{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-59868562782cd0f8", "name": "Privileged port 1000 in use", "shortDescription": {"text": "Privileged port 1000 in use"}, "fullDescription": {"text": "Port 1000 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e066691601852931", "name": "Docker base image is tag-pinned but not digest-pinned: python:3.11-slim", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: python:3.11-slim"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c02cdc2c2891b779", "name": "Runtime dotenv file present in repo: .env.swarm", "shortDescription": {"text": "Runtime dotenv file present in repo: .env.swarm"}, "fullDescription": {"text": "`.env.swarm` looks like a runtime dotenv file. It contains secret-looking assignments for NEUROERP_PASS. Move real values to a secret manager and keep only `.env.example` style templates in source control."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-634694189e843739", "name": "Insecure pattern 'node_child_process' in playwright.global-setup.mjs:1", "shortDescription": {"text": "Insecure pattern 'node_child_process' in playwright.global-setup.mjs:1"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7d6b8f15871c55a0", "name": "Insecure pattern 'node_child_process' in playwright.global-teardown.mjs:1", "shortDescription": {"text": "Insecure pattern 'node_child_process' in playwright.global-teardown.mjs:1"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-eadafbec4bc98405", "name": "Insecure pattern 'node_child_process' in setup-storybook.mjs:12", "shortDescription": {"text": "Insecure pattern 'node_child_process' in setup-storybook.mjs:12"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-12605dd10cf5eefa", "name": "Insecure pattern 'local_storage_auth_token' in lint-results.json:5", "shortDescription": {"text": "Insecure pattern 'local_storage_auth_token' in lint-results.json:5"}, "fullDescription": {"text": "Found a known-risky pattern (local_storage_auth_token). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2336738dc64628ae", "name": "Insecure pattern 'document_write' in .coderabbit.yaml:71", "shortDescription": {"text": "Insecure pattern 'document_write' in .coderabbit.yaml:71"}, "fullDescription": {"text": "Found a known-risky pattern (document_write). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d0f53eee13d03ab1", "name": "Insecure pattern 'dangerous_innerhtml' in .coderabbit.yaml:71", "shortDescription": {"text": "Insecure pattern 'dangerous_innerhtml' in .coderabbit.yaml:71"}, "fullDescription": {"text": "Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7622d3d23cddb7b7", "name": "Insecure pattern 'cors_wildcard' in main.py:221", "shortDescription": {"text": "Insecure pattern 'cors_wildcard' in main.py:221"}, "fullDescription": {"text": "Found a known-risky pattern (cors_wildcard). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-109553ba766024f9", "name": "Insecure pattern 'node_child_process' in playwright.global-setup.ts:1", "shortDescription": {"text": "Insecure pattern 'node_child_process' in playwright.global-setup.ts:1"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-cb639d9a10a47b23", "name": "package.json defines install-time lifecycle scripts", "shortDescription": {"text": "package.json defines install-time lifecycle scripts"}, "fullDescription": {"text": "preinstall/install/postinstall/prepare scripts execute during dependency installation. Review them carefully for network calls, obfuscation, shell execution, or credential access."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4b8062bcb76ad4e7", "name": "Very large file: tmp_lieferschein_head.tsx (2523 lines)", "shortDescription": {"text": "Very large file: tmp_lieferschein_head.tsx (2523 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6893a6c8b0861585", "name": "Very low test-to-source ratio", "shortDescription": {"text": "Very low test-to-source ratio"}, "fullDescription": {"text": "3 test file(s) for 33 source file(s) (ratio 0.09). Consider adding integration or unit tests for critical paths."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 794 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-749d4bc1bd66df5f", "name": "Agent instructions exist but release-hardening basics are missing", "shortDescription": {"text": "Agent instructions exist but release-hardening basics are missing"}, "fullDescription": {"text": "AI-coder instruction files were found, but the repo is missing ci. Treat this as a contract gap: the agent is guided, but the generated output is not yet guarded by the controls that make it repeatable."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-bea357a6497a2d5d", "name": "Agent authority lacks a verifier contract: CLAUDE.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: CLAUDE.