{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "AGT016", "name": "Codex session log reader may expose prompts or tool-call content", "shortDescription": {"text": "Codex session log reader may expose prompts or tool-call content"}, "fullDescription": {"text": "Parse only usage metadata by default. Redact prompts, tool arguments, file paths, and message content before storage, telemetry, export, screenshots, or support bundles."}, "properties": {"scanner": "repobility-agent-runtime", "category": "quality", "severity": "medium", "confidence": 0.73, "cwe": "", "owasp": ""}}, {"id": "SEC031", "name": "[SEC031] Catastrophic Backtracking Regex (ReDoS): Regex contains nested quantifiers like `(a+)+` or quantified alternati", "shortDescription": {"text": "[SEC031] Catastrophic Backtracking Regex (ReDoS): Regex contains nested quantifiers like `(a+)+` or quantified alternation with overlapping branches. On adversarial input these patterns exhibit exponential backtracking, freezing the process"}, "fullDescription": {"text": "Three options, pick one:\n  1. Rewrite the pattern to avoid nested quantifiers. E.g. `(a+)+` is      functionally equivalent to `a+` for matching purposes.\n  2. Use Google's re2 (`pip install google-re2`): linear-time, drop-in      replacement for `re` for most use cases.\n  3. Set a hard timeout: `signal.alarm(1)` before regex eval.\nTest patterns against `safe-regex` or `redos-detector` before shipping."}, "properties": {"scanner": "repobility-threat-engine", "category": "redos", "severity": "medium", "confidence": 1.0, "cwe": "", "owasp": ""}}, {"id": "SEC041", "name": "[SEC041] Tabnabbing \u2014 target=\"_blank\" without rel=\"noopener noreferrer\": <a target=\"_blank\"> without rel=\"noopener noref", "shortDescription": {"text": "[SEC041] Tabnabbing \u2014 target=\"_blank\" without rel=\"noopener noreferrer\": <a target=\"_blank\"> without rel=\"noopener noreferrer\" leaks window.opener to the opened page. The opened page can then run window.opener.location = 'phishing-site' and"}, "fullDescription": {"text": "Add rel=\"noopener noreferrer\" to every <a target=\"_blank\">:\n  <a href=\"...\" target=\"_blank\" rel=\"noopener noreferrer\">link</a>\nFor dynamically generated links from JS, set rel on the element before appending. Even safe-looking subdomains should harden \u2014 costs nothing."}, "properties": {"scanner": "repobility-threat-engine", "category": "security", "severity": "medium", "confidence": 1.0, "cwe": "", "owasp": ""}}, {"id": "ERR002", "name": "[ERR002] Empty Catch Block: Empty catch blocks hide errors.", "shortDescription": {"text": "[ERR002] Empty Catch Block: Empty catch blocks hide errors."}, "fullDescription": {"text": "Log the error or rethrow it. Use console.error() at minimum."}, "properties": {"scanner": "repobility-threat-engine", "category": "error_handling", "severity": "medium", "confidence": 1.0, "cwe": "", "owasp": ""}}, {"id": "SEC087", "name": "[SEC087] JS: weak Math.random for crypto: Math.random() is not cryptographically secure; using it for tokens/keys/nonces", "shortDescription": {"text": "[SEC087] JS: weak Math.random for crypto: Math.random() is not cryptographically secure; using it for tokens/keys/nonces is predictable. Ported from gosec G404 / eslint detect-pseudoRandomBytes concept (Apache-2.0)."}, "fullDescription": {"text": "Use `crypto.randomBytes(32).toString('hex')` (Node) or `crypto.getRandomValues()` (browser)."}, "properties": {"scanner": "repobility-threat-engine", "category": "quality", "severity": "medium", "confidence": 1.0, "cwe": "", "owasp": ""}}, {"id": "SEC045", "name": "[SEC045] eval()/exec() on stored or user-supplied data: eval() and exec() on data \u2014 even admin-stored data \u2014 is a latera", "shortDescription": {"text": "[SEC045] eval()/exec() on stored or user-supplied data: eval() and exec() on data \u2014 even admin-stored data \u2014 is a lateral-movement vector after any one credential compromise. Sandboxes (__builtins__ cleared) are escapable: attackers use obj"}, "fullDescription": {"text": "For literal data structures: use ast.literal_eval(text) \u2014 only parses literals, raises on code.\nFor formula evaluation: use asteval or simpleeval (purpose-built sandboxes with allow-lists).\nFor Odoo: use odoo.tools.safe_eval(expr, locals_dict, mode='exec').\nIf you genuinely need to execute admin-stored code: require explicit super-admin permission AND log every execution with a stack trace."}, "properties": {"scanner": "repobility-threat-engine", "category": "injection", "severity": "medium", "confidence": 1.0, "cwe": "", "owasp": ""}}, {"id": "SEC132", "name": "[SEC132] String concat where the language has interpolation (AI style drift): String built by concatenation where the la", "shortDescription": {"text": "[SEC132] String concat where the language has interpolation (AI style drift): String built by concatenation where the language has cleaner interpolation (Python f-strings since 3.6, JS template literals since ES6). Not a vulnerability on it"}, "fullDescription": {"text": "Python: `f\"prefix {var} suffix\"`. JS/TS: `` `prefix ${var} suffix` ``. Add a lint rule (pyupgrade UP032, eslint prefer-template) so future PRs catch this automatically."}, "properties": {"scanner": "repobility-threat-engine", "category": "quality", "severity": "low", "confidence": 1.0, "cwe": "", "owasp": ""}}, {"id": "AIC003", "name": "Duplicated implementation block across source files", "shortDescription": {"text": "Duplicated implementation block across source files"}, "fullDescription": {"text": "Extract the shared behavior into one function/module or delete the inactive duplicate after proving which path is used."}, "properties": {"scanner": "repobility-ai-code-hygiene", "category": "quality", "severity": "low", "confidence": 0.86, "cwe": "", "owasp": ""}}, {"id": "MINED052", "name": "[MINED052] Ts Any Typed: : any used as type annotation. Defeats TypeScript type safety.", "shortDescription": {"text": "[MINED052] Ts Any Typed: : any used as type annotation. Defeats TypeScript type safety."}, "fullDescription": {"text": "Review and fix per the pattern semantics. See CWE-704 /  for context."}, "properties": {"scanner": "repobility-threat-engine", "category": "quality", "severity": "info", "confidence": 1.0, "cwe": "", "owasp": ""}}, {"id": "MINED058", "name": "[MINED058] React Dangerously Set Html: dangerouslySetInnerHTML bypasses Reacts JSX escaping. Pair with DOMPurify or neve", "shortDescription": {"text": "[MINED058] React Dangerously Set Html: dangerouslySetInnerHTML bypasses Reacts JSX escaping. Pair with DOMPurify or never use with user data."}, "fullDescription": {"text": "Review and fix per the pattern semantics. See CWE-79 / A03:2021 for context."}, "properties": {"scanner": "repobility-threat-engine", "category": "quality", "severity": "info", "confidence": 1.0, "cwe": "", "owasp": ""}}, {"id": "MINED049", "name": "[MINED049] Print Pii: Logging password/token/email/ssn directly to stdout.", "shortDescription": {"text": "[MINED049] Print Pii: Logging password/token/email/ssn directly to stdout."}, "fullDescription": {"text": "Review and fix per the pattern semantics. See CWE-532 / A09:2021 for context."}, "properties": {"scanner": "repobility-threat-engine", "category": "quality", "severity": "info", "confidence": 1.0, "cwe": "", "owasp": ""}}, {"id": "MINED027", "name": "[MINED027] React State Array Mutation (and 1 more): Same pattern found in 1 additional files. Review if needed.", "shortDescription": {"text": "[MINED027] React State Array Mutation (and 1 more): Same pattern found in 1 additional files. Review if needed."}, "fullDescription": {"text": "Review and fix per the pattern semantics. See CWE-682 /  for context."}, "properties": {"scanner": "repobility-threat-engine", "category": "quality", "severity": "info", "confidence": 0.2, "cwe": "", "owasp": ""}}, {"id": "MINED054", "name": "[MINED054] Ts As Any: Casting to any (as any) bypasses type checking entirely.", "shortDescription": {"text": "[MINED054] Ts As Any: Casting to any (as any) bypasses type checking entirely."}, "fullDescription": {"text": "Review and fix per the pattern semantics. See CWE-704 /  for context."}, "properties": {"scanner": "repobility-threat-engine", "category": "quality", "severity": "info", "confidence": 1.0, "cwe": "", "owasp": ""}}, {"id": "MINED043", "name": "[MINED043] Http Not Https (and 7 more): Same pattern found in 7 additional files. Review if needed.", "shortDescription": {"text": "[MINED043] Http Not Https (and 7 more): Same pattern found in 7 additional files. Review if needed."}, "fullDescription": {"text": "Review and fix per the pattern semantics. See CWE-319 / A02:2021 for context."}, "properties": {"scanner": "repobility-threat-engine", "category": "quality", "severity": "info", "confidence": 0.2, "cwe": "", "owasp": ""}}, {"id": "MINED045", "name": "[MINED045] Ts Non Null Assertion (and 45 more): Same pattern found in 45 additional files. Review if needed.", "shortDescription": {"text": "[MINED045] Ts Non Null Assertion (and 45 more): Same pattern found in 45 additional files. Review if needed."}, "fullDescription": {"text": "Review and fix per the pattern semantics. See CWE-476 /  for context."}, "properties": {"scanner": "repobility-threat-engine", "category": "quality", "severity": "info", "confidence": 0.2, "cwe": "", "owasp": ""}}, {"id": "SEC128", "name": "[SEC128] Async function without await \u2014 fire-and-forget Promise (AI mistake) (and 44 more): Same pattern found in 44 add", "shortDescription": {"text": "[SEC128] Async function without await \u2014 fire-and-forget Promise (AI mistake) (and 44 more): Same pattern found in 44 additional files. Review if needed."}, "fullDescription": {"text": "Add `await` before each async call, or chain with `.then`. If you intentionally want fire-and-forget, prefix with `void` (TS) or assign to `_` (Python with `asyncio.create_task`) to make the intent explicit and survive lint."}, "properties": {"scanner": "repobility-threat-engine", "category": "quality", "severity": "info", "confidence": 0.2, "cwe": "", "owasp": ""}}, {"id": "MINED044", "name": "[MINED044] Js Console Log Prod (and 18 more): Same pattern found in 18 additional files. Review if needed.", "shortDescription": {"text": "[MINED044] Js Console Log Prod (and 18 more): Same pattern found in 18 additional files. Review if needed."}, "fullDescription": {"text": "Review and fix per the pattern semantics. See CWE-532 /  for context."}, "properties": {"scanner": "repobility-threat-engine", "category": "quality", "severity": "info", "confidence": 0.2, "cwe": "", "owasp": ""}}, {"id": "SEC040", "name": "[SEC040] innerHTML XSS \u2014 template literal with server-supplied data (and 7 more): Same pattern found in 7 additional fil", "shortDescription": {"text": "[SEC040] innerHTML XSS \u2014 template literal with server-supplied data (and 7 more): Same pattern found in 7 additional files. Review if needed."}, "fullDescription": {"text": "For plain text: use el.textContent = data.value (auto-escapes).\nFor HTML you need to render: el.innerHTML = DOMPurify.sanitize(html).\nFor React/Vue/Svelte: stop using innerHTML; use the framework's binding.\nWhen data comes from CV/PDF parsers, sanitize at the parser boundary too."}, "properties": {"scanner": "repobility-threat-engine", "category": "xss", "severity": "info", "confidence": 0.2, "cwe": "", "owasp": ""}}, {"id": "SEC085", "name": "[SEC085] JS: child_process.exec with non-literal (and 26 more): Same pattern found in 26 additional files. Review if nee", "shortDescription": {"text": "[SEC085] JS: child_process.exec with non-literal (and 26 more): Same pattern found in 26 additional files. Review if needed."}, "fullDescription": {"text": "Use execFile / spawn with separate args array; never pass shell strings."}, "properties": {"scanner": "repobility-threat-engine", "category": "quality", "severity": "info", "confidence": 0.2, "cwe": "", "owasp": ""}}, {"id": "SEC118", "name": "[SEC118] UUIDv1 / UUIDv3 used for security-sensitive identifier (and 8 more): Same pattern found in 8 additional files. ", "shortDescription": {"text": "[SEC118] UUIDv1 / UUIDv3 used for security-sensitive identifier (and 8 more): Same pattern found in 8 additional files. Review if needed."