{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "foundry_bad_chain", "name": "Foundry mined bad chains: Scobydoo1/frequency", "shortDescription": {"text": "Foundry mined bad chains: Scobydoo1/frequency"}, "fullDescription": {"text": "Comment chain pattern product: bad_chains\nRepo: Scobydoo1/frequency\nThread: Scobydoo1/frequency:github-feedback-comment-bb49fc976604ad50\nOutcome: not_resolved_or_not_observed\nThread label: thread_has_human_issue_without_fix_context\nSource graph label: github_or_motif_graph_without_source_files\nReasons: link_quality_unresolved, high_risk_human_feedback_label\nChain evidence:\nIssue/PR evidence chain: Scobydoo1/frequency:github-feedback-comment-bb49fc976604ad50\nRepo: Scobydoo1/frequency\nThread label: thread_has_human_issue_without_fix_context\nOutcome: not_resolved_or_not_observed\nComment count: 1\nLinked commit count: 0\nLinked CI commit count: 0\nLinked CI labels: {}\nChanged file count: 0\nLabels: {'deployment_env_gap': 1}\nPolarities: {'bad': 1}\nChanged file labels: {}\nExamples:\n[\n  {\n    \"id\": \"github-feedback-comment-bb49fc976604ad50\",\n    \"kind\": \"commit_comment\",\n    \"label\": \"deployment_env_gap\",\n    \"polarity\": \"bad\",\n    \"url\": \"https://github.com/Scobydoo1/frequency/commit/cc57b7b8394"}, "properties": {"scanner": "foundry_dataset", "category": "practices", "severity": "high", "confidence": 0.84, "cwe": "", "owasp": ""}}, {"id": "scanner-6372cebde0220094", "name": "No auth library detected", "shortDescription": {"text": "No auth library detected"}, "fullDescription": {"text": "The scanner did not find any standard auth library (JWT, OAuth, NextAuth, Auth0, etc.). The repo has auth/admin/session surface indicators, so auth may live in custom code, in a separate service, or be missing."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-141b30a41e03817b", "name": "No license file detected", "shortDescription": {"text": "No license file detected"}, "fullDescription": {"text": "No LICENSE/COPYING/NOTICE file was found. Generated repositories often omit licensing, which blocks reuse and automated intake."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-c0f5cc947793dd2b", "name": "`fetch()` without try/.catch or AbortSignal \u2014 frequency/api/_lib/store.js:159", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 frequency/api/_lib/store.js:159"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-94f63e29fa221a9d", "name": "`fetch()` without try/.catch or AbortSignal \u2014 frequency/src/sound.js:293", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 frequency/src/sound.js:293"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/19069"}, "properties": {"repository": "Scobydoo1/frequency", "repoUrl": "https://github.com/Scobydoo1/frequency", "branch": "main"}, "results": [{"ruleId": "foundry_bad_chain", "level": "error", "message": {"text": "Foundry mined bad chains: Scobydoo1/frequency"}, "properties": {"repobilityId": 316032, "scanner": "foundry_dataset", "fingerprint": "17d168e06c9a0d85ebc9d076296401c50c850fc930f12120108ade03b975d61a", "category": "practices", "severity": "high", "confidence": 0.84, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Imported from mined Foundry/Fable5 evidence with real GitHub/source provenance. Review source_id before acting.", "evidence": {"meta": {"kind": "comment_chain_pattern_product", "source": "comment_chain_pattern_miner", "product": "bad_chains", "synthetic": false, "thread_key": "Scobydoo1/frequency:github-feedback-comment-bb49fc976604ad50", "human_labels": ["deployment_env_gap"], "issue_number": "", "thread_label": "thread_has_human_issue_without_fix_context", "outcome_label": "not_resolved_or_not_observed", "source_backed": false, "max_confidence": 0.0, "repo_full_name": "Scobydoo1/frequency", "training_usage": "negative_or_unresolved", "confidence_tier": "unresolved", "source_chain_id": "evidence-chain-issue_chain-f2c9fe3a8f077c84", "helicopter_views": {}, "artifact_families": {}, "source_chain_kind": "issue_chain", "changed_file_count": 0, "source_graph_label": "github_or_motif_graph_without_source_files", "changed_file_labels": {}, "linked_commit_count": 0, "helicopter_view_count": 0, "source_artifact_count": 0, "classification_reasons": ["link_quality_unresolved", "high_risk_human_feedback_label"], "linked_ci_commit_count": 0, "verification_artifact_count": 