{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-1946896e003260f5", "name": "Stray `console.log` in TS/JS \u2014 api/stripe-webhook.js:53", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 api/stripe-webhook.js:53"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-caef45eee676ca9f", "name": "Stray `console.log` in TS/JS \u2014 api/cron/sync-tracker-positions.js:137", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 api/cron/sync-tracker-positions.js:137"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e88ea9a3ae0d138d", "name": "TODO/FIXME marker in shipping code \u2014 mobile-app/www/native-bridge.js:73", "shortDescription": {"text": "TODO/FIXME marker in shipping code \u2014 mobile-app/www/native-bridge.js:73"}, "fullDescription": {"text": "Track in /reviews or /issues, not as a code comment that rots.\n\nWhy: Drift control \u2014 shouldn't be the same as Quality TODO scanner.\nRule id: fq.todo-marker"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-28154b36b882bdf4", "name": "Stray `console.log` in TS/JS \u2014 mobile-app/www/native-bridge.js:24", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 mobile-app/www/native-bridge.js:24"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f6e21d9f9dd1a2b2", "name": "Privileged port 3 in use", "shortDescription": {"text": "Privileged port 3 in use"}, "fullDescription": {"text": "Port 3 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9bd1fd53b8c6cb83", "name": "Privileged port 4 in use", "shortDescription": {"text": "Privileged port 4 in use"}, "fullDescription": {"text": "Port 4 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9710c8d059e53154", "name": "No frontend routes/components detected", "shortDescription": {"text": "No frontend routes/components detected"}, "fullDescription": {"text": "No React/Vue/Next routes were found. This is fine for backend-only repos."}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-c76bc41d95ce6d51", "name": "Possible secret in setup-traccar-server.sh", "shortDescription": {"text": "Possible secret in setup-traccar-server.sh"}, "fullDescription": {"text": "Detected pattern matching password_literal. Rotate the credential and move to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-006cf5fd35fd092d", "name": "Insecure pattern 'direct_innerhtml_assignment' in booking.html:1214", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in booking.html:1214"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d60aa31cbbfb5bc2", "name": "Insecure pattern 'local_storage_auth_token' in booking.html:1832", "shortDescription": {"text": "Insecure pattern 'local_storage_auth_token' in booking.html:1832"}, "fullDescription": {"text": "Found a known-risky pattern (local_storage_auth_token). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6b009543502de5c8", "name": "Insecure pattern 'direct_innerhtml_assignment' in chat-widget.js:461", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in chat-widget.js:461"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e76063597b0926f2", "name": "Insecure pattern 'direct_innerhtml_assignment' in index.html:4294", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in index.html:4294"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a23ea523ae07871a", "name": "Insecure pattern 'direct_outerhtml_assignment' in index.html:4173", "shortDescription": {"text": "Insecure pattern 'direct_outerhtml_assignment' in index.html:4173"}, "fullDescription": {"text": "Found a known-risky pattern (direct_outerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0c567e530ec3fdd3", "name": "Insecure pattern 'direct_innerhtml_assignment' in return.html:391", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in return.html:391"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0ff97445ef318ffb", "name": "Insecure pattern 'direct_innerhtml_assignment' in i18n.js:995", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in i18n.js:995"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e5a4930a66eb54f3", "name": "Insecure pattern 'document_write' in admin.html:1742", "shortDescription": {"text": "Insecure pattern 'document_write' in admin.html:1742"}, "fullDescription": {"text": "Found a known-risky pattern (document_write). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-37aaa310c99b21cf", "name": "Insecure pattern 'direct_innerhtml_assignment' in admin.html:1291", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in admin.html:1291"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7e1a61e739da50c3", "name": "Insecure pattern 'direct_innerhtml_assignment' in anleitung.html:563", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in anleitung.html:563"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-cf898e34483bff0e", "name": "Insecure pattern 'local_storage_auth_token' in native-bridge.js:77", "shortDescription": {"text": "Insecure pattern 'local_storage_auth_token' in native-bridge.js:77"}, "fullDescription": {"text": "Found a known-risky pattern (local_storage_auth_token). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ee6ca27e9af2c5c7", "name": "Insecure pattern 'direct_innerhtml_assignment' in precheck.html:369", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in precheck.html:369"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e035de3c7deb0404", "name": "Insecure pattern 'direct_innerhtml_assignment' in hero-light.html:4111", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in hero-light.html:4111"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3ddc2381a6bc0d5b", "name": "Insecure pattern 'direct_outerhtml_assignment' in hero-light.html:3990", "shortDescription": {"text": "Insecure pattern 'direct_outerhtml_assignment' in hero-light.html:3990"}, "fullDescription": {"text": "Found a known-risky pattern (direct_outerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f294fa6d80e2bd0a", "name": "Insecure pattern 'direct_innerhtml_assignment' in account.html:548", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in account.html:548"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-217de5be891470aa", "name": "Insecure pattern 'local_storage_auth_token' in account.html:364", "shortDescription": {"text": "Insecure pattern 'local_storage_auth_token' in account.html:364"}, "fullDescription": {"text": "Found a known-risky pattern (local_storage_auth_token). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3e7b554d793c2205", "name": "Insecure pattern 'cors_wildcard' in api/notify-when-available.js:16", "shortDescription": {"text": "Insecure pattern 'cors_wildcard' in api/notify-when-available.js:16"}, "fullDescription": {"text": "Found a known-risky pattern (cors_wildcard). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6c8a2ec50508fd3c", "name": "Insecure pattern 'cors_wildcard' in api/process-return.js:9", "shortDescription": {"text": "Insecure pattern 'cors_wildcard' in api/process-return.js:9"}, "fullDescription": {"text": "Found a known-risky pattern (cors_wildcard). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8fe2b6c5a98fa70c", "name": "Insecure pattern 'cors_wildcard' in api/contact.js:23", "shortDescription": {"text": "Insecure pattern 'cors_wildcard' in api/contact.js:23"}, "fullDescription": {"text": "Found a known-risky pattern (cors_wildcard). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1df1f81a61c04519", "name": "Insecure pattern 'cors_wildcard' in api/get-availability.js:6", "shortDescription": {"text": "Insecure pattern 'cors_wildcard' in api/get-availability.js:6"}, "fullDescription": {"text": "Found a known-risky pattern (cors_wildcard). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ca633abeaa6d63c9", "name": "Insecure pattern 'cors_wildcard' in api/chat.js:171", "shortDescription": {"text": "Insecure pattern 'cors_wildcard' in api/chat.js:171"}, "fullDescription": {"text": "Found a known-risky pattern (cors_wildcard). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7887967f52eff401", "name": "Insecure pattern 'cors_wildcard' in api/send-reminders.js:14", "shortDescription": {"text": "Insecure pattern 'cors_wildcard' in api/send-reminders.js:14"}, "fullDescription": {"text": "Found a known-risky pattern (cors_wildcard). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-de9f914e002324ae", "name": "Insecure pattern 'cors_wildcard' in api/newsletter-subscribe.js:19", "shortDescription": {"text": "Insecure pattern 'cors_wildcard' in api/newsletter-subscribe.js:19"}, "fullDescription": {"text": "Found a known-risky pattern (cors_wildcard). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-884ba8e72b7822a0", "name": "Insecure pattern 'cors_wildcard' in api/create-payment-intent.js:18", "shortDescription": {"text": "Insecure pattern 'cors_wildcard' in api/create-payment-intent.js:18"}, "fullDescription": {"text": "Found a known-risky pattern (cors_wildcard). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6e45c117a2ac045a", "name": "Insecure pattern 'cors_wildcard' in api/identity.js:23", "shortDescription": {"text": "Insecure pattern 'cors_wildcard' in api/identity.js:23"}, "fullDescription": {"text": "Found a known-risky pattern (cors_wildcard). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b1d00512dcf9ae38", "name": "Insecure pattern 'cors_wildcard' in api/get-trailers.js:5", "shortDescription": {"text": "Insecure pattern 'cors_wildcard' in api/get-trailers.js:5"}, "fullDescription": {"text": "Found a known-risky pattern (cors_wildcard). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e6e401dcc4711351", "name": "Insecure pattern 'cors_wildcard' in api/health.js:9", "shortDescription": {"text": "Insecure pattern 'cors_wildcard' in api/health.js:9"}, "fullDescription": {"text": "Found a known-risky pattern (cors_wildcard). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2c38e583544aa8d1", "name": "Insecure pattern 'cors_wildcard' in api/heartbeat.js:14", "shortDescription": {"text": "Insecure pattern 'cors_wildcard' in api/heartbeat.js:14"}, "fullDescription": {"text": "Found a known-risky pattern (cors_wildcard). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1ef050e80518ec81", "name": "Insecure pattern 'cors_wildcard' in api/booking.js:16", "shortDescription": {"text": "Insecure pattern 'cors_wildcard' in api/booking.js:16"}, "fullDescription": {"text": "Found a known-risky pattern (cors_wildcard). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-5fdc1e0355f6cccd", "name": "Insecure pattern 'cors_wildcard' in api/live-visitors.js:15", "shortDescription": {"text": "Insecure pattern 'cors_wildcard' in api/live-visitors.js:15"}, "fullDescription": {"text": "Found a known-risky pattern (cors_wildcard). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7e52a237edb4b42c", "name": "Insecure pattern 'local_storage_auth_token' in mobile-app/www/native-bridge.js:74", "shortDescription": {"text": "Insecure pattern 'local_storage_auth_token' in mobile-app/www/native-bridge.js:74"}, "fullDescription": {"text": "Found a known-risky pattern (local_storage_auth_token). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9b41d9d68a5be218", "name": "Insecure pattern 'local_storage_auth_token' in mobile-app/www/api-client.js:100", "shortDescription": {"text": "Insecure pattern 'local_storage_auth_token' in mobile-app/www/api-client.js:100"}, "fullDescription": {"text": "Found a known-risky pattern (local_storage_auth_token). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-329789a552e8b555", "name": "Insecure pattern 'cors_wildcard' in mobile-app/server-stub/delete-account.js:22", "shortDescription": {"text": "Insecure pattern 'cors_wildcard' in mobile-app/server-stub/delete-account.js:22"}, "fullDescription": {"text": "Found a known-risky pattern (cors_wildcard). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f5cf3f3593d1f69a", "name": "Insecure pattern 'cors_wildcard' in mobile-app/server-stub/save-push-token.js:24", "shortDescription": {"text": "Insecure pattern 'cors_wildcard' in mobile-app/server-stub/save-push-token.js:24"}, "fullDescription": {"text": "Found a known-risky pattern (cors_wildcard). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d36e1a9a890a4b31", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d9e43cd48e551e1b", "name": "Very large file: i18n.js (1130 lines)", "shortDescription": {"text": "Very large file: i18n.js (1130 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6893a6c8b0861585", "name": "Very low test-to-source ratio", "shortDescription": {"text": "Very low test-to-source ratio"}, "fullDescription": {"text": "0 test file(s) for 65 source file(s) (ratio 0.00). Consider adding integration or unit tests for critical paths."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-141b30a41e03817b", "name": "No license file detected", "shortDescription": {"text": "No license file detected"}, "fullDescription": {"text": "No LICENSE/COPYING/NOTICE file was found. Generated repositories often omit licensing, which blocks reuse and automated intake."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b3ed68815bca2f8c", "name": "Node manifest has dependencies but no lockfile: package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 8 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9d79c4077342a7d0", "name": "Runtime service client appears to use placeholder configuration", "shortDescription": {"text": "Runtime service client appears to use placeholder configuration"}, "fullDescription": {"text": "A runtime source file appears to wire Supabase/Firebase/AI/payment-style clients to placeholder URLs, keys, or fallback values. In the Fable corpus this often means the UI/API shape is present while the backend service is not actually configured."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b9088664ace7f748", "name": "Composite production-readiness gap", "shortDescription": {"text": "Composite production-readiness gap"}, "fullDescription": {"text": "Multiple low-cost hardening controls are missing together: license, ci, lockfile. Opus verification showed these co-occurring gaps are a better readiness signal than reading each flag in isolation."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-749d4bc1bd66df5f", "name": "Agent instructions exist but release-hardening basics are missing", "shortDescription": {"text": "Agent instructions exist but release-hardening basics are missing"}, "fullDescription": {"text": "AI-coder instruction files were found, but the repo is missing license, ci, lockfile. Treat this as a contract gap: the agent is guided, but the generated output is not yet guarded by the controls that make it repeatable."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-17d866d91a7c451e", "name": "Agent instruction/config may expose a secret: CLAUDE.md", "shortDescription": {"text": "Agent instruction/config may expose a secret: CLAUDE.md"}, "fullDescription": {"text": "Agent-facing files are routinely pasted into LLM/tool contexts. Move literal tokens, keys, and passwords into a secret manager or document them as placeholders only."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-ad6b197ce23611a0", "name": "Legacy-named symbol `st_chat_history_v2` in chat-widget.js:13", "shortDescription": {"text": "Legacy-named symbol `st_chat_history_v2` in chat-widget.js:13"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-29912b795494965d", "name": "Commented-code block (5 lines) in chat-widget.js:610", "shortDescription": {"text": "Commented-code block (5 lines) in chat-widget.js:610"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-f51f8a8f59a70ab4", "name": "`fetch()` without try/.catch or AbortSignal \u2014 sw.js:54", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 sw.js:54"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-cd85d620541cb19c", "name": "Commented-code block (5 lines) in i18n.js:947", "shortDescription": {"text": "Commented-code block (5 lines) in i18n.js:947"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-a3614efdecf45a6c", "name": "Commented-code block (5 lines) in analytics.js:52", "shortDescription": {"text": "Commented-code block (5 lines) in analytics.js:52"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-8d288d9fc2b640c3", "name": "`fetch()` without try/.catch or AbortSignal \u2014 api/trailer-position.js:48", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 api/trailer-position.js:48"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e7d4659061d06652", "name": "Commented-code block (6 lines) in api/process-return.js:158", "shortDescription": {"text": "Commented-code block (6 lines) in api/process-return.js:158"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-2284ce46aaed3fc0", "name": "`fetch()` without try/.catch or AbortSignal \u2014 api/process-return.js:83", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 api/process-return.js:83"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9f9949c3ac7e34ba", "name": "Commented-code block (6 lines) in api/create-payment-intent.js:151", "shortDescription": {"text": "Commented-code block (6 lines) in api/create-payment-intent.js:151"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-7b9bbaba2ed7a177", "name": "`fetch()` without try/.catch or AbortSignal \u2014 api/_push-sender.js:77", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 api/_push-sender.js:77"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-23de3f4cdd47530f", "name": "`fetch()` without try/.catch or AbortSignal \u2014 api/cron/midweek-check.js:59", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 api/cron/midweek-check.js:59"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e751226e3171ae4b", "name": "`fetch()` without try/.catch or AbortSignal \u2014 api/cron/bug-triager.js:41", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 api/cron/bug-triager.js:41"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f539c8f8e647650f", "name": "`fetch()` without try/.catch or AbortSignal \u2014 api/cron/weekly-ratgeber-generator.js:102", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 api/cron/weekly-ratgeber-generator.js:102"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d0976456bfac2c81", "name": "`fetch()` without try/.catch or AbortSignal \u2014 api/cron/legal-quarterly-audit.js:91", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 