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9b2cff056c2cb35d", "name": "Agent authority lacks a verifier contract: .continuerc.json", "shortDescription": {"text": "Agent authority lacks a verifier contract: .continuerc.json"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7b2bc46e3fcd81bb", "name": "Legacy-named symbol `policies_v1` in main.py:23", "shortDescription": {"text": "Legacy-named symbol `policies_v1` in main.py:23"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d0b17c8c07a7421d", "name": "8 env vars used in code but missing from .env.example", "shortDescription": {"text": "8 env vars used in code but missing from .env.example"}, "fullDescription": {"text": "Drift between code and config docs. The first few: `CI`, `FRONTEND_URL`, `NEUROERP_URL`, `PLAYWRIGHT_FORCE_SPAWN`, `PLAYWRIGHT_FRONTEND_PROBE_MS`, `PLAYWRIGHT_PREVIEW_PORT`, `PLAYWRIGHT_SSE_URL`, `VALEO_BASE_URL`. Add them (with a placeholder/comment) to .env.example so onboarding doesn't break."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f146c97add72cbb1", "name": "FastAPI POST `mcp_kpis_stub` without auth dependency \u2014 main.py:449", "shortDescription": {"text": "FastAPI POST `mcp_kpis_stub` without auth dependency \u2014 main.py:449"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-885faff2f38f3708", "name": "FastAPI POST `mcp_trends_stub` without auth dependency \u2014 main.py:454", "shortDescription": {"text": "FastAPI POST `mcp_trends_stub` without auth dependency \u2014 main.py:454"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-d684883c81ff0886", "name": "FastAPI POST `mcp_copilot_forecast_stub` without auth dependency \u2014 main.py:459", "shortDescription": {"text": "FastAPI POST `mcp_copilot_forecast_stub` without auth dependency \u2014 main.py:459"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/26901"}, "properties": {"repository": "JochenWeerda/VALEO-NeuroERP-3.0", "repoUrl": "https://github.com/JochenWeerda/VALEO-NeuroERP-3.0", "branch": "main"}, "results": [{"ruleId": "scanner-59868562782cd0f8", "level": "warning", "message": {"text": "Privileged port 1000 in use"}, "properties": {"repobilityId": "5ac9fc9372cfe169", "scanner": "scanner-primary", "fingerprint": "59868562782cd0f8", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Dockerfile"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e066691601852931", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: python:3.11-slim"}, "properties": {"repobilityId": "9fb40b87187d743e", "scanner": "scanner-primary", "fingerprint": "e066691601852931", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Dockerfile"}, "region": {"startLine": 3}}}]}, {"ruleId": "scanner-e066691601852931", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: python:3.11-slim"}, "properties": {"repobilityId": "5b097cb875de73e2", "scanner": "scanner-primary", "fingerprint": "e066691601852931", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Dockerfile"}, "region": {"startLine": 21}}}]}, {"ruleId": "scanner-c02cdc2c2891b779", "level": "error", "message": {"text": "Runtime dotenv file present in repo: .env.swarm"}, "properties": {"repobilityId": "66b2ed80ab888c22", "scanner": "scanner-primary", "fingerprint": "c02cdc2c2891b779", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets", "config", "env-file", "runtime-env", "env_file_with_secret"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".env.swarm"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-634694189e843739", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in playwright.global-setup.mjs:1"}, "properties": {"repobilityId": "5bdf783bc5643b2c", "scanner": "scanner-primary", "fingerprint": "634694189e843739", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "playwright.global-setup.mjs"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-7d6b8f15871c55a0", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in playwright.global-teardown.mjs:1"}, "properties": {"repobilityId": "fe5c3abbe79d336f", "scanner": "scanner-primary", "fingerprint": "7d6b8f15871c55a0", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "playwright.global-teardown.mjs"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-eadafbec4bc98405", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in setup-storybook.mjs:12"}, "properties": {"repobilityId": "34e3c7bfe8ac861e", "scanner": "scanner-primary", "fingerprint": "eadafbec4bc98405", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "setup-storybook.mjs"}, "region": {"startLine": 12}}}]}, {"ruleId": "scanner-12605dd10cf5eefa", "level": "warning", "message": {"text": "Insecure pattern 'local_storage_auth_token' in lint-results.json:5"}, "properties": {"repobilityId": "a4aea7b0c998b366", "scanner": "scanner-primary", "fingerprint": "12605dd10cf5eefa", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "local_storage_auth_token"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "lint-results.json"}, "region": {"startLine": 5}}}]}, {"ruleId": "scanner-2336738dc64628ae", "level": "note", "message": {"text": "Insecure pattern 'document_write' in .coderabbit.yaml:71"}, "properties": {"repobilityId": "d9421e25e29df7c3", "scanner": "scanner-primary", "fingerprint": "2336738dc64628ae", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["owasp", "document_write"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".coderabbit.yaml"}, "region": {"startLine": 