startLine": 64}}}]}, {"ruleId": "MINED115", "level": "error", "message": {"text": "Action `GrantBirki/comment` pinned to mutable ref `@v2.1.1`"}, "properties": {"repobilityId": 44954, "scanner": "repobility-supply-chain", "fingerprint": "83e05735092cd599342ef7a91d19df484b2e58e522ce153781a6da016a06535d", "category": "dependency", "severity": "high", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "gha-mutable-ref", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|83e05735092cd599342ef7a91d19df484b2e58e522ce153781a6da016a06535d"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/5-step.yml"}, "region": {"startLine": 50}}}]}, {"ruleId": "MINED115", "level": "error", "message": {"text": "Action `GrantBirki/comment` pinned to mutable ref `@v2.1.1`"}, "properties": {"repobilityId": 44953, "scanner": "repobility-supply-chain", "fingerprint": "9a3c5104ccb07b43ae186d973cad97b1e3bd070ca7c8cb9b90ec04b6d2734050", "category": "dependency", "severity": "high", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "gha-mutable-ref", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|9a3c5104ccb07b43ae186d973cad97b1e3bd070ca7c8cb9b90ec04b6d2734050"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/5-step.yml"}, "region": {"startLine": 43}}}]}, {"ruleId": "MINED115", "level": "error", "message": {"text": "Action `actions/checkout` pinned to mutable ref `@v5`"}, "properties": {"repobilityId": 44952, "scanner": "repobility-supply-chain", "fingerprint": "856957f4e2565af9e83f603337d664d876f205037eaf8c42d029870c22c64351", "category": "dependency", "severity": "high", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "gha-mutable-ref", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|856957f4e2565af9e83f603337d664d876f205037eaf8c42d029870c22c64351"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/5-step.yml"}, "region": {"startLine": 36}}}]}, {"ruleId": "MINED115", "level": "error", "message": {"text": "Action `actions/checkout` pinned to mutable ref `@v5`"}, "properties": {"repobilityId": 44951, "scanner": "repobility-supply-chain", "fingerprint": "3a28b8565f980bfa39e3e4b027503b09147898d776485a305ef7ecd8a4eea9ae", "category": "dependency", "severity": "high", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "gha-mutable-ref", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|3a28b8565f980bfa39e3e4b027503b09147898d776485a305ef7ecd8a4eea9ae"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/5-step.yml"}, "region": {"startLine": 33}}}]}, {"ruleId": "MINED115", "level": "error", "message": {"text": "Action `skills/exercise-toolkit/.github/workflows/find-exercise-issue.yml` pinned to mutable ref `@v0.8.1`"}, "properties": {"repobilityId": 44950, "scanner": "repobility-supply-chain", "fingerprint": "d1d425fc1bd6233b88b3b4599a3ee4feaa96b4acb6653cdcb0ac1b20a332bf88", "category": "dependency", "severity": "high", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "gha-mutable-ref", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|d1d425fc1bd6233b88b3b4599a3ee4feaa96b4acb6653cdcb0ac1b20a332bf88"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/5-step.yml"}, "region": {"startLine": 21}}}]}, {"ruleId": "MINED115", "level": "error", "message": {"text": "Action `GrantBirki/comment` pinned to mutable ref `@v2.1.1`"}, "properties": {"repobilityId": 44949, "scanner": "repobility-supply-chain", "fingerprint": "7e8c54348eb9e5da10ea0a0020d683d261b0181561637f07b968f771e08c2d10", "category": "dependency", "severity": "high", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "gha-mutable-ref", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|7e8c54348eb9e5da10ea0a0020d683d261b0181561637f07b968f771e08c2d10"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/1-step.yml"}, "region": {"startLine": 128}}}]}, {"ruleId": "MINED115", "level": "error", "message": {"text": "Action `GrantBirki/comment` pinned to mutable ref `@v2.1.1`"}, "properties": {"repobilityId": 44948, "scanner": "repobility-supply-chain", "fingerprint": "73229c238d8aa939b18c666640ea323fdb3baab1cb427f4f6a459bd90f93069f", "category": "dependency", "severity": "high", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "gha-mutable-ref", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|73229c238d8aa939b18c666640ea323fdb3baab1cb427f4f6a459bd90f93069f"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/1-step.yml"}, "region": {"startLine": 121}}}]}, {"ruleId": "MINED115", "level": "error", "message": {"text": "Action `GrantBirki/comment` pinned to mutable ref `@v2.1.1`"}, "properties": {"repobilityId": 44947, "scanner": "repobility-supply-chain", "fingerprint": "a3609eb1162199a0bc64a37dddb92d47206edb2ef766484dcb092bf74e21ec09", "category": "dependency", "severity": "high", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "gha-mutable-ref", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|a3609eb1162199a0bc64a37dddb92d47206edb2ef766484dcb092bf74e21ec09"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/1-step.yml"}, "region": {"startLine": 112}}}]}, {"ruleId": "MINED115", "level": "error", "message": {"text": "Action `actions/checkout` pinned to mutable ref `@v6`"}, "properties": {"repobilityId": 44946, "scanner": "repobility-supply-chain", "fingerprint": "97a9e82062c1ac95a0fb2212499a2df36ab1b3e4ce39dd511cc647180db1888c", "category": "dependency", "severity": "high", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "gha-mutable-ref", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|97a9e82062c1ac95a0fb2212499a2df36ab1b3e4ce39dd511cc647180db1888c"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/1-step.yml"}, "region": {"startLine": 105}}}]}, {"ruleId": "MINED115", "level": "error", "message": {"text": "Action `actions/checkout` pinned to mutable ref `@v6`"}, "properties": {"repobilityId": 44945, "scanner": "repobility-supply-chain", "fingerprint": "87205cb2f824d9e8ea7487f32a7e118224a20b4fd0834bcac94bf94927ab90f7", "category": "dependency", "severity": "high", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "gha-mutable-ref", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|87205cb2f824d9e8ea7487f32a7e118224a20b4fd0834bcac94bf94927ab90f7"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/1-step.yml"}, "region": {"startLine": 102}}}]}, {"ruleId": "MINED115", "level": "error", "message": {"text": "Action `GrantBirki/comment` pinned to mutable ref `@v2.1.1`"}, "properties": {"repobilityId": 44944, "scanner": "repobility-supply-chain", "fingerprint": "dabf44e5493f0940495864370f57cf6aadc73647693165a568892cc9c0fb2638", "category": "dependency", "severity": "high", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "gha-mutable-ref", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|dabf44e5493f0940495864370f57cf6aadc73647693165a568892cc9c0fb2638"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/1-step.yml"}, "region": {"startLine": 73}}}]}, {"ruleId": "MINED115", "level": "error", "message": {"text": "Action `skills/action-keyphrase-checker` pinned to mutable ref `@v1`"}, "properties": {"repobilityId": 44943, "scanner": "repobility-supply-chain", "fingerprint": "220b6fe5da5c6f3b632a2d8b478bf0d8e8974e765e411758f6dd3b29a6748ed8", "category": "dependency", "severity": "high", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "gha-mutable-ref", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|220b6fe5da5c6f3b632a2d8b478bf0d8e8974e765e411758f6dd3b29a6748ed8"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/1-step.yml"}, "region": {"startLine": 63}}}]}, {"ruleId": "MINED115", "level": "error", "message": {"text": "Action `GrantBirki/comment` pinned to mutable ref `@v2.1.1`"}, "properties": {"repobilityId": 44942, "scanner": "repobility-supply-chain", "fingerprint": "4e3737fdeb59e53cff3b16d81c543bfc0c1b459668807a1c6b2c85dde9d9acf0", "category": "dependency", "severity": "high", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "gha-mutable-ref", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|4e3737fdeb59e53cff3b16d81c543bfc0c1b459668807a1c6b2c85dde9d9acf0"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/1-step.yml"}, "region": {"startLine": 50}}}]}, {"ruleId": "MINED115", "level": "error", "message": {"text": "Action `peter-evans/find-comment` pinned to mutable ref `@v3`"}, "properties": {"repobilityId": 44941, "scanner": "repobility-supply-chain", "fingerprint": "91f0f5b708073c02e751b58c87b305834fc23f809ee00a88bfb771daeacd5980", "category": "dependency", "severity": "high", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "gha-mutable-ref", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|91f0f5b708073c02e751b58c87b305834fc23f809ee00a88bfb771daeacd5980"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/1-step.yml"}, "region": {"startLine": 43}}}]}, {"ruleId": "MINED115", "level": "error", "message": {"text": "Action `actions/checkout` pinned to mutable ref `@v6`"}, "properties": {"repobilityId": 44940, "scanner": "repobility-supply-chain", "fingerprint": "6b9cf2dd41d2b6f0a9b0a869f7a24802b4669f4b8cbd65edd0a0e8c9768ba44d", "category": "dependency", "severity": "high", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "gha-mutable-ref", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|6b9cf2dd41d2b6f0a9b0a869f7a24802b4669f4b8cbd65edd0a0e8c9768ba44d"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/1-step.yml"}, "region": {"startLine": 35}}}]}, {"ruleId": "MINED115", "level": "error", "message": {"text": "Action `actions/checkout` pinned to mutable ref `@v6`"}, "properties": {"repobilityId": 44939, "scanner": "repobility-supply-chain", "fingerprint": "f9b592934bdc5938b5ec32b25497987932e737b2fa2d58c7d5436b55f6224447", "category": "dependency", "severity": "high", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "gha-mutable-ref", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|f9b592934bdc5938b5ec32b25497987932e737b2fa2d58c7d5436b55f6224447"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/1-step.yml"}, "region": {"startLine": 32}}}]}, {"ruleId": "MINED115", "level": "error", "message": {"text": "Action `skills/exercise-toolkit/.github/workflows/find-exercise-issue.yml` pinned to mutable ref `@v0.8.1`"}, "properties": {"repobilityId": 44938, "scanner": "repobility-supply-chain", "fingerprint": "646b037b1638db9f53f3751e7d3f30f76f48cb2698f70d5b8781f93409d9e8c5", "category": "dependency", "severity": "high", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "gha-mutable-ref", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|646b037b1638db9f53f3751e7d3f30f76f48cb2698f70d5b8781f93409d9e8c5"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/1-step.yml"}, "region": {"startLine": 20}}}]}, {"ruleId": "MINED112", "level": "error", "message": {"text": "FastAPI POST /activities/{activity_name}/signup has no auth"}, "properties": {"repobilityId": 44933, "scanner": "repobility-route-auth", "fingerprint": "bf6dc928dab7cc95213d9c110e5d388fa35518092a5107085d7e72d229f6a9da", "category": "quality", "severity": "high", "confidence": 0.8, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "fastapi-destructive-unauth", "owasp": "A01:2021", "cwe_ids": ["CWE-306", "CWE-862"], "languages": ["python", "javascript"], "observations_count": 10455}, "scanner": "repobility-route-auth", "correlation_key": "fp|bf6dc928dab7cc95213d9c110e5d388fa35518092a5107085d7e72d229f6a9da"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/app.py"}, "region": {"startLine": 56}}}]}]}]}