{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-bead75b0f9233e05", "name": "No API endpoints detected", "shortDescription": {"text": "No API endpoints detected"}, "fullDescription": {"text": "The scanner did not find FastAPI/Flask/Express/NestJS/GraphQL/gRPC routes. If this repo exposes APIs, the framework may be unsupported."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "info", "confidence": 1.0}}, {"id": "scanner-2ff9a194078e39ff", "name": "`dangerouslySetInnerHTML` used in a React component \u2014 packages/analytics/src/GoogleTagManager.tsx:36", "shortDescription": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 packages/analytics/src/GoogleTagManager.tsx:36"}, "fullDescription": {"text": "Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library.\n\nWhy: OWASP basics. Already partially flagged by the security analyzer.\nRule id: fq.dangerous-html"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-fe8cf2dc1c8e3136", "name": "`dangerouslySetInnerHTML` used in a React component \u2014 packages/analytics/src/GtagBootstrap.tsx:69", "shortDescription": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 packages/analytics/src/GtagBootstrap.tsx:69"}, "fullDescription": {"text": "Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library.\n\nWhy: OWASP basics. Already partially flagged by the security analyzer.\nRule id: fq.dangerous-html"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a972e1d05221ebe3", "name": "`dangerouslySetInnerHTML` used in a React component \u2014 packages/analytics/src/LinkedInInsightTag.tsx:45", "shortDescription": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 packages/analytics/src/LinkedInInsightTag.tsx:45"}, "fullDescription": {"text": "Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library.\n\nWhy: OWASP basics. Already partially flagged by the security analyzer.\nRule id: fq.dangerous-html"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e959b956bade2088", "name": "`dangerouslySetInnerHTML` used in a React component \u2014 packages/analytics/src/FacebookPixel.tsx:66", "shortDescription": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 packages/analytics/src/FacebookPixel.tsx:66"}, "fullDescription": {"text": "Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library.\n\nWhy: OWASP basics. Already partially flagged by the security analyzer.\nRule id: fq.dangerous-html"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1eac594b4d862c45", "name": "Stray `console.log` in TS/JS \u2014 packages/switch-env/test/shared/kitchenSinkScenarios.ts:76", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 packages/switch-env/test/shared/kitchenSinkScenarios.ts:76"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-aa5acaa49eb8315b", "name": "Containers defined but no K8s/orchestration manifest found", "shortDescription": {"text": "Containers defined but no K8s/orchestration manifest found"}, "fullDescription": {"text": "Repo has Dockerfiles/compose but no Kubernetes/Nomad manifests. If the target deployment is K8s, the manifests may live in a separate ops repo."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-60d8a0a6e5ff7918", "name": "Runtime dotenv file present in repo: packages/payload-utilities/dev/.env.development", "shortDescription": {"text": "Runtime dotenv file present in repo: packages/payload-utilities/dev/.env.development"}, "fullDescription": {"text": "`packages/payload-utilities/dev/.env.development` looks like a runtime dotenv file. It contains secret-looking assignments for PAYLOAD_SECRET. Move real values to a secret manager and keep only `.env.example` style templates in source control."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-857ddaf3f21414b8", "name": "Insecure pattern 'node_child_process' in scripts/resolve-payload-matrix.mjs:2", "shortDescription": {"text": "Insecure pattern 'node_child_process' in scripts/resolve-payload-matrix.mjs:2"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-956c5ecbd8cb1bec", "name": "Insecure pattern 'node_child_process' in scripts/check-package-exports.mjs:2", "shortDescription": {"text": "Insecure pattern 'node_child_process' in scripts/check-package-exports.mjs:2"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-619cb7938022317c", "name": "Insecure pattern 'dangerous_innerhtml' in packages/analytics/src/GoogleTagManager.tsx:36", "shortDescription": {"text": "Insecure pattern 'dangerous_innerhtml' in packages/analytics/src/GoogleTagManager.tsx:36"}, "fullDescription": {"text": "Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7939f1355e30762e", "name": "Insecure pattern 'dangerous_innerhtml' in packages/analytics/src/GtagBootstrap.tsx:69", "shortDescription": {"text": "Insecure pattern 'dangerous_innerhtml' in packages/analytics/src/GtagBootstrap.tsx:69"}, "fullDescription": {"text": "Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-28b683ba17898980", "name": "Insecure pattern 'dangerous_innerhtml' in packages/analytics/src/LinkedInInsightTag.tsx:45", "shortDescription": {"text": "Insecure pattern 'dangerous_innerhtml' in packages/analytics/src/LinkedInInsightTag.tsx:45"}, "fullDescription": {"text": "Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-fd43ed8733e55b25", "name": "Insecure pattern 'dangerous_innerhtml' in packages/analytics/src/FacebookPixel.tsx:66", "shortDescription": {"text": "Insecure pattern 'dangerous_innerhtml' in packages/analytics/src/FacebookPixel.tsx:66"}, "fullDescription": {"text": "Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1838a141491ce38c", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea3b5e389d8c9c0f", "name": "Low test-to-source ratio", "shortDescription": {"text": "Low test-to-source ratio"}, "fullDescription": {"text": "26 tests / 148 src (ratio 0.18)."