{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-302420f9f676610d", "name": "Possibly dead Python function: open_browser", "shortDescription": {"text": "Possibly dead Python function: open_browser"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-56c8ca9660df596c", "name": "Possibly dead Python function: f_cond", "shortDescription": {"text": "Possibly dead Python function: f_cond"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cf7b2a47b558cabf", "name": "Possibly dead Python function: disc_badge", "shortDescription": {"text": "Possibly dead Python function: disc_badge"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-807d535fd9e01953", "name": "Possibly dead Python function: soft_panel", "shortDescription": {"text": "Possibly dead Python function: soft_panel"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-971e4b726e84e884", "name": "Possibly dead Python function: f_cond", "shortDescription": {"text": "Possibly dead Python function: f_cond"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-bf5d2d6aabf4bb59", "name": "Possibly dead Python function: ease_out_quint", "shortDescription": {"text": "Possibly dead Python function: ease_out_quint"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f843fc55851b332e", "name": "Stray `console.log` in TS/JS \u2014 main.js:290", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 main.js:290"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-134191c3e9f47b4d", "name": "Stray `console.log` in TS/JS \u2014 tests/test-websockets-realtime.js:16", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 tests/test-websockets-realtime.js:16"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9741f442b67edb81", "name": "Stray `console.log` in TS/JS \u2014 js/error-logger.js:135", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 js/error-logger.js:135"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0b2403a38bd3fde5", "name": "Stray `console.log` in TS/JS \u2014 js/sync.js:64", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 js/sync.js:64"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5128e0dd56150f91", "name": "Stray `console.log` in TS/JS \u2014 js/utils.js:713", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 js/utils.js:713"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-77ec76aa3390e184", "name": "Stray `console.log` in TS/JS \u2014 js/db.js:599", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 js/db.js:599"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-00f7adf99bc80c6f", "name": "Stray `console.log` in TS/JS \u2014 js/cache-nuker.js:8", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 js/cache-nuker.js:8"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fa4965e25bd47ae5", "name": "Stray `console.log` in TS/JS \u2014 js/auth.js:114", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 js/auth.js:114"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2ed29da31c2d4939", "name": "Stray `console.log` in TS/JS \u2014 js/notifications.js:13", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 js/notifications.js:13"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7f7ed616a2a35385", "name": "Stray `console.log` in TS/JS \u2014 js/push-subscribe.js:23", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 js/push-subscribe.js:23"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2763bb66fd7e3440", "name": "Stray `console.log` in TS/JS \u2014 js/confirm-dialog.js:114", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 js/confirm-dialog.js:114"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a2cb38987f9da8f4", "name": "Stray `console.log` in TS/JS \u2014 js/sii_api.js:45", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 js/sii_api.js:45"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-919e86263da3afca", "name": "Stray `console.log` in TS/JS \u2014 js/sync/outbox.js:52", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 js/sync/outbox.js:52"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4c8494dbd21b6d0f", "name": "Stray `console.log` in TS/JS \u2014 js/sync/sync-v2.js:3", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 js/sync/sync-v2.js:3"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c06d134ad152aef7", "name": "Stray `console.log` in TS/JS \u2014 js/sync/device-id.js:10", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 js/sync/device-id.js:10"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-48aa4242e3f9c2b0", "name": "Stray `console.log` in TS/JS \u2014 js/views/settings.js:318", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 js/views/settings.js:318"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f7142824c6bc4401", "name": "Stray `console.log` in TS/JS \u2014 js/views/expenses.js:77", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 js/views/expenses.js:77"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e1748a2fd209c9fd", "name": "Stray `console.log` in TS/JS \u2014 js/views/daily_sales.js:71", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 js/views/daily_sales.js:71"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d9a08941e56155ec", "name": "Stray `console.log` in TS/JS \u2014 js/views/sales_invoices.js:54", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 js/views/sales_invoices.js:54"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-950c5959ee003b1f", "name": "Stray `console.log` in TS/JS \u2014 js/views/electronic_invoices.js:253", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 js/views/electronic_invoices.js:253"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-183ab9c344e22770", "name": "Stray `console.log` in TS/JS \u2014 js/views/employees.js:24", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 js/views/employees.js:24"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8353c60371f3e8ef", "name": "Stray `console.log` in TS/JS \u2014 js/views/cash_register.js:103", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 js/views/cash_register.js:103"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6bcf3140c2a0ea10", "name": "Stray `console.log` in TS/JS \u2014 js/views/purchase_invoices.js:232", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 js/views/purchase_invoices.js:232"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-aac2d2d44c9dd51b", "name": "Stray `console.log` in TS/JS \u2014 js/views/credits.js:135", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 js/views/credits.js:135"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-67246270239b4d18", "name": "Stray `console.log` in TS/JS \u2014 supabase/functions/push-reminder/index.ts:145", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 supabase/functions/push-reminder/index.ts:145"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9710c8d059e53154", "name": "No frontend routes/components detected", "shortDescription": {"text": "No frontend routes/components detected"}, "fullDescription": {"text": "No React/Vue/Next routes were found. This is fine for backend-only repos."}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-6bbd8a0bb0fa2e14", "name": "Insecure pattern 'direct_innerhtml_assignment' in main.js:69", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in main.js:69"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e9ae49016c52b884", "name": "Insecure pattern 'local_storage_auth_token' in main.js:266", "shortDescription": {"text": "Insecure pattern 'local_storage_auth_token' in main.js:266"}, "fullDescription": {"text": "Found a known-risky pattern (local_storage_auth_token). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-dc917e607e2e2341", "name": "Insecure pattern 'direct_innerhtml_assignment' in js/sync.js:521", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/sync.js:521"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6e3028455a2f4735", "name": "Insecure pattern 'direct_innerhtml_assignment' in js/utils.js:687", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/utils.js:687"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-57d19c392373898a", "name": "Insecure pattern 'local_storage_auth_token' in js/auth.js:39", "shortDescription": {"text": "Insecure pattern 'local_storage_auth_token' in js/auth.js:39"}, "fullDescription": {"text": "Found a known-risky pattern (local_storage_auth_token). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-50549adb3191fe3d", "name": "Insecure pattern 'direct_innerhtml_assignment' in js/confirm-dialog.js:27", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/confirm-dialog.js:27"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-03fa2b0fbe5a46b0", "name": "Insecure pattern 'direct_innerhtml_assignment' in js/views/settings.js:6", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/views/settings.js:6"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e7d8f0fa2245dd84", "name": "Insecure pattern 'direct_innerhtml_assignment' in js/views/expenses.js:5", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/views/expenses.js:5"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e150785f8967cf0f", "name": "Insecure pattern 'direct_innerhtml_assignment' in js/views/suppliers.js:5", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/views/suppliers.js:5"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-604ba3fabfcc9c5d", "name": "Insecure pattern 'direct_innerhtml_assignment' in js/views/daily_sales.js:5", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/views/daily_sales.js:5"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-368f3f5cd9aabccd", "name": "Insecure pattern 'direct_innerhtml_assignment' in js/views/marketing.js:5", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/views/marketing.js:5"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1f83c84dc4917cc2", "name": "Insecure pattern 'direct_innerhtml_assignment' in js/views/sales_invoices.js:5", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/views/sales_invoices.js:5"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-db2649e37988e39b", "name": "Insecure pattern 'direct_innerhtml_assignment' in js/views/loans.js:6", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/views/loans.js:6"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ada2c4e5ab982b05", "name": "Insecure pattern 'direct_innerhtml_assignment' in js/views/calculator.js:5", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/views/calculator.js:5"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-5021c8c8838900f6", "name": "Insecure pattern 'direct_innerhtml_assignment' in js/views/dashboard.js:188", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/views/dashboard.js:188"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b64d6a25aa12058f", "name": "Insecure pattern 'insert_adjacent_html' in js/views/dashboard.js:919", "shortDescription": {"text": "Insecure pattern 'insert_adjacent_html' in js/views/dashboard.js:919"}, "fullDescription": {"text": "Found a known-risky pattern (insert_adjacent_html). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0621a0b5b43ce384", "name": "Insecure pattern 'direct_innerhtml_assignment' in js/views/security.js:70", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/views/security.js:70"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d338309baae6b49a", "name": "Insecure pattern 'direct_innerhtml_assignment' in js/views/electronic_invoices.js:5", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/views/electronic_invoices.js:5"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-301778d617bc425c", "name": "Insecure pattern 'direct_innerhtml_assignment' in js/views/profit_monitor.js:5", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/views/profit_monitor.js:5"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2c109bb7346a13d6", "name": "Insecure pattern 'direct_innerhtml_assignment' in js/views/employees.js:32", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/views/employees.js:32"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8b3a0a169d9934f5", "name": "Insecure pattern 'direct_innerhtml_assignment' in js/views/cash_register.js:5", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/views/cash_register.js:5"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7d6d493c66af5783", "name": "Insecure pattern 'direct_innerhtml_assignment' in js/views/purchase_invoices.js:8", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/views/purchase_invoices.js:8"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b26e55a596046cb4", "name": "Insecure pattern 'direct_innerhtml_assignment' in js/views/abc_analysis.js:5", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/views/abc_analysis.js:5"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e99edb1ea1d7eb1b", "name": "Insecure pattern 'direct_innerhtml_assignment' in js/views/credits.js:5", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/views/credits.js:5"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-22f6efbef0738c46", "name": "Insecure pattern 'direct_innerhtml_assignment' in js/views/barcode.js:13", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/views/barcode.js:13"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-48bfba3f3157d461", "name": "Insecure pattern 'direct_innerhtml_assignment' in marketing/studio/index.html:183", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in marketing/studio/index.html:183"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-25041870e279fdf4", "name": "Insecure pattern 'cors_wildcard' in supabase/functions/push-reminder/index.ts:44", "shortDescription": {"text": "Insecure pattern 'cors_wildcard' in supabase/functions/push-reminder/index.ts:44"}, "fullDescription": {"text": "Found a known-risky pattern (cors_wildcard). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4601e3ad3bb28677", "name": "No CI/CD pipelines detected", "shortDescription": {"text": "No CI/CD pipelines detected"}, "fullDescription": {"text": "No GitHub Actions, GitLab CI, or CircleCI configs found. Without CI you can't gate deploys on tests/lints."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d6a16efb851d34f2", "name": "Very large file: js/views/dashboard.js (2310 lines)", "shortDescription": {"text": "Very large file: js/views/dashboard.js (2310 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-54d324357700f177", "name": "Very large file: js/views/cash_register.js (985 lines)", "shortDescription": {"text": "Very large file: js/views/cash_register.js (985 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b7434c9f0d3c7c2b", "name": "Very large file: js/views/purchase_invoices.js (2656 lines)", "shortDescription": {"text": "Very large file: js/views/purchase_invoices.js (2656 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6893a6c8b0861585", "name": "Very low test-to-source ratio", "shortDescription": {"text": "Very low test-to-source ratio"}, "fullDescription": {"text": "4 test file(s) for 49 source file(s) (ratio 0.08). Consider adding integration or unit tests for critical paths."