{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-b075f2bc4f49e56b", "name": "Possibly dead Python function: process", "shortDescription": {"text": "Possibly dead Python function: process"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a067bc36b7b3d54e", "name": "Possibly dead Python function: process", "shortDescription": {"text": "Possibly dead Python function: process"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2570a2c1f7a49d5c", "name": "Possibly dead Python function: crawl_one_whatnot", "shortDescription": {"text": "Possibly dead Python function: crawl_one_whatnot"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-dd9a414e0a071fa4", "name": "Possibly dead Python function: fetch_and_hash", "shortDescription": {"text": "Possibly dead Python function: fetch_and_hash"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-af0595410920b85a", "name": "Possibly dead Python function: trend", "shortDescription": {"text": "Possibly dead Python function: trend"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-af2e3c10266d8d8d", "name": "Possibly dead Python function: crawl_one_ebay", "shortDescription": {"text": "Possibly dead Python function: crawl_one_ebay"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-05016196dc105595", "name": "Possibly dead Python function: crawl_one_whatnot", "shortDescription": {"text": "Possibly dead Python function: crawl_one_whatnot"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f715b8c76ba37260", "name": "Possibly dead Python function: fetch_one", "shortDescription": {"text": "Possibly dead Python function: fetch_one"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e506070676b8b94f", "name": "Possibly dead Python function: cmd_probe", "shortDescription": {"text": "Possibly dead Python function: cmd_probe"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-43b0fa458ab6f7be", "name": "Possibly dead Python function: cmd_scan", "shortDescription": {"text": "Possibly dead Python function: cmd_scan"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-de300ba259e1b8d5", "name": "Possibly dead Python function: cmd_download", "shortDescription": {"text": "Possibly dead Python function: cmd_download"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8377e6d372356b15", "name": "Possibly dead Python function: download_one", "shortDescription": {"text": "Possibly dead Python function: download_one"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f13d42f786d3dbab", "name": "Possibly dead Python function: upload_one", "shortDescription": {"text": "Possibly dead Python function: upload_one"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-bead75b0f9233e05", "name": "No API endpoints detected", "shortDescription": {"text": "No API endpoints detected"}, "fullDescription": {"text": "The scanner did not find FastAPI/Flask/Express/NestJS/GraphQL/gRPC routes. If this repo exposes APIs, the framework may be unsupported."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "info", "confidence": 1.0}}, {"id": "scanner-eccc76bd5ddf91cd", "name": "Stray `console.log` in TS/JS \u2014 workers/ebay-proxy/worker.js:1401", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 workers/ebay-proxy/worker.js:1401"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-73376fd5ff8a8a9f", "name": "Stray `console.log` in TS/JS \u2014 workers/xcode-discord/worker.js:129", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 workers/xcode-discord/worker.js:129"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-00b0f1dcb8c30b71", "name": "Stray `console.log` in TS/JS \u2014 workers/pricing-snapshot/worker.js:285", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 workers/pricing-snapshot/worker.js:285"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-89633a1fda00bf58", "name": "Stray `console.log` in TS/JS \u2014 workers/price-estimator/worker.js:347", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 workers/price-estimator/worker.js:347"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ba4670cf4d6b0344", "name": "Icon-only button without accessible name \u2014 js/app.js:6077", "shortDescription": {"text": "Icon-only button without accessible name \u2014 js/app.js:6077"}, "fullDescription": {"text": "A `<button>` whose only child is a single glyph or symbol needs `title=` or `aria-label=` so screen readers (and tooltips on hover) work.\n\nWhy: P3 in CHECKLIST.md \u2014 icon-only buttons skipped a title.\nRule id: fq.button.no-label"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-27fae5003fc6d1fb", "name": "Stray `console.log` in TS/JS \u2014 js/app.js:2267", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 js/app.js:2267"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-93337082f0ea862d", "name": "Privileged port 7 in use", "shortDescription": {"text": "Privileged port 7 in use"}, "fullDescription": {"text": "Port 7 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-534b4050deb5bab9", "name": "Privileged port 9 in use", "shortDescription": {"text": "Privileged port 9 in use"}, "fullDescription": {"text": "Port 9 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-474c73eee5a86fd8", "name": "Privileged port 41 in use", "shortDescription": {"text": "Privileged port 41 in use"}, "fullDescription": {"text": "Port 41 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-5704dea984e5ebd2", "name": "Insecure pattern 'cors_wildcard' in workers/youtube-feed/worker.js:96", "shortDescription": {"text": "Insecure pattern 'cors_wildcard' in workers/youtube-feed/worker.js:96"}, "fullDescription": {"text": "Found a known-risky pattern (cors_wildcard). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6efc0534dc954767", "name": "Insecure pattern 'cors_wildcard' in workers/ebay-proxy/worker.js:136", "shortDescription": {"text": "Insecure pattern 'cors_wildcard' in workers/ebay-proxy/worker.js:136"}, "fullDescription": {"text": "Found a known-risky pattern (cors_wildcard). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b8fdbc7eb5861386", "name": "Insecure pattern 'cors_wildcard' in workers/pricing-snapshot/worker.js:45", "shortDescription": {"text": "Insecure pattern 'cors_wildcard' in workers/pricing-snapshot/worker.js:45"}, "fullDescription": {"text": "Found a known-risky pattern (cors_wildcard). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2c458bfc775b265d", "name": "Insecure pattern 'cors_wildcard' in workers/pricing-tracker/worker.js:25", "shortDescription": {"text": "Insecure pattern 'cors_wildcard' in workers/pricing-tracker/worker.js:25"}, "fullDescription": {"text": "Found a known-risky pattern (cors_wildcard). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-699187314742d643", "name": "Insecure pattern 'cors_wildcard' in workers/price-estimator/worker.js:66", "shortDescription": {"text": "Insecure pattern 'cors_wildcard' in workers/price-estimator/worker.js:66"}, "fullDescription": {"text": "Found a known-risky pattern (cors_wildcard). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-baaa4ef8d39a2ba0", "name": "Insecure pattern 'cors_wildcard' in workers/account-delete/worker.js:30", "shortDescription": {"text": "Insecure pattern 'cors_wildcard' in workers/account-delete/worker.js:30"}, "fullDescription": {"text": "Found a known-risky pattern (cors_wildcard). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6a890cb277a5b74f", "name": "Insecure pattern 'cors_wildcard' in workers/avatar-upload/worker.js:32", "shortDescription": {"text": "Insecure pattern 'cors_wildcard' in workers/avatar-upload/worker.js:32"}, "fullDescription": {"text": "Found a known-risky pattern (cors_wildcard). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-545876637a2828a8", "name": "Insecure pattern 'cors_wildcard' in workers/comc-proxy/src/index.ts:202", "shortDescription": {"text": "Insecure pattern 'cors_wildcard' in workers/comc-proxy/src/index.ts:202"}, "fullDescription": {"text": "Found a known-risky pattern (cors_wildcard). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d1c2f33a7b13be08", "name": "Insecure pattern 'cors_wildcard' in workers/mod-merge/worker.js:67", "shortDescription": {"text": "Insecure pattern 'cors_wildcard' in workers/mod-merge/worker.js:67"}, "fullDescription": {"text": "Found a known-risky pattern (cors_wildcard). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2a90db49d8e42584", "name": "Insecure pattern 'direct_innerhtml_assignment' in js/watch.js:192", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/watch.js:192"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f583cceb3e0ace59", "name": "Insecure pattern 'direct_innerhtml_assignment' in js/app.js:165", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/app.js:165"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-903bd33dd3bde880", "name": "Insecure pattern 'insert_adjacent_html' in js/app.js:4306", "shortDescription": {"text": "Insecure pattern 'insert_adjacent_html' in js/app.js:4306"}, "fullDescription": {"text": "Found a known-risky pattern (insert_adjacent_html). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-211e5a2b474722d9", "name": "Insecure pattern 'local_storage_auth_token' in js/discord.js:140", "shortDescription": {"text": "Insecure pattern 'local_storage_auth_token' in js/discord.js:140"}, "fullDescription": {"text": "Found a known-risky pattern (local_storage_auth_token). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f8fafe0ed32cb77b", "name": "Insecure pattern 'direct_innerhtml_assignment' in js/practice.js:699", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/practice.js:699"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-21270efbc20d06d7", "name": "Insecure pattern 'direct_innerhtml_assignment' in js/collection.js:106", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/collection.js:106"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0b01ea1d263f2d99", "name": "Insecure pattern 'direct_innerhtml_assignment' in js/purchase.js:43", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/purchase.js:43"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-db4338a3d8172e16", "name": "Insecure pattern 'direct_innerhtml_assignment' in js/store-locator.js:342", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/store-locator.js:342"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-27bdf6ca07c67e05", "name": "Insecure pattern 'direct_innerhtml_assignment' in js/auth.js:87", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/auth.js:87"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-fd9642a6238275f9", "name": "Insecure pattern 'direct_innerhtml_assignment' in pipeline/scripts/reconcile_audit_results.py:725", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in pipeline/scripts/reconcile_audit_results.py:725"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6177df1a95d75db1", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0df9484da6e8645b", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/github-script@v7 