}, "fullDescription": {"text": "Use `uuid.uuid4()` (random) or `secrets.token_urlsafe()` for tokens. In Go, use `uuid.NewRandom()` (google/uuid)."}, "properties": {"scanner": "repobility-threat-engine", "category": "crypto", "severity": "info", "confidence": 0.2, "cwe": "", "owasp": ""}}, {"id": "SEC114", "name": "[SEC114] path.join / Path() on user-controlled segment without containment check (and 5 more): Same pattern found in 5 a", "shortDescription": {"text": "[SEC114] path.join / Path() on user-controlled segment without containment check (and 5 more): Same pattern found in 5 additional files. Review if needed."}, "fullDescription": {"text": "After joining, re-check containment: `if !strings.HasPrefix(filepath.Clean(joined), filepath.Clean(baseDir)+string(os.PathSeparator)) { error }`. In Node: `path.resolve(base, x); if (!resolved.startsWith(base + path.sep)) throw`."}, "properties": {"scanner": "repobility-threat-engine", "category": "path_traversal", "severity": "info", "confidence": 0.2, "cwe": "", "owasp": ""}}, {"id": "SEC029", "name": "[SEC029] Server-Side Request Forgery (SSRF) \u2014 outbound HTTP from user input (and 61 more): Same pattern found in 61 addi", "shortDescription": {"text": "[SEC029] Server-Side Request Forgery (SSRF) \u2014 outbound HTTP from user input (and 61 more): Same pattern found in 61 additional files. Review if needed."}, "fullDescription": {"text": "Validate the URL against an allowlist BEFORE fetching:\n  ALLOWED = {'images.example.com', 'cdn.example.com'}\n  host = urlparse(url).hostname\n  if host not in ALLOWED: abort(400)\nOr use a server-side proxy (Imgproxy / serve-files-only-from-S3) that isolates outbound network access from the request handler.\nBlock private CIDRs explicitly: 10/8, 172.16/12, 192.168/16, 169.254/16."}, "properties": {"scanner": "repobility-threat-engine", "category": "ssrf", "severity": "info", "confidence": 0.2, "cwe": "", "owasp": ""}}, {"id": "JRN009", "name": "Secret-like setting is echoed into a password input value", "shortDescription": {"text": "Secret-like setting is echoed into a password input value"}, "fullDescription": {"text": "Never prefill secret fields with stored values. Show a masked status such as configured/not configured, require explicit rotation to replace the value, and return the raw key only once at creation time."}, "properties": {"scanner": "repobility-journey-contract", "category": "auth", "severity": "high", "confidence": 0.83, "cwe": "", "owasp": ""}}, {"id": "SEC013", "name": "[SEC013] Path Traversal \u2014 User Input in File Path: User-controlled input used in file path without sanitization. Allows ", "shortDescription": {"text": "[SEC013] Path Traversal \u2014 User Input in File Path: User-controlled input used in file path without sanitization. Allows reading arbitrary files."}, "fullDescription": {"text": "Use os.path.realpath() and verify the path starts with your expected base directory. Use secure_filename() for uploads."}, "properties": {"scanner": "repobility-threat-engine", "category": "path_traversal", "severity": "high", "confidence": 0.8, "cwe": "", "owasp": ""}}, {"id": "SEC033", "name": "[SEC033] Prototype Pollution \u2014 unfiltered merge of user object: Merging user-controlled object into a target without fil", "shortDescription": {"text": "[SEC033] Prototype Pollution \u2014 unfiltered merge of user object: Merging user-controlled object into a target without filtering `__proto__`/`constructor`/`prototype` keys lets attackers inject properties onto Object.prototype, affecting ever"}, "fullDescription": {"text": "Sanitize keys BEFORE merge:\n  function sanitize(obj) {\n    delete obj.__proto__;\n    delete obj.constructor;\n    delete obj.prototype;\n    return obj;\n  }\nOr use Object.create(null) for the target. Or use Map() for user-key-indexed data. Upgrade lodash >= 4.17.21 for partial mitigation."}, "properties": {"scanner": "repobility-threat-engine", "category": "prototype_pollution", "severity": "high", "confidence": 1.0, "cwe": "", "owasp": ""}}, {"id": "SEC083", "name": "[SEC083] JS: new RegExp() with non-literal: new RegExp(<variable>) \u2014 variable input can craft a ReDoS pattern. Ported fr", "shortDescription": {"text": "[SEC083] JS: new RegExp() with non-literal: new RegExp(<variable>) \u2014 variable input can craft a ReDoS pattern. Ported from eslint-plugin-security detect-non-literal-regexp (Apache-2.0)."}, "fullDescription": {"text": "Use a literal RegExp or whitelist-validate user input before constructing patterns."}, "properties": {"scanner": "repobility-threat-engine", "category": "quality", "severity": "high", "confidence": 1.0, "cwe": "", "owasp": ""}}, {"id": "SEC100", "name": "[SEC100] CORS permissive Access-Control-Allow-Origin: *: Permissive CORS policy (`*` origin) allows any website to make ", "shortDescription": {"text": "[SEC100] CORS permissive Access-Control-Allow-Origin: *: Permissive CORS policy (`*` origin) allows any website to make authenticated cross-origin requests. Especially dangerous when combined with `Access-Control-Allow-Credentials: true`."}, "fullDescription": {"text": "Allowlist specific origins. For dynamic per-request validation, validate against a known list and echo the origin back. Never combine wildcard origin with credentials."}, "properties": {"scanner": "repobility-threat-engine", "category": "quality", "severity": "high", "confidence": 1.0, "cwe": "", "owasp": ""}}, {"id": "SEC038", "name": "[SEC038] HTTP Request Smuggling Risk \u2014 TE/CL mismatch: HTTP Request Smuggling (HRS) abuses parser disagreement between f", "shortDescription": {"text": "[SEC038] HTTP Request Smuggling Risk \u2014 TE/CL mismatch: HTTP Request Smuggling (HRS) abuses parser disagreement between front-end and back-end servers about request boundaries when Transfer-Encoding and Content-Length both present. Attackers"}, "fullDescription": {"text": "Don't set Transfer-Encoding manually \u2014 let the framework. If you must:\n  1. Only set ONE of Transfer-Encoding or Content-Length per response.\n  2. Reject incoming requests with both headers (RFC 7230 \u00a73.3.3 #3).\n  3. Use a battle-tested HTTP server (nginx, envoy) as front-end; never      accept raw HTTP over the network.\n  4. For chunked-encoding handling, use the framework's built-in parser      rather than rolling your own."}, "properties": {"scanner": "repobility-threat-engine", "category": "injection", "severity": "high", "confidence": 1.0, "cwe": "", "owasp": ""}}, {"id": "MINED019", "name": "[MINED019] Ssti Jinja From String: jinja2.Environment().from_string(user_input) \u2014 full RCE via templates.", "shortDescription": {"text": "[MINED019] Ssti Jinja From String: jinja2.Environment().from_string(user_input) \u2014 full RCE via templates."}, "fullDescription": {"text": "Review and fix per the pattern semantics. See CWE-94 / A03:2021 for context."}, "properties": {"scanner": "repobility-threat-engine", "category": "quality", "severity": "critical", "confidence": 1.0, "cwe": "", "owasp": ""}}]}}, "automationDetails": {"id": "repobility/519"}, "properties": {"repository": "pingdotgg/t3code", "repoUrl": "https://github.com/pingdotgg/t3code", "branch": "main"}, "results": [{"ruleId": "AGT016", "level": "warning", "message": {"text": "Codex session log reader may expose prompts or tool-call content"}, "properties": {"repobilityId": 30422, "scanner": "repobility-agent-runtime", "fingerprint": "a9504b03b4b0f5e18c31214900b6d3690aa79e3805b05d737d00d0e1bd4a8c71", "category": "quality", "severity": "medium", "confidence": 0.73, "triageState": "open", "verdict": "likely", "isResolved": false, "reason": "File reads Codex session JSONL or usage logs and references prompt/message/tool content without visible redaction controls.", "evidence": {"rule_id": "AGT016", "scanner": "repobility-agent-runtime", "references": [], "correlation_key": "fp|a9504b03b4b0f5e18c31214900b6d3690aa79e3805b05d737d00d0e1bd4a8c71"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/server/src/provider/Layers/CodexAdapter.ts"}, "region": {"startLine": 2}}}]}, {"ruleId": "SEC031", "level": "warning", "message": {"text": "[SEC031] Catastrophic Backtracking Regex (ReDoS): Regex contains nested quantifiers like `(a+)+` or quantified alternation with overlapping branches. On adversarial input these patterns exhibit exponential backtracking, freezing the process. CWE-1333. Real CVEs: CVE-2017-16129 (minimatch), CVE-2021-3807 (ansi-regex), and dozens more."}, "properties": {"repobilityId": 30407, "scanner": "repobility-threat-engine", "fingerprint": "b8b92f98a0c45624aa1aee6c5854e7822a4ee3f796009f6c9d54dad57d0f4d69", "category": "redos", "severity": "medium", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": "new RegExp(`^${WORKTREE_BRANCH_PREFIX}\\\\/[0-9a-f]{8}$`);\n\n/**\n * Sanitize an arbitrary string into a", "reason": "Pattern matched with no mitigating context found", "rule_id": "SEC031", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "fp|b8b92f98a0c45624aa1aee6c5854e7822a4ee3f796009f6c9d54dad57d0f4d69"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/shared/src/git.ts"}, "region": {"startLine": 14}}}]}, {"ruleId": "SEC041", "level": "warning", "message": {"text": "[SEC041] Tabnabbing \u2014 target=\"_blank\" without rel=\"noopener noreferrer\": <a target=\"_blank\"> without rel=\"noopener noreferrer\" leaks window.opener to the opened page. The opened page can then run window.opener.location = 'phishing-site' and the parent tab quietly navigates to attacker-controlled content (reverse tabnabbing). OWASP-classic; modern browsers default rel='noopener' for new windows but explicit attribute is still required for compatibility."}, "properties": {"repobilityId": 30406, "scanner": "repobility-threat-engine", "fingerprint": "e018fffd42a8a8a12effc706ad8f239afac91f2a16e1d077dc7ea9e341a4413a", "category": "security", "severity": "medium", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": "window.open(url, \"_blank\", \"noopener,noreferrer\")", "reason": "Pattern matched with no mitigating context found", "rule_id": "SEC041", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "code|security|apps/web/src/localapi.ts|63|sec041"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/web/src/localApi.ts"}, "region": {"startLine": 63}}}]}, {"ruleId": "ERR002", "level": "warning", "message": {"text": "[ERR002] Empty Catch Block: Empty catch blocks hide errors."}, "properties": {"repobilityId": 30405, "scanner": "repobility-threat-engine", "fingerprint": "1db59275c5a6b63889590f65475c48d1b4c0f4031e886fb651623b2fb8063bc7", "category": "error_handling", "severity": "medium", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": ".catch(() => {})", "reason": "Pattern matched with no mitigating context found", "rule_id": "ERR002", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "fp|1db59275c5a6b63889590f65475c48d1b4c0f4031e886fb651623b2fb8063bc7"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/web/src/components/settings/SettingsPanels.browser.tsx"}, "region": {"startLine": 491}}}]}, {"ruleId": "ERR002", "level": "warning", "message": {"text": "[ERR002] Empty Catch Block: Empty catch blocks hide errors."}, "properties": {"repobilityId": 30404, "scanner": "repobility-threat-engine", "fingerprint": "3826d81849a69f22d5c8346bed68733e5017bc35bc177809bd72e76752ca2ce3", "category": "error_handling", "severity": "medium", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": ".catch(() => {})", "reason": "Pattern matched with no mitigating context found", "rule_id": "ERR002", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "fp|3826d81849a69f22d5c8346bed68733e5017bc35bc177809bd72e76752ca2ce3"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/web/src/components/KeybindingsToast.browser.tsx"}, "region": {"startLine": 596}}}]}, {"ruleId": "SEC087", "level": "warning", "message": {"text": "[SEC087] JS: weak Math.random for crypto: Math.random() is not cryptographically secure; using it for tokens/keys/nonces is predictable. Ported from gosec G404 / eslint detect-pseudoRandomBytes concept (Apache-2.0)."}, "properties": {"repobilityId": 30403, "scanner": "repobility-threat-engine", "fingerprint": "c1e40f428b6b1614caf20aaa3e17f633b7f250703cd8f98f5955481ee970794c", "category": "quality", "severity": "medium", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": "Math.random() * 40) + 50}%`;\n  }, []);\n\n  return (\n    <div", "reason": "Pattern matched with no mitigating context found", "rule_id": "SEC087", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "fp|c1e40f428b6b1614caf20aaa3e17f633b7f250703cd8f98f5955481ee970794c"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/web/src/components/ui/sidebar.tsx"}, "region": {"startLine": 894}}}]}, {"ruleId": "SEC087", "level": "warning", "message": {"text": "[SEC087] JS: weak Math.random for crypto: Math.random() is not cryptographically secure; using it for tokens/keys/nonces is predictable. Ported from gosec G404 / eslint detect-pseudoRandomBytes concept (Apache-2.0)."}, "properties": {"repobilityId": 30402, "scanner": "repobility-threat-engine", "fingerprint": "09b64d4213cc6978eeac3a585535df07d34845360dacf830d6b4ef3e41738fcc", "category": "quality", "severity": "medium", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": "KEY = `composer-editor-${Math.random(", "reason": "Pattern matched with no mitigating context found", "rule_id": "SEC087", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "fp|09b64d4213cc6978eeac3a585535df07d34845360dacf830d6b4ef3e41738fcc"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/web/src/components/ComposerPromptEditor.tsx"}, "region": {"startLine": 78}}}]}, {"ruleId": "SEC045", "level": "warning", "message": {"text": "[SEC045] eval()/exec() on stored or user-supplied data: eval() and exec() on data \u2014 even admin-stored data \u2014 is a lateral-movement vector after any one credential compromise. Sandboxes (__builtins__ cleared) are escapable: attackers use object introspection (().__class__.__mro__[-1].__subclasses__()) to reach os.system. CWE-95 (eval injection)."}, "properties": {"repobilityId": 30386, "scanner": "repobility-threat-engine", "fingerprint": "25e0bb3ae2f586291e051c19839684cfd4020a80b6b275b4027d80c25167c4f8", "category": "injection", "severity": "medium", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": ".exec(", "reason": "Pattern matched with no mitigating context found", "rule_id": "SEC045", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "code|injection|token|153|sec045"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/server/src/git/GitManager.ts"}, "region": {"startLine": 153}}}]}, {"ruleId": "SEC045", "level": "warning", "message": {"text": "[SEC045] eval()/exec() on stored or user-supplied data: eval() and exec() on data \u2014 even admin-stored data \u2014 is a lateral-movement vector after any one credential compromise. Sandboxes (__builtins__ cleared) are escapable: attackers use object introspection (().__class__.__mro__[-1].__subclasses__()) to reach os.system. CWE-95 (eval injection)."}, "properties": {"repobilityId": 30385, "scanner": "repobility-threat-engine", "fingerprint": "b176fb0ecff498ffaf97cc60f1075cf10a3c70486f3a254ea40f2ffea508835a", "category": "injection", "severity": "medium", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": ".exec(", "reason": "Pattern matched with no mitigating context found", "rule_id": "SEC045", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "code|injection|token|85|sec045"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/server/src/diagnostics/ProcessDiagnostics.ts"}, "region": {"startLine": 85}}}]}, {"ruleId": "SEC045", "level": "warning", "message": {"text": "[SEC045] eval()/exec() on stored or user-supplied data: eval() and exec() on data \u2014 even admin-stored data \u2014 is a lateral-movement vector after any one credential compromise. Sandboxes (__builtins__ cleared) are escapable: attackers use object introspection (().__class__.__mro__[-1].__subclasses__()) to reach os.system. CWE-95 (eval injection)."}, "properties": {"repobilityId": 30384, "scanner": "repobility-threat-engine", "fingerprint": "2d69709c63f3ae3b07fb35ba0ae436408263556211a3f9f140338fafc8214fed", "category": "injection", "severity": "medium", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": ".exec(", "reason": "Pattern matched with no mitigating context found", "rule_id": "SEC045", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "code|injection|token|410|sec045"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/server/src/cli/config.ts"}, "region": {"startLine": 410}}}]}, {"ruleId": "SEC132", "level": "note", "message": {"text": "[SEC132] String concat where the language has interpolation (AI style drift): String built by concatenation where the language has cleaner interpolation (Python f-strings since 3.6, JS template literals since ES6). Not a vulnerability on its own, but a style signature of cross-language AI rewrites \u2014 the model wrote idiomatic Java/C# and then translated mechanically. When this style appears in only *some* files of a repo, it's a strong indicator of an AI-driven rewrite that needs a human review p"}, "properties": {"repobilityId": 30749, "scanner": "repobility-threat-engine", "fingerprint": "1a3965efd2732d10b738681c43b9e42bc03b1711c7e0e1667356c286332bc0b2", "category": "quality", "severity": "low", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": "\"Remote node \" + rawVersion + \" does not satisfy required range \"", "reason": "Pattern matched with no mitigating context found", "rule_id": "SEC132", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "fp|1a3965efd2732d10b738681c43b9e42bc03b1711c7e0e1667356c286332bc0b2"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/ssh/src/tunnel.ts"}, "region": {"startLine": 204}}}]}, {"ruleId": "AIC003", "level": "note", "message": {"text": "Duplicated implementation block across source files"}, "properties": {"repobilityId": 30421, "scanner": "repobility-ai-code-hygiene", "fingerprint": "b04b985176efeb0c8371232e52e3af34c01a0b585576dd830ce3490c335fd58b", "category": "quality", "severity": "low", "confidence": 0.86, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "A normalized source-code window appears in two different non-test files.", "evidence": {"lines": 12, "rule_id": "AIC003", "scanner": "repobility-ai-code-hygiene", "references": ["https://jscpd.dev/"], "duplicate_file": "apps/web/src/components/ui/autocomplete.tsx", "duplicate_line": 16, "correlation_key": "fp|b04b985176efeb0c8371232e52e3af34c01a0b585576dd830ce3490c335fd58b"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/web/src/components/ui/combobox.tsx"}, "region": {"startLine": 59}}}]}, {"ruleId": "AIC003", "level": "note", "message": {"text": "Duplicated implementation block across source files"}, "properties": {"repobilityId": 30420, "scanner": "repobility-ai-code-hygiene", "fingerprint": "f9d1077792afdf001d038fef726da86f757a4918b4101e3d76563f6947f5bfd9", "category": "quality", "severity": "low", "confidence": 0.86, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "A normalized source-code window appears in two different non-test files.", "evidence": {"lines": 12, "rule_id": "AIC003", "scanner": "repobility-ai-code-hygiene", "references": ["https://jscpd.dev/"], "duplicate_file": "apps/server/src/textGeneration/ClaudeTextGeneration.ts", "duplicate_line": 232, "correlation_key": "fp|f9d1077792afdf001d038fef726da86f757a4918b4101e3d76563f6947f5bfd9"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/server/src/textGeneration/OpenCodeTextGeneration.ts"}, "region": {"startLine": 332}}}]}, {"ruleId": "AIC003", "level": "note", "message": {"text": "Duplicated implementation block across source files"}, "properties": {"repobilityId": 30419, "scanner": "repobility-ai-code-hygiene", "fingerprint": "f397e1f4a6752fe71ff09f48bb6a796fd7252b35998ea12543ff21ec63b0f792", "category": "quality", "severity": "low", "confidence": 0.86, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "A normalized source-code window appears in two different non-test files.", "evidence": {"lines": 12, "rule_id": "AIC003", "scanner": "repobility-ai-code-hygiene", "references": ["https://jscpd.dev/"], "duplicate_file": "apps/server/src/textGeneration/CodexTextGeneration.ts", "duplicate_line": 368, "correlation_key": "fp|f397e1f4a6752fe71ff09f48bb6a796fd7252b35998ea12543ff21ec63b0f792"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/server/src/textGeneration/CursorTextGeneration.ts"}, "region": {"startLine": 237}}}]}, {"ruleId": "AIC003", "level": "note", "message": {"text": "Duplicated implementation block across source files"}, "properties": {"repobilityId": 30418, "scanner": "repobility-ai-code-hygiene", "fingerprint": "7c1c0714960092e6fa180d0e18907b89db26743ba09e60b98759ad21d4dfe387", "category": "quality", "severity": "low", "confidence": 0.86, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "A normalized source-code window appears in two different non-test files.", "evidence": {"lines": 12, "rule_id": "AIC003", "scanner": "repobility-ai-code-hygiene", "references": ["https://jscpd.dev/"], "duplicate_file": "apps/server/src/textGeneration/ClaudeTextGeneration.ts", "duplicate_line": 80, "correlation_key": "fp|7c1c0714960092e6fa180d0e18907b89db26743ba09e60b98759ad21d4dfe387"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/server/src/textGeneration/CursorTextGeneration.ts"}, "region": {"startLine": 56}}}]}, {"ruleId": "AIC003", "level": "note", "message": {"text": "Duplicated implementation block across source files"}, "properties": {"repobilityId": 30417, "scanner": "repobility-ai-code-hygiene", "fingerprint": "ee22bf77686bb9360f4e0e5eefd8f1ff36752666de0afdfe6c32043cc5a10729", "category": "quality", "severity": "low", "confidence": 0.86, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "A normalized source-code window appears in two different non-test files.", "evidence": {"lines": 12, "rule_id": "AIC003", "scanner": "repobility-ai-code-hygiene", "references": ["https://jscpd.dev/"], "duplicate_file": "apps/server/src/textGeneration/ClaudeTextGeneration.ts", "duplicate_line": 10, "correlation_key": "fp|ee22bf77686bb9360f4e0e5eefd8f1ff36752666de0afdfe6c32043cc5a10729"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/server/src/textGeneration/CodexTextGeneration.ts"}, "region": {"startLine": 21}}}]}, {"ruleId": "AIC003", "level": "note", "message": {"text": "Duplicated implementation block across source files"}, "properties": {"repobilityId": 30416, "scanner": "repobility-ai-code-hygiene", "fingerprint": "c4896e091b862083f3a7db992b5ff674b034e2549979ff6b138e5b2b81220dfa", "category": "quality", "severity": "low", "confidence": 0.86, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "A normalized source-code window appears in two different non-test files.", "evidence": {"lines": 12, "rule_id": "AIC003", "scanner": "repobility-ai-code-hygiene", "references": ["https://jscpd.dev/"], "duplicate_file": "apps/server/src/sourceControl/BitbucketSourceControlProvider.ts", "duplicate_line": 31, "correlation_key": "fp|c4896e091b862083f3a7db992b5ff674b034e2549979ff6b138e5b2b81220dfa"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/server/src/sourceControl/GitLabSourceControlProvider.ts"}, "region": {"startLine": 28}}}]}, {"ruleId": "AIC003", "level": "note", "message": {"text": "Duplicated implementation block across source files"}, "properties": {"repobilityId": 30415, "scanner": "repobility-ai-code-hygiene", "fingerprint": "e24ee601d8191d3bd177c913a3cc1cb3055438d2d55c44617ba241882208081d", "category": "quality", "severity": "low", "confidence": 0.86, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "A normalized source-code window appears in two different non-test files.", "evidence": {"lines": 12, "rule_id": "AIC003", "scanner": "repobility-ai-code-hygiene", "references": ["https://jscpd.dev/"], "duplicate_file": "apps/server/src/provider/acp/AcpCoreRuntimeEvents.ts", "duplicate_line": 40, "correlation_key": "fp|e24ee601d8191d3bd177c913a3cc1cb3055438d2d55c44617ba241882208081d"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/server/src/provider/acp/AcpRuntimeModel.ts"}, "region": {"startLine": 222}}}]}, {"ruleId": "AIC003", "level": "note", "message": {"text": "Duplicated implementation block across source files"}, "properties": {"repobilityId": 30414, "scanner": "repobility-ai-code-hygiene", "fingerprint": "6b86825f3cf85829f0c0123c60b06d3802ec99ec91879ef06fad0b67eb7b9f13", "category": "quality", "severity": "low", "confidence": 