71}}}]}, {"ruleId": "scanner-d0f53eee13d03ab1", "level": "warning", "message": {"text": "Insecure pattern 'dangerous_innerhtml' in .coderabbit.yaml:71"}, "properties": {"repobilityId": "77d338624ea33629", "scanner": "scanner-primary", "fingerprint": "d0f53eee13d03ab1", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "dangerous_innerhtml"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".coderabbit.yaml"}, "region": {"startLine": 71}}}]}, {"ruleId": "scanner-7622d3d23cddb7b7", "level": "warning", "message": {"text": "Insecure pattern 'cors_wildcard' in main.py:221"}, "properties": {"repobilityId": "7efce937690fb5d6", "scanner": "scanner-primary", "fingerprint": "7622d3d23cddb7b7", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "cors_wildcard"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "main.py"}, "region": {"startLine": 221}}}]}, {"ruleId": "scanner-109553ba766024f9", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in playwright.global-setup.ts:1"}, "properties": {"repobilityId": "ca1e902e04200204", "scanner": "scanner-primary", "fingerprint": "109553ba766024f9", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "playwright.global-setup.ts"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-cb639d9a10a47b23", "level": "note", "message": {"text": "package.json defines install-time lifecycle scripts"}, "properties": {"repobilityId": "b86179956da3a4a8", "scanner": "scanner-primary", "fingerprint": "cb639d9a10a47b23", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "npm", "install-scripts"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-4b8062bcb76ad4e7", "level": "note", "message": {"text": "Very large file: tmp_lieferschein_head.tsx (2523 lines)"}, "properties": {"repobilityId": "60f34978f88ec7fa", "scanner": "scanner-primary", "fingerprint": "4b8062bcb76ad4e7", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-6893a6c8b0861585", "level": "warning", "message": {"text": "Very low test-to-source ratio"}, "properties": {"repobilityId": "54a7de3f06314bf0", "scanner": "scanner-primary", "fingerprint": "6893a6c8b0861585", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["tests", "coverage"]}}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "fac3952de56fe7b6", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "1d705458032229fa", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-749d4bc1bd66df5f", "level": "warning", "message": {"text": "Agent instructions exist but release-hardening basics are missing"}, "properties": {"repobilityId": "5cc1a608588c0dc8", "scanner": "scanner-primary", "fingerprint": "749d4bc1bd66df5f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-bea357a6497a2d5d", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: CLAUDE.md"}, "properties": {"repobilityId": "aae72df3934829ac", "scanner": "scanner-primary", "fingerprint": "bea357a6497a2d5d", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "CLAUDE.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-9b2cff056c2cb35d", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .continuerc.json"}, "properties": {"repobilityId": "9adb4a6f0cabebc7", "scanner": "scanner-primary", "fingerprint": "9b2cff056c2cb35d", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "agent_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".continuerc.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-7b2bc46e3fcd81bb", "level": "note", "message": {"text": "Legacy-named symbol `policies_v1` in main.py:23"}, "properties": {"repobilityId": "d84717370ad71ae8", "scanner": "scanner-primary", "fingerprint": "7b2bc46e3fcd81bb", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-d0b17c8c07a7421d", "level": "note", "message": {"text": "8 env vars used in code but missing from .env.example"}, "properties": {"repobilityId": "17fe720e8247f9df", "scanner": "scanner-primary", "fingerprint": "d0b17c8c07a7421d", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "config-drift"]}}, {"ruleId": "scanner-f146c97add72cbb1", "level": "error", "message": {"text": "FastAPI POST `mcp_kpis_stub` without auth dependency \u2014 main.py:449"}, "properties": {"repobilityId": "2f6dbb0c5ff99690", "scanner": "scanner-primary", "fingerprint": "f146c97add72cbb1", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "main.py"}, "region": {"startLine": 449}}}]}, {"ruleId": "scanner-885faff2f38f3708", "level": "error", "message": {"text": "FastAPI POST `mcp_trends_stub` without auth dependency \u2014 main.py:454"}, "properties": {"repobilityId": "d93f8d11d323b2d7", "scanner": "scanner-primary", "fingerprint": "885faff2f38f3708", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "main.py"}, "region": {"startLine": 454}}}]}, {"ruleId": "scanner-d684883c81ff0886", "level": "error", "message": {"text": "FastAPI POST `mcp_copilot_forecast_stub` without auth dependency \u2014 main.py:459"}, "properties": {"repobilityId": "edd501b1a8a3f05c", "scanner": "scanner-primary", "fingerprint": "d684883c81ff0886", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "main.py"}, "region": {"startLine": 459}}}]}]}]}