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b6b785f4d112de1b", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c7e881573ce0cc41", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/setup-java@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-65bed872775b6f47", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e4f658c0c00de0d4", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/upload-pages-artifact@v3 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-448d8837178ae57a", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-83aca799b2b62a1f", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-94df93a0b9371bdc", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e40b30aab8dd1565", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f9bed191f58ece5b", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-dade7897d3bd0af8", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-eae8abda1d14ec49", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-02779ad0b186d100", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/setup-python@v5 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5489fe553afc6971", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9cbadcdd4c863177", "name": "Very large file: workers/ebay-proxy/worker.js (2405 lines)", "shortDescription": {"text": "Very large file: workers/ebay-proxy/worker.js (2405 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-368fb0fd758dcf23", "name": "Very large file: js/app.js (6440 lines)", "shortDescription": {"text": "Very large file: js/app.js (6440 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f80a9419a309ed7f", "name": "Very large file: js/practice.js (8384 lines)", "shortDescription": {"text": "Very large file: js/practice.js (8384 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b05c19d4b7d31cad", "name": "Very large file: js/collection.js (4250 lines)", "shortDescription": {"text": "Very large file: js/collection.js (4250 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9730cf2a017c1169", "name": "Very large file: tools/screenshots/src/app/ScreenshotsClient.tsx (1784 lines)", "shortDescription": {"text": "Very large file: tools/screenshots/src/app/ScreenshotsClient.tsx (1784 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e452459e0c3ca0c5", "name": "Very large file: pipeline/scripts/reconcile_audit_results.py (1583 lines)", "shortDescription": {"text": "Very large file: pipeline/scripts/reconcile_audit_results.py (1583 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6893a6c8b0861585", "name": "Very low test-to-source ratio", "shortDescription": {"text": "Very low test-to-source ratio"}, "fullDescription": {"text": "0 test file(s) for 94 source file(s) (ratio 0.00). Consider adding integration or unit tests for critical paths."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-141b30a41e03817b", "name": "No license file detected", "shortDescription": {"text": "No license file detected"}, "fullDescription": {"text": "No LICENSE/COPYING/NOTICE file was found. Generated repositories often omit licensing, which blocks reuse and automated intake."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 839 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-72b2a6250083a784", "name": "Placeholder or mock-heavy implementation detected", "shortDescription": {"text": "Placeholder or mock-heavy implementation detected"}, "fullDescription": {"text": "Found 73 placeholder/mock markers across 13 source files. This often means the repo looks complete while core flows still use generated scaffolding or fake data."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-11825279136b53a3", "name": "CI is configured but no tests are detected", "shortDescription": {"text": "CI is configured but no tests are detected"}, "fullDescription": {"text": "A CI pipeline exists, but the scan found no test files to gate. Opus labeled this generated-code pattern as config theater: release machinery exists, but it has little behavioral signal."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b9088664ace7f748", "name": "Composite production-readiness gap", "shortDescription": {"text": "Composite production-readiness gap"}, "fullDescription": {"text": "Multiple low-cost hardening controls are missing together: license, tests. Opus verification showed these co-occurring gaps are a better readiness signal than reading each flag in isolation."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-749d4bc1bd66df5f", "name": "Agent instructions exist but release-hardening basics are missing", "shortDescription": {"text": "Agent instructions exist but release-hardening basics are missing"}, "fullDescription": {"text": "AI-coder instruction files were found, but the repo is missing license, tests. Treat this as a contract gap: the agent is guided, but the generated output is not yet guarded by the controls that make it repeatable."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-bea357a6497a2d5d", "name": "Agent authority lacks a verifier contract: CLAUDE.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: CLAUDE.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-122f91b7f2906dc4", "name": "Agent authority lacks a verifier contract: .claude/settings.json", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/settings.json"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-cf1411982e529822", "name": "Agent authority lacks a verifier contract: .claude/commands/milestone.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/commands/milestone.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-64623e0be9eccc01", "name": "Agent authority lacks a verifier contract: .claude/commands/KUI/brand.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/commands/KUI/brand.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-96d0b4df592bd84c", "name": "Agent authority lacks a verifier contract: .claude/commands/KUI/a11y.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/commands/KUI/a11y.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ecb7a20e0b0957e3", "name": "Agent authority lacks a verifier contract: .claude/commands/KUI/system.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/commands/KUI/system.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-5532f1f02488f153", "name": "Agent authority lacks a verifier contract: .claude/commands/KUI/darkmode.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/commands/KUI/darkmode.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-58cee1f831c6b67f", "name": "Agent authority lacks a verifier contract: .claude/commands/KUI/review.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/commands/KUI/review.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b8f5076ef0fe3ea3", "name": "Commented-code block (13 lines) in workers/youtube-feed/worker.js:73", "shortDescription": {"text": "Commented-code block (13 lines) in workers/youtube-feed/worker.js:73"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-78ccf04e97532827", "name": "`fetch()` without try/.catch or AbortSignal \u2014 workers/youtube-feed/worker.js:114", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 workers/youtube-feed/worker.js:114"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6c2817f399282dba", "name": "Legacy-named symbol `normaliseSoldLegacy` in workers/ebay-proxy/worker.js:798", "shortDescription": {"text": "Legacy-named symbol `normaliseSoldLegacy` in workers/ebay-proxy/worker.js:798"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-62a64887d11106a7", "name": "Commented-code block (6 lines) in workers/ebay-proxy/worker.js:51", "shortDescription": {"text": "Commented-code block (6 lines) in workers/ebay-proxy/worker.js:51"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-b5a0a9ab299b7614", "name": "`fetch()` without try/.catch or AbortSignal \u2014 workers/ebay-proxy/worker.js:686", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 workers/ebay-proxy/worker.js:686"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-45147d7dc80462ad", "name": "`fetch()` without try/.catch or AbortSignal \u2014 workers/pricing-snapshot/worker.js:55", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 workers/pricing-snapshot/worker.js:55"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea282adcbf8fe361", "name": "Commented-code block (5 lines) in workers/pricing-tracker/worker.js:240", "shortDescription": {"text": "Commented-code block (5 lines) in workers/pricing-tracker/worker.js:240"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-242a244b41b81c49", "name": "`fetch()` without try/.catch or AbortSignal \u2014 workers/pricing-tracker/worker.js:159", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 workers/pricing-tracker/worker.js:159"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-17449a65551e28e7", "name": "Commented-code block (9 lines) in workers/price-estimator/worker.js:71", "shortDescription": {"text": "Commented-code block (9 lines) in workers/price-estimator/worker.js:71"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-806fd8e0ee4d76e5", "name": "`fetch()` without try/.catch or AbortSignal \u2014 workers/price-estimator/worker.js:196", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 workers/price-estimator/worker.js:196"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-28482d54b9fac9d6", "name": "`fetch()` without try/.catch or AbortSignal \u2014 workers/account-delete/worker.js:43", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 workers/account-delete/worker.js:43"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1774de8d3f39d430", "name": "`fetch()` without try/.catch or AbortSignal \u2014 workers/avatar-upload/worker.js:66", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 workers/avatar-upload/worker.js:66"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ebb7949ae23d22e7", "name": "Commented-code block (6 lines) in workers/comc-proxy/src/index.ts:210", "shortDescription": {"text": "Commented-code block (6 lines) in workers/comc-proxy/src/index.ts:210"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-665ad97179be0c77", "name": "`fetch()` without try/.catch or AbortSignal \u2014 workers/comc-proxy/src/index.ts:209", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 workers/comc-proxy/src/index.ts:209"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e843dbd8a1b3db4d", "name": "Commented-code block (5 lines) in workers/mod-merge/worker.js:248", "shortDescription": {"text": "Commented-code block (5 lines) in workers/mod-merge/worker.js:248"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-9bc9a08232ddfa97", "name": "`fetch()` without try/.catch or AbortSignal \u2014 workers/mod-merge/worker.js:89", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 workers/mod-merge/worker.js:89"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9c4e3d3af01bd80d", "name": "Legacy-named symbol `bp_findGridDensity_v1` in js/app.js:5474", "shortDescription": {"text": "Legacy-named symbol `bp_findGridDensity_v1` in js/app.js:5474"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-09134ffa0fa3ab68", "name": "Commented-code block (5 lines) in js/app.js:118", "shortDescription": {"text": "Commented-code block (5 lines) in