api/cron/legal-quarterly-audit.js:91"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-83a102d6f92d2107", "name": "`fetch()` without try/.catch or AbortSignal \u2014 api/cron/social-media-generator.js:108", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 api/cron/social-media-generator.js:108"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-96767d3d28605447", "name": "`fetch()` without try/.catch or AbortSignal \u2014 api/cron/weekly-advisor.js:87", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 api/cron/weekly-advisor.js:87"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c35588f0a2d04861", "name": "`fetch()` without try/.catch or AbortSignal \u2014 api/cron/tracker-watchdog.js:52", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 api/cron/tracker-watchdog.js:52"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-28143d6d4b0bcc32", "name": "`fetch()` without try/.catch or AbortSignal \u2014 api/cron/competitor-watcher.js:69", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 api/cron/competitor-watcher.js:69"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f8f2296e4a50c062", "name": "Commented-code block (6 lines) in api/cron/sync-tracker-positions.js:122", "shortDescription": {"text": "Commented-code block (6 lines) in api/cron/sync-tracker-positions.js:122"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-b9923fdd832ba013", "name": "`fetch()` without try/.catch or AbortSignal \u2014 api/cron/sync-tracker-positions.js:41", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 api/cron/sync-tracker-positions.js:41"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-855a54721c2e5633", "name": "`fetch()` without try/.catch or AbortSignal \u2014 api/cron/budget-optimizer.js:21", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 api/cron/budget-optimizer.js:21"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7e09e51daf464f45", "name": "`fetch()` without try/.catch or AbortSignal \u2014 mobile-app/server-stub/delete-account.js:9", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 mobile-app/server-stub/delete-account.js:9"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1afecd7142103456", "name": "`fetch()` without try/.catch or AbortSignal \u2014 mobile-app/server-stub/save-push-token.js:10", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 mobile-app/server-stub/save-push-token.js:10"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/19696"}, "properties": {"repository": "SimpleTrailer/simpletrailer", "repoUrl": "https://github.com/SimpleTrailer/simpletrailer", "branch": "main"}, "results": [{"ruleId": "scanner-1946896e003260f5", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 api/stripe-webhook.js:53"}, "properties": {"repobilityId": "b06cdbf3917dbcaa", "scanner": "scanner-primary", "fingerprint": "1946896e003260f5", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-caef45eee676ca9f", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 api/cron/sync-tracker-positions.js:137"}, "properties": {"repobilityId": "0010fc49768c1e75", "scanner": "scanner-primary", "fingerprint": "caef45eee676ca9f", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-e88ea9a3ae0d138d", "level": "none", "message": {"text": "TODO/FIXME marker in shipping code \u2014 mobile-app/www/native-bridge.js:73"}, "properties": {"repobilityId": "44653748adfd8527", "scanner": "scanner-primary", "fingerprint": "e88ea9a3ae0d138d", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.todo-marker"]}}, {"ruleId": "scanner-28154b36b882bdf4", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 mobile-app/www/native-bridge.js:24"}, "properties": {"repobilityId": "797c74594b583895", "scanner": "scanner-primary", "fingerprint": "28154b36b882bdf4", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-f6e21d9f9dd1a2b2", "level": "warning", "message": {"text": "Privileged port 3 in use"}, "properties": {"repobilityId": "261b7b1c6a18d412", "scanner": "scanner-primary", "fingerprint": "f6e21d9f9dd1a2b2", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "setup-traccar-server.sh"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-9bd1fd53b8c6cb83", "level": "warning", "message": {"text": "Privileged port 4 in use"}, "properties": {"repobilityId": "1594bfeff919296e", "scanner": "scanner-primary", "fingerprint": "9bd1fd53b8c6cb83", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "setup-traccar-server.sh"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-9710c8d059e53154", "level": "none", "message": {"text": "No frontend routes/components detected"}, "properties": {"repobilityId": "44ca61485762e494", "scanner": "scanner-primary", "fingerprint": "9710c8d059e53154", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-c76bc41d95ce6d51", "level": "error", "message": {"text": "Possible secret in setup-traccar-server.sh"}, "properties": {"repobilityId": "7e9ee615fa361677", "scanner": "scanner-primary", "fingerprint": "c76bc41d95ce6d51", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "setup-traccar-server.sh"}, "region": {"startLine": 74}}}]}, {"ruleId": "scanner-c76bc41d95ce6d51", "level": "error", "message": {"text": "Possible secret in setup-traccar-server.sh"}, "properties": {"repobilityId": "7e9ee615fa361677", "scanner": "scanner-primary", "fingerprint": "c76bc41d95ce6d51", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "setup-traccar-server.sh"}, "region": {"startLine": 75}}}]}, {"ruleId": "scanner-006cf5fd35fd092d", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in booking.html:1214"}, "properties": {"repobilityId": "257a4379bdb4e0c5", "scanner": "scanner-primary", "fingerprint": "006cf5fd35fd092d", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "booking.html"}, "region": {"startLine": 1214}}}]}, {"ruleId": "scanner-d60aa31cbbfb5bc2", "level": "warning", "message": {"text": "Insecure pattern 'local_storage_auth_token' in booking.html:1832"}, "properties": {"repobilityId": "6f503db88ad1bb40", "scanner": "scanner-primary", "fingerprint": "d60aa31cbbfb5bc2", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "local_storage_auth_token"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "booking.html"}, "region": {"startLine": 