0.86, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "A normalized source-code window appears in two different non-test files.", "evidence": {"lines": 12, "rule_id": "AIC003", "scanner": "repobility-ai-code-hygiene", "references": ["https://jscpd.dev/"], "duplicate_file": "apps/server/src/provider/Drivers/CodexDriver.ts", "duplicate_line": 134, "correlation_key": "fp|6b86825f3cf85829f0c0123c60b06d3802ec99ec91879ef06fad0b67eb7b9f13"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/server/src/provider/Drivers/OpenCodeDriver.ts"}, "region": {"startLine": 140}}}]}, {"ruleId": "AIC003", "level": "note", "message": {"text": "Duplicated implementation block across source files"}, "properties": {"repobilityId": 30413, "scanner": "repobility-ai-code-hygiene", "fingerprint": "fc31661c53c7f49eae909de37fb3e738787bd1ebf239ea318b027d6d6045558c", "category": "quality", "severity": "low", "confidence": 0.86, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "A normalized source-code window appears in two different non-test files.", "evidence": {"lines": 12, "rule_id": "AIC003", "scanner": "repobility-ai-code-hygiene", "references": ["https://jscpd.dev/"], "duplicate_file": "apps/server/src/provider/Drivers/CursorDriver.ts", "duplicate_line": 80, "correlation_key": "fp|fc31661c53c7f49eae909de37fb3e738787bd1ebf239ea318b027d6d6045558c"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/server/src/provider/Drivers/OpenCodeDriver.ts"}, "region": {"startLine": 90}}}]}, {"ruleId": "AIC003", "level": "note", "message": {"text": "Duplicated implementation block across source files"}, "properties": {"repobilityId": 30412, "scanner": "repobility-ai-code-hygiene", "fingerprint": "4d677dade6aef40cdf441697c3ee7152b6091143eb41f70ebe0c1516ee2ef287", "category": "quality", "severity": "low", "confidence": 0.86, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "A normalized source-code window appears in two different non-test files.", "evidence": {"lines": 12, "rule_id": "AIC003", "scanner": "repobility-ai-code-hygiene", "references": ["https://jscpd.dev/"], "duplicate_file": "apps/server/src/provider/Drivers/ClaudeDriver.ts", "duplicate_line": 22, "correlation_key": "fp|4d677dade6aef40cdf441697c3ee7152b6091143eb41f70ebe0c1516ee2ef287"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/server/src/provider/Drivers/OpenCodeDriver.ts"}, "region": {"startLine": 21}}}]}, {"ruleId": "AIC003", "level": "note", "message": {"text": "Duplicated implementation block across source files"}, "properties": {"repobilityId": 30411, "scanner": "repobility-ai-code-hygiene", "fingerprint": "8be15b9ad62811882d64e80cb5e299eaa21a65b9483558d2dc6aa1902984579e", "category": "quality", "severity": "low", "confidence": 0.86, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "A normalized source-code window appears in two different non-test files.", "evidence": {"lines": 12, "rule_id": "AIC003", "scanner": "repobility-ai-code-hygiene", "references": ["https://jscpd.dev/"], "duplicate_file": "apps/server/src/provider/Drivers/CodexDriver.ts", "duplicate_line": 134, "correlation_key": "fp|8be15b9ad62811882d64e80cb5e299eaa21a65b9483558d2dc6aa1902984579e"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/server/src/provider/Drivers/CursorDriver.ts"}, "region": {"startLine": 136}}}]}, {"ruleId": "AIC003", "level": "note", "message": {"text": "Duplicated implementation block across source files"}, "properties": {"repobilityId": 30410, "scanner": "repobility-ai-code-hygiene", "fingerprint": "704d8e812cfe5ed2cce2cd83b36d5781298d31b5b89cb70b3e3a9efc523a7786", "category": "quality", "severity": "low", "confidence": 0.86, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "A normalized source-code window appears in two different non-test files.", "evidence": {"lines": 12, "rule_id": "AIC003", "scanner": "repobility-ai-code-hygiene", "references": ["https://jscpd.dev/"], "duplicate_file": "apps/server/src/provider/Drivers/ClaudeDriver.ts", "duplicate_line": 60, "correlation_key": "fp|704d8e812cfe5ed2cce2cd83b36d5781298d31b5b89cb70b3e3a9efc523a7786"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/server/src/provider/Drivers/CursorDriver.ts"}, "region": {"startLine": 46}}}]}, {"ruleId": "AIC003", "level": "note", "message": {"text": "Duplicated implementation block across source files"}, "properties": {"repobilityId": 30409, "scanner": "repobility-ai-code-hygiene", "fingerprint": "4d526a8fc06638924a00a527faa9c861edb28aa64ab9b41925a67a9f0a6d388a", "category": "quality", "severity": "low", "confidence": 0.86, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "A normalized source-code window appears in two different non-test files.", "evidence": {"lines": 12, "rule_id": "AIC003", "scanner": "repobility-ai-code-hygiene", "references": ["https://jscpd.dev/"], "duplicate_file": "apps/server/src/provider/Drivers/ClaudeDriver.ts", "duplicate_line": 60, "correlation_key": "fp|4d526a8fc06638924a00a527faa9c861edb28aa64ab9b41925a67a9f0a6d388a"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/server/src/provider/Drivers/CodexDriver.ts"}, "region": {"startLine": 40}}}]}, {"ruleId": "AIC003", "level": "note", "message": {"text": "Duplicated implementation block across source files"}, "properties": {"repobilityId": 30408, "scanner": "repobility-ai-code-hygiene", "fingerprint": "d44be10e1bc222bd97e6692e98fcc38ef432cd844ebe83c47664dc9e82a53268", "category": "quality", "severity": "low", "confidence": 0.86, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "A normalized source-code window appears in two different non-test files.", "evidence": {"lines": 12, "rule_id": "AIC003", "scanner": "repobility-ai-code-hygiene", "references": ["https://jscpd.dev/"], "duplicate_file": "apps/server/src/persistence/Layers/ProjectionCheckpoints.ts", "duplicate_line": 53, "correlation_key": "fp|d44be10e1bc222bd97e6692e98fcc38ef432cd844ebe83c47664dc9e82a53268"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/server/src/persistence/Layers/ProjectionTurns.ts"}, "region": {"startLine": 50}}}]}, {"ruleId": "MINED052", "level": "none", "message": {"text": "[MINED052] Ts Any Typed: : any used as type annotation. Defeats TypeScript type safety."}, "properties": {"repobilityId": 30748, "scanner": "repobility-threat-engine", "fingerprint": "6cce849166dbc218d083e9bac031e6aae01bed1dbb27b2bfd53d356006eddfcd", "category": "quality", "severity": "info", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "ts-any-typed", "owasp": null, "cwe_ids": ["CWE-704"], "languages": ["typescript", "tsx"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.348022+00:00", "triaged_in_corpus": 12, "observations_count": 496002, "ai_coder_pattern_id": 97}, "scanner": "repobility-threat-engine", "correlation_key": "fp|6cce849166dbc218d083e9bac031e6aae01bed1dbb27b2bfd53d356006eddfcd"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/web/src/rpc/wsRpcClient.ts"}, "region": {"startLine": 29}}}]}, {"ruleId": "MINED058", "level": "none", "message": {"text": "[MINED058] React Dangerously Set Html: dangerouslySetInnerHTML bypasses Reacts JSX escaping. Pair with DOMPurify or never use with user data."}, "properties": {"repobilityId": 30747, "scanner": "repobility-threat-engine", "fingerprint": "69c902abfd9dcd42c0a3c6aa1430dd45b03d57247dc304182f229f04ae8972de", "category": "quality", "severity": "info", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "react-dangerously-set-html", "owasp": "A03:2021", "cwe_ids": ["CWE-79"], "languages": ["javascript", "typescript"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.348037+00:00", "triaged_in_corpus": 12, "observations_count": 255650, "ai_coder_pattern_id": 49}, "scanner": "repobility-threat-engine", "correlation_key": "fp|69c902abfd9dcd42c0a3c6aa1430dd45b03d57247dc304182f229f04ae8972de"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/web/src/components/chat/SkillInlineText.tsx"}, "region": {"startLine": 79}}}]}, {"ruleId": "MINED058", "level": "none", "message": {"text": "[MINED058] React Dangerously Set Html: dangerouslySetInnerHTML bypasses Reacts JSX escaping. Pair with DOMPurify or never use with user data."}, "properties": {"repobilityId": 30746, "scanner": "repobility-threat-engine", "fingerprint": "68f4dea412783f2b4707c00f8733db167a850962d6cbc42ffeee49a5416d1035", "category": "quality", "severity": "info", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "react-dangerously-set-html", "owasp": "A03:2021", "cwe_ids": ["CWE-79"], "languages": ["javascript", "typescript"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.348037+00:00", "triaged_in_corpus": 12, "observations_count": 255650, "ai_coder_pattern_id": 49}, "scanner": "repobility-threat-engine", "correlation_key": "fp|68f4dea412783f2b4707c00f8733db167a850962d6cbc42ffeee49a5416d1035"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/web/src/components/ComposerPromptEditor.tsx"}, "region": {"startLine": 258}}}]}, {"ruleId": "MINED058", "level": "none", "message": {"text": "[MINED058] React Dangerously Set Html: dangerouslySetInnerHTML bypasses Reacts JSX escaping. Pair with DOMPurify or never use with user data."}, "properties": {"repobilityId": 30745, "scanner": "repobility-threat-engine", "fingerprint": "4406d074d373d05fe6aeadb1eb17d6c0256a5ce110c5569c7bcdfc51f161ce3e", "category": "quality", "severity": "info", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "react-dangerously-set-html", "owasp": "A03:2021", "cwe_ids": ["CWE-79"], "languages": ["javascript", "typescript"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.348037+00:00", "triaged_in_corpus": 12, "observations_count": 255650, "ai_coder_pattern_id": 49}, "scanner": "repobility-threat-engine", "correlation_key": "fp|4406d074d373d05fe6aeadb1eb17d6c0256a5ce110c5569c7bcdfc51f161ce3e"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/web/src/components/ChatMarkdown.tsx"}, "region": {"startLine": 218}}}]}, {"ruleId": "MINED049", "level": "none", "message": {"text": "[MINED049] Print Pii: Logging password/token/email/ssn directly to stdout."}, "properties": {"repobilityId": 30744, "scanner": "repobility-threat-engine", "fingerprint": "aed74d95247e7fbd7747cc6e4c47e215ae7f3d1f2fb587f779e16d7c123d0720", "category": "quality", "severity": "info", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "print-pii", "owasp": "A09:2021", "cwe_ids": ["CWE-532"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.348015+00:00", "triaged_in_corpus": 12, "observations_count": 676566, "ai_coder_pattern_id": 26}, "scanner": "repobility-threat-engine", "correlation_key": "fp|aed74d95247e7fbd7747cc6e4c47e215ae7f3d1f2fb587f779e16d7c123d0720"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/server/src/cli/auth.ts"}, "region": {"startLine": 183}}}]}, {"ruleId": "MINED027", "level": "none", "message": {"text": "[MINED027] React State Array Mutation (and 1 more): Same pattern found in 1 additional files. Review if needed."}, "properties": {"repobilityId": 30743, "scanner": "repobility-threat-engine", "fingerprint": "657b8f020f05e594b866af864b5f808bd954697e40b562bcb696fc036f39d1e0", "category": "quality", "severity": "info", "confidence": 0.2, "triageState": "false_positive", "verdict": "likely_fp", "isResolved": true, "reason": "Deduplicated summary only: 1 additional occurrences found. The top occurrences remain visible as actionable findings.", "evidence": {"mined": true, "mining": {"slug": "react-state-array-mutation", "owasp": null, "cwe_ids": ["CWE-682"], "languages": ["typescript", "tsx", "javascript", "jsx"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.347961+00:00", "triaged_in_corpus": 15, "observations_count": 14444, "ai_coder_pattern_id": 136}, "scanner": "repobility-threat-engine", "aggregated": true, "correlation_key": "fp|657b8f020f05e594b866af864b5f808bd954697e40b562bcb696fc036f39d1e0", "aggregated_count": 1}}}, {"ruleId": "MINED054", "level": "none", "message": {"text": "[MINED054] Ts As Any: Casting to any (as any) bypasses type checking entirely."}, "properties": {"repobilityId": 30738, "scanner": "repobility-threat-engine", "fingerprint": "fa5d7ac9b827991d4791bfbf5c0ff22d4d8e0cdfb2dcf1da9dc63ec8a3293e10", "category": "quality", "severity": "info", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "ts-as-any", "owasp": null, "cwe_ids": ["CWE-704"], "languages": ["typescript", "tsx"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.348028+00:00", "triaged_in_corpus": 12, "observations_count": 341218, "ai_coder_pattern_id": 98}, "scanner": "repobility-threat-engine", "correlation_key": "fp|fa5d7ac9b827991d4791bfbf5c0ff22d4d8e0cdfb2dcf1da9dc63ec8a3293e10"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/web/src/routeTree.gen.ts"}, "region": {"startLine": 30}}}]}, {"ruleId": "MINED054", "level": "none", "message": {"text": "[MINED054] Ts As Any: Casting to any (as any) bypasses type checking entirely."}, "properties": {"repobilityId": 30737, "scanner": "repobility-threat-engine", "fingerprint": "b4bd2e35961ced74dd7cd10a4c58e787b2d0d578cac53190a954a1648a1f60f2", "category": "quality", "severity": "info", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "ts-as-any", "owasp": null, "cwe_ids": ["CWE-704"], "languages": ["typescript", "tsx"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.348028+00:00", "triaged_in_corpus": 12, "observations_count": 341218, "ai_coder_pattern_id": 98}, "scanner": "repobility-threat-engine", "correlation_key": "fp|b4bd2e35961ced74dd7cd10a4c58e787b2d0d578cac53190a954a1648a1f60f2"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/server/src/persistence/NodeSqliteClient.ts"}, "region": {"startLine": 126}}}]}, {"ruleId": "MINED054", "level": "none", "message": {"text": "[MINED054] Ts As Any: Casting to any (as any) bypasses type checking entirely."}, "properties": {"repobilityId": 30736, "scanner": "repobility-threat-engine", "fingerprint": "d925d0b1151855d48bbad6fcc9119b8e55271cb97795a9ec9ae4d4eb7e5c949c", "category": "quality", "severity": "info", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "ts-as-any", "owasp": null, "cwe_ids": ["CWE-704"], "languages": ["typescript", "tsx"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.348028+00:00", "triaged_in_corpus": 12, "observations_count": 341218, "ai_coder_pattern_id": 98}, "scanner": "repobility-threat-engine", "correlation_key": "fp|d925d0b1151855d48bbad6fcc9119b8e55271cb97795a9ec9ae4d4eb7e5c949c"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/desktop/src/electron/ElectronApp.ts"}, "region": {"startLine": 51}}}]}, {"ruleId": "MINED043", "level": "none", "message": {"text": "[MINED043] Http Not Https (and 7 more): Same pattern found in 7 additional files. Review if needed."}, "properties": {"repobilityId": 30735, "scanner": "repobility-threat-engine", "fingerprint": "449cbc19159d9baefc3f321524305fe6dc5e981a906befc7a247f4af9fda7c12", "category": "quality", "severity": "info", "confidence": 0.2, "triageState": "false_positive", "verdict": "likely_fp", "isResolved": true, "reason": "Deduplicated summary only: 7 additional occurrences found. The top occurrences remain visible as actionable findings.", "evidence": {"mined": true, "mining": {"slug": "http-not-https", "owasp": "A02:2021", "cwe_ids": ["CWE-319"], "precision": 0.917, "promoted_at": "2026-05-18T14:01:32.347999+00:00", "triaged_in_corpus": 12, "observations_count": 4113831, "ai_coder_pattern_id": 15}, "scanner": "repobility-threat-engine", "aggregated": true, "correlation_key": "fp|449cbc19159d9baefc3f321524305fe6dc5e981a906befc7a247f4af9fda7c12", "aggregated_count": 7}}}, {"ruleId": "MINED043", "level": "none", "message": {"text": "[MINED043] Http Not Https: Hardcoded http:// (not localhost) for endpoints that handle credentials or data."}, "properties": {"repobilityId": 30734, "scanner": "repobility-threat-engine", "fingerprint": "75b4d31af81cb2aa7cffc3882656ac56fb35027662944e48b6b6c8d6861dc83d", "category": "quality", "severity": "info", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "http-not-https", "owasp": "A02:2021", "cwe_ids": ["CWE-319"], "precision": 0.917, "promoted_at": "2026-05-18T14:01:32.347999+00:00", "triaged_in_corpus": 12, "observations_count": 4113831, "ai_coder_pattern_id": 15}, "scanner": "repobility-threat-engine", "correlation_key": "fp|75b4d31af81cb2aa7cffc3882656ac56fb35027662944e48b6b6c8d6861dc83d"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/server/src/serverRuntimeStartup.ts"}, "region": {"startLine": 248}}}]}, {"ruleId": "MINED043", "level": "none", "message": {"text": "[MINED043] Http Not Https: Hardcoded http:// (not localhost) for endpoints that handle credentials or data."}, "properties": {"repobilityId": 30733, "scanner": "repobility-threat-engine", "fingerprint": "7d3a55fddfc302b45315b7022c7e9c98e3da22b5c75affc91bc893ba15174f55", "category": "quality", "severity": "info", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "http-not-https", "owasp": "A02:2021", "cwe_ids": ["CWE-319"], "precision": 0.917, "promoted_at": "2026-05-18T14:01:32.347999+00:00", "triaged_in_corpus": 12, "observations_count": 4113831, "ai_coder_pattern_id": 15}, "scanner": "repobility-threat-engine", "correlation_key": "fp|7d3a55fddfc302b45315b7022c7e9c98e3da22b5c75affc91bc893ba15174f55"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/desktop/src/backend/tailscaleEndpointProvider.ts"}, "region": {"startLine": 47}}}]}, {"ruleId": "MINED043", "level": "none", "message": {"text": "[MINED043] Http Not Https: Hardcoded http:// (not localhost) for endpoints that handle credentials or data."}, "properties": {"repobilityId": 30732, "scanner": "repobility-threat-engine", "fingerprint": "b131ca00659b63c9e7a9b41b4aa04f1e554d1dc8430a016a85a2df074d440e6a", "category": "quality", "severity": "info", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "http-not-https", "owasp": "A02:2021", "cwe_ids": ["CWE-319"], "precision": 0.917, "promoted_at": "2026-05-18T14:01:32.347999+00:00", "triaged_in_corpus": 12, "observations_count": 4113831, "ai_coder_pattern_id": 15}, "scanner": "repobility-threat-engine", "correlation_key": "fp|b131ca00659b63c9e7a9b41b4aa04f1e554d1dc8430a016a85a2df074d440e6a"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/desktop/src/backend/DesktopServerExposure.ts"}, "region": {"startLine": 118}}}]}, {"ruleId": "MINED045", "level": "none", "message": {"text": "[MINED045] Ts Non Null Assertion (and 45 more): Same pattern found in 45 additional files. Review if needed."}, "properties": {"repobilityId": 30731, "scanner": "repobility-threat-engine", "fingerprint": "95d5f6e71ce4d958d3d518caffef964ba719de5a4cd04e416638deac572d5035", "category": "quality", "severity": "info", "confidence": 0.2, "triageState": "false_positive", "verdict": "likely_fp", "isResolved": true, "reason": "Deduplicated summary only: 45 additional occurrences found. The top occurrences remain visible as actionable findings.", "evidence": {"mined": true, "mining": {"slug": "ts-non-null-assertion", "owasp": null, "cwe_ids": ["CWE-476"], "languages": ["typescript", "tsx"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.348005+00:00", "triaged_in_corpus": 12, "observations_count": 1810954, "ai_coder_pattern_id": 105}, "scanner": "repobility-threat-engine", "aggregated": true, "correlation_key": "fp|95d5f6e71ce4d958d3d518caffef964ba719de5a4cd04e416638deac572d5035", "aggregated_count": 45}}}, {"ruleId": "MINED045", "level": "none", "message": {"text": "[MINED045] Ts Non Null Assertion: x! asserts not null - bypasses null checks - TypeError if wrong."}, "properties": {"repobilityId": 30730, "scanner": "repobility-threat-engine", "fingerprint": "b2bb3c712d15403d462922bb7ad4dfd719ebb933769b0d9ef2228af9c17b535a", "category": "quality", "severity": "info", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "ts-non-null-assertion", "owasp": null, "cwe_ids": ["CWE-476"], "languages": ["typescript", "tsx"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.348005+00:00", "triaged_in_corpus": 12, "observations_count": 1810954, "ai_coder_pattern_id": 105}, "scanner": "repobility-threat-engine", "correlation_key": "fp|b2bb3c712d15403d462922bb7ad4dfd719ebb933769b0d9ef2228af9c17b535a"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/desktop/src/settings/DesktopSavedEnvironments.ts"}, "region": {"startLine": 283}}}]}, {"ruleId": "MINED045", "level": "none", "message": {"text": "[MINED045] Ts Non Null Assertion: x! asserts not null - bypasses null checks - TypeError if wrong."}, "properties": {"repobilityId": 30729, "scanner": "repobility-threat-engine", "fingerprint": "8b1df353fe68d12d406535904c6c2e6971ee8810352c3a0931e2212d073a35b9", "category": "quality", "severity": "info", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "ts-non-null-assertion", "owasp": null, "cwe_ids": ["CWE-476"], "languages": ["typescript", "tsx"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.348005+00:00", "triaged_in_corpus": 12, "observations_count": 1810954, "ai_coder_pattern_id": 105}, "scanner": "repobility-threat-engine", "correlation_key": "fp|8b1df353fe68d12d406535904c6c2e6971ee8810352c3a0931e2212d073a35b9"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/desktop/src/app/DesktopLifecycle.ts"}, "region": {"startLine": 216}}}]}, {"ruleId": "MINED045", "level": "none", "message": {"text": "[MINED045] Ts Non Null Assertion: x! asserts not null - bypasses null checks - TypeError if wrong."}, "properties": {"repobilityId": 30728, "scanner": "repobility-threat-engine", "fingerprint": "b8dd945691ad50f6157167f696b9f6a2e11393f87f1ea91e72cb75838fbbb5a9", "category": "quality", "severity": "info", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "ts-non-null-assertion", "owasp": null, "cwe_ids": ["CWE-476"], "languages": ["typescript", "tsx"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.348005+00:00", "triaged_in_corpus": 12, "observations_count": 1810954, "ai_coder_pattern_id": 105}, "scanner": "repobility-threat-engine", "correlation_key": "fp|b8dd945691ad50f6157167f696b9f6a2e11393f87f1ea91e72cb75838fbbb5a9"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/desktop/src/app/DesktopApp.ts"}, "region": {"startLine": 74}}}]}, {"ruleId": "SEC128", "level": "none", "message": {"text": "[SEC128] Async function without await \u2014 fire-and-forget Promise (AI mistake) (and 44 more): Same pattern found in 44 additional files. Review if needed."}, "properties": {"repobilityId": 30727, "scanner": "repobility-threat-engine", "fingerprint": "c133e6b582231769da7b523478ae41b10481ae270c95cb64d723b7bbd880cb77", "category": "quality", "severity": "info", "confidence": 0.2, "triageState": "false_positive", "verdict": "likely_fp", "isResolved": true, "reason": "Deduplicated summary only: 44 additional occurrences found. The top occurrences remain visible as actionable findings.", "evidence": {"reason": "Deduplicated summary only: 44 additional occurrences found. The top occurrences remain visible as actionable findings.", "rule_id": "SEC128", "scanner": "repobility-threat-engine", "confidence": 0.2, "correlation_key": "fp|c133e6b582231769da7b523478ae41b10481ae270c95cb64d723b7bbd880cb77"}}}, {"ruleId": "MINED044", "level": "none", "message": {"text": "[MINED044] Js Console Log Prod (and 18 more): Same pattern found in 18 additional files. Review if needed."}, "properties": {"repobilityId": 30723, "scanner": "repobility-threat-engine", "fingerprint": "81623ccad9e487588ac3bf74509560c4a438d46a835beb91ee036388a0b7f7ba", "category": "quality", "severity": "info", "confidence": 0.2, "triageState": "false_positive", "verdict": "likely_fp", "isResolved": true, "reason": "Deduplicated summary only: 18 additional occurrences found. The top occurrences remain visible as actionable findings.", "evidence": {"mined": true, "mining": {"slug": "js-console-log-prod", "owasp": null, "cwe_ids": ["CWE-532"], "languages": ["javascript", "typescript", "tsx", "jsx"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.348003+00:00", "triaged_in_corpus": 10, "observations_count": 1940833, "ai_coder_pattern_id": 102}, "scanner": "repobility-threat-engine", "aggregated": true, "correlation_key": "fp|81623ccad9e487588ac3bf74509560c4a438d46a835beb91ee036388a0b7f7ba", "aggregated_count": 18}}}, {"ruleId": "MINED044", "level": "none", "message": {"text": "[MINED044] Js Console Log Prod: console.log left in code. Should be replaced with logger or removed."}, "properties": {"repobilityId": 30722, "scanner": "repobility-threat-engine", "fingerprint": "4b6030c73a2d501f3d099c8b05cbed54299f4778069a4123cfeb336ecafeab20", "category": "quality", "severity": "info", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "js-console-log-prod", "owasp": null, "cwe_ids": ["CWE-532"], "languages": ["javascript", "typescript", "tsx", "jsx"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.348003+00:00", "triaged_in_corpus": 10, "observations_count": 1940833, "ai_coder_pattern_id": 102}, "scanner": "repobility-threat-engine", "correlation_key": "fp|4b6030c73a2d501f3d099c8b05cbed54299f4778069a4123cfeb336ecafeab20"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/server/src/cli/project.ts"}, "region": {"startLine": 284}}}]}, {"ruleId": "MINED044", "level": "none", "message": {"text": "[MINED044] Js Console Log Prod: console.log left in code. Should be replaced with logger or removed."}, "properties": {"repobilityId": 30721, "scanner": "repobility-threat-engine", "fingerprint": "7d76bf51efee5184fe600ac99251e56aabc8c544b3c3afb59f1cbb0d2517e88c", "category": "quality", "severity": "info", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "js-console-log-prod", "owasp": null, "cwe_ids": ["CWE-532"], "languages": ["javascript", "typescript", "tsx", "jsx"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.348003+00:00", "triaged_in_corpus": 10, "observations_count": 1940833, "ai_coder_pattern_id": 102}, "scanner": "repobility-threat-engine", "correlation_key": "fp|7d76bf51efee5184fe600ac99251e56aabc8c544b3c3afb59f1cbb0d2517e88c"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/server/src/cli/auth.ts"}, "region": {"startLine": 109}}}]}, {"ruleId": "MINED044", "level": "none", "message": {"text": "[MINED044] Js Console Log Prod: console.log left in code. Should be replaced with logger or removed."}, "properties": {"repobilityId": 30720, "scanner": "repobility-threat-engine", "fingerprint": "fcd8e7dc6fc8b60b917f48da72b5b6e0d9dee1be18e4d8cedadc9d1a73155234", "category": "quality", "severity": "info", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "js-console-log-prod", "owasp": null, "cwe_ids": ["CWE-532"], "languages": ["javascript", "typescript", "tsx", "jsx"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.348003+00:00", "triaged_in_corpus": 10, "observations_count": 1940833, "ai_coder_pattern_id": 102}, "scanner": "repobility-threat-engine", "correlation_key": "fp|fcd8e7dc6fc8b60b917f48da72b5b6e0d9dee1be18e4d8cedadc9d1a73155234"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/desktop/scripts/electron-launcher.mjs"}, "region": {"startLine": 101}}}]}, {"ruleId": "SEC040", "level": "none", "message": {"text": "[SEC040] innerHTML XSS \u2014 template literal with server-supplied data (and 7 more): Same pattern found in 7 additional files. Review if needed."}, "properties": {"repobilityId": 30396, "scanner": "repobility-threat-engine", "fingerprint": "e6b12850e54eb1ffa424becfb0f6a8e7a5c6d257d13b26934f0112681066c89f", "category": "xss", "severity": "info", "confidence": 0.2, "triageState": "false_positive", "verdict": "likely_fp", "isResolved": true, "reason": "Deduplicated summary only: 7 additional occurrences found. The top occurrences remain visible as actionable findings.", "evidence": {"reason": "Deduplicated summary only: 7 additional occurrences found. The top occurrences remain visible as actionable findings.", "rule_id": "SEC040", "scanner": "repobility-threat-engine", "confidence": 0.2, "correlation_key": "fp|e6b12850e54eb1ffa424becfb0f6a8e7a5c6d257d13b26934f0112681066c89f"}}}, {"ruleId": "SEC085", "level": "none", "message": {"text": "[SEC085] JS: child_process.exec with non-literal (and 26 more): Same pattern found in 26 additional files. Review if needed."}, "properties": {"repobilityId": 30391, "scanner": "repobility-threat-engine", "fingerprint": "6a81b2da8b25c2b4c77a7854ab8e1fc8afd4a16ff051baa5c4f4e5bf2bea2486", "category": "quality", "severity": "info", "confidence": 0.2, "triageState": "false_positive", "verdict": "likely_fp", "isResolved": true, "reason": "Deduplicated summary only: 26 additional occurrences found. The top occurrences remain visible as actionable findings.", "evidence": {"reason": "Deduplicated summary only: 26 additional occurrences found. The top occurrences remain visible as actionable findings.", "rule_id": "SEC085", "scanner": "repobility-threat-engine", "confidence": 0.2, "correlation_key": "fp|6a81b2da8b25c2b4c77a7854ab8e1fc8afd4a16ff051baa5c4f4e5bf2bea2486"}}}, {"ruleId": "SEC045", "level": "none", "message": {"text": "[SEC045] eval()/exec() on stored or user-supplied data (and 26 more): Same pattern found in 26 additional files. Review if needed."}, "properties": {"repobilityId": 30387, "scanner": "repobility-threat-engine", "fingerprint": "935ca1bcfb4d5d281bd63348c3a3354eb0a4b201cfe472375901be41ecd40841", "category": "injection", "severity": "info", "confidence": 0.2, "triageState": "false_positive", "verdict": "likely_fp", "isResolved": true, "reason": "Deduplicated summary only: 26 additional occurrences found. The top occurrences remain visible as actionable findings.", "evidence": {"reason": "Deduplicated summary only: 26 additional occurrences found. The top occurrences remain visible as actionable findings.", "rule_id": "SEC045", "scanner": "repobility-threat-engine", "confidence": 0.2, "correlation_key": "fp|935ca1bcfb4d5d281bd63348c3a3354eb0a4b201cfe472375901be41ecd40841"}}}, {"ruleId": "SEC118", "level": "none", "message": {"text": "[SEC118] UUIDv1 / UUIDv3 used for security-sensitive identifier (and 8 more): Same pattern found in 8 additional files. Review if needed."}, "properties": {"repobilityId": 30382, "scanner": "repobility-threat-engine", "fingerprint": "841b8d35ba95ecf21ebda10f6b871b586198fb1a8c1c7ed357b568567894cc01", "category": "crypto", "severity": "info", "confidence": 0.2, "triageState": "false_positive", "verdict": "likely_fp", "isResolved": true, "reason": "Deduplicated summary only: 8 additional occurrences found. The top occurrences remain visible as actionable findings.", "evidence": {"reason": "Deduplicated summary only: 8 additional occurrences found. The top occurrences remain visible as actionable findings.", "rule_id": "SEC118", "scanner": "repobility-threat-engine", "confidence": 0.2, "correlation_key": "fp|841b8d35ba95ecf21ebda10f6b871b586198fb1a8c1c7ed357b568567894cc01"}}}, {"ruleId": "SEC118", "level": "none", "message": {"text": "[SEC118] UUIDv1 / UUIDv3 used for security-sensitive identifier: UUIDv1 encodes the MAC address and timestamp, making it predictable. Used as a session token or password-reset key, it's enumerable."}, "properties": {"repobilityId": 30381, "scanner": "repobility-threat-engine", "fingerprint": "ee3aaf47ee1363f77b40cc04ca041abff0978fb54b0eec5fcbfe1c56f3edab6b", "category": "crypto", "severity": "info", "confidence": 0.1, "triageState": "false_positive", "verdict": "likely_fp", "isResolved": true, "reason": "Safe pattern 'randomUUID' detected on same line", "evidence": {"match": "crypto.randomUUID", "reason": "Safe pattern 'randomUUID' detected on same line", "rule_id": "SEC118", "scanner": "repobility-threat-engine", "confidence": 0.1, "correlation_key": "code|crypto|token|346|sec118"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/server/src/cli/project.ts"}, "region": {"startLine": 346}}}]}, {"ruleId": "SEC118", "level": "none", "message": {"text": "[SEC118] UUIDv1 / UUIDv3 used for security-sensitive identifier: UUIDv1 encodes the MAC address and timestamp, making it predictable. Used as a session token or password-reset key, it's enumerable."}, "properties": {"repobilityId": 30380, "scanner": "repobility-threat-engine", "fingerprint": "e305582e2229c16b0d57d34924c3a7d67cb6d8c60ab2f56ddd9e41070e5e8dff", "category": "crypto", "severity": "info", "confidence": 0.1, "triageState": "false_positive", "verdict": "likely_fp", "isResolved": true, "reason": "Safe pattern 'randomUUID' detected on same line", "evidence": {"match": "crypto.randomUUID", "reason": "Safe pattern 'randomUUID' detected on same line", "rule_id": "SEC118", "scanner": "repobility-threat-engine", "confidence": 0.1, "correlation_key": "code|crypto|token|206|sec118"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/server/src/auth/Layers/SessionCredentialService.ts"}, "region": {"startLine": 206}}}]}, {"ruleId": "SEC118", "level": "none", "message": {"text": "[SEC118] UUIDv1 / UUIDv3 used for security-sensitive identifier: UUIDv1 encodes the MAC address and timestamp, making it predictable. Used as a session token or password-reset key, it's enumerable."}, "properties": {"repobilityId": 30379, "scanner": "repobility-threat-engine", "fingerprint": "56d4e1566d6d46d8fdb2e560819e4c91657838ec290d2d578612ec51adba5ab0", "category": "crypto", "severity": "info", "confidence": 0.1, "triageState": "false_positive", "verdict": "likely_fp", "isResolved": true, "reason": "Safe pattern 'randomUUID' detected on same line", "evidence": {"match": "Crypto.randomUUID", "reason": "Safe pattern 'randomUUID' detected on same line", "rule_id": "SEC118", "scanner": "repobility-threat-engine", "confidence": 0.1, "correlation_key": "code|crypto|token|55|sec118"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/server/src/auth/Layers/ServerSecretStore.ts"}, "region": {"startLine": 55}}}]}, {"ruleId": "SEC114", "level": "none", "message": {"text": "[SEC114] path.join / Path() on user-controlled segment without containment check (and 5 more): Same pattern found in 5 additional files. Review if needed."}, "properties": {"repobilityId": 30378, "scanner": "repobility-threat-engine", "fingerprint": "812c1c0c1b9f86ff999179f5f0f257bed61ae320c1600ec91c87e434cce67f0a", "category": "path_traversal", "severity": "info", "confidence": 0.2, "triageState": "false_positive", "verdict": "likely_fp", "isResolved": true, "reason": "Deduplicated summary only: 5 additional occurrences found. The top occurrences remain visible as actionable findings.", "evidence": {"reason": "Deduplicated summary only: 5 additional occurrences found. The top occurrences remain visible as actionable findings.", "rule_id": "SEC114", "scanner": "repobility-threat-engine", "confidence": 0.2, "correlation_key": "fp|812c1c0c1b9f86ff999179f5f0f257bed61ae320c1600ec91c87e434cce67f0a"}}}, {"ruleId": "SEC029", "level": "none", "message": {"text": "[SEC029] Server-Side Request Forgery (SSRF) \u2014 outbound HTTP from user input (and 61 more): Same pattern found in 61 additional files. Review if needed."}, "properties": {"repobilityId": 30374, "scanner": "repobility-threat-engine", "fingerprint": "ff7d25bebdca1008ed031996e594dc626440850f5202855484308ada899f3042", "category": "ssrf", "severity": "info", "confidence": 0.2, "triageState": "false_positive", "verdict": "likely_fp", "isResolved": true, "reason": "Deduplicated summary only: 61 additional occurrences found. The top occurrences remain visible as actionable findings.", "evidence": {"reason": "Deduplicated summary only: 61 additional occurrences found. The top occurrences remain visible as actionable findings.", "rule_id": "SEC029", "scanner": "repobility-threat-engine", "confidence": 0.2, "correlation_key": "fp|ff7d25bebdca1008ed031996e594dc626440850f5202855484308ada899f3042"}}}, {"ruleId": "MINED027", "level": "error", "message": {"text": "[MINED027] React State Array Mutation: state.X.push/splice/sort followed by setState \u2014 React skips re-render on mutated reference."}, "properties": {"repobilityId": 30742, "scanner": "repobility-threat-engine", "fingerprint": "b87217c3ee71761e90b6ed7fff4f601d85579fe77450d8f958d0aa48e5c97361", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "react-state-array-mutation", "owasp": null, "cwe_ids": ["CWE-682"], "languages": ["typescript", "tsx", "javascript", "jsx"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.347961+00:00", "triaged_in_corpus": 15, "observations_count": 14444, "ai_coder_pattern_id": 136}, "scanner": "repobility-threat-engine", "correlation_key": "fp|b87217c3ee71761e90b6ed7fff4f601d85579fe77450d8f958d0aa48e5c97361"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/server/src/provider/Layers/ClaudeAdapter.ts"}, "region": {"startLine": 1143}}}]}, {"ruleId": "MINED027", "level": "error", "message": {"text": "[MINED027] React State Array Mutation: state.X.push/splice/sort followed by setState \u2014 React skips re-render on mutated reference."