js/app.js:118"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-bde3c1a700577bc1", "name": "`fetch()` without try/.catch or AbortSignal \u2014 js/app.js:3768", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 js/app.js:3768"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4f68a4b289f051e9", "name": "Commented-code block (5 lines) in js/discord.js:1", "shortDescription": {"text": "Commented-code block (5 lines) in js/discord.js:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-3f695f46fbfcff48", "name": "`fetch()` without try/.catch or AbortSignal \u2014 js/discord.js:121", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 js/discord.js:121"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a8b96bb38c90bf75", "name": "Legacy-named symbol `bp_practiceTutorialSeen_v1` in js/practice.js:7909", "shortDescription": {"text": "Legacy-named symbol `bp_practiceTutorialSeen_v1` in js/practice.js:7909"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a5b67fa485b142fa", "name": "Commented-code block (5 lines) in js/practice.js:486", "shortDescription": {"text": "Commented-code block (5 lines) in js/practice.js:486"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-7871a97c0d261006", "name": "Legacy-named symbol `bp_collectionSort_v1` in js/collection.js:1448", "shortDescription": {"text": "Legacy-named symbol `bp_collectionSort_v1` in js/collection.js:1448"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-43b35db5854defe4", "name": "Commented-code block (5 lines) in js/collection.js:36", "shortDescription": {"text": "Commented-code block (5 lines) in js/collection.js:36"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-821326b993fcf257", "name": "Commented-code block (5 lines) in js/api.js:209", "shortDescription": {"text": "Commented-code block (5 lines) in js/api.js:209"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-9eb74c2adb6232ca", "name": "`fetch()` without try/.catch or AbortSignal \u2014 js/api.js:6", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 js/api.js:6"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-72be38143718c01d", "name": "`fetch()` without try/.catch or AbortSignal \u2014 js/purchase.js:34", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 js/purchase.js:34"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-aad06fafb71be6b0", "name": "Legacy-named symbol `elo_records_v1` in js/elo.js:20", "shortDescription": {"text": "Legacy-named symbol `elo_records_v1` in js/elo.js:20"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-38bcfa07a2d6e66e", "name": "`fetch()` without try/.catch or AbortSignal \u2014 js/store-locator.js:91", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 js/store-locator.js:91"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e2eb2aecf812c0d6", "name": "Commented-code block (5 lines) in js/auth.js:348", "shortDescription": {"text": "Commented-code block (5 lines) in js/auth.js:348"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-eeddf1fa591501c4", "name": "Network/subprocess call without timeout or try/except \u2014 scripts/apply_cyber_handoff.py:157", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/apply_cyber_handoff.py:157"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-989636070f4996cd", "name": "Commented-code block (6 lines) in scripts/apply_sealed_images.py:36", "shortDescription": {"text": "Commented-code block (6 lines) in scripts/apply_sealed_images.py:36"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-85d64ace4d4f8f34", "name": "Network/subprocess call without timeout or try/except \u2014 scripts/backfill_null_athletes.py:98", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/backfill_null_athletes.py:98"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-31810a41c08747fa", "name": "Commented-code block (8 lines) in scripts/audit_estimator.py:329", "shortDescription": {"text": "Commented-code block (8 lines) in scripts/audit_estimator.py:329"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-71ee63d13a6542a6", "name": "Network/subprocess call without timeout or try/except \u2014 scripts/audit_estimator.py:76", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/audit_estimator.py:76"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2941a2718df9548e", "name": "Legacy-named symbol `nearest_comparable_v1` in scripts/build_price_estimates.py:833", "shortDescription": {"text": "Legacy-named symbol `nearest_comparable_v1` in scripts/build_price_estimates.py:833"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-aa84bb686fca68dc", "name": "Commented-code block (6 lines) in scripts/build_price_estimates.py:73", "shortDescription": {"text": "Commented-code block (6 lines) in scripts/build_price_estimates.py:73"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-0c9a51a9730d8434", "name": "Commented-code block (6 lines) in scripts/check_audit_regressions.py:69", "shortDescription": {"text": "Commented-code block (6 lines) in scripts/check_audit_regressions.py:69"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-a67f23467314646a", "name": "Commented-code block (5 lines) in scripts/apply_handoff_batch.py:208", "shortDescription": {"text": "Commented-code block (5 lines) in scripts/apply_handoff_batch.py:208"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-ecc8bb20fd4478cb", "name": "Network/subprocess call without timeout or try/except \u2014 scripts/apply_handoff_batch.py:179", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/apply_handoff_batch.py:179"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-caa97ca3afcb5e8e", "name": "Commented-code block (7 lines) in scripts/merge_approved_additions.py:242", "shortDescription": {"text": "Commented-code block (7 lines) in scripts/merge_approved_additions.py:242"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-3d2bcfd03ad9db8b", "name": "Network/subprocess call without timeout or try/except \u2014 scripts/merge_approved_additions.py:128", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/merge_approved_additions.py:128"}, "fullDescription": {"text": "`requests.get(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6cf0b782b582e705", "name": "Commented-code block (6 lines) in scripts/refresh_events.py:110", "shortDescription": {"text": "Commented-code block (6 lines) in scripts/refresh_events.py:110"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-5f30cc4fa9024761", "name": "Commented-code block (5 lines) in scripts/rebuild_search_index.py:71", "shortDescription": {"text": "Commented-code block (5 lines) in scripts/rebuild_search_index.py:71"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-f0e08266e8ac2ce4", "name": "Commented-code block (6 lines) in scripts/build_power_patch.py:99", "shortDescription": {"text": "Commented-code block (6 lines) in scripts/build_power_patch.py:99"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-566768d696a68007", "name": "Network/subprocess call without timeout or try/except \u2014 scripts/propagate_dbs.py:94", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/propagate_dbs.py:94"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7a3dde399b34a146", "name": "Commented-code block (7 lines) in scripts/audit_hero_mismatches.py:57", "shortDescription": {"text": "Commented-code block (7 lines) in scripts/audit_hero_mismatches.py:57"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-5d590dfb7d514203", "name": "Commented-code block (5 lines) in scripts/audit_play_effects.py:95", "shortDescription": {"text": "Commented-code block (5 lines) in scripts/audit_play_effects.py:95"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-4dca88da616c7768", "name": "Legacy-named symbol `by_old` in scripts/apply_hot_dog_handoff.py:95", "shortDescription": {"text": "Legacy-named symbol `by_old` in scripts/apply_hot_dog_handoff.py:95"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-dcd37135c00481c4", "name": "Commented-code block (8 lines) in scripts/track_audit_history.py:210", "shortDescription": {"text": "Commented-code block (8 lines) in scripts/track_audit_history.py:210"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-544f373376c1c3ed", "name": "Network/subprocess call without timeout or try/except \u2014 scripts/apply_dbs_upstream_patch.py:81", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/apply_dbs_upstream_patch.py:81"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-bef2b496956b1555", "name": "Commented-code block (8 lines) in tools/play-assets/frame-screens.py:89", "shortDescription": {"text": "Commented-code block (8 lines) in tools/play-assets/frame-screens.py:89"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-2aa8876a1fa579d9", "name": "Commented-code block (5 lines) in tools/screenshots/src/app/ScreenshotsClient.tsx:505", "shortDescription": {"text": "Commented-code block (5 lines) in tools/screenshots/src/app/ScreenshotsClient.tsx:505"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-60f6bef5c3f20353", "name": "Commented-code block (5 lines) in pipeline/scripts/stage_a_scrape_ebay.py:104", "shortDescription": {"text": "Commented-code block (5 lines) in pipeline/scripts/stage_a_scrape_ebay.py:104"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-2364a707b84d3b12", "name": "Network/subprocess call without timeout or try/except \u2014 pipeline/scripts/stage_a_scrape_ebay.py:93", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 pipeline/scripts/stage_a_scrape_ebay.py:93"}, "fullDescription": {"text": "`subprocess.check_output(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-5530c6af03a3642f", "name": "Legacy-named symbol `boba_id_v2` in pipeline/scripts/migrate_v2_bobaid_references.py:53", "shortDescription": {"text": "Legacy-named symbol `boba_id_v2` in pipeline/scripts/migrate_v2_bobaid_references.py:53"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7b3725e8988e2adb", "name": "Commented-code block (11 lines) in pipeline/scripts/stage_b_recognize.py:79", "shortDescription": {"text": "Commented-code block (11 lines) in pipeline/scripts/stage_b_recognize.py:79"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-44b16b60cb8e84a7", "name": "Network/subprocess call without timeout or try/except \u2014 pipeline/scripts/stage_b_recognize.py:226", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 pipeline/scripts/stage_b_recognize.py:226"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-88ec5890ae5b5059", "name": "Commented-code block (7 lines) in pipeline/scripts/regen_bundles.py:41", "shortDescription": {"text": "Commented-code block (7 lines) in pipeline/scripts/regen_bundles.py:41"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-60900723d57c8b76", "name": "Network/subprocess call without timeout or try/except \u2014 pipeline/scripts/send_audit_email.py:172", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 pipeline/scripts/send_audit_email.py:172"}, "fullDescription": {"text": "`requests.post(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-587612587b5d5153", "name": "Network/subprocess call without timeout or try/except \u2014 pipeline/scripts/stage_a_scrape_bv.py:61", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 pipeline/scripts/stage_a_scrape_bv.py:61"}, "fullDescription": {"text": "`subprocess.check_output(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-951c420e667a5215", "name": "Commented-code block (5 lines) in pipeline/scripts/reconcile_audit_results.py:55", "shortDescription": {"text": "Commented-code block (5 lines) in pipeline/scripts/reconcile_audit_results.py:55"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-6192586e542d97b5", "name": "Legacy-named symbol `build_boba_id_v2` in pipeline/scripts/apply_audit_patch.py:78", "shortDescription": {"text": "Legacy-named symbol `build_boba_id_v2` in pipeline/scripts/apply_audit_patch.py:78"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-222f81d39093c94d", "name": "Commented-code block (5 lines) in pipeline/scripts/apply_audit_patch.py:167", "shortDescription": {"text": "Commented-code block (5 lines) in pipeline/scripts/apply_audit_patch.py:167"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-5c7d222c7cbd961c", "name": "Commented-code block (5 lines) in pipeline/scripts/stage_c_commit.py:321", "shortDescription": {"text": "Commented-code block (5 lines) in pipeline/scripts/stage_c_commit.py:321"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-9b80aa5949f69354", "name": "Network/subprocess call without timeout or try/except \u2014 pipeline/scripts/stage_c_commit.py:413", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 pipeline/scripts/stage_c_commit.py:413"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-960d6c9e46713310", "name": "Legacy-named symbol `boba_id_v2` in pipeline/scripts/migrate_bobaid_to_v3.py:48", "shortDescription": {"text": "Legacy-named symbol `boba_id_v2` in pipeline/scripts/migrate_bobaid_to_v3.py:48"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-58f25e4c2aab1d0e", "name": "Commented-code block (8 lines) in pipeline/scripts/import_research_queue.py:86", "shortDescription": {"text": "Commented-code block (8 lines) in pipeline/scripts/import_research_queue.py:86"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-2c04133e54348533", "name": "Near-duplicate function bodies in 2 places", "shortDescription": {"text": "Near-duplicate function bodies in 2 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nscripts/apply_cyber_handoff.py:build_search_tokens, scripts/apply_handoff_batch.py:build_search_tokens\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0027e313ade46c8f", "name": "Near-duplicate function bodies in 7 places", "shortDescription": {"text": "Near-duplicate function bodies in 7 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nscripts/audit_play_effects.py:walk_ops, scripts/audit_play_effects.py:walk, scripts/audit_play_effects.py:walk, scripts/audit_play_effects.py:walk\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-02525d39071dd2c7", "name": "Near-duplicate function bodies in 5 places", "shortDescription": {"text": "Near-duplicate function bodies in 5 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\npipeline/scripts/stage_a_scrape_ebay.py:make_r2_client, pipeline/scripts/stage_b_recognize.py:make_r2_client, pipeline/scripts/stage_a_scrape_bv.py:make_r2_client, pipeline/scripts/stage_c_commit.py:make_r2_client\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/24579"}, "properties": {"repository": "bhwilkoff/BOBA-Playbook", "repoUrl": "https://github.com/bhwilkoff/BOBA-Playbook", "branch": "main"}, "results": [{"ruleId": "scanner-b075f2bc4f49e56b", "level": "note", "message": {"text": "Possibly dead Python function: process"}, "properties": {"repobilityId": "b581289e0147aac1", "scanner": "scanner-primary", "fingerprint": "b075f2bc4f49e56b", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/apply_cyber_handoff.py:123"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a067bc36b7b3d54e", "level": "note", "message": {"text": "Possibly dead Python function: process"}, "properties": {"repobilityId": "b581289e0147aac1", "scanner": "scanner-primary", "fingerprint": "a067bc36b7b3d54e", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/apply_handoff_batch.py:146"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-2570a2c1f7a49d5c", "level": "note", "message": {"text": "Possibly dead Python function: crawl_one_whatnot"}, "properties": {"repobilityId": "bfaf95f2c943dcd2", "scanner": "scanner-primary", "fingerprint": "2570a2c1f7a49d5c", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/crawl_active_listings.py:143"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-dd9a414e0a071fa4", "level": "note", "message": {"text": "Possibly dead Python function: fetch_and_hash"}, "properties": {"repobilityId": "67d693a73fadbaa1", "scanner": "scanner-primary", "fingerprint": "dd9a414e0a071fa4", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/build_phash_index.py:119"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-af0595410920b85a", "level": "note", "message": {"text": "Possibly dead Python function: trend"}, "properties": {"repobilityId": "06b74b91b4a6c736", "scanner": "scanner-primary", "fingerprint": "af0595410920b85a", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/calibrate_estimator.py:70"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-af2e3c10266d8d8d", "level": "note", "message": {"text": "Possibly dead Python function: crawl_one_ebay"}, "properties": {"repobilityId": "5aaa27c0d91328b4", "scanner": "scanner-primary", "fingerprint": "af2e3c10266d8d8d", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/refresh_stale_prices.py:66"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-05016196dc105595", "level": "note", "message": {"text": "Possibly dead Python function: crawl_one_whatnot"}, "properties": {"repobilityId": "bfaf95f2c943dcd2", "scanner": "scanner-primary", "fingerprint": "05016196dc105595", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/refresh_stale_prices.py:82"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f715b8c76ba37260", "level": "note", "message": {"text": "Possibly dead Python function: fetch_one"}, "properties": {"repobilityId": "87b4aa7c92d11833", "scanner": "scanner-primary", "fingerprint": "f715b8c76ba37260", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pipeline/scripts/fetch_card_images.py:73"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e506070676b8b94f", "level": "note", "message": {"text": "Possibly dead Python function: cmd_probe"}, "properties": {"repobilityId": "a23409fbb6658184", "scanner": "scanner-primary", "fingerprint": "e506070676b8b94f", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pipeline/scripts/bv_catalog_scraper.py:153"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-43b0fa458ab6f7be", "level": "note", "message": {"text": "Possibly dead Python function: cmd_scan"}, "properties": {"repobilityId": "45239483b43d0dd2", "scanner": "scanner-primary", "fingerprint": "43b0fa458ab6f7be", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pipeline/scripts/bv_catalog_scraper.py:176"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-de300ba259e1b8d5", "level": "note", "message": {"text": "Possibly dead Python function: cmd_download"}, "properties": {"repobilityId": "72ad65382ec48700", "scanner": "scanner-primary", "fingerprint": "de300ba259e1b8d5", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pipeline/scripts/bv_catalog_scraper.py:213"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-8377e6d372356b15", "level": "note", "message": {"text": "Possibly dead Python function: download_one"}, "properties": {"repobilityId": "9b27934a4ecfbf77", "scanner": "scanner-primary", "fingerprint": "8377e6d372356b15", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pipeline/scripts/stage_b_recognize.py:180"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f13d42f786d3dbab", "level": "note", "message": {"text": "Possibly dead Python function: upload_one"}, "properties": {"repobilityId": "4cfe105803c2f354", "scanner": "scanner-primary", "fingerprint": "f13d42f786d3dbab", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pipeline/scripts/import_research_queue.py:219"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-bead75b0f9233e05", "level": "none", "message": {"text": "No API endpoints detected"}, "properties": {"repobilityId": "0f8bb852027c38f8", "scanner": "scanner-primary", "fingerprint": "bead75b0f9233e05", "layer": "api", "severity": "info", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-eccc76bd5ddf91cd", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 workers/ebay-proxy/worker.js:1401"}, "properties": {"repobilityId": "e2b67d6c25a43ee8", "scanner": "scanner-primary", "fingerprint": "eccc76bd5ddf91cd", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-73376fd5ff8a8a9f", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 workers/xcode-discord/worker.js:129"}, "properties": {"repobilityId": "b08d48038e0deb74", "scanner": "scanner-primary", "fingerprint": "73376fd5ff8a8a9f", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-00b0f1dcb8c30b71", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 workers/pricing-snapshot/worker.js:285"}, "properties": {"repobilityId": "f01a15543feee274", "scanner": "scanner-primary", "fingerprint": "00b0f1dcb8c30b71", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-89633a1fda00bf58", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 workers/price-estimator/worker.js:347"}, "properties": {"repobilityId": "72ebc361b3526938", "scanner": "scanner-primary", "fingerprint": "89633a1fda00bf58", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-ba4670cf4d6b0344", "level": "note", "message": {"text": "Icon-only button without accessible name \u2014 js/app.js:6077"}, "properties": {"repobilityId": "94cbda94eb273d63", "scanner": "scanner-primary", "fingerprint": "ba4670cf4d6b0344", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.button.no-label"]}}, {"ruleId": "scanner-27fae5003fc6d1fb", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 js/app.js:2267"}, "properties": {"repobilityId": "492423ae30ec4cc6", "scanner": "scanner-primary", "fingerprint": "27fae5003fc6d1fb", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-93337082f0ea862d", "level": "warning", "message": {"text": "Privileged port 7 in use"}, "properties": {"repobilityId": "428a6faecc63b5d6", "scanner": "scanner-primary", "fingerprint": "93337082f0ea862d", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/refresh-stores.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-534b4050deb5bab9", "level": "warning", "message": {"text": "Privileged port 9 in use"}, "properties": {"repobilityId": "31590a6ba3409390", "scanner": "scanner-primary", "fingerprint": "534b4050deb5bab9", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/play-assets/capture-screens.sh"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-474c73eee5a86fd8", "level": "warning", "message": {"text": "Privileged port 41 in use"}, "properties": {"repobilityId": "21c3be090ea64fdb", "scanner": "scanner-primary", "fingerprint": "474c73eee5a86fd8", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/play-assets/capture-screens.sh"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-5704dea984e5ebd2", "level": "warning", "message": {"text": "Insecure pattern 'cors_wildcard' in workers/youtube-feed/worker.js:96"}, "properties": {"repobilityId": "18b3271ce0d0966d", "scanner": "scanner-primary", "fingerprint": "5704dea984e5ebd2", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "cors_wildcard"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "workers/youtube-feed/worker.js"}, "region": {"startLine": 96}}}]}, {"ruleId": "scanner-6efc0534dc954767", "level": "warning", "message": {"text": "Insecure pattern 'cors_wildcard' in workers/ebay-proxy/worker.js:136"}, "properties": {"repobilityId": "81ccc83202aff9e6", "scanner": "scanner-primary", "fingerprint": "6efc0534dc954767", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "cors_wildcard"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "workers/ebay-proxy/worker.js"}, "region": {"startLine": 136}}}]}, {"ruleId": "scanner-b8fdbc7eb5861386", "level": "warning", "message": {"text": "Insecure pattern 'cors_wildcard' in workers/pricing-snapshot/worker.js:45"}, "properties": {"repobilityId": "f09c07cb363d1ea7", "scanner": "scanner-primary", "fingerprint": "b8fdbc7eb5861386", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "cors_wildcard"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "workers/pricing-snapshot/worker.js"}, "region": {"startLine": 45}}}]}, {"ruleId": "scanner-2c458bfc775b265d", "level": "warning", "message": {"text": "Insecure pattern 'cors_wildcard' in workers/pricing-tracker/worker.js:25"}, "properties": {"repobilityId": "d88e76db3f271d0c", "scanner": "scanner-primary", "fingerprint": "2c458bfc775b265d", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "cors_wildcard"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "workers/pricing-tracker/worker.js"}, "region": {"startLine": 25}}}]}, {"ruleId": "scanner-699187314742d643", "level": "warning", "message": {"text": "Insecure pattern 'cors_wildcard' in workers/price-estimator/worker.js:66"}, "properties": {"repobilityId": "44eaedee5ccfde1f", "scanner": "scanner-primary", "fingerprint": "699187314742d643", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "cors_wildcard"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "workers/price-estimator/worker.js"}, "region": {"startLine": 66}}}]}, {"ruleId": "scanner-baaa4ef8d39a2ba0", "level": "warning", "message": {"text": "Insecure pattern 'cors_wildcard' in workers/account-delete/worker.js:30"}, "properties": {"repobilityId": "29170351ac84767d", "scanner": "scanner-primary", "fingerprint": "baaa4ef8d39a2ba0", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "cors_wildcard"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "workers/account-delete/worker.js"}, "region": {"startLine": 30}}}]}, {"ruleId": "scanner-6a890cb277a5b74f", "level": "warning", "message": {"text": "Insecure pattern 'cors_wildcard' in workers/avatar-upload/worker.js:32"}, "properties": {"repobilityId": "a51a1da5e11f3295", "scanner": "scanner-primary", "fingerprint": "6a890cb277a5b74f", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "cors_wildcard"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "workers/avatar-upload/worker.js"}, "region": {"startLine": 32}}}]}, {"ruleId": "scanner-545876637a2828a8", "level": "warning", "message": {"text": "Insecure pattern 'cors_wildcard' in workers/comc-proxy/src/index.ts:202"}, "properties": {"repobilityId": "9efb617087e4e3f6", "scanner": "scanner-primary", "fingerprint": "545876637a2828a8", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "cors_wildcard"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "workers/comc-proxy/src/index.ts"}, "region": {"startLine": 202}}}]}, {"ruleId": "scanner-d1c2f33a7b13be08", "level": "warning", "message": {"text": "Insecure pattern 'cors_wildcard' in workers/mod-merge/worker.js:67"}, "properties": {"repobilityId": "e1acce0e6cdcadc4", "scanner": "scanner-primary", "fingerprint": "d1c2f33a7b13be08", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "cors_wildcard"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "workers/mod-merge/worker.js"}, "region": {"startLine": 67}}}]}, {"ruleId": "scanner-2a90db49d8e42584", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/watch.js:192"}, "properties": {"repobilityId": "9f54ec33268354c9", "scanner": "scanner-primary", "fingerprint": "2a90db49d8e42584", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "js/watch.js"}, "region": {"startLine": 192}}}]}, {"ruleId": "scanner-f583cceb3e0ace59", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/app.js:165"}, "properties": {"repobilityId": "f12f5fb5c6eb3ec0", "scanner": "scanner-primary", "fingerprint": "f583cceb3e0ace59", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "js/app.js"}, "region": {"startLine": 165}}}]}, {"ruleId": "scanner-903bd33dd3bde880", "level": "warning", "message": {"text": "Insecure pattern 'insert_adjacent_html' in js/app.js:4306"}, "properties": {"repobilityId": "578a49a921ae88fa", "scanner": "scanner-primary", "fingerprint": "903bd33dd3bde880", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "insert_adjacent_html"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "js/app.js"}, "region": {"startLine": 4306}}}]}, {"ruleId": "scanner-211e5a2b474722d9", "level": "warning", "message": {"text": "Insecure pattern 'local_storage_auth_token' in js/discord.js:140"}, "properties": {"repobilityId": "456abd8ffa9d8829", "scanner": "scanner-primary", "fingerprint": "211e5a2b474722d9", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "local_storage_auth_token"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "js/discord.js"}, "region": {"startLine": 140}}}]}, {"ruleId": "scanner-f8fafe0ed32cb77b", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/practice.js:699"}, "properties": {"repobilityId": "ae08d29f17adf6de", "scanner": "scanner-primary", "fingerprint": "f8fafe0ed32cb77b", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "js/practice.js"}, "region": {"startLine": 699}}}]}, {"ruleId": "scanner-21270efbc20d06d7", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/collection.js:106"}, "properties": {"repobilityId": "e70bf7c683ff4ad8", "scanner": "scanner-primary", "fingerprint": "21270efbc20d06d7", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "js/collection.js"}, "region": {"startLine": 106}}}]}, {"ruleId": "scanner-0b01ea1d263f2d99", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/purchase.js:43"}, "properties": {"repobilityId": "d2758959af36c8d7", "scanner": "scanner-primary", "fingerprint": "0b01ea1d263f2d99", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "js/purchase.js"}, "region": {"startLine": 43}}}]}, {"ruleId": "scanner-db4338a3d8172e16", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/store-locator.js:342"}, "properties": {"repobilityId": "4938860ac7d73eda", "scanner": "scanner-primary", "fingerprint": "db4338a3d8172e16", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "js/store-locator.js"}, "region": {"startLine": 342}}}]}, {"ruleId": "scanner-27bdf6ca07c67e05", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/auth.js:87"}, "properties": {"repobilityId": "90656fe2d6e7ff79", "scanner": "scanner-primary", "fingerprint": "27bdf6ca07c67e05", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "js/auth.js"}, "region": {"startLine": 87}}}]}, {"ruleId": "scanner-fd9642a6238275f9", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in pipeline/scripts/reconcile_audit_results.py:725"}, "properties": {"repobilityId": "ebf16010be28f0fb", "scanner": "scanner-primary", "fingerprint": "fd9642a6238275f9", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pipeline/scripts/reconcile_audit_results.py"}, "region": {"startLine": 725}}}]}, {"ruleId": "scanner-6177df1a95d75db1", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "d103d7cf0d0c7990", "scanner": "scanner-primary", "fingerprint": "6177df1a95d75db1", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/refresh-events.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-0df9484da6e8645b", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "86d270004396c1fb", "scanner": "scanner-primary", "fingerprint": "0df9484da6e8645b", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/pricing-daily-refresh.yml"}, "region": {"startLine": 214}}}]}, {"ruleId": "scanner-b6b785f4d112de1b", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "829c00d6cf1bcc18", "scanner": "scanner-primary", "fingerprint": "b6b785f4d112de1b", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/pricing-daily-refresh.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c7e881573ce0cc41", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "fe869660bc41da4d", "scanner": "scanner-primary", "fingerprint": "c7e881573ce0cc41", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/android-build.yml"}, "region": {"startLine": 40}}}]}, {"ruleId": "scanner-c7e881573ce0cc41", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "9eac96f919d93fb4", "scanner": "scanner-primary", "fingerprint": "c7e881573ce0cc41", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/android-build.yml"}, "region": {"startLine": 46}}}]}, {"ruleId": "scanner-c7e881573ce0cc41", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "b184e6938f118623", "scanner": "scanner-primary", "fingerprint": "c7e881573ce0cc41", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/android-build.yml"}, "region": {"startLine": 51}}}]}, {"ruleId": "scanner-c7e881573ce0cc41", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "da394abfe6d1d378", "scanner": "scanner-primary", "fingerprint": "c7e881573ce0cc41", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/android-build.yml"}, "region": {"startLine": 73}}}]}, {"ruleId": "scanner-c7e881573ce0cc41", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "fe869660bc41da4d", "scanner": "scanner-primary", "fingerprint": "c7e881573ce0cc41", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/android-build.yml"}, "region": {"startLine": 89}}}]}, {"ruleId": "scanner-c7e881573ce0cc41", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "9eac96f919d93fb4", "scanner": "scanner-primary", "fingerprint": "c7e881573ce0cc41", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/android-build.yml"}, "region": {"startLine": 94}}}]}, {"ruleId": "scanner-c7e881573ce0cc41", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "da394abfe6d1d378", "scanner": "scanner-primary", "fingerprint": "c7e881573ce0cc41", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/android-build.yml"}, "region": {"startLine": 120}}}]}, {"ruleId": "scanner-c7e881573ce0cc41", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "da394abfe6d1d378", "scanner": "scanner-primary", "fingerprint": "c7e881573ce0cc41", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/android-build.yml"}, "region": {"startLine": 134}}}]}, {"ruleId": "scanner-c7e881573ce0cc41", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "7318196414373b1e", "scanner": "scanner-primary", "fingerprint": "c7e881573ce0cc41", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/android-build.yml"}, "region": {"startLine": 141}}}]}, {"ruleId": "scanner-65bed872775b6f47", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "6d57b1fa0d8afb62", "scanner": "scanner-primary", "fingerprint": "65bed872775b6f47", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/pipeline-stage-a-scrape-bv.yml"}, "region": {"startLine": 36}}}]}, {"ruleId": "scanner-65bed872775b6f47", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "5f2c57e4674b94ff", "scanner": "scanner-primary", "fingerprint": "65bed872775b6f47", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/pipeline-stage-a-scrape-bv.yml"}, "region": {"startLine": 39}}}]}, {"ruleId": "scanner-e4f658c0c00de0d4", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "7b2f6f2d816930a2", "scanner": "scanner-primary", "fingerprint": "e4f658c0c00de0d4", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/pages.yml"}, "region": {"startLine": 62}}}]}, {"ruleId": "scanner-e4f658c0c00de0d4", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "25e1fa3783e7cb32", "scanner": "scanner-primary", "fingerprint": "e4f658c0c00de0d4", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/pages.yml"}, "region": {"startLine": 75}}}]}, {"ruleId": "scanner-448d8837178ae57a", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "13af6451e15656fc", "scanner": "scanner-primary", "fingerprint": "448d8837178ae57a", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/pages.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-83aca799b2b62a1f", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "83bcab9977a7fad7", "scanner": "scanner-primary", "fingerprint": "83aca799b2b62a1f", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/pipeline-stage-a-scrape-ebay.yml"}, "region": {"startLine": 48}}}]}, {"ruleId": "scanner-83aca799b2b62a1f", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "ef1619cfba225d45", "scanner": "scanner-primary", "fingerprint": "83aca799b2b62a1f", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/pipeline-stage-a-scrape-ebay.yml"}, "region": {"startLine": 51}}}]}, {"ruleId": "scanner-94df93a0b9371bdc", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "76da9a9b99e14e3e", "scanner": "scanner-primary", "fingerprint": "94df93a0b9371bdc", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/refresh-stores.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e40b30aab8dd1565", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "bbfa0b9fa656049f", "scanner": "scanner-primary", "fingerprint": "e40b30aab8dd1565", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/pipeline-stage-c-commit.yml"}, "region": {"startLine": 52}}}]}, {"ruleId": "scanner-e40b30aab8dd1565", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "cab033e3626f01c3", "scanner": "scanner-primary", "fingerprint": "e40b30aab8dd1565", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/pipeline-stage-c-commit.yml"}, "region": {"startLine": 58}}}]}, {"ruleId": "scanner-f9bed191f58ece5b", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "3d6b227a85d5e07e", "scanner": "scanner-primary", "fingerprint": "f9bed191f58ece5b", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/pipeline-stage-c-commit.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-dade7897d3bd0af8", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "02d831acc29cea3e", "scanner": "scanner-primary", "fingerprint": "dade7897d3bd0af8", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/refresh-blog.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-eae8abda1d14ec49", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "0ddae57ef6ea3ba1", "scanner": "scanner-primary", "fingerprint": "eae8abda1d14ec49", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/pipeline-stage-b-recognize.yml"}, "region": {"startLine": 56}}}]}, {"ruleId": "scanner-eae8abda1d14ec49", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "8d6ae8b1687db8f5", "scanner": "scanner-primary", "fingerprint": "eae8abda1d14ec49", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/pipeline-stage-b-recognize.yml"}, "region": {"startLine": 67}}}]}, {"ruleId": "scanner-eae8abda1d14ec49", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "ce7123ed43a52abc", "scanner": "scanner-primary", "fingerprint": "eae8abda1d14ec49", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/pipeline-stage-b-recognize.yml"}, "region": {"startLine": 77}}}]}, {"ruleId": "scanner-02779ad0b186d100", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "8b1df4deb21575a9", "scanner": "scanner-primary", "fingerprint": "02779ad0b186d100", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/phash-index-refresh.yml"}, "region": {"startLine": 31}}}]}, {"ruleId": "scanner-02779ad0b186d100", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "69dc13d2a4734e3d", "scanner": "scanner-primary", "fingerprint": "02779ad0b186d100", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/phash-index-refresh.yml"}, "region": {"startLine": 56}}}]}, {"ruleId": "scanner-5489fe553afc6971", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "82ebb29952d854f8", "scanner": "scanner-primary", "fingerprint": "5489fe553afc6971", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/phash-index-refresh.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-9cbadcdd4c863177", "level": "note", "message": {"text": "Very large file: workers/ebay-proxy/worker.js (2405 lines)"}, "properties": {"repobilityId": "02374dcc467a1bc0", "scanner": "scanner-primary", "fingerprint": "9cbadcdd4c863177", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-368fb0fd758dcf23", "level": "note", "message": {"text": "Very large file: js/app.js (6440 lines)"}, "properties": {"repobilityId": "c38eec27975b7a83", "scanner": "scanner-primary", "fingerprint": "368fb0fd758dcf23", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-f80a9419a309ed7f", "level": "note", "message": {"text": "Very large file: js/practice.js (8384 lines)"}, "properties": {"repobilityId": "138491a6c463969c", "scanner": "scanner-primary", "fingerprint": "f80a9419a309ed7f", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-b05c19d4b7d31cad", "level": "note", "message": {"text": "Very large file: js/collection.js (4250 lines)"}, "properties": {"repobilityId": "9bf3503381938413", "scanner": "scanner-primary", "fingerprint": "b05c19d4b7d31cad", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-9730cf2a017c1169", "level": "note", "message": {"text": "Very large file: tools/screenshots/src/app/ScreenshotsClient.tsx (1784 lines)"}, "properties": {"repobilityId": "64f9b6ce92f6988d", "scanner": "scanner-primary", "fingerprint": "9730cf2a017c1169", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-e452459e0c3ca0c5", "level": "note", "message": {"text": "Very large file: pipeline/scripts/reconcile_audit_results.py (1583 lines)"}, "properties": {"repobilityId": "57220679f105ff43", "scanner": "scanner-primary", "fingerprint": "e452459e0c3ca0c5", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-6893a6c8b0861585", "level": "warning", "message": {"text": "Very low test-to-source ratio"}, "properties": {"repobilityId": "54a7de3f06314bf0", "scanner": "scanner-primary", "fingerprint": "6893a6c8b0861585", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["tests", "coverage"]}}, {"ruleId": "scanner-141b30a41e03817b", "level": "note", "message": {"text": "No license file detected"}, "properties": {"repobilityId": "a8cceadb6966bf48", "scanner": "scanner-primary", "fingerprint": "141b30a41e03817b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["license", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "3b91cba4794c1f3f", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-72b2a6250083a784", "level": "warning", "message": {"text": "Placeholder or mock-heavy implementation detected"}, "properties": {"repobilityId": "7017fd56c5022ed2", "scanner": "scanner-primary", "fingerprint": "72b2a6250083a784", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "incomplete", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "e526805cd2c66a16", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-11825279136b53a3", "level": "warning", "message": {"text": "CI is configured but no tests are detected"}, "properties": {"repobilityId": "197604f650d31232", "scanner": "scanner-primary", "fingerprint": "11825279136b53a3", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["tests", "ci", "config-theater", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-b9088664ace7f748", "level": "note", "message": {"text": "Composite production-readiness gap"}, "properties": {"repobilityId": "a3564f03a7b3e8e4", "scanner": "scanner-primary", "fingerprint": "b9088664ace7f748", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["production-readiness", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-749d4bc1bd66df5f", "level": "warning", "message": {"text": "Agent instructions exist but release-hardening basics are missing"}, "properties": {"repobilityId": "b1ab7555ed2e0581", "scanner": "scanner-primary", "fingerprint": "749d4bc1bd66df5f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-bea357a6497a2d5d", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: CLAUDE.md"}, "properties": {"repobilityId": "aae72df3934829ac", "scanner": "scanner-primary", "fingerprint": "bea357a6497a2d5d", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "CLAUDE.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-122f91b7f2906dc4", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/settings.json"}, "properties": {"repobilityId": "a2967269048b6a9d", "scanner": "scanner-primary", "fingerprint": "122f91b7f2906dc4", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/settings.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-cf1411982e529822", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/commands/milestone.md"}, "properties": {"repobilityId": "4a86a1ac5bfd0b80", "scanner": "scanner-primary", "fingerprint": "cf1411982e529822", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/commands/milestone.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-64623e0be9eccc01", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/commands/KUI/brand.md"}, "properties": {"repobilityId": "fa06032bb3acdb5b", "scanner": "scanner-primary", "fingerprint": "64623e0be9eccc01", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/commands/KUI/brand.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-96d0b4df592bd84c", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/commands/KUI/a11y.md"}, "properties": {"repobilityId": "90f3562b4c65bae4", "scanner": "scanner-primary", "fingerprint": "96d0b4df592bd84c", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/commands/KUI/a11y.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ecb7a20e0b0957e3", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/commands/KUI/system.md"}, "properties": {"repobilityId": "9fb455aa4a02296b", "scanner": "scanner-primary", "fingerprint": "ecb7a20e0b0957e3", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/commands/KUI/system.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-5532f1f02488f153", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/commands/KUI/darkmode.md"}, "properties": {"repobilityId": "59bca55078e9c9ab", "scanner": "scanner-primary", "fingerprint": "5532f1f02488f153", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/commands/KUI/darkmode.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-58cee1f831c6b67f", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/commands/KUI/review.md"}, "properties": {"repobilityId": "57ad4fded0a1f373", "scanner": "scanner-primary", "fingerprint": "58cee1f831c6b67f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/commands/KUI/review.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b8f5076ef0fe3ea3", "level": "none", "message": {"text": "Commented-code block (13 lines) in workers/youtube-feed/worker.js:73"}, "properties": {"repobilityId": "bea60bf0bc12fe98", "scanner": "scanner-primary", "fingerprint": "b8f5076ef0fe3ea3", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-78ccf04e97532827", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 workers/youtube-feed/worker.js:114"}, "properties": {"repobilityId": "01c11bc226aa45da", "scanner": "scanner-primary", "fingerprint": "78ccf04e97532827", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-6c2817f399282dba", "level": "note", "message": {"text": "Legacy-named symbol `normaliseSoldLegacy` in workers/ebay-proxy/worker.js:798"}, "properties": {"repobilityId": "e0825320bde14073", "scanner": "scanner-primary", "fingerprint": "6c2817f399282dba", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-62a64887d11106a7", "level": "none", "message": {"text": "Commented-code block (6 lines) in workers/ebay-proxy/worker.js:51"}, "properties": {"repobilityId": "66a9a32db769d2ad", "scanner": "scanner-primary", "fingerprint": "62a64887d11106a7", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-b5a0a9ab299b7614", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 workers/ebay-proxy/worker.js:686"}, "properties": {"repobilityId": "f87fdf4fd0635343", "scanner": "scanner-primary", "fingerprint": "b5a0a9ab299b7614", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-45147d7dc80462ad", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 workers/pricing-snapshot/worker.js:55"}, "properties": {"repobilityId": "ebee2438c7ff00d2", "scanner": "scanner-primary", "fingerprint": "45147d7dc80462ad", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-ea282adcbf8fe361", "level": "none", "message": {"text": "Commented-code block (5 lines) in workers/pricing-tracker/worker.js:240"}, "properties": {"repobilityId": "f273f60d2661178d", "scanner": "scanner-primary", "fingerprint": "ea282adcbf8fe361", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-242a244b41b81c49", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 workers/pricing-tracker/worker.js:159"}, "properties": {"repobilityId": "9b332192cfd414a1", "scanner": "scanner-primary", "fingerprint": "242a244b41b81c49", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-17449a65551e28e7", "level": "none", "message": {"text": "Commented-code block (9 lines) in workers/price-estimator/worker.js:71"}, "properties": {"repobilityId": "0bbc3c7830351f1b", "scanner": "scanner-primary", "fingerprint": "17449a65551e28e7", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-806fd8e0ee4d76e5", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 workers/price-estimator/worker.js:196"}, "properties": {"repobilityId": "5c2fa3d788683a37", "scanner": "scanner-primary", "fingerprint": "806fd8e0ee4d76e5", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-28482d54b9fac9d6", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 workers/account-delete/worker.js:43"}, "properties": {"repobilityId": "bcd015a202fac2ae", "scanner": "scanner-primary", "fingerprint": "28482d54b9fac9d6", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-1774de8d3f39d430", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 workers/avatar-upload/worker.js:66"}, "properties": {"repobilityId": "c80ada6bfabbee19", "scanner": "scanner-primary", "fingerprint": "1774de8d3f39d430", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-ebb7949ae23d22e7", "level": "none", "message": {"text": "Commented-code block (6 lines) in workers/comc-proxy/src/index.ts:210"}, "properties": {"repobilityId": "06ca89f13091b688", "scanner": "scanner-primary", "fingerprint": "ebb7949ae23d22e7", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-665ad97179be0c77", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 workers/comc-proxy/src/index.ts:209"}, "properties": {"repobilityId": "c131ee35d6ad7604", "scanner": "scanner-primary", "fingerprint": "665ad97179be0c77", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-e843dbd8a1b3db4d", "level": "none", "message": {"text": "Commented-code block (5 lines) in workers/mod-merge/worker.js:248"}, "properties": {"repobilityId": "8632865cd692cfbd", "scanner": "scanner-primary", "fingerprint": "e843dbd8a1b3db4d", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-9bc9a08232ddfa97", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 workers/mod-merge/worker.js:89"}, "properties": {"repobilityId": "9a7327d98e7d6f91", "scanner": "scanner-primary", "fingerprint": "9bc9a08232ddfa97", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-9c4e3d3af01bd80d", "level": "note", "message": {"text": "Legacy-named symbol `bp_findGridDensity_v1` in js/app.js:5474"}, "properties": {"repobilityId": "18efc53d1649f036", "scanner": "scanner-primary", "fingerprint": "9c4e3d3af01bd80d", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-09134ffa0fa3ab68", "level": "none", "message": {"text": "Commented-code block (5 lines) in js/app.js:118"}, "properties": {"repobilityId": "db4308d56b149412", "scanner": "scanner-primary", "fingerprint": "09134ffa0fa3ab68", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-bde3c1a700577bc1", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 js/app.js:3768"}, "properties": {"repobilityId": "a6912289fd25e257", "scanner": "scanner-primary", "fingerprint": "bde3c1a700577bc1", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-4f68a4b289f051e9", "level": "none", "message": {"text": "Commented-code block (5 lines) in js/discord.js:1"}, "properties": {"repobilityId": "a54f71f827859584", "scanner": "scanner-primary", "fingerprint": "4f68a4b289f051e9", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-3f695f46fbfcff48", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 js/discord.js:121"}, "properties": {"repobilityId": "21e9126d95061106", "scanner": "scanner-primary", "fingerprint": "3f695f46fbfcff48", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-a8b96bb38c90bf75", "level": "note", "message": {"text": "Legacy-named symbol `bp_practiceTutorialSeen_v1` in js/practice.js:7909"}, "properties": {"repobilityId": "d2208f185a176135", "scanner": "scanner-primary", "fingerprint": "a8b96bb38c90bf75", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-a5b67fa485b142fa", "level": "none", "message": {"text": "Commented-code block (5 lines) in js/practice.js:486"}, "properties": {"repobilityId": "d751720f0ea700c5", "scanner": "scanner-primary", "fingerprint": "a5b67fa485b142fa", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-7871a97c0d261006", "level": "note", "message": {"text": "Legacy-named symbol `bp_collectionSort_v1` in js/collection.js:1448"}, "properties": {"repobilityId": "1ff4329a5ff9341a", "scanner": "scanner-primary", "fingerprint": "7871a97c0d261006", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-43b35db5854defe4", "level": "none", "message": {"text": "Commented-code block (5 lines) in js/collection.js:36"}, "properties": {"repobilityId": "fd1a3a0a58df3ce2", "scanner": "scanner-primary", "fingerprint": "43b35db5854defe4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-821326b993fcf257", "level": "none", "message": {"text": "Commented-code block (5 lines) in js/api.js:209"}, "properties": {"repobilityId": "e99ff25706838cca", "scanner": "scanner-primary", "fingerprint": "821326b993fcf257", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-9eb74c2adb6232ca", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 js/api.js:6"}, "properties": {"repobilityId": "1e8713f3b2a80708", "scanner": "scanner-primary", "fingerprint": "9eb74c2adb6232ca", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-72be38143718c01d", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 js/purchase.js:34"}, "properties": {"repobilityId": "5655856fab603d6e", "scanner": "scanner-primary", "fingerprint": "72be38143718c01d", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-aad06fafb71be6b0", "level": "note", "message": {"text": "Legacy-named symbol `elo_records_v1` in js/elo.js:20"}, "properties": {"repobilityId": "d2f2ed6b8bff62b0", "scanner": "scanner-primary", "fingerprint": "aad06fafb71be6b0", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-38bcfa07a2d6e66e", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 js/store-locator.js:91"}, "properties": {"repobilityId": "5da7072a432b5d92", "scanner": "scanner-primary", "fingerprint": "38bcfa07a2d6e66e", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-e2eb2aecf812c0d6", "level": "none", "message": {"text": "Commented-code block (5 lines) in js/auth.js:348"}, "properties": {"repobilityId": "a482f4dfba149027", "scanner": "scanner-primary", "fingerprint": "e2eb2aecf812c0d6", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-eeddf1fa591501c4", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/apply_cyber_handoff.py:157"}, "properties": {"repobilityId": "b482ecdcfbf07000", "scanner": "scanner-primary", "fingerprint": "eeddf1fa591501c4", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-989636070f4996cd", "level": "none", "message": {"text": "Commented-code block (6 lines) in scripts/apply_sealed_images.py:36"}, "properties": {"repobilityId": "dc19e2173bcd5db4", "scanner": "scanner-primary", "fingerprint": "989636070f4996cd", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-85d64ace4d4f8f34", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/backfill_null_athletes.py:98"}, "properties": {"repobilityId": "2a41e0a8242ceda9", "scanner": "scanner-primary", "fingerprint": "85d64ace4d4f8f34", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-31810a41c08747fa", "level": "none", "message": {"text": "Commented-code block (8 lines) in scripts/audit_estimator.py:329"}, "properties": {"repobilityId": "97764915a4eb1328", "scanner": "scanner-primary", "fingerprint": "31810a41c08747fa", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-71ee63d13a6542a6", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/audit_estimator.py:76"}, "properties": {"repobilityId": "f9037309e00e7738", "scanner": "scanner-primary", "fingerprint": "71ee63d13a6542a6", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-2941a2718df9548e", "level": "note", "message": {"text": "Legacy-named symbol `nearest_comparable_v1` in