0, "design_schema_api_artifact_count": 0}, "text": "Comment chain pattern product: bad_chains\nRepo: Scobydoo1/frequency\nThread: Scobydoo1/frequency:github-feedback-comment-bb49fc976604ad50\nOutcome: not_resolved_or_not_observed\nThread label: thread_has_human_issue_without_fix_context\nSource graph label: github_or_motif_graph_without_source_files\nReasons: link_quality_unresolved, high_risk_human_feedback_label\nChain evidence:\nIssue/PR evidence chain: Scobydoo1/frequency:github-feedback-comment-bb49fc976604ad50\nRepo: Scobydoo1/frequency\nThread label: thread_has_human_issue_without_fix_context\nOutcome: not_resolved_or_not_observed\nComment count: 1\nLinked commit count: 0\nLinked CI commit count: 0\nLinked CI labels: {}\nChanged file count: 0\nLabels: {'deployment_env_gap': 1}\nPolarities: {'bad': 1}\nChanged file labels: {}\nExamples:\n[\n  {\n    \"id\": \"github-feedback-comment-bb49fc976604ad50\",\n    \"kind\": \"commit_comment\",\n    \"label\": \"deployment_env_gap\",\n    \"polarity\": \"bad\",\n    \"url\": \"https://github.com/Scobydoo1/frequency/commit/cc57b7b8394d8ba257a905ad9160b79876f2a649#commitcomment-188426875\",\n    \"text\": \"GitHub feedback: deployment_env_gap\\nPolarity: bad\\nKind: commit_comment\\nRepo: Scobydoo1/frequency\\nAuthor: vercel[bot] (Bot)\\nURL: https://github.com/Scobydoo1/frequency/commit/cc57b7b8394d8ba257a905ad9160b79876f2a649#commitcomment-188426875\\nTitle: \\nBody:\\nSuccessfully deployed to the following URLs:\\n\\n## frequency \u2013 ./frequency\\n\\n[frequency-drab.vercel.app](https://frequency-drab.vercel.app)  \\n[frequency-vo-trung-thah-s-projects.vercel.app](https://frequency-vo-trung-thah-s-projects.vercel.app)  \\n[frequency-git-main-vo-trung-thah-s-projects.vercel.app](https://frequency-git-main-vo-trung-thah-s-projects.vercel.app)\"\n  }\n]\nChanged files:\n[]\nLinked chain ids:\n[\"evidence-chain-comment_to_commit-b457c86279bc6e78\"]\nSource graph evidence:\nSource evidence repo graph summary\nRepo: Scobydoo1/frequency\nGraph label: github_or_motif_graph_without_source_files\nNodes: 3\nEdges: 2\nNode types: {\"github_repo_summary\": 1, \"repo\": 1, \"source_bundle\": 1}\nEdge types: {\"repo_has_github_evidence_summary\": 1, \"repo_has_source_bundle\": 1}\nArtifact families: {}\nHelicopter views: {}\nBundle labels: {\"source_inventory_without_extracted_artifacts\": 1}\nCo-occurrence labels: {}", "source": "foundry_mined_dataset", "repo_url": "https://github.com/Scobydoo1/frequency", "source_id": "comment-chain-pattern-bad_chains-727a8e407fdf5ee7", "synthetic": false, "gold_label": "", "graph_label": "github_or_motif_graph_without_source_files", "source_path": "/data/distillate/foundry_data/comment_chain_patterns/bad_chains/shard-0.jsonl", "bundle_label": "", "priority_band": "", "priority_score": 0, "repo_full_name": "Scobydoo1/frequency", "source_dataset": "comment_chain_patterns/bad_chains", "training_usage": "negative_or_unresolved"}}}, {"ruleId": "scanner-6372cebde0220094", "level": "warning", "message": {"text": "No auth library detected"}, "properties": {"repobilityId": "a5b6035a5bbf8054", "scanner": "scanner-primary", "fingerprint": "6372cebde0220094", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["coverage", "auth"]}}, {"ruleId": "scanner-141b30a41e03817b", "level": "note", "message": {"text": "No license file detected"}, "properties": {"repobilityId": "2f89a3b09c528330", "scanner": "scanner-primary", "fingerprint": "141b30a41e03817b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["license", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "7c75066bfc4c9d91", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "07d9e2108fb00be7", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "49e37a60c8dbc24b", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-c0f5cc947793dd2b", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 frequency/api/_lib/store.js:159"}, "properties": {"repobilityId": "ce6b35c3b4678362", "scanner": "scanner-primary", "fingerprint": "c0f5cc947793dd2b", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-94f63e29fa221a9d", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 frequency/src/sound.js:293"}, "properties": {"repobilityId": "61328a91d725221e", "scanner": "scanner-primary", "fingerprint": "94f63e29fa221a9d", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}]}]}