1832}}}]}, {"ruleId": "scanner-6b009543502de5c8", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in chat-widget.js:461"}, "properties": {"repobilityId": "dae7ff8577caabba", "scanner": "scanner-primary", "fingerprint": "6b009543502de5c8", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "chat-widget.js"}, "region": {"startLine": 461}}}]}, {"ruleId": "scanner-e76063597b0926f2", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in index.html:4294"}, "properties": {"repobilityId": "f91708437a3a5445", "scanner": "scanner-primary", "fingerprint": "e76063597b0926f2", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "index.html"}, "region": {"startLine": 4294}}}]}, {"ruleId": "scanner-a23ea523ae07871a", "level": "warning", "message": {"text": "Insecure pattern 'direct_outerhtml_assignment' in index.html:4173"}, "properties": {"repobilityId": "fbffc2b0cac7f83e", "scanner": "scanner-primary", "fingerprint": "a23ea523ae07871a", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_outerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "index.html"}, "region": {"startLine": 4173}}}]}, {"ruleId": "scanner-0c567e530ec3fdd3", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in return.html:391"}, "properties": {"repobilityId": "45c92bb880c34a28", "scanner": "scanner-primary", "fingerprint": "0c567e530ec3fdd3", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "return.html"}, "region": {"startLine": 391}}}]}, {"ruleId": "scanner-0ff97445ef318ffb", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in i18n.js:995"}, "properties": {"repobilityId": "4231557a5319c233", "scanner": "scanner-primary", "fingerprint": "0ff97445ef318ffb", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "i18n.js"}, "region": {"startLine": 995}}}]}, {"ruleId": "scanner-e5a4930a66eb54f3", "level": "note", "message": {"text": "Insecure pattern 'document_write' in admin.html:1742"}, "properties": {"repobilityId": "b73add9be8b2c6c6", "scanner": "scanner-primary", "fingerprint": "e5a4930a66eb54f3", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["owasp", "document_write"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "admin.html"}, "region": {"startLine": 1742}}}]}, {"ruleId": "scanner-37aaa310c99b21cf", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in admin.html:1291"}, "properties": {"repobilityId": "6ce12d2fb0d90b99", "scanner": "scanner-primary", "fingerprint": "37aaa310c99b21cf", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "admin.html"}, "region": {"startLine": 1291}}}]}, {"ruleId": "scanner-7e1a61e739da50c3", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in anleitung.html:563"}, "properties": {"repobilityId": "ce9a2a247a52cf4c", "scanner": "scanner-primary", "fingerprint": "7e1a61e739da50c3", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "anleitung.html"}, "region": {"startLine": 563}}}]}, {"ruleId": "scanner-cf898e34483bff0e", "level": "warning", "message": {"text": "Insecure pattern 'local_storage_auth_token' in native-bridge.js:77"}, "properties": {"repobilityId": "5914b9061fafb47b", "scanner": "scanner-primary", "fingerprint": "cf898e34483bff0e", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "local_storage_auth_token"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "native-bridge.js"}, "region": {"startLine": 77}}}]}, {"ruleId": "scanner-ee6ca27e9af2c5c7", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in precheck.html:369"}, "properties": {"repobilityId": "9d31fe28d63b7069", "scanner": "scanner-primary", "fingerprint": "ee6ca27e9af2c5c7", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "precheck.html"}, "region": {"startLine": 369}}}]}, {"ruleId": "scanner-e035de3c7deb0404", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in hero-light.html:4111"}, "properties": {"repobilityId": "c1bc76c3cce17fa0", "scanner": "scanner-primary", "fingerprint": "e035de3c7deb0404", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "hero-light.html"}, "region": {"startLine": 4111}}}]}, {"ruleId": "scanner-3ddc2381a6bc0d5b", "level": "warning", "message": {"text": "Insecure pattern 'direct_outerhtml_assignment' in hero-light.html:3990"}, "properties": {"repobilityId": "81420fb1dc41bafb", "scanner": "scanner-primary", "fingerprint": "3ddc2381a6bc0d5b", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_outerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "hero-light.html"}, "region": {"startLine": 3990}}}]}, {"ruleId": "scanner-f294fa6d80e2bd0a", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in account.html:548"}, "properties": {"repobilityId": "796de0196e47d2e7", "scanner": "scanner-primary", "fingerprint": "f294fa6d80e2bd0a", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "account.html"}, "region": {"startLine": 548}}}]}, {"ruleId": "scanner-217de5be891470aa", "level": "warning", "message": {"text": "Insecure pattern 'local_storage_auth_token' in account.html:364"}, "properties": {"repobilityId": "03e510227f6d4970", "scanner": "scanner-primary", "fingerprint": "217de5be891470aa", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "local_storage_auth_token"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "account.html"}, "region": {"startLine": 364}}}]}, {"ruleId": "scanner-3e7b554d793c2205", "level": "warning", "message": {"text": "Insecure pattern 'cors_wildcard' in api/notify-when-available.js:16"}, "properties": {"repobilityId": "390fea13ba6c551d", "scanner": "scanner-primary", "fingerprint": "3e7b554d793c2205", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "cors_wildcard"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "api/notify-when-available.js"}, "region": {"startLine": 16}}}]}, {"ruleId": "scanner-6c8a2ec50508fd3c", "level": "warning", "message": {"text": "Insecure pattern 'cors_wildcard' in api/process-return.js:9"}, "properties": {"repobilityId": "5dd88ab8b162a8c1", "scanner": "scanner-primary", "fingerprint": "6c8a2ec50508fd3c", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "cors_wildcard"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "api/process-return.js"}, "region": {"startLine": 