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3fe7d4fef20a9c84", "name": "Node manifest has dependencies but no lockfile: packages/select-search-field/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: packages/select-search-field/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-95d55dd25357c15e", "name": "Node manifest has dependencies but no lockfile: packages/analytics/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: packages/analytics/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-bca37daaeefbecd8", "name": "Node manifest has dependencies but no lockfile: packages/payload-utilities/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: packages/payload-utilities/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5833d09574732e44", "name": "Node manifest has dependencies but no lockfile: packages/block-settings/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: packages/block-settings/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cfffa27b3dc88bfa", "name": "Node manifest has dependencies but no lockfile: packages/switch-env/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: packages/switch-env/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a14d56e1587b5d21", "name": "Node manifest has dependencies but no lockfile: tools/dev-fixture/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: tools/dev-fixture/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-749d4bc1bd66df5f", "name": "Agent instructions exist but release-hardening basics are missing", "shortDescription": {"text": "Agent instructions exist but release-hardening basics are missing"}, "fullDescription": {"text": "AI-coder instruction files were found, but the repo is missing lockfile. Treat this as a contract gap: the agent is guided, but the generated output is not yet guarded by the controls that make it repeatable."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-2679282aa1c484b5", "name": "Agent authority lacks a verifier contract: AGENTS.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: AGENTS.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e725d2ab884fbd49", "name": "Multiple root agent instruction files without precedence", "shortDescription": {"text": "Multiple root agent instruction files without precedence"}, "fullDescription": {"text": "The repo has multiple top-level AI-coder instruction files. Without precedence rules, different agents may follow different policies."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e23ab6e535f23c2f", "name": "Commented-code block (9 lines) in packages/analytics/dev/postcss.config.mjs:5", "shortDescription": {"text": "Commented-code block (9 lines) in packages/analytics/dev/postcss.config.mjs:5"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-56d221f5e7574f5e", "name": "Commented-code block (5 lines) in packages/switch-env/test/shared/kitchenSinkScenarios.ts:144", "shortDescription": {"text": "Commented-code block (5 lines) in packages/switch-env/test/shared/kitchenSinkScenarios.ts:144"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-c8c1cea3905a1b48", "name": "Commented-code block (7 lines) in packages/switch-env/test/mongo/superseded-filename-index.spec.ts:10", "shortDescription": {"text": "Commented-code block (7 lines) in packages/switch-env/test/mongo/superseded-filename-index.spec.ts:10"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-11bec7400c0afcad", "name": "Commented-code block (6 lines) in packages/switch-env/test/sqlite/prod-push-disabled.spec.ts:35", "shortDescription": {"text": "Commented-code block (6 lines) in packages/switch-env/test/sqlite/prod-push-disabled.spec.ts:35"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-04fa2c55df7c4d5b", "name": "Commented-code block (7 lines) in packages/switch-env/test/sqlite/upload-dedup.spec.ts:26", "shortDescription": {"text": "Commented-code block (7 lines) in packages/switch-env/test/sqlite/upload-dedup.spec.ts:26"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-4e1b83c20494998e", "name": "Commented-code block (8 lines) in packages/switch-env/src/plugin.ts:224", "shortDescription": {"text": "Commented-code block (8 lines) in packages/switch-env/src/plugin.ts:224"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-71fec4f83a5daa68", "name": "Commented-code block (5 lines) in packages/switch-env/src/lib/collectionConfig.ts:112", "shortDescription": {"text": "Commented-code block (5 lines) in packages/switch-env/src/lib/collectionConfig.ts:112"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-d1039e7a938b1829", "name": "`fetch()` without try/.catch or AbortSignal \u2014 packages/switch-env/src/lib/api-endpoints/switch.ts:167", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 packages/switch-env/src/lib/api-endpoints/switch.ts:167"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a53a17ad230c9297", "name": "Commented-code block (5 lines) in packages/switch-env/src/lib/db/sql.ts:393", "shortDescription": {"text": "Commented-code block (5 lines) in packages/switch-env/src/lib/db/sql.ts:393"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-6d271b1bcfc8dbac", "name": "Commented-code block (6 lines) in packages/switch-env/src/lib/db/getDbaFunction.ts:7", "shortDescription": {"text": "Commented-code block (6 lines) in packages/switch-env/src/lib/db/getDbaFunction.ts:7"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-8da4eaacb2c7baa7", "name": "Commented-code block (5 lines) in packages/switch-env/src/lib/db/dropSupersededFilenameIndexes.ts:139", "shortDescription": {"text": "Commented-code block (5 lines) in packages/switch-env/src/lib/db/dropSupersededFilenameIndexes.ts:139"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-d785c17821858dcb", "name": "22 env vars used in code but missing from .env.example", "shortDescription": {"text": "22 env vars used in code but missing from .env.example"}, "fullDescription": {"text": "Drift between code and config docs. The first few: `ADMIN_EMAIL`, `APP_ENV`, `CI`, `DB_ADAPTER`, `DEVELOPMENT_MONGODB_URI`, `DEVELOPMENT_SQLITE_URL`, `GITHUB_OUTPUT`, `NEXT_BASE_PATH` + 14 more. Add them (with a placeholder/comment) to .env.example so onboarding doesn't break."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/22687"}, "properties": {"repository": "what-works-global/payload-packages", "repoUrl": "https://github.com/what-works-global/payload-packages", "branch": "main"}, "results": [{"ruleId": "scanner-bead75b0f9233e05", "level": "none", "message": {"text": "No API endpoints detected"}, "properties": {"repobilityId": "0f8bb852027c38f8", "scanner": "scanner-primary", