{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-59868562782cd0f8", "name": "Privileged port 1000 in use", "shortDescription": {"text": "Privileged port 1000 in use"}, "fullDescription": {"text": "Port 1000 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-80e96c6c0a8668a3", "name": "Docker base image is tag-pinned but not digest-pinned: docker.io/library/ruby:$RUBY_VERSION-slim", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: docker.io/library/ruby:$RUBY_VERSION-slim"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9710c8d059e53154", "name": "No frontend routes/components detected", "shortDescription": {"text": "No frontend routes/components detected"}, "fullDescription": {"text": "No React/Vue/Next routes were found. This is fine for backend-only repos."}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-e9be6c1a4ff53bce", "name": "Insecure pattern 'direct_innerhtml_assignment' in app/javascript/controllers/mention_controller.js:62", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in app/javascript/controllers/mention_controller.js:62"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-75a9e931b67edf30", "name": "Insecure pattern 'direct_innerhtml_assignment' in app/javascript/controllers/notification_preview_controller.js:15", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in app/javascript/controllers/notification_preview_controller.js:15"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c534a8dbd15575ac", "name": "Insecure pattern 'direct_innerhtml_assignment' in app/javascript/controllers/flash_controller.js:22", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in app/javascript/controllers/flash_controller.js:22"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f73c8ba1bc5c2a22", "name": "Insecure pattern 'direct_innerhtml_assignment' in app/javascript/controllers/conversation_search_controller.js:25", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in app/javascript/controllers/conversation_search_controller.js:25"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1bb833f0b97215e4", "name": "Insecure pattern 'direct_innerhtml_assignment' in app/javascript/controllers/photo_upload_controller.js:55", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in app/javascript/controllers/photo_upload_controller.js:55"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6372cebde0220094", "name": "No auth library detected", "shortDescription": {"text": "No auth library detected"}, "fullDescription": {"text": "The scanner did not find any standard auth library (JWT, OAuth, NextAuth, Auth0, etc.). The repo has auth/admin/session surface indicators, so auth may live in custom code, in a separate service, or be missing."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4601e3ad3bb28677", "name": "No CI/CD pipelines detected", "shortDescription": {"text": "No CI/CD pipelines detected"}, "fullDescription": {"text": "No GitHub Actions, GitLab CI, or CircleCI configs found. Without CI you can't gate deploys on tests/lints."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6893a6c8b0861585", "name": "Very low test-to-source ratio", "shortDescription": {"text": "Very low test-to-source ratio"}, "fullDescription": {"text": "0 test file(s) for 37 source file(s) (ratio 0.00). Consider adding integration or unit tests for critical paths."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-141b30a41e03817b", "name": "No license file detected", "shortDescription": {"text": "No license file detected"}, "fullDescription": {"text": "No LICENSE/COPYING/NOTICE file was found. Generated repositories often omit licensing, which blocks reuse and automated intake."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b9088664ace7f748", "name": "Composite production-readiness gap", "shortDescription": {"text": "Composite production-readiness gap"}, "fullDescription": {"text": "Multiple low-cost hardening controls are missing together: license, ci, tests. Opus verification showed these co-occurring gaps are a better readiness signal than reading each flag in isolation."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-749d4bc1bd66df5f", "name": "Agent instructions exist but release-hardening basics are missing", "shortDescription": {"text": "Agent instructions exist but release-hardening basics are missing"}, "fullDescription": {"text": "AI-coder instruction files were found, but the repo is missing license, ci, tests. Treat this as a contract gap: the agent is guided, but the generated output is not yet guarded by the controls that make it repeatable."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6a76f9bd08c65921", "name": "Agent authority lacks a verifier contract: .claude/commands/coverage.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/commands/coverage.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-998f8065facf434b", "name": "Agent authority lacks a verifier contract: .claude/commands/create-user.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/commands/create-user.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9bf971fb959c1bd9", "name": "Agent authority lacks a verifier contract: .claude/commands/review.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/commands/review.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4fd2480942ceb856", "name": "Agent authority lacks a verifier contract: .claude/skills/create-cli/references/cli-guidelines.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/skills/create-cli/references/cli-guidelines.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a43e95534fc952fe", "name": "`fetch()` without try/.catch or AbortSignal \u2014 app/views/pwa/service-worker.js:59", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 app/views/pwa/service-worker.js:59"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-97bdc9d85d15515d", "name": "`fetch()` without try/.catch or AbortSignal \u2014 app/javascript/controllers/push_notifications_controller.js:49", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 app/javascript/controllers/push_notifications_controller.js:49"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4c4b3e1205f8bd23", "name": "`fetch()` without try/.catch or AbortSignal \u2014 app/javascript/controllers/map_controller.js:41", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 app/javascript/controllers/map_controller.js:41"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-880feaf6a8772dc0", "name": "`fetch()` without try/.catch or AbortSignal \u2014 app/javascript/controllers/emoji_reaction_controller.js:48", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 app/javascript/controllers/emoji_reaction_controller.js:48"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/24801"}, "properties": {"repository": "calebl/sacred-feminine-community", "repoUrl": "https://github.com/calebl/sacred-feminine-community", "branch": "main"}, "results": [{"ruleId": "scanner-59868562782cd0f8", "level": "warning", "message": {"text": "Privileged port 1000 in use"}, "properties": {"repobilityId": "5ac9fc9372cfe169", "scanner": "scanner-primary", "fingerprint": "59868562782cd0f8", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Dockerfile"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-80e96c6c0a8668a3", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: docker.io/library/ruby:$RUBY_VERSION-slim"}, "properties": {"repobilityId": "3e414d7a1a76d6a8", "scanner": "scanner-primary", "fingerprint": "80e96c6c0a8668a3", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Dockerfile"}, "region": {"startLine": 12}}}]}, {"ruleId": "scanner-9710c8d059e53154", "level": "none", "message": {"text": "No frontend routes/components detected"}, "properties": {"repobilityId": "44ca61485762e494", "scanner": "scanner-primary", "fingerprint": "9710c8d059e53154", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-e9be6c1a4ff53bce", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in app/javascript/controllers/mention_controller.js:62"}, "properties": {"repobilityId": "e6c7ebbabedb5139", "scanner": "scanner-primary", "fingerprint": "e9be6c1a4ff53bce", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "app/javascript/controllers/mention_controller.js"}, "region": {"startLine": 62}}}]}, {"ruleId": "scanner-75a9e931b67edf30", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in app/javascript/controllers/notification_preview_controller.js:15"}, "properties": {"repobilityId": "beb20f2a78efaa63", "scanner": "scanner-primary", "fingerprint": "75a9e931b67edf30", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "app/javascript/controllers/notification_preview_controller.js"}, "region": {"startLine": 15}}}]}, {"ruleId": "scanner-c534a8dbd15575ac", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in app/javascript/controllers/flash_controller.js:22"}, "properties": {"repobilityId": "816c6ad3851d2399", "scanner": "scanner-primary", "fingerprint": "c534a8dbd15575ac", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "app/javascript/controllers/flash_controller.js"}, "region": {"startLine": 22}}}]}, {"ruleId": "scanner-f73c8ba1bc5c2a22", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in app/javascript/controllers/conversation_search_controller.js:25"}, "properties": {"repobilityId": "bc27c67c5692c86d", "scanner": "scanner-primary", "fingerprint": "f73c8ba1bc5c2a22", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "app/javascript/controllers/conversation_search_controller.js"}, "region": {"startLine": 25}}}]}, {"ruleId": "scanner-1bb833f0b97215e4", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in app/javascript/controllers/photo_upload_controller.js:55"}, "properties": {"repobilityId": "e9fa3b9e73340408", "scanner": "scanner-primary", "fingerprint": "1bb833f0b97215e4", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "app/javascript/controllers/photo_upload_controller.js"}, "region": {"startLine": 55}}}]}, {"ruleId": "scanner-6372cebde0220094", "level": "warning", "message": {"text": "No auth library detected"}, "properties": {"repobilityId": "a5b6035a5bbf8054", "scanner": "scanner-primary", "fingerprint": "6372cebde0220094", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["coverage", "auth"]}}, {"ruleId": "scanner-4601e3ad3bb28677", "level": "warning", "message": {"text": "No CI/CD pipelines detected"}, "properties": {"repobilityId": "c3ee439bce2bc51e", "scanner": "scanner-primary", "fingerprint": "4601e3ad3bb28677", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-6893a6c8b0861585", "level": "warning", "message": {"text": "Very low test-to-source ratio"}, "properties": {"repobilityId": "54a7de3f06314bf0", "scanner": "scanner-primary", "fingerprint": "6893a6c8b0861585", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["tests", "coverage"]}}, {"ruleId": "scanner-141b30a41e03817b", "level": "note", "message": {"text": "No license file detected"}, "properties": {"repobilityId": "ca27a74494203b6e", "scanner": "scanner-primary", "fingerprint": "141b30a41e03817b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["license", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-b9088664ace7f748", "level": "warning", "message": {"text": "Composite production-readiness gap"}, "properties": {"repobilityId": "817a9ad554847ac4", "scanner": "scanner-primary", "fingerprint": "b9088664ace7f748", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["production-readiness", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-749d4bc1bd66df5f", "level": "warning", "message": {"text": "Agent instructions exist but release-hardening basics are missing"}, "properties": {"repobilityId": "995c07696346c608", "scanner": "scanner-primary", "fingerprint": "749d4bc1bd66df5f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-6a76f9bd08c65921", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/commands/coverage.md"}, "properties": {"repobilityId": "e7b5685ae7c90b41", "scanner": "scanner-primary", "fingerprint": "6a76f9bd08c65921", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/commands/coverage.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-998f8065facf434b", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/commands/create-user.md"}, "properties": {"repobilityId": "469eaa5f9744fd0f", "scanner": "scanner-primary", "fingerprint": "998f8065facf434b", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/commands/create-user.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-9bf971fb959c1bd9", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/commands/review.md"}, "properties": {"repobilityId": "b1e28d266fdfdeb8", "scanner": "scanner-primary", "fingerprint": "9bf971fb959c1bd9", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/commands/review.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-4fd2480942ceb856", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/skills/create-cli/references/cli-guidelines.md"}, "properties": {"repobilityId": "d1fabd3873fd7b88", "scanner": "scanner-primary", "fingerprint": "4fd2480942ceb856", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/create-cli/references/cli-guidelines.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a43e95534fc952fe", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 app/views/pwa/service-worker.js:59"}, "properties": {"repobilityId": "3fc829b753fee02e", "scanner": "scanner-primary", "fingerprint": "a43e95534fc952fe", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-97bdc9d85d15515d", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 app/javascript/controllers/push_notifications_controller.js:49"}, "properties": {"repobilityId": "615e4ba65036b053", "scanner": "scanner-primary", "fingerprint": "97bdc9d85d15515d", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-4c4b3e1205f8bd23", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 app/javascript/controllers/map_controller.js:41"}, "properties": {"repobilityId": "62650cdaa87dbf57", "scanner": "scanner-primary", "fingerprint": "4c4b3e1205f8bd23", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-880feaf6a8772dc0", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 app/javascript/controllers/emoji_reaction_controller.js:48"}, "properties": {"repobilityId": "fb5bb1604921561d", "scanner": "scanner-primary", "fingerprint": "880feaf6a8772dc0", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}]}]}