9}}}]}, {"ruleId": "scanner-8fe2b6c5a98fa70c", "level": "warning", "message": {"text": "Insecure pattern 'cors_wildcard' in api/contact.js:23"}, "properties": {"repobilityId": "1011c4f7d255c476", "scanner": "scanner-primary", "fingerprint": "8fe2b6c5a98fa70c", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "cors_wildcard"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "api/contact.js"}, "region": {"startLine": 23}}}]}, {"ruleId": "scanner-1df1f81a61c04519", "level": "warning", "message": {"text": "Insecure pattern 'cors_wildcard' in api/get-availability.js:6"}, "properties": {"repobilityId": "94a54b3866178702", "scanner": "scanner-primary", "fingerprint": "1df1f81a61c04519", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "cors_wildcard"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "api/get-availability.js"}, "region": {"startLine": 6}}}]}, {"ruleId": "scanner-ca633abeaa6d63c9", "level": "warning", "message": {"text": "Insecure pattern 'cors_wildcard' in api/chat.js:171"}, "properties": {"repobilityId": "fce07b023a441240", "scanner": "scanner-primary", "fingerprint": "ca633abeaa6d63c9", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "cors_wildcard"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "api/chat.js"}, "region": {"startLine": 171}}}]}, {"ruleId": "scanner-7887967f52eff401", "level": "warning", "message": {"text": "Insecure pattern 'cors_wildcard' in api/send-reminders.js:14"}, "properties": {"repobilityId": "4cf54b932824616c", "scanner": "scanner-primary", "fingerprint": "7887967f52eff401", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "cors_wildcard"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "api/send-reminders.js"}, "region": {"startLine": 14}}}]}, {"ruleId": "scanner-de9f914e002324ae", "level": "warning", "message": {"text": "Insecure pattern 'cors_wildcard' in api/newsletter-subscribe.js:19"}, "properties": {"repobilityId": "afaa8c387cb8bc6e", "scanner": "scanner-primary", "fingerprint": "de9f914e002324ae", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "cors_wildcard"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "api/newsletter-subscribe.js"}, "region": {"startLine": 19}}}]}, {"ruleId": "scanner-884ba8e72b7822a0", "level": "warning", "message": {"text": "Insecure pattern 'cors_wildcard' in api/create-payment-intent.js:18"}, "properties": {"repobilityId": "02529573993a82ce", "scanner": "scanner-primary", "fingerprint": "884ba8e72b7822a0", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "cors_wildcard"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "api/create-payment-intent.js"}, "region": {"startLine": 18}}}]}, {"ruleId": "scanner-6e45c117a2ac045a", "level": "warning", "message": {"text": "Insecure pattern 'cors_wildcard' in api/identity.js:23"}, "properties": {"repobilityId": "275e4495af2f0875", "scanner": "scanner-primary", "fingerprint": "6e45c117a2ac045a", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "cors_wildcard"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "api/identity.js"}, "region": {"startLine": 23}}}]}, {"ruleId": "scanner-b1d00512dcf9ae38", "level": "warning", "message": {"text": "Insecure pattern 'cors_wildcard' in api/get-trailers.js:5"}, "properties": {"repobilityId": "72ed8249f19e740d", "scanner": "scanner-primary", "fingerprint": "b1d00512dcf9ae38", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "cors_wildcard"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "api/get-trailers.js"}, "region": {"startLine": 5}}}]}, {"ruleId": "scanner-e6e401dcc4711351", "level": "warning", "message": {"text": "Insecure pattern 'cors_wildcard' in api/health.js:9"}, "properties": {"repobilityId": "0f32033d51d457e0", "scanner": "scanner-primary", "fingerprint": "e6e401dcc4711351", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "cors_wildcard"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "api/health.js"}, "region": {"startLine": 9}}}]}, {"ruleId": "scanner-2c38e583544aa8d1", "level": "warning", "message": {"text": "Insecure pattern 'cors_wildcard' in api/heartbeat.js:14"}, "properties": {"repobilityId": "ff0465ce7b791d4c", "scanner": "scanner-primary", "fingerprint": "2c38e583544aa8d1", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "cors_wildcard"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "api/heartbeat.js"}, "region": {"startLine": 14}}}]}, {"ruleId": "scanner-1ef050e80518ec81", "level": "warning", "message": {"text": "Insecure pattern 'cors_wildcard' in api/booking.js:16"}, "properties": {"repobilityId": "8f0f1615892b9ed0", "scanner": "scanner-primary", "fingerprint": "1ef050e80518ec81", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "cors_wildcard"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "api/booking.js"}, "region": {"startLine": 16}}}]}, {"ruleId": "scanner-5fdc1e0355f6cccd", "level": "warning", "message": {"text": "Insecure pattern 'cors_wildcard' in api/live-visitors.js:15"}, "properties": {"repobilityId": "bcde9035c96a05db", "scanner": "scanner-primary", "fingerprint": "5fdc1e0355f6cccd", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "cors_wildcard"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "api/live-visitors.js"}, "region": {"startLine": 15}}}]}, {"ruleId": "scanner-7e52a237edb4b42c", "level": "warning", "message": {"text": "Insecure pattern 'local_storage_auth_token' in mobile-app/www/native-bridge.js:74"}, "properties": {"repobilityId": "5cb47e48edb1c65e", "scanner": "scanner-primary", "fingerprint": "7e52a237edb4b42c", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "local_storage_auth_token"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "mobile-app/www/native-bridge.js"}, "region": {"startLine": 74}}}]}, {"ruleId": "scanner-9b41d9d68a5be218", "level": "warning", "message": {"text": "Insecure pattern 'local_storage_auth_token' in mobile-app/www/api-client.js:100"}, "properties": {"repobilityId": "9266757bdaa28101", "scanner": "scanner-primary", "fingerprint": "9b41d9d68a5be218", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "local_storage_auth_token"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "mobile-app/www/api-client.js"}, "region": {"startLine": 