}, "properties": {"repobilityId": 30741, "scanner": "repobility-threat-engine", "fingerprint": "e7c27829c98b85927c51f8270cccea4e38e835c4de5e11e2821794d58345db69", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "react-state-array-mutation", "owasp": null, "cwe_ids": ["CWE-682"], "languages": ["typescript", "tsx", "javascript", "jsx"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.347961+00:00", "triaged_in_corpus": 15, "observations_count": 14444, "ai_coder_pattern_id": 136}, "scanner": "repobility-threat-engine", "correlation_key": "fp|e7c27829c98b85927c51f8270cccea4e38e835c4de5e11e2821794d58345db69"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/server/src/processRunner.ts"}, "region": {"startLine": 174}}}]}, {"ruleId": "MINED027", "level": "error", "message": {"text": "[MINED027] React State Array Mutation: state.X.push/splice/sort followed by setState \u2014 React skips re-render on mutated reference."}, "properties": {"repobilityId": 30740, "scanner": "repobility-threat-engine", "fingerprint": "3d8b2415fbc54b3f1e7d294582cf243256e1e0528c5c063bdb8d3c773b5088ee", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "react-state-array-mutation", "owasp": null, "cwe_ids": ["CWE-682"], "languages": ["typescript", "tsx", "javascript", "jsx"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.347961+00:00", "triaged_in_corpus": 15, "observations_count": 14444, "ai_coder_pattern_id": 136}, "scanner": "repobility-threat-engine", "correlation_key": "fp|3d8b2415fbc54b3f1e7d294582cf243256e1e0528c5c063bdb8d3c773b5088ee"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/server/integration/TestProviderAdapter.integration.ts"}, "region": {"startLine": 298}}}]}, {"ruleId": "SEC128", "level": "error", "message": {"text": "[SEC128] Async function without await \u2014 fire-and-forget Promise (AI mistake): Async call invoked without `await` returns an unhandled Promise. The outer function resolves before the inner work completes \u2014 DB writes lost, emails not sent, race conditions. This is one of the top-3 errors AI coders make: they understand async-shape but drop the await keyword when chaining multiple ops. Surfaces as flaky tests or silently dropped data in production."}, "properties": {"repobilityId": 30726, "scanner": "repobility-threat-engine", "fingerprint": "f31c047377b22e9e6e74428f4b1ec29d94616132798e55853f8f210d13759fab", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": "window.destroy();", "reason": "Pattern matched with no mitigating context found", "rule_id": "SEC128", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "fp|f31c047377b22e9e6e74428f4b1ec29d94616132798e55853f8f210d13759fab"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/desktop/src/electron/ElectronWindow.ts"}, "region": {"startLine": 118}}}]}, {"ruleId": "SEC128", "level": "error", "message": {"text": "[SEC128] Async function without await \u2014 fire-and-forget Promise (AI mistake): Async call invoked without `await` returns an unhandled Promise. The outer function resolves before the inner work completes \u2014 DB writes lost, emails not sent, race conditions. This is one of the top-3 errors AI coders make: they understand async-shape but drop the await keyword when chaining multiple ops. Surfaces as flaky tests or silently dropped data in production."}, "properties": {"repobilityId": 30725, "scanner": "repobility-threat-engine", "fingerprint": "195faf6c42e16b0c98f6d43c941f5fffd2737858ac62a45783bc40ec0458ea62", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": "next.delete(scheme);", "reason": "Pattern matched with no mitigating context found", "rule_id": "SEC128", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "fp|195faf6c42e16b0c98f6d43c941f5fffd2737858ac62a45783bc40ec0458ea62"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/desktop/src/electron/ElectronProtocol.ts"}, "region": {"startLine": 220}}}]}, {"ruleId": "SEC128", "level": "error", "message": {"text": "[SEC128] Async function without await \u2014 fire-and-forget Promise (AI mistake): Async call invoked without `await` returns an unhandled Promise. The outer function resolves before the inner work completes \u2014 DB writes lost, emails not sent, race conditions. This is one of the top-3 errors AI coders make: they understand async-shape but drop the await keyword when chaining multiple ops. Surfaces as flaky tests or silently dropped data in production."}, "properties": {"repobilityId": 30724, "scanner": "repobility-threat-engine", "fingerprint": "67450434512bdb3407bf12671408ca40af62016e578550153cac9b3917d22aa9", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": "socket.destroy();", "reason": "Pattern matched with no mitigating context found", "rule_id": "SEC128", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "fp|67450434512bdb3407bf12671408ca40af62016e578550153cac9b3917d22aa9"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/desktop/scripts/wait-for-resources.mjs"}, "region": {"startLine": 29}}}]}, {"ruleId": "JRN009", "level": "error", "message": {"text": "Secret-like setting is echoed into a password input value"}, "properties": {"repobilityId": 30423, "scanner": "repobility-journey-contract", "fingerprint": "b9cd85b0bdbc984447a5567395ef8ecff533c6817f2df78a892a310d221afa96", "category": "auth", "severity": "high", "confidence": 0.83, "triageState": "open", "verdict": "likely", "isResolved": false, "reason": "A password or secret-named input is populated from a secret-like variable instead of a masked placeholder.", "evidence": {"rule_id": "JRN009", "scanner": "repobility-journey-contract", "references": ["https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html"], "correlation_key": "code|auth|token|191|jrn009"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/web/src/components/desktop/SshPasswordPromptDialog.tsx"}, "region": {"startLine": 191}}}]}, {"ruleId": "SEC013", "level": "error", "message": {"text": "[SEC013] Path Traversal \u2014 User Input in File Path: User-controlled input used in file path without sanitization. Allows reading arbitrary files."}, "properties": {"repobilityId": 30401, "scanner": "repobility-threat-engine", "fingerprint": "4439dd7033dc09e790b86cb82e2a23927c270b60484618165fac894b42472cef", "category": "path_traversal", "severity": "high", "confidence": 0.8, "triageState": "open", "verdict": "likely", "isResolved": false, "reason": "User-controlled input detected in file path construction", "evidence": {"match": "open(input", "reason": "User-controlled input detected in file path construction", "rule_id": "SEC013", "scanner": "repobility-threat-engine", "confidence": 0.8, "correlation_key": "code|path_traversal|token|11|sec013"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/web/src/environmentApi.ts"}, "region": {"startLine": 11}}}]}, {"ruleId": "SEC013", "level": "error", "message": {"text": "[SEC013] Path Traversal \u2014 User Input in File Path: User-controlled input used in file path without sanitization. Allows reading arbitrary files."}, "properties": {"repobilityId": 30400, "scanner": "repobility-threat-engine", "fingerprint": "645af208749aad1d9ce6c6e427c698c0cd1c71082b5e53fbad1fc34d25211275", "category": "path_traversal", "severity": "high", "confidence": 0.8, "triageState": "open", "verdict": "likely", "isResolved": false, "reason": "User-controlled input detected in file path construction", "evidence": {"match": "open(openTerminalInput", "reason": "User-controlled input detected in file path construction", "rule_id": "SEC013", "scanner": "repobility-threat-engine", "confidence": 0.8, "correlation_key": "code|path_traversal|token|1928|sec013"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/web/src/components/ChatView.tsx"}, "region": {"startLine": 1928}}}]}, {"ruleId": "SEC013", "level": "error", "message": {"text": "[SEC013] Path Traversal \u2014 User Input in File Path: User-controlled input used in file path without sanitization. Allows reading arbitrary files."}, "properties": {"repobilityId": 30399, "scanner": "repobility-threat-engine", "fingerprint": "c161636fb501768838860f5be84bf94cf0cc46d7b014e195de3d6d90c133ec8f", "category": "path_traversal", "severity": "high", "confidence": 0.8, "triageState": "open", "verdict": "likely", "isResolved": false, "reason": "User-controlled input detected in file path construction", "evidence": {"match": "open(input", "reason": "User-controlled input detected in file path construction", "rule_id": "SEC013", "scanner": "repobility-threat-engine", "confidence": 0.8, "correlation_key": "code|path_traversal|apps/server/src/ws.ts|1106|sec013"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/server/src/ws.ts"}, "region": {"startLine": 1106}}}]}, {"ruleId": "SEC033", "level": "error", "message": {"text": "[SEC033] Prototype Pollution \u2014 unfiltered merge of user object: Merging user-controlled object into a target without filtering `__proto__`/`constructor`/`prototype` keys lets attackers inject properties onto Object.prototype, affecting every object in the process. CWE-1321. Real-world: CVE-2019-10744 (lodash), CVE-2021-23337 (lodash.set), CVE-2023-26136 (tough-cookie)."}, "properties": {"repobilityId": 30398, "scanner": "repobility-threat-engine", "fingerprint": "9c37eab79dbe02093f3e2ad3bc0b7f37c3fde82fe19d2944283da86b87f28279", "category": "prototype_pollution", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": "[input.action] =", "reason": "Pattern matched with no mitigating context found", "rule_id": "SEC033", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "fp|9c37eab79dbe02093f3e2ad3bc0b7f37c3fde82fe19d2944283da86b87f28279"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/server/src/provider/Layers/ProviderRegistry.ts"}, "region": {"startLine": 403}}}]}, {"ruleId": "SEC083", "level": "error", "message": {"text": "[SEC083] JS: new RegExp() with non-literal: new RegExp(<variable>) \u2014 variable input can craft a ReDoS pattern. Ported from eslint-plugin-security detect-non-literal-regexp (Apache-2.0)."}, "properties": {"repobilityId": 30397, "scanner": "repobility-threat-engine", "fingerprint": "6f54d647d62f69500aaf2f9e4bd8cd5ec65050e74ce98f78a5fe72ecf7a17777", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": "new RegExp(`${", "reason": "Pattern matched with no mitigating context found", "rule_id": "SEC083", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "fp|6f54d647d62f69500aaf2f9e4bd8cd5ec65050e74ce98f78a5fe72ecf7a17777"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/server/src/provider/Layers/CodexSessionRuntime.ts"}, "region": {"startLine": 49}}}]}, {"ruleId": "SEC040", "level": "error", "message": {"text": "[SEC040] innerHTML XSS \u2014 template literal with server-supplied data: Setting .innerHTML with a template literal that interpolates server-supplied or user-supplied data is the canonical stored/reflected XSS vector. The browser parses the HTML and executes any <script> or event-handler attributes in the data. CWE-79. Especially dangerous when the data comes from a CV parser, profile field, or any user-input pipeline."}, "properties": {"repobilityId": 30395, "scanner": "repobility-threat-engine", "fingerprint": "3489ae98166d81af936240ec761e2c32737b0d8adfc2f3c7ef3f9452651ee074", "category": "xss", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": "map((arg) => `\"${arg}", "reason": "Pattern matched with no mitigating context found", "rule_id": "SEC040", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "fp|3489ae98166d81af936240ec761e2c32737b0d8adfc2f3c7ef3f9452651ee074"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/server/src/process/externalLauncher.ts"}, "region": {"startLine": 334}}}]}, {"ruleId": "SEC040", "level": "error", "message": {"text": "[SEC040] innerHTML XSS \u2014 template literal with server-supplied data: Setting .innerHTML with a template literal that interpolates server-supplied or user-supplied data is the canonical stored/reflected XSS vector. The browser parses the HTML and executes any <script> or event-handler attributes in the data. CWE-79. Especially dangerous when the data comes from a CV parser, profile field, or any user-input pipeline."}, "properties": {"repobilityId": 30394, "scanner": "repobility-threat-engine", "fingerprint": "dc1ca3c247139e2df1edaf150e3fdb0f9d331fa2bc56ee1ec6bbc167e5ea8a6d", "category": "xss", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": "map(([id, name]) => `${id}_${name}", "reason": "Pattern matched with no mitigating context found", "rule_id": "SEC040", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "fp|dc1ca3c247139e2df1edaf150e3fdb0f9d331fa2bc56ee1ec6bbc167e5ea8a6d"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/server/src/persistence/Migrations.ts"}, "region": {"startLine": 129}}}]}, {"ruleId": "SEC040", "level": "error", "message": {"text": "[SEC040] innerHTML XSS \u2014 template literal with server-supplied data: Setting .innerHTML with a template literal that interpolates server-supplied or user-supplied data is the canonical stored/reflected XSS vector. The browser parses the HTML and executes any <script> or event-handler attributes in the data. CWE-79. Especially dangerous when the data comes from a CV parser, profile field, or any user-input pipeline."}, "properties": {"repobilityId": 30393, "scanner": "repobility-threat-engine", "fingerprint": "2059c8f30041285d7478ab829cd2f4f18bf6674316b791331a6c8d4f427720b8", "category": "xss", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": "map((encoded) => `${encoded}", "reason": "Pattern matched with no mitigating context found", "rule_id": "SEC040", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "fp|2059c8f30041285d7478ab829cd2f4f18bf6674316b791331a6c8d4f427720b8"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/server/src/keybindings.ts"}, "region": {"startLine": 431}}}]}, {"ruleId": "SEC100", "level": "error", "message": {"text": "[SEC100] CORS permissive Access-Control-Allow-Origin: *: Permissive CORS policy (`*` origin) allows any website to make authenticated cross-origin requests. Especially dangerous when combined with `Access-Control-Allow-Credentials: true`."}, "properties": {"repobilityId": 30392, "scanner": "repobility-threat-engine", "fingerprint": "e81eaeda1da1da6dfdcf376a9046ccb7f39afe7125c6b1efbea634b11fed035a", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": "\"access-control-allow-origin\": \"*\"", "reason": "Pattern matched with no mitigating context found", "rule_id": "SEC100", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "fp|e81eaeda1da1da6dfdcf376a9046ccb7f39afe7125c6b1efbea634b11fed035a"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/server/src/httpCors.ts"}, "region": {"startLine": 10}}}]}, {"ruleId": "SEC085", "level": "error", "message": {"text": "[SEC085] JS: child_process.exec with non-literal: child_process.exec with user-derived input enables command injection. Ported from eslint-plugin-security detect-child-process (Apache-2.0)."}, "properties": {"repobilityId": 30390, "scanner": "repobility-threat-engine", "fingerprint": "d5df48473dbdf8687cdeb153d1c59bd7365fac5acb46844bfe2e1d044d28da88", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": "exec(trimmed", "reason": "Pattern matched with no mitigating context found", "rule_id": "SEC085", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "fp|d5df48473dbdf8687cdeb153d1c59bd7365fac5acb46844bfe2e1d044d28da88"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/server/src/git/GitManager.ts"}, "region": {"startLine": 153}}}]}, {"ruleId": "SEC085", "level": "error", "message": {"text": "[SEC085] JS: child_process.exec with non-literal: child_process.exec with user-derived input enables command injection. Ported from eslint-plugin-security detect-child-process (Apache-2.0)."}, "properties": {"repobilityId": 30389, "scanner": "repobility-threat-engine", "fingerprint": "f864e78c5bb4ce2407484bd39bdb51b3451938f5009c3bc3c7bb469180af8068", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": "exec(line", "reason": "Pattern matched with no mitigating context found", "rule_id": "SEC085", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "fp|f864e78c5bb4ce2407484bd39bdb51b3451938f5009c3bc3c7bb469180af8068"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/server/src/diagnostics/ProcessDiagnostics.ts"}, "region": {"startLine": 85}}}]}, {"ruleId": "SEC085", "level": "error", "message": {"text": "[SEC085] JS: child_process.exec with non-literal: child_process.exec with user-derived input enables command injection. Ported from eslint-plugin-security detect-child-process (Apache-2.0)."}, "properties": {"repobilityId": 30388, "scanner": "repobility-threat-engine", "fingerprint": "8c68c54bf89053203cb23ed57d984d5c41e3c135fe0a5ccff73685037329e43a", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": "exec(trimmed", "reason": "Pattern matched with no mitigating context found", "rule_id": "SEC085", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "fp|8c68c54bf89053203cb23ed57d984d5c41e3c135fe0a5ccff73685037329e43a"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/server/src/cli/config.ts"}, "region": {"startLine": 410}}}]}, {"ruleId": "SEC038", "level": "error", "message": {"text": "[SEC038] HTTP Request Smuggling Risk \u2014 TE/CL mismatch: HTTP Request Smuggling (HRS) abuses parser disagreement between front-end and back-end servers about request boundaries when Transfer-Encoding and Content-Length both present. Attackers smuggle a second request, stealing other users' responses or bypassing auth. CWE-444. Real CVEs: CVE-2019-16276 (Go net/http), CVE-2020-10719 (Undertow), CVE-2022-24735 (Redis-7), Cloudflare/Akamai/Varnish disclosures."}, "properties": {"repobilityId": 30383, "scanner": "repobility-threat-engine", "fingerprint": "4fb810e75024d5f13a443c4ed9ea0571fc88117477f7b44c54b6dd96a73453e3", "category": "injection", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": "headers[\"transfer-encoding\"] =", "reason": "Pattern matched with no mitigating context found", "rule_id": "SEC038", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "code|injection|token|63|sec038"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/server/src/auth/http.ts"}, "region": {"startLine": 63}}}]}, {"ruleId": "SEC114", "level": "error", "message": {"text": "[SEC114] path.join / Path() on user-controlled segment without containment check: filepath.Clean / path.Join on attacker-supplied segments does NOT prevent escape from the base directory. `../../../etc/passwd` resolves cleanly."}, "properties": {"repobilityId": 30377, "scanner": "repobility-threat-engine", "fingerprint": "e986e467d3c466ea2eb272d00baee3551ff65a8a9e1eb777597ca030feacdc76", "category": "path_traversal", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": "Path.resolve(input", "reason": "Pattern matched with no mitigating context found", "rule_id": "SEC114", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "code|path_traversal|token|23|sec114"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/server/src/attachmentPaths.ts"}, "region": {"startLine": 23}}}]}, {"ruleId": "SEC114", "level": "error", "message": {"text": "[SEC114] path.join / Path() on user-controlled segment without containment check: filepath.Clean / path.Join on attacker-supplied segments does NOT prevent escape from the base directory. `../../../etc/passwd` resolves cleanly."}, "properties": {"repobilityId": 30376, "scanner": "repobility-threat-engine", "fingerprint": "966521501c759b97acab8d957376841cc3a0f384e2ea5390db9f3a76b6164b44", "category": "path_traversal", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": "path.join(staticRoot, request", "reason": "Pattern matched with no mitigating context found", "rule_id": "SEC114", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "code|path_traversal|token|125|sec114"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/desktop/src/electron/ElectronProtocol.ts"}, "region": {"startLine": 125}}}]}, {"ruleId": "SEC114", "level": "error", "message": {"text": "[SEC114] path.join / Path() on user-controlled segment without containment check: filepath.Clean / path.Join on attacker-supplied segments does NOT prevent escape from the base directory. `../../../etc/passwd` resolves cleanly."}, "properties": {"repobilityId": 30375, "scanner": "repobility-threat-engine", "fingerprint": "27bfd089e5878c601e5bcc340ac543d0e39a3f35ea973aa616f0fa8e8e2ee9d5", "category": "path_traversal", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": "path.resolve(input", "reason": "Pattern matched with no mitigating context found", "rule_id": "SEC114", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "code|path_traversal|token|155|sec114"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/desktop/src/app/DesktopEnvironment.ts"}, "region": {"startLine": 155}}}]}, {"ruleId": "SEC029", "level": "error", "message": {"text": "[SEC029] Server-Side Request Forgery (SSRF) \u2014 outbound HTTP from user input: Outbound HTTP request to a user-controlled URL without allowlist validation. Attackers can probe internal services (169.254.169.254 metadata, internal Kubernetes endpoints, file:// URIs), exfiltrate data, or pivot through your network. SSRF is OWASP A10:2021 and a frequent foothold in cloud breaches."}, "properties": {"repobilityId": 30373, "scanner": "repobility-threat-engine", "fingerprint": "ca2a7a3af8361816cb17ef6dce5b1259f83ced2da4c56fd3e16a5417d25f0740", "category": "ssrf", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": "URL(v", "reason": "Pattern matched with no mitigating context found", "rule_id": "SEC029", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "fp|ca2a7a3af8361816cb17ef6dce5b1259f83ced2da4c56fd3e16a5417d25f0740"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/desktop/src/backend/DesktopServerExposure.ts"}, "region": {"startLine": 83}}}]}, {"ruleId": "SEC029", "level": "error", "message": {"text": "[SEC029] Server-Side Request Forgery (SSRF) \u2014 outbound HTTP from user input: Outbound HTTP request to a user-controlled URL without allowlist validation. Attackers can probe internal services (169.254.169.254 metadata, internal Kubernetes endpoints, file:// URIs), exfiltrate data, or pivot through your network. SSRF is OWASP A10:2021 and a frequent foothold in cloud breaches."}, "properties": {"repobilityId": 30372, "scanner": "repobility-threat-engine", "fingerprint": "2bd0f47c47bf10c3dcbc3ee57d7e801a4c9b497b0b9e1ab4bba3548a0cbcdde3", "category": "ssrf", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": "URL(B", "reason": "Pattern matched with no mitigating context found", "rule_id": "SEC029", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "fp|2bd0f47c47bf10c3dcbc3ee57d7e801a4c9b497b0b9e1ab4bba3548a0cbcdde3"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/desktop/src/backend/DesktopBackendManager.ts"}, "region": {"startLine": 183}}}]}, {"ruleId": "SEC029", "level": "error", "message": {"text": "[SEC029] Server-Side Request Forgery (SSRF) \u2014 outbound HTTP from user input: Outbound HTTP request to a user-controlled URL without allowlist validation. Attackers can probe internal services (169.254.169.254 metadata, internal Kubernetes endpoints, file:// URIs), exfiltrate data, or pivot through your network. SSRF is OWASP A10:2021 and a frequent foothold in cloud breaches."}, "properties": {"repobilityId": 30371, "scanner": "repobility-threat-engine", "fingerprint": "4ee6503279e5fc90a3f50c15e64524297c0319b8a583cea43596c00de7626f8e", "category": "ssrf", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": "URL(d", "reason": "Pattern matched with no mitigating context found", "rule_id": "SEC029", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "fp|4ee6503279e5fc90a3f50c15e64524297c0319b8a583cea43596c00de7626f8e"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/desktop/scripts/dev-electron.mjs"}, "region": {"startLine": 13}}}]}, {"ruleId": "MINED019", "level": "error", "message": {"text": "[MINED019] Ssti Jinja From String: jinja2.Environment().from_string(user_input) \u2014 full RCE via templates."}, "properties": {"repobilityId": 30739, "scanner": "repobility-threat-engine", "fingerprint": "1dedc49536a3efa1b793778ba331e0846943734ed15a7a331ffbe4caefebbf6a", "category": "quality", "severity": "critical", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "ssti-jinja-from-string", "owasp": "A03:2021", "cwe_ids": ["CWE-94"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.347943+00:00", "triaged_in_corpus": 20, "observations_count": 47984, "ai_coder_pattern_id": 34}, "scanner": "repobility-threat-engine", "correlation_key": "fp|1dedc49536a3efa1b793778ba331e0846943734ed15a7a331ffbe4caefebbf6a"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/desktop/src/electron/ElectronMenu.ts"}, "region": {"startLine": 145}}}]}]}]}