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-141b30a41e03817b", "name": "No license file detected", "shortDescription": {"text": "No license file detected"}, "fullDescription": {"text": "No LICENSE/COPYING/NOTICE file was found. Generated repositories often omit licensing, which blocks reuse and automated intake."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-01f96f71d9907a8c", "name": "README lacks setup or run instructions", "shortDescription": {"text": "README lacks setup or run instructions"}, "fullDescription": {"text": "A README exists, but it does not contain common install/setup/run markers. This matches a frequent generated-code pattern: UI is present, operational handoff is thin."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b3ed68815bca2f8c", "name": "Node manifest has dependencies but no lockfile: package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 76 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-72b2a6250083a784", "name": "Placeholder or mock-heavy implementation detected", "shortDescription": {"text": "Placeholder or mock-heavy implementation detected"}, "fullDescription": {"text": "Found 79 placeholder/mock markers across 19 source files. This often means the repo looks complete while core flows still use generated scaffolding or fake data."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b9088664ace7f748", "name": "Composite production-readiness gap", "shortDescription": {"text": "Composite production-readiness gap"}, "fullDescription": {"text": "Multiple low-cost hardening controls are missing together: license, ci, operator-readme, lockfile. Opus verification showed these co-occurring gaps are a better readiness signal than reading each flag in isolation."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-749d4bc1bd66df5f", "name": "Agent instructions exist but release-hardening basics are missing", "shortDescription": {"text": "Agent instructions exist but release-hardening basics are missing"}, "fullDescription": {"text": "AI-coder instruction files were found, but the repo is missing license, ci, operator-readme, lockfile. Treat this as a contract gap: the agent is guided, but the generated output is not yet guarded by the controls that make it repeatable."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-4cf9d22e31691012", "name": "`fetch()` without try/.catch or AbortSignal \u2014 service-worker.js:47", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 service-worker.js:47"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6994175b5e68c1ec", "name": "Commented-code block (9 lines) in api/notify.js:1", "shortDescription": {"text": "Commented-code block (9 lines) in api/notify.js:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-db9bb5c24da95be7", "name": "Commented-code block (6 lines) in js/utils.js:298", "shortDescription": {"text": "Commented-code block (6 lines) in js/utils.js:298"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-7734a094ac1feb1b", "name": "Commented-code block (5 lines) in js/confirm-dialog.js:248", "shortDescription": {"text": "Commented-code block (5 lines) in js/confirm-dialog.js:248"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-59f1c11a79810ee7", "name": "Commented-code block (8 lines) in js/transaction-manager.js:8", "shortDescription": {"text": "Commented-code block (8 lines) in js/transaction-manager.js:8"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-0260ccf46e2776b8", "name": "Legacy-named symbol `sii_limpieza_manuales_v1` in js/sii_api.js:340", "shortDescription": {"text": "Legacy-named symbol `sii_limpieza_manuales_v1` in js/sii_api.js:340"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2410c14830df2f03", "name": "`fetch()` without try/.catch or AbortSignal \u2014 js/sii_api.js:125", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 js/sii_api.js:125"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-42b6f28f1327c67a", "name": "Commented-code block (5 lines) in js/views/dashboard.js:1744", "shortDescription": {"text": "Commented-code block (5 lines) in js/views/dashboard.js:1744"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-396110bb43fd69d2", "name": "Blocking `time.sleep(...)` inside `async def publish` \u2014 marketing/studio/server.py:459", "shortDescription": {"text": "Blocking `time.sleep(...)` inside `async def publish` \u2014 marketing/studio/server.py:459"}, "fullDescription": {"text": "Sync I/O inside an async function blocks the event loop. While `time.sleep(...)` is running, *all* other coroutines on this loop are paused \u2014 silent throughput collapse under concurrency. Use the async equivalent (`httpx.AsyncClient`, `asyncio.sleep`, `aiofiles`) or wrap with `await asyncio.to_thread(...)`."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "high", "confidence": 1.0}}, {"id": "scanner-94cad8c668a0e2e2", "name": "Legacy-named symbol `price_old` in marketing/tools/templates.py:147", "shortDescription": {"text": "Legacy-named symbol `price_old` in marketing/tools/templates.py:147"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b5910fc39029b5c1", "name": "Network/subprocess call without timeout or try/except \u2014 marketing/tools/audio.py:196", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 marketing/tools/audio.py:196"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-44294757e71f254f", "name": "Legacy-named symbol `price_old` in marketing/tools/make_video.py:288", "shortDescription": {"text": "Legacy-named symbol `price_old` in marketing/tools/make_video.py:288"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6608e3fdef25eb51", "name": "Commented-code block (7 lines) in supabase/functions/push-reminder/index.ts:6", "shortDescription": {"text": "Commented-code block (7 lines) in supabase/functions/push-reminder/index.ts:6"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-2eafc3188c36bb02", "name": "3 env vars used in code but missing from .env.example", "shortDescription": {"text": "3 env vars used in code but missing from .env.example"}, "fullDescription": {"text": "Drift between code and config docs. The first few: `FB_REDIRECT_URI`, `IG_TOKEN`, `IG_USER_ID`. Add them (with a placeholder/comment) to .env.example so onboarding doesn't break."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-9a2548af59cd32e3", "name": "FastAPI POST `upload` without auth dependency \u2014 marketing/studio/server.py:79", "shortDescription": {"text": "FastAPI POST `upload` without auth dependency \u2014 marketing/studio/server.py:79"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-eff356b496a761d2", "name": "FastAPI POST `generate` without auth dependency \u2014 marketing/studio/server.py:107", "shortDescription": {"text": "FastAPI POST `generate` without auth dependency \u2014 marketing/studio/server.py:107"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-0dad764143f17a50", "name": "FastAPI POST `caption` without auth dependency \u2014 marketing/studio/server.py:250", "shortDescription": {"text": "FastAPI POST `caption` without auth dependency \u2014 marketing/studio/server.py:250"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-438b0ac565f60dc6", "name": "FastAPI POST `schedule` without auth dependency \u2014 marketing/studio/server.py:274", "shortDescription": {"text": "FastAPI POST `schedule` without auth dependency \u2014 marketing/studio/server.py:274"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-08ab0a7a9dcfc728", "name": "FastAPI POST `autoschedule` without auth dependency \u2014 marketing/studio/server.py:289", "shortDescription": {"text": "FastAPI POST `autoschedule` without auth dependency \u2014 marketing/studio/server.py:289"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-eaa431cf48dfa5bf", "name": "FastAPI POST `publish` without auth dependency \u2014 marketing/studio/server.py:427", "shortDescription": {"text": "FastAPI POST `publish` without auth dependency \u2014 marketing/studio/server.py:427"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-8bff4e9c3dc5f7da", "name": "FastAPI POST `delete` without auth dependency \u2014 marketing/studio/server.py:484", "shortDescription": {"text": "FastAPI POST `delete` without auth dependency \u2014 marketing/studio/server.py:484"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-5baa8971ebe192a1", "name": "Unused endpoint: GET /", "shortDescription": {"text": "Unused endpoint: GET /"}, "fullDescription": {"text": "`marketing/studio/server.py` declares `GET /` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-27652a11ba620012", "name": "Unused endpoint: GET /api/state", "shortDescription": {"text": "Unused endpoint: GET /api/state"}, "fullDescription": {"text": "`marketing/studio/server.py` declares `GET /api/state` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-536fc60d1287e634", "name": "Unused endpoint: POST /api/upload", "shortDescription": {"text": "Unused endpoint: POST /api/upload"}, "fullDescription": {"text": "`marketing/studio/server.py` declares `POST /api/upload` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-093467ddc6e6a64d", "name": "Unused endpoint: POST /api/generate", "shortDescription": {"text": "Unused endpoint: POST /api/generate"}, "fullDescription": {"text": "`marketing/studio/server.py` declares `POST /api/generate` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-21f06e90f2830109", "name": "Unused endpoint: POST /api/caption", "shortDescription": {"text": "Unused endpoint: POST /api/caption"}, "fullDescription": {"text": "`marketing/studio/server.py` declares `POST /api/caption` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d97aa2c9d6ad08fc", "name": "Unused endpoint: POST /api/schedule", "shortDescription": {"text": "Unused endpoint: POST /api/schedule"}, "fullDescription": {"text": "`marketing/studio/server.py` declares `POST /api/schedule` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5878c5fb0831211f", "name": "Unused endpoint: POST /api/autoschedule", "shortDescription": {"text": "Unused endpoint: POST /api/autoschedule"}, "fullDescription": {"text": "`marketing/studio/server.py` declares `POST /api/autoschedule` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5f3412431f4279be", "name": "Unused endpoint: GET /api/export.csv", "shortDescription": {"text": "Unused endpoint: GET /api/export.csv"}, "fullDescription": {"text": "`marketing/studio/server.py` declares `GET /api/export.csv` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-af8eb998ca73e836", "name": "Unused endpoint: GET /api/fb-connect", "shortDescription": {"text": "Unused endpoint: GET /api/fb-connect"}, "fullDescription": {"text": "`marketing/studio/server.py` declares `GET /api/fb-connect` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-be054816c7b1ce4d", "name": "Unused endpoint: GET /api/fb-callback", "shortDescription": {"text": "Unused endpoint: GET /api/fb-callback"}, "fullDescription": {"text": "`marketing/studio/server.py` declares `GET /api/fb-callback` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5edf10039a749255", "name": "Unused endpoint: GET /api/ig-status", "shortDescription": {"text": "Unused endpoint: GET /api/ig-status"}, "fullDescription": {"text": "`marketing/studio/server.py` declares `GET /api/ig-status` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b1781960ab88cbc8", "name": "Unused endpoint: POST /api/publish", "shortDescription": {"text": "Unused endpoint: POST /api/publish"}, "fullDescription": {"text": "`marketing/studio/server.py` declares `POST /api/publish` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-05ad17fe4becd2dc", "name": "Unused endpoint: GET /api/ig-id", "shortDescription": {"text": "Unused endpoint: GET /api/ig-id"}, "fullDescription": {"text": "`marketing/studio/server.py` declares `GET /api/ig-id` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-83c287ea4fc96de7", "name": "Unused endpoint: POST /api/delete", "shortDescription": {"text": "Unused endpoint: POST /api/delete"}, "fullDescription": {"text": "`marketing/studio/server.py` declares `POST /api/delete` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/18910"}, "properties": {"repository": "sanmaglass/App_ELmaravilloso", "repoUrl": "https://github.com/sanmaglass/App_ELmaravilloso", "branch": "main"}, "results": [{"ruleId": "scanner-302420f9f676610d", "level": "note", "message": {"text": "Possibly dead Python function: open_browser"}, "properties": {"repobilityId": "d6455af6e78d5e19", "scanner": "scanner-primary", "fingerprint": "302420f9f676610d", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "marketing/studio/server.py:492"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-56c8ca9660df596c", "level": "note", "message": {"text": "Possibly dead Python function: f_cond"}, "properties": {"repobilityId": "7c68bcea5cd503fd", "scanner": "scanner-primary", "fingerprint": "56c8ca9660df596c", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "marketing/tools/templates.py:60"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-cf7b2a47b558cabf", "level": "note", "message": {"text": "Possibly dead Python function: disc_badge"}, "properties": {"repobilityId": "4f8eb6dcbf829847", "scanner": "scanner-primary", "fingerprint": "cf7b2a47b558cabf", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "marketing/tools/templates.py:302"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-807d535fd9e01953", "level": "note", "message": {"text": "Possibly dead Python function: soft_panel"}, "properties": {"repobilityId": "ec93dbb9c0575e19", "scanner": "scanner-primary", "fingerprint": "807d535fd9e01953", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "marketing/tools/templates.py:308"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-971e4b726e84e884", "level": "note", "message": {"text": "Possibly dead Python function: f_cond"}, "properties": {"repobilityId": "7c68bcea5cd503fd", "scanner": "scanner-primary", "fingerprint": "971e4b726e84e884", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "marketing/tools/make_video.py:59"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-bf5d2d6aabf4bb59", "level": "note", "message": {"text": "Possibly dead Python function: ease_out_quint"}, "properties": {"repobilityId": "6c8218dba65246ea", "scanner": "scanner-primary", "fingerprint": "bf5d2d6aabf4bb59", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "marketing/tools/make_video.py:70"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f843fc55851b332e", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 main.js:290"}, "properties": {"repobilityId": "4a2f610e5e3afce9", "scanner": "scanner-primary", "fingerprint": "f843fc55851b332e", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-134191c3e9f47b4d", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 tests/test-websockets-realtime.js:16"}, "properties": {"repobilityId": "f6b31dfbd5c2cf85", "scanner": "scanner-primary", "fingerprint": "134191c3e9f47b4d", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-9741f442b67edb81", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 js/error-logger.js:135"}, "properties": {"repobilityId": "70dd310e7e2f9d06", "scanner": "scanner-primary", "fingerprint": "9741f442b67edb81", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-0b2403a38bd3fde5", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 