scripts/build_price_estimates.py:833"}, "properties": {"repobilityId": "0fdbc196d76815ea", "scanner": "scanner-primary", "fingerprint": "2941a2718df9548e", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-aa84bb686fca68dc", "level": "none", "message": {"text": "Commented-code block (6 lines) in scripts/build_price_estimates.py:73"}, "properties": {"repobilityId": "66aad6087e9f885a", "scanner": "scanner-primary", "fingerprint": "aa84bb686fca68dc", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-0c9a51a9730d8434", "level": "none", "message": {"text": "Commented-code block (6 lines) in scripts/check_audit_regressions.py:69"}, "properties": {"repobilityId": "bf67405ed61edf51", "scanner": "scanner-primary", "fingerprint": "0c9a51a9730d8434", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-a67f23467314646a", "level": "none", "message": {"text": "Commented-code block (5 lines) in scripts/apply_handoff_batch.py:208"}, "properties": {"repobilityId": "a7286292e3fac22b", "scanner": "scanner-primary", "fingerprint": "a67f23467314646a", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-ecc8bb20fd4478cb", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/apply_handoff_batch.py:179"}, "properties": {"repobilityId": "e5cba6941ccb7ef5", "scanner": "scanner-primary", "fingerprint": "ecc8bb20fd4478cb", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-caa97ca3afcb5e8e", "level": "none", "message": {"text": "Commented-code block (7 lines) in scripts/merge_approved_additions.py:242"}, "properties": {"repobilityId": "9cd94825415d4ad2", "scanner": "scanner-primary", "fingerprint": "caa97ca3afcb5e8e", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-3d2bcfd03ad9db8b", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/merge_approved_additions.py:128"}, "properties": {"repobilityId": "96b678b4abdf2c5e", "scanner": "scanner-primary", "fingerprint": "3d2bcfd03ad9db8b", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-6cf0b782b582e705", "level": "none", "message": {"text": "Commented-code block (6 lines) in scripts/refresh_events.py:110"}, "properties": {"repobilityId": "5ffc16aad266146e", "scanner": "scanner-primary", "fingerprint": "6cf0b782b582e705", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-5f30cc4fa9024761", "level": "none", "message": {"text": "Commented-code block (5 lines) in scripts/rebuild_search_index.py:71"}, "properties": {"repobilityId": "80d395ec214e092e", "scanner": "scanner-primary", "fingerprint": "5f30cc4fa9024761", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-f0e08266e8ac2ce4", "level": "none", "message": {"text": "Commented-code block (6 lines) in scripts/build_power_patch.py:99"}, "properties": {"repobilityId": "2ebd54bfe892dacc", "scanner": "scanner-primary", "fingerprint": "f0e08266e8ac2ce4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-566768d696a68007", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/propagate_dbs.py:94"}, "properties": {"repobilityId": "dbf175528599c372", "scanner": "scanner-primary", "fingerprint": "566768d696a68007", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-7a3dde399b34a146", "level": "none", "message": {"text": "Commented-code block (7 lines) in scripts/audit_hero_mismatches.py:57"}, "properties": {"repobilityId": "43e874d2ca3202cf", "scanner": "scanner-primary", "fingerprint": "7a3dde399b34a146", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-5d590dfb7d514203", "level": "none", "message": {"text": "Commented-code block (5 lines) in scripts/audit_play_effects.py:95"}, "properties": {"repobilityId": "16d603c970d4c916", "scanner": "scanner-primary", "fingerprint": "5d590dfb7d514203", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-4dca88da616c7768", "level": "note", "message": {"text": "Legacy-named symbol `by_old` in scripts/apply_hot_dog_handoff.py:95"}, "properties": {"repobilityId": "32df06b29e2cdeac", "scanner": "scanner-primary", "fingerprint": "4dca88da616c7768", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-dcd37135c00481c4", "level": "none", "message": {"text": "Commented-code block (8 lines) in scripts/track_audit_history.py:210"}, "properties": {"repobilityId": "61e8c2ff522e7efa", "scanner": "scanner-primary", "fingerprint": "dcd37135c00481c4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-544f373376c1c3ed", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/apply_dbs_upstream_patch.py:81"}, "properties": {"repobilityId": "334f0ee76781a9c3", "scanner": "scanner-primary", "fingerprint": "544f373376c1c3ed", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-bef2b496956b1555", "level": "none", "message": {"text": "Commented-code block (8 lines) in tools/play-assets/frame-screens.py:89"}, "properties": {"repobilityId": "953b77d52d29f46b", "scanner": "scanner-primary", "fingerprint": "bef2b496956b1555", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-2aa8876a1fa579d9", "level": "none", "message": {"text": "Commented-code block (5 lines) in tools/screenshots/src/app/ScreenshotsClient.tsx:505"}, "properties": {"repobilityId": "4d8e33dd7fa54f19", "scanner": "scanner-primary", "fingerprint": "2aa8876a1fa579d9", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-60f6bef5c3f20353", "level": "none", "message": {"text": "Commented-code block (5 lines) in pipeline/scripts/stage_a_scrape_ebay.py:104"}, "properties": {"repobilityId": "8a1c1b7131c7498c", "scanner": "scanner-primary", "fingerprint": "60f6bef5c3f20353", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-2364a707b84d3b12", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 pipeline/scripts/stage_a_scrape_ebay.py:93"}, "properties": {"repobilityId": "879e109e823e9391", "scanner": "scanner-primary", "fingerprint": "2364a707b84d3b12", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-5530c6af03a3642f", "level": "note", "message": {"text": "Legacy-named symbol `boba_id_v2` in pipeline/scripts/migrate_v2_bobaid_references.py:53"}, "properties": {"repobilityId": "f81e520e21e3c689", "scanner": "scanner-primary", "fingerprint": "5530c6af03a3642f", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-7b3725e8988e2adb", "level": "none", "message": {"text": "Commented-code block (11 lines) in pipeline/scripts/stage_b_recognize.py:79"}, "properties": {"repobilityId": "4496d1381b9166ee", "scanner": "scanner-primary", "fingerprint": "7b3725e8988e2adb", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-44b16b60cb8e84a7", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 pipeline/scripts/stage_b_recognize.py:226"}, "properties": {"repobilityId": "95ebdb55d8e43d74", "scanner": "scanner-primary", "fingerprint": "44b16b60cb8e84a7", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-88ec5890ae5b5059", "level": "none", "message": {"text": "Commented-code block (7 lines) in pipeline/scripts/regen_bundles.py:41"}, "properties": {"repobilityId": "ccfeaf825d01f69b", "scanner": "scanner-primary", "fingerprint": "88ec5890ae5b5059", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-60900723d57c8b76", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 pipeline/scripts/send_audit_email.py:172"}, "properties": {"repobilityId": "40c855d17df7031c", "scanner": "scanner-primary", "fingerprint": "60900723d57c8b76", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-587612587b5d5153", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 pipeline/scripts/stage_a_scrape_bv.py:61"}, "properties": {"repobilityId": "6f3692e2de373958", "scanner": "scanner-primary", "fingerprint": "587612587b5d5153", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-951c420e667a5215", "level": "none", "message": {"text": "Commented-code block (5 lines) in pipeline/scripts/reconcile_audit_results.py:55"}, "properties": {"repobilityId": "952ed34afd863b5b", "scanner": "scanner-primary", "fingerprint": "951c420e667a5215", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-6192586e542d97b5", "level": "note", "message": {"text": "Legacy-named symbol `build_boba_id_v2` in pipeline/scripts/apply_audit_patch.py:78"}, "properties": {"repobilityId": "b2896a840500bc2c", "scanner": "scanner-primary", "fingerprint": "6192586e542d97b5", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-222f81d39093c94d", "level": "none", "message": {"text": "Commented-code block (5 lines) in pipeline/scripts/apply_audit_patch.py:167"}, "properties": {"repobilityId": "fe1f24ab69f654cd", "scanner": "scanner-primary", "fingerprint": "222f81d39093c94d", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-5c7d222c7cbd961c", "level": "none", "message": {"text": "Commented-code block (5 lines) in pipeline/scripts/stage_c_commit.py:321"}, "properties": {"repobilityId": "25c9fd74df9cd5dc", "scanner": "scanner-primary", "fingerprint": "5c7d222c7cbd961c", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-9b80aa5949f69354", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 pipeline/scripts/stage_c_commit.py:413"}, "properties": {"repobilityId": "0552fb19852faef5", "scanner": "scanner-primary", "fingerprint": "9b80aa5949f69354", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-960d6c9e46713310", "level": "note", "message": {"text": "Legacy-named symbol `boba_id_v2` in pipeline/scripts/migrate_bobaid_to_v3.py:48"}, "properties": {"repobilityId": "e73a7826f5ffcf75", "scanner": "scanner-primary", "fingerprint": "960d6c9e46713310", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-58f25e4c2aab1d0e", "level": "none", "message": {"text": "Commented-code block (8 lines) in pipeline/scripts/import_research_queue.py:86"}, "properties": {"repobilityId": "676dcb9765c0ad18", "scanner": "scanner-primary", "fingerprint": "58f25e4c2aab1d0e", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "7dca3e581f18bcbe", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "403a380b87f45d62", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "ef0c7c10caaff1d1", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "00dd0cdc49040f61", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "4739afc9c508f7cd", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "7a73ed1d359b1bf9", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "d990706cf3dad004", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "a1fcdf4a8ef5c28e", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "4d6fef80fe5033b4", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "2acd8c3cda749703", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "f60fb29130314176", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-0027e313ade46c8f", "level": "note", "message": {"text": "Near-duplicate function bodies in 7 places"}, "properties": {"repobilityId": "5dca22ac3573e14c", "scanner": "scanner-primary", "fingerprint": "0027e313ade46c8f", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-02525d39071dd2c7", "level": "note", "message": {"text": "Near-duplicate function bodies in 5 places"}, "properties": {"repobilityId": "f064ea467d520c54", "scanner": "scanner-primary", "fingerprint": "02525d39071dd2c7", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "1d539703ec0154d2", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}]}]}