100}}}]}, {"ruleId": "scanner-329789a552e8b555", "level": "warning", "message": {"text": "Insecure pattern 'cors_wildcard' in mobile-app/server-stub/delete-account.js:22"}, "properties": {"repobilityId": "f8bb78e5ab59a5a4", "scanner": "scanner-primary", "fingerprint": "329789a552e8b555", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "cors_wildcard"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "mobile-app/server-stub/delete-account.js"}, "region": {"startLine": 22}}}]}, {"ruleId": "scanner-f5cf3f3593d1f69a", "level": "warning", "message": {"text": "Insecure pattern 'cors_wildcard' in mobile-app/server-stub/save-push-token.js:24"}, "properties": {"repobilityId": "32399350516a952b", "scanner": "scanner-primary", "fingerprint": "f5cf3f3593d1f69a", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "cors_wildcard"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "mobile-app/server-stub/save-push-token.js"}, "region": {"startLine": 24}}}]}, {"ruleId": "scanner-d36e1a9a890a4b31", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "b6f764da7873d8cd", "scanner": "scanner-primary", "fingerprint": "d36e1a9a890a4b31", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "mobile-app/.github/workflows/android-build.yml"}, "region": {"startLine": 33}}}]}, {"ruleId": "scanner-d36e1a9a890a4b31", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "e60aa57d25b52125", "scanner": "scanner-primary", "fingerprint": "d36e1a9a890a4b31", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "mobile-app/.github/workflows/android-build.yml"}, "region": {"startLine": 36}}}]}, {"ruleId": "scanner-d36e1a9a890a4b31", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "9ec891932b66e99b", "scanner": "scanner-primary", "fingerprint": "d36e1a9a890a4b31", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "mobile-app/.github/workflows/android-build.yml"}, "region": {"startLine": 43}}}]}, {"ruleId": "scanner-d36e1a9a890a4b31", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "573a019bdda7563a", "scanner": "scanner-primary", "fingerprint": "d36e1a9a890a4b31", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "mobile-app/.github/workflows/android-build.yml"}, "region": {"startLine": 49}}}]}, {"ruleId": "scanner-d36e1a9a890a4b31", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "e67144f27d92d9bc", "scanner": "scanner-primary", "fingerprint": "d36e1a9a890a4b31", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "mobile-app/.github/workflows/android-build.yml"}, "region": {"startLine": 69}}}]}, {"ruleId": "scanner-d36e1a9a890a4b31", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "e67144f27d92d9bc", "scanner": "scanner-primary", "fingerprint": "d36e1a9a890a4b31", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "mobile-app/.github/workflows/android-build.yml"}, "region": {"startLine": 104}}}]}, {"ruleId": "scanner-d9e43cd48e551e1b", "level": "note", "message": {"text": "Very large file: i18n.js (1130 lines)"}, "properties": {"repobilityId": "b6f30bd653e776b2", "scanner": "scanner-primary", "fingerprint": "d9e43cd48e551e1b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-6893a6c8b0861585", "level": "warning", "message": {"text": "Very low test-to-source ratio"}, "properties": {"repobilityId": "54a7de3f06314bf0", "scanner": "scanner-primary", "fingerprint": "6893a6c8b0861585", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["tests", "coverage"]}}, {"ruleId": "scanner-141b30a41e03817b", "level": "note", "message": {"text": "No license file detected"}, "properties": {"repobilityId": "965e84d8b604226a", "scanner": "scanner-primary", "fingerprint": "141b30a41e03817b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["license", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-b3ed68815bca2f8c", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: package.json"}, "properties": {"repobilityId": "7edae0550c126386", "scanner": "scanner-primary", "fingerprint": "b3ed68815bca2f8c", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "c18ce6cf8b658746", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-9d79c4077342a7d0", "level": "warning", "message": {"text": "Runtime service client appears to use placeholder configuration"}, "properties": {"repobilityId": "c026535e4c10e76c", "scanner": "scanner-primary", "fingerprint": "9d79c4077342a7d0", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "runtime-config", "service-client", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "4003f0964d914a05", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-b9088664ace7f748", "level": "warning", "message": {"text": "Composite production-readiness gap"}, "properties": {"repobilityId": "213b62aa2f8be28a", "scanner": "scanner-primary", "fingerprint": "b9088664ace7f748", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["production-readiness", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-749d4bc1bd66df5f", "level": "warning", "message": {"text": "Agent instructions exist but release-hardening basics are missing"}, "properties": {"repobilityId": "12dbe77cc51aeefb", "scanner": "scanner-primary", "fingerprint": "749d4bc1bd66df5f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "4d84c47ba8b1915a", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "9f6b9283bc17310f", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-17d866d91a7c451e", "level": "error", "message": {"text": "Agent instruction/config may expose a secret: CLAUDE.md"}, "properties": {"repobilityId": "ccce5984e58a48f0", "scanner": "scanner-primary", "fingerprint": "17d866d91a7c451e", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["agent-instructions", "secrets", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "CLAUDE.md"}, "region": {"startLine": 34}}}]}, {"ruleId": "scanner-ad6b197ce23611a0", "level": "note", "message": {"text": "Legacy-named symbol `st_chat_history_v2` in chat-widget.js:13"}, "properties": {"repobilityId": "ce8d6a7818d5a0e8", "scanner": "scanner-primary", "fingerprint": "ad6b197ce23611a0", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-29912b795494965d", "level": "none", "message": {"text": "Commented-code block (5 lines) in chat-widget.js:610"}, "properties": {"repobilityId": "a2ad701a5c09718c", "scanner": "scanner-primary", "fingerprint": "29912b795494965d", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-f51f8a8f59a70ab4", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 sw.js:54"}, "properties": {"repobilityId": "d437f97082a797cf", "scanner": "scanner-primary", "fingerprint": "f51f8a8f59a70ab4", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-cd85d620541cb19c", "level": "none", "message": {"text": "Commented-code block (5 lines) in i18n.js:947"}, "properties": {"repobilityId": "95a30ba94fd7e25a", "scanner": "scanner-primary", "fingerprint": "cd85d620541cb19c", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-a3614efdecf45a6c", "level": "none", "message": {"text": "Commented-code block (5 lines) in analytics.js:52"}, "properties": {"repobilityId": "368d8c8896dc46f3", "scanner": "scanner-primary", "fingerprint": "a3614efdecf45a6c", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-8d288d9fc2b640c3", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 api/trailer-position.js:48"}, "properties": {"repobilityId": "5a26e25cbabdb382", "scanner": "scanner-primary", "fingerprint": "8d288d9fc2b640c3", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-e7d4659061d06652", "level": "none", "message": {"text": "Commented-code block (6 lines) in api/process-return.js:158"}, "properties": {"repobilityId": "370f3973d4ce086c", "scanner": "scanner-primary", "fingerprint": "e7d4659061d06652", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-2284ce46aaed3fc0", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 api/process-return.js:83"}, "properties": {"repobilityId": "37eda611ad74f82b", "scanner": "scanner-primary", "fingerprint": "2284ce46aaed3fc0", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-9f9949c3ac7e34ba", "level": "none", "message": {"text": "Commented-code block (6 lines) in api/create-payment-intent.js:151"}, "properties": {"repobilityId": "0eefe7e7667e8c2d", "scanner": "scanner-primary", "fingerprint": "9f9949c3ac7e34ba", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-7b9bbaba2ed7a177", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 api/_push-sender.js:77"}, "properties": {"repobilityId": "4ec2149b920e815b", "scanner": "scanner-primary", "fingerprint": "7b9bbaba2ed7a177", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-23de3f4cdd47530f", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 api/cron/midweek-check.js:59"}, "properties": {"repobilityId": "0fe6775be3222202", "scanner": "scanner-primary", "fingerprint": "23de3f4cdd47530f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-e751226e3171ae4b", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 api/cron/bug-triager.js:41"}, "properties": {"repobilityId": "eb7228ecd9328562", "scanner": "scanner-primary", "fingerprint": "e751226e3171ae4b", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-f539c8f8e647650f", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 api/cron/weekly-ratgeber-generator.js:102"}, "properties": {"repobilityId": "d14476734a709e64", "scanner": "scanner-primary", "fingerprint": "f539c8f8e647650f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-d0976456bfac2c81", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 api/cron/legal-quarterly-audit.js:91"}, "properties": {"repobilityId": "bd8a4365a0563616", "scanner": "scanner-primary", "fingerprint": "d0976456bfac2c81", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-83a102d6f92d2107", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 api/cron/social-media-generator.js:108"}, "properties": {"repobilityId": "286d58fc585bdb26", "scanner": "scanner-primary", "fingerprint": "83a102d6f92d2107", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-96767d3d28605447", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 api/cron/weekly-advisor.js:87"}, "properties": {"repobilityId": "b79009942537df32", "scanner": "scanner-primary", "fingerprint": "96767d3d28605447", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-c35588f0a2d04861", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 api/cron/tracker-watchdog.js:52"}, "properties": {"repobilityId": "09c1521c152742b6", "scanner": "scanner-primary", "fingerprint": "c35588f0a2d04861", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-28143d6d4b0bcc32", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 api/cron/competitor-watcher.js:69"}, "properties": {"repobilityId": "e03c0acd8c368cc0", "scanner": "scanner-primary", "fingerprint": "28143d6d4b0bcc32", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-f8f2296e4a50c062", "level": "none", "message": {"text": "Commented-code block (6 lines) in api/cron/sync-tracker-positions.js:122"}, "properties": {"repobilityId": "41a3f77d98018d88", "scanner": "scanner-primary", "fingerprint": "f8f2296e4a50c062", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-b9923fdd832ba013", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 api/cron/sync-tracker-positions.js:41"}, "properties": {"repobilityId": "924bc4d4acd064c7", "scanner": "scanner-primary", "fingerprint": "b9923fdd832ba013", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-855a54721c2e5633", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 api/cron/budget-optimizer.js:21"}, "properties": {"repobilityId": "af5c5f56a8eefc0d", "scanner": "scanner-primary", "fingerprint": "855a54721c2e5633", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-7e09e51daf464f45", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 mobile-app/server-stub/delete-account.js:9"}, "properties": {"repobilityId": "e45cf68ef3648672", "scanner": "scanner-primary", "fingerprint": "7e09e51daf464f45", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-1afecd7142103456", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 mobile-app/server-stub/save-push-token.js:10"}, "properties": {"repobilityId": "f80554587ad5a76b", "scanner": "scanner-primary", "fingerprint": "1afecd7142103456", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}]}]}