js/sync.js:64"}, "properties": {"repobilityId": "33c03a3b09c3b1fd", "scanner": "scanner-primary", "fingerprint": "0b2403a38bd3fde5", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-5128e0dd56150f91", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 js/utils.js:713"}, "properties": {"repobilityId": "943b3131be271978", "scanner": "scanner-primary", "fingerprint": "5128e0dd56150f91", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-77ec76aa3390e184", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 js/db.js:599"}, "properties": {"repobilityId": "f9fcda697bbc90f5", "scanner": "scanner-primary", "fingerprint": "77ec76aa3390e184", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-00f7adf99bc80c6f", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 js/cache-nuker.js:8"}, "properties": {"repobilityId": "045c369307af4e3e", "scanner": "scanner-primary", "fingerprint": "00f7adf99bc80c6f", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-fa4965e25bd47ae5", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 js/auth.js:114"}, "properties": {"repobilityId": "15a71c2d598e55c6", "scanner": "scanner-primary", "fingerprint": "fa4965e25bd47ae5", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-2ed29da31c2d4939", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 js/notifications.js:13"}, "properties": {"repobilityId": "8b19a6a81bd5fea4", "scanner": "scanner-primary", "fingerprint": "2ed29da31c2d4939", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-7f7ed616a2a35385", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 js/push-subscribe.js:23"}, "properties": {"repobilityId": "76e1802e93ca61bd", "scanner": "scanner-primary", "fingerprint": "7f7ed616a2a35385", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-2763bb66fd7e3440", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 js/confirm-dialog.js:114"}, "properties": {"repobilityId": "6497adbffa4b737b", "scanner": "scanner-primary", "fingerprint": "2763bb66fd7e3440", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-a2cb38987f9da8f4", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 js/sii_api.js:45"}, "properties": {"repobilityId": "3c9af0150e2abd33", "scanner": "scanner-primary", "fingerprint": "a2cb38987f9da8f4", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-919e86263da3afca", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 js/sync/outbox.js:52"}, "properties": {"repobilityId": "8bb2a9a08c3984a7", "scanner": "scanner-primary", "fingerprint": "919e86263da3afca", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-4c8494dbd21b6d0f", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 js/sync/sync-v2.js:3"}, "properties": {"repobilityId": "3b37dbd80a74566c", "scanner": "scanner-primary", "fingerprint": "4c8494dbd21b6d0f", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-c06d134ad152aef7", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 js/sync/device-id.js:10"}, "properties": {"repobilityId": "b9b4c467cc10c155", "scanner": "scanner-primary", "fingerprint": "c06d134ad152aef7", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-48aa4242e3f9c2b0", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 js/views/settings.js:318"}, "properties": {"repobilityId": "49a494bc04e23284", "scanner": "scanner-primary", "fingerprint": "48aa4242e3f9c2b0", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-f7142824c6bc4401", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 js/views/expenses.js:77"}, "properties": {"repobilityId": "91117500931219d3", "scanner": "scanner-primary", "fingerprint": "f7142824c6bc4401", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-e1748a2fd209c9fd", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 js/views/daily_sales.js:71"}, "properties": {"repobilityId": "5fecb6f8023e3251", "scanner": "scanner-primary", "fingerprint": "e1748a2fd209c9fd", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-d9a08941e56155ec", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 js/views/sales_invoices.js:54"}, "properties": {"repobilityId": "4d7db2d51eb5d2a9", "scanner": "scanner-primary", "fingerprint": "d9a08941e56155ec", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-950c5959ee003b1f", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 js/views/electronic_invoices.js:253"}, "properties": {"repobilityId": "ddf776a3d90508ee", "scanner": "scanner-primary", "fingerprint": "950c5959ee003b1f", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-183ab9c344e22770", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 js/views/employees.js:24"}, "properties": {"repobilityId": "a42934efba3e7a2a", "scanner": "scanner-primary", "fingerprint": "183ab9c344e22770", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-8353c60371f3e8ef", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 js/views/cash_register.js:103"}, "properties": {"repobilityId": "ff262f7a64ef1b16", "scanner": "scanner-primary", "fingerprint": "8353c60371f3e8ef", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-6bcf3140c2a0ea10", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 js/views/purchase_invoices.js:232"}, "properties": {"repobilityId": "1d11bfd4877f6c48", "scanner": "scanner-primary", "fingerprint": "6bcf3140c2a0ea10", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-aac2d2d44c9dd51b", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 js/views/credits.js:135"}, "properties": {"repobilityId": "48e31d22ae1fdb1e", "scanner": "scanner-primary", "fingerprint": "aac2d2d44c9dd51b", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-67246270239b4d18", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 supabase/functions/push-reminder/index.ts:145"}, "properties": {"repobilityId": "6a8d895bab111a61", "scanner": "scanner-primary", "fingerprint": "67246270239b4d18", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-9710c8d059e53154", "level": "none", "message": {"text": "No frontend routes/components detected"}, "properties": {"repobilityId": "44ca61485762e494", "scanner": "scanner-primary", "fingerprint": "9710c8d059e53154", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-6bbd8a0bb0fa2e14", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in main.js:69"}, "properties": {"repobilityId": "1b4d35edc097833f", "scanner": "scanner-primary", "fingerprint": "6bbd8a0bb0fa2e14", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "main.js"}, "region": {"startLine": 69}}}]}, {"ruleId": "scanner-e9ae49016c52b884", "level": "warning", "message": {"text": "Insecure pattern 'local_storage_auth_token' in main.js:266"}, "properties": {"repobilityId": "0d7a05ae307aba7b", "scanner": "scanner-primary", "fingerprint": "e9ae49016c52b884", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "local_storage_auth_token"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "main.js"}, "region": {"startLine": 266}}}]}, {"ruleId": "scanner-dc917e607e2e2341", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/sync.js:521"}, "properties": {"repobilityId": "4406a4d33093e4b9", "scanner": "scanner-primary", "fingerprint": "dc917e607e2e2341", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "js/sync.js"}, "region": {"startLine": 521}}}]}, {"ruleId": "scanner-6e3028455a2f4735", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/utils.js:687"}, "properties": {"repobilityId": "2e1605fb925b68d1", "scanner": "scanner-primary", "fingerprint": "6e3028455a2f4735", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "js/utils.js"}, "region": {"startLine": 687}}}]}, {"ruleId": "scanner-57d19c392373898a", "level": "warning", "message": {"text": "Insecure pattern 'local_storage_auth_token' in js/auth.js:39"}, "properties": {"repobilityId": "06899a13d6cd12f6", "scanner": "scanner-primary", "fingerprint": "57d19c392373898a", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "local_storage_auth_token"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "js/auth.js"}, "region": {"startLine": 39}}}]}, {"ruleId": "scanner-50549adb3191fe3d", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/confirm-dialog.js:27"}, "properties": {"repobilityId": "d7e40dcda9eb6a2c", "scanner": "scanner-primary", "fingerprint": "50549adb3191fe3d", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "js/confirm-dialog.js"}, "region": {"startLine": 27}}}]}, {"ruleId": "scanner-03fa2b0fbe5a46b0", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/views/settings.js:6"}, "properties": {"repobilityId": "82a870446ac11f4c", "scanner": "scanner-primary", "fingerprint": "03fa2b0fbe5a46b0", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "js/views/settings.js"}, "region": {"startLine": 6}}}]}, {"ruleId": "scanner-e7d8f0fa2245dd84", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/views/expenses.js:5"}, "properties": {"repobilityId": "c78db73a8f0933da", "scanner": "scanner-primary", "fingerprint": "e7d8f0fa2245dd84", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "js/views/expenses.js"}, "region": {"startLine": 5}}}]}, {"ruleId": "scanner-e150785f8967cf0f", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/views/suppliers.js:5"}, "properties": {"repobilityId": "d2b85238e41a3b3c", "scanner": "scanner-primary", "fingerprint": "e150785f8967cf0f", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "js/views/suppliers.js"}, "region": {"startLine": 5}}}]}, {"ruleId": "scanner-604ba3fabfcc9c5d", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/views/daily_sales.js:5"}, "properties": {"repobilityId": "7fd2b3ca2c37be45", "scanner": "scanner-primary", "fingerprint": "604ba3fabfcc9c5d", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "js/views/daily_sales.js"}, "region": {"startLine": 5}}}]}, {"ruleId": "scanner-368f3f5cd9aabccd", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/views/marketing.js:5"}, "properties": {"repobilityId": "12f0e40f60b11c59", "scanner": "scanner-primary", "fingerprint": "368f3f5cd9aabccd", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "js/views/marketing.js"}, "region": {"startLine": 5}}}]}, {"ruleId": "scanner-1f83c84dc4917cc2", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/views/sales_invoices.js:5"}, "properties": {"repobilityId": "08659da017ab45cd", "scanner": "scanner-primary", "fingerprint": "1f83c84dc4917cc2", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "js/views/sales_invoices.js"}, "region": {"startLine": 5}}}]}, {"ruleId": "scanner-db2649e37988e39b", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/views/loans.js:6"}, "properties": {"repobilityId": "71bb5832cd022471", "scanner": "scanner-primary", "fingerprint": "db2649e37988e39b", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "js/views/loans.js"}, "region": {"startLine": 6}}}]}, {"ruleId": "scanner-ada2c4e5ab982b05", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/views/calculator.js:5"}, "properties": {"repobilityId": "60020e79a703967f", "scanner": "scanner-primary", "fingerprint": "ada2c4e5ab982b05", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "js/views/calculator.js"}, "region": {"startLine": 5}}}]}, {"ruleId": "scanner-5021c8c8838900f6", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/views/dashboard.js:188"}, "properties": {"repobilityId": "43946f44841c08f1", "scanner": "scanner-primary", "fingerprint": "5021c8c8838900f6", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "js/views/dashboard.js"}, "region": {"startLine": 188}}}]}, {"ruleId": "scanner-b64d6a25aa12058f", "level": "warning", "message": {"text": "Insecure pattern 'insert_adjacent_html' in js/views/dashboard.js:919"}, "properties": {"repobilityId": "dc191c0257f2f8af", "scanner": "scanner-primary", "fingerprint": "b64d6a25aa12058f", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "insert_adjacent_html"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "js/views/dashboard.js"}, "region": {"startLine": 919}}}]}, {"ruleId": "scanner-0621a0b5b43ce384", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/views/security.js:70"}, "properties": {"repobilityId": "3f925aa6d52f4897", "scanner": "scanner-primary", "fingerprint": "0621a0b5b43ce384", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "js/views/security.js"}, "region": {"startLine": 70}}}]}, {"ruleId": "scanner-d338309baae6b49a", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/views/electronic_invoices.js:5"}, "properties": {"repobilityId": "1ca59f8afe2dbffe", "scanner": "scanner-primary", "fingerprint": "d338309baae6b49a", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "js/views/electronic_invoices.js"}, "region": {"startLine": 5}}}]}, {"ruleId": "scanner-301778d617bc425c", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/views/profit_monitor.js:5"}, "properties": {"repobilityId": "74c2b7caabf58a38", "scanner": "scanner-primary", "fingerprint": "301778d617bc425c", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "js/views/profit_monitor.js"}, "region": {"startLine": 5}}}]}, {"ruleId": "scanner-2c109bb7346a13d6", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/views/employees.js:32"}, "properties": {"repobilityId": "1b014bfa7406981e", "scanner": "scanner-primary", "fingerprint": "2c109bb7346a13d6", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "js/views/employees.js"}, "region": {"startLine": 32}}}]}, {"ruleId": "scanner-8b3a0a169d9934f5", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/views/cash_register.js:5"}, "properties": {"repobilityId": "a7ea9abc99426c14", "scanner": "scanner-primary", "fingerprint": "8b3a0a169d9934f5", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "js/views/cash_register.js"}, "region": {"startLine": 5}}}]}, {"ruleId": "scanner-7d6d493c66af5783", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/views/purchase_invoices.js:8"}, "properties": {"repobilityId": "972f55b0329f2761", "scanner": "scanner-primary", "fingerprint": "7d6d493c66af5783", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "js/views/purchase_invoices.js"}, "region": {"startLine": 8}}}]}, {"ruleId": "scanner-b26e55a596046cb4", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/views/abc_analysis.js:5"}, "properties": {"repobilityId": "c70e3ad87b18f4ee", "scanner": "scanner-primary", "fingerprint": "b26e55a596046cb4", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "js/views/abc_analysis.js"}, "region": {"startLine": 5}}}]}, {"ruleId": "scanner-e99edb1ea1d7eb1b", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/views/credits.js:5"}, "properties": {"repobilityId": "d573c49d3069db40", "scanner": "scanner-primary", "fingerprint": "e99edb1ea1d7eb1b", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "js/views/credits.js"}, "region": {"startLine": 5}}}]}, {"ruleId": "scanner-22f6efbef0738c46", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/views/barcode.js:13"}, "properties": {"repobilityId": "0814ea0f3ba23cec", "scanner": "scanner-primary", "fingerprint": "22f6efbef0738c46", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "js/views/barcode.js"}, "region": {"startLine": 13}}}]}, {"ruleId": "scanner-48bfba3f3157d461", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in marketing/studio/index.html:183"}, "properties": {"repobilityId": "e06dfe16ff47b695", "scanner": "scanner-primary", "fingerprint": "48bfba3f3157d461", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "marketing/studio/index.html"}, "region": {"startLine": 183}}}]}, {"ruleId": "scanner-25041870e279fdf4", "level": "warning", "message": {"text": "Insecure pattern 'cors_wildcard' in supabase/functions/push-reminder/index.ts:44"}, "properties": {"repobilityId": "cfe13d6cb60c74cf", "scanner": "scanner-primary", "fingerprint": "25041870e279fdf4", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "cors_wildcard"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "supabase/functions/push-reminder/index.ts"}, "region": {"startLine": 44}}}]}, {"ruleId": "scanner-4601e3ad3bb28677", "level": "warning", "message": {"text": "No CI/CD pipelines detected"}, "properties": {"repobilityId": "c3ee439bce2bc51e", "scanner": "scanner-primary", "fingerprint": "4601e3ad3bb28677", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-d6a16efb851d34f2", "level": "note", "message": {"text": "Very large file: js/views/dashboard.js (2310 lines)"}, "properties": {"repobilityId": "c8fa502354621d2a", "scanner": "scanner-primary", "fingerprint": "d6a16efb851d34f2", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-54d324357700f177", "level": "note", "message": {"text": "Very large file: js/views/cash_register.js (985 lines)"}, "properties": {"repobilityId": "a619cd23cbaff7ae", "scanner": "scanner-primary", "fingerprint": "54d324357700f177", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-b7434c9f0d3c7c2b", "level": "note", "message": {"text": "Very large file: js/views/purchase_invoices.js (2656 lines)"}, "properties": {"repobilityId": "95e089e1f0cd3d61", "scanner": "scanner-primary", "fingerprint": "b7434c9f0d3c7c2b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-6893a6c8b0861585", "level": "warning", "message": {"text": "Very low test-to-source ratio"}, "properties": {"repobilityId": "54a7de3f06314bf0", "scanner": "scanner-primary", "fingerprint": "6893a6c8b0861585", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["tests", "coverage"]}}, {"ruleId": "scanner-141b30a41e03817b", "level": "note", "message": {"text": "No license file detected"}, "properties": {"repobilityId": "1b5c4fe98664a399", "scanner": "scanner-primary", "fingerprint": "141b30a41e03817b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["license", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-01f96f71d9907a8c", "level": "note", "message": {"text": "README lacks setup or run instructions"}, "properties": {"repobilityId": "596e78c3f773c8e2", "scanner": "scanner-primary", "fingerprint": "01f96f71d9907a8c", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["docs", "readme", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-b3ed68815bca2f8c", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: package.json"}, "properties": {"repobilityId": "7edae0550c126386", "scanner": "scanner-primary", "fingerprint": "b3ed68815bca2f8c", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "ee06aefc43b683c8", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-72b2a6250083a784", "level": "warning", "message": {"text": "Placeholder or mock-heavy implementation detected"}, "properties": {"repobilityId": "24961586411725f5", "scanner": "scanner-primary", "fingerprint": "72b2a6250083a784", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "incomplete", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "8f5803615cf5a082", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-b9088664ace7f748", "level": "warning", "message": {"text": "Composite production-readiness gap"}, "properties": {"repobilityId": "ed2e6adf76b1dbaa", "scanner": "scanner-primary", "fingerprint": "b9088664ace7f748", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["production-readiness", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-749d4bc1bd66df5f", "level": "warning", "message": {"text": "Agent instructions exist but release-hardening basics are missing"}, "properties": {"repobilityId": "bce3cb520f707f67", "scanner": "scanner-primary", "fingerprint": "749d4bc1bd66df5f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "05bcf418cb614a8a", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "187eee097a767665", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-4cf9d22e31691012", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 service-worker.js:47"}, "properties": {"repobilityId": "ae41ddbf57d569cb", "scanner": "scanner-primary", "fingerprint": "4cf9d22e31691012", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-6994175b5e68c1ec", "level": "none", "message": {"text": "Commented-code block (9 lines) in api/notify.js:1"}, "properties": {"repobilityId": "78e0308a6d2df62f", "scanner": "scanner-primary", "fingerprint": "6994175b5e68c1ec", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-db9bb5c24da95be7", "level": "none", "message": {"text": "Commented-code block (6 lines) in js/utils.js:298"}, "properties": {"repobilityId": "d0a2d4aba1c6f00c", "scanner": "scanner-primary", "fingerprint": "db9bb5c24da95be7", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-7734a094ac1feb1b", "level": "none", "message": {"text": "Commented-code block (5 lines) in js/confirm-dialog.js:248"}, "properties": {"repobilityId": "e8452e580a8dcf7b", "scanner": "scanner-primary", "fingerprint": "7734a094ac1feb1b", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-59f1c11a79810ee7", "level": "none", "message": {"text": "Commented-code block (8 lines) in js/transaction-manager.js:8"}, "properties": {"repobilityId": "1f49e490e86ff37b", "scanner": "scanner-primary", "fingerprint": "59f1c11a79810ee7", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-0260ccf46e2776b8", "level": "note", "message": {"text": "Legacy-named symbol `sii_limpieza_manuales_v1` in js/sii_api.js:340"}, "properties": {"repobilityId": "c72f3cfa75df0204", "scanner": "scanner-primary", "fingerprint": "0260ccf46e2776b8", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-2410c14830df2f03", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 js/sii_api.js:125"}, "properties": {"repobilityId": "9e45eb812f28698d", "scanner": "scanner-primary", "fingerprint": "2410c14830df2f03", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-42b6f28f1327c67a", "level": "none", "message": {"text": "Commented-code block (5 lines) in js/views/dashboard.js:1744"}, "properties": {"repobilityId": "3f2541041afee5d1", "scanner": "scanner-primary", "fingerprint": "42b6f28f1327c67a", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-396110bb43fd69d2", "level": "error", "message": {"text": "Blocking `time.sleep(...)` inside `async def publish` \u2014 marketing/studio/server.py:459"}, "properties": {"repobilityId": "155a6c39d31c4db8", "scanner": "scanner-primary", "fingerprint": "396110bb43fd69d2", "layer": "quality", "severity": "high", "confidence": 1.0, "tags": ["integrity", "sync-io-in-async", "performance"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "marketing/studio/server.py"}, "region": {"startLine": 459}}}]}, {"ruleId": "scanner-94cad8c668a0e2e2", "level": "note", "message": {"text": "Legacy-named symbol `price_old` in marketing/tools/templates.py:147"}, "properties": {"repobilityId": "271aa4deab1cae95", "scanner": "scanner-primary", "fingerprint": "94cad8c668a0e2e2", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-b5910fc39029b5c1", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 marketing/tools/audio.py:196"}, "properties": {"repobilityId": "2b0a3c94d13df96f", "scanner": "scanner-primary", "fingerprint": "b5910fc39029b5c1", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-44294757e71f254f", "level": "note", "message": {"text": "Legacy-named symbol `price_old` in marketing/tools/make_video.py:288"}, "properties": {"repobilityId": "ce9c338d16cb1004", "scanner": "scanner-primary", "fingerprint": "44294757e71f254f", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-6608e3fdef25eb51", "level": "none", "message": {"text": "Commented-code block (7 lines) in supabase/functions/push-reminder/index.ts:6"}, "properties": {"repobilityId": "13c6e54bd542d42e", "scanner": "scanner-primary", "fingerprint": "6608e3fdef25eb51", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-2eafc3188c36bb02", "level": "none", "message": {"text": "3 env vars used in code but missing from .env.example"}, "properties": {"repobilityId": "bd934ba112b02ffa", "scanner": "scanner-primary", "fingerprint": "2eafc3188c36bb02", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "config-drift"]}}, {"ruleId": "scanner-9a2548af59cd32e3", "level": "error", "message": {"text": "FastAPI POST `upload` without auth dependency \u2014 marketing/studio/server.py:79"}, "properties": {"repobilityId": "071feb4423b328d5", "scanner": "scanner-primary", "fingerprint": "9a2548af59cd32e3", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "marketing/studio/server.py"}, "region": {"startLine": 79}}}]}, {"ruleId": "scanner-eff356b496a761d2", "level": "error", "message": {"text": "FastAPI POST `generate` without auth dependency \u2014 marketing/studio/server.py:107"}, "properties": {"repobilityId": "8b213553bc8c3a3e", "scanner": "scanner-primary", "fingerprint": "eff356b496a761d2", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "marketing/studio/server.py"}, "region": {"startLine": 107}}}]}, {"ruleId": "scanner-0dad764143f17a50", "level": "error", "message": {"text": "FastAPI POST `caption` without auth dependency \u2014 marketing/studio/server.py:250"}, "properties": {"repobilityId": "84a34d9cfc66f5f9", "scanner": "scanner-primary", "fingerprint": "0dad764143f17a50", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "marketing/studio/server.py"}, "region": {"startLine": 250}}}]}, {"ruleId": "scanner-438b0ac565f60dc6", "level": "error", "message": {"text": "FastAPI POST `schedule` without auth dependency \u2014 marketing/studio/server.py:274"}, "properties": {"repobilityId": "aa0a5c34de160d92", "scanner": "scanner-primary", "fingerprint": "438b0ac565f60dc6", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "marketing/studio/server.py"}, "region": {"startLine": 274}}}]}, {"ruleId": "scanner-08ab0a7a9dcfc728", "level": "error", "message": {"text": "FastAPI POST `autoschedule` without auth dependency \u2014 marketing/studio/server.py:289"}, "properties": {"repobilityId": "c1012d566c55583d", "scanner": "scanner-primary", "fingerprint": "08ab0a7a9dcfc728", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "marketing/studio/server.py"}, "region": {"startLine": 289}}}]}, {"ruleId": "scanner-eaa431cf48dfa5bf", "level": "error", "message": {"text": "FastAPI POST `publish` without auth dependency \u2014 marketing/studio/server.py:427"}, "properties": {"repobilityId": "94f498cc6cc284d2", "scanner": "scanner-primary", "fingerprint": "eaa431cf48dfa5bf", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "marketing/studio/server.py"}, "region": {"startLine": 427}}}]}, {"ruleId": "scanner-8bff4e9c3dc5f7da", "level": "error", "message": {"text": "FastAPI POST `delete` without auth dependency \u2014 marketing/studio/server.py:484"}, "properties": {"repobilityId": "47edd035416e3d33", "scanner": "scanner-primary", "fingerprint": "8bff4e9c3dc5f7da", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "marketing/studio/server.py"}, "region": {"startLine": 484}}}]}, {"ruleId": "scanner-5baa8971ebe192a1", "level": "note", "message": {"text": "Unused endpoint: GET /"}, "properties": {"repobilityId": "151f27747b1d2bb7", "scanner": "scanner-primary", "fingerprint": "5baa8971ebe192a1", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-27652a11ba620012", "level": "note", "message": {"text": "Unused endpoint: GET /api/state"}, "properties": {"repobilityId": "570ed08b9802bab0", "scanner": "scanner-primary", "fingerprint": "27652a11ba620012", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-536fc60d1287e634", "level": "note", "message": {"text": "Unused endpoint: POST /api/upload"}, "properties": {"repobilityId": "2ed28eea2c2879a9", "scanner": "scanner-primary", "fingerprint": "536fc60d1287e634", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-093467ddc6e6a64d", "level": "note", "message": {"text": "Unused endpoint: POST /api/generate"}, "properties": {"repobilityId": "b3e740f6c607a51f", "scanner": "scanner-primary", "fingerprint": "093467ddc6e6a64d", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-21f06e90f2830109", "level": "note", "message": {"text": "Unused endpoint: POST /api/caption"}, "properties": {"repobilityId": "2a0cc2a13c0e9b88", "scanner": "scanner-primary", "fingerprint": "21f06e90f2830109", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-d97aa2c9d6ad08fc", "level": "note", "message": {"text": "Unused endpoint: POST /api/schedule"}, "properties": {"repobilityId": "261ab55a90b388d5", "scanner": "scanner-primary", "fingerprint": "d97aa2c9d6ad08fc", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-5878c5fb0831211f", "level": "note", "message": {"text": "Unused endpoint: POST /api/autoschedule"}, "properties": {"repobilityId": "be45a2226b7302f4", "scanner": "scanner-primary", "fingerprint": "5878c5fb0831211f", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-5f3412431f4279be", "level": "note", "message": {"text": "Unused endpoint: GET /api/export.csv"}, "properties": {"repobilityId": "44d96caa25975064", "scanner": "scanner-primary", "fingerprint": "5f3412431f4279be", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-af8eb998ca73e836", "level": "note", "message": {"text": "Unused endpoint: GET /api/fb-connect"}, "properties": {"repobilityId": "7c3de93fdd482774", "scanner": "scanner-primary", "fingerprint": "af8eb998ca73e836", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-be054816c7b1ce4d", "level": "note", "message": {"text": "Unused endpoint: GET /api/fb-callback"}, "properties": {"repobilityId": "c449e1d57f9390b0", "scanner": "scanner-primary", "fingerprint": "be054816c7b1ce4d", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-5edf10039a749255", "level": "note", "message": {"text": "Unused endpoint: GET /api/ig-status"}, "properties": {"repobilityId": "2a819e921dbb9af7", "scanner": "scanner-primary", "fingerprint": "5edf10039a749255", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-b1781960ab88cbc8", "level": "note", "message": {"text": "Unused endpoint: POST /api/publish"}, "properties": {"repobilityId": "0cf4b1ee5d54d9d2", "scanner": "scanner-primary", "fingerprint": "b1781960ab88cbc8", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-05ad17fe4becd2dc", "level": "note", "message": {"text": "Unused endpoint: GET /api/ig-id"}, "properties": {"repobilityId": "8e93136b8593c856", "scanner": "scanner-primary", "fingerprint": "05ad17fe4becd2dc", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-83c287ea4fc96de7", "level": "note", "message": {"text": "Unused endpoint: POST /api/delete"}, "properties": {"repobilityId": "5f7c44d6b6682c9a", "scanner": "scanner-primary", "fingerprint": "83c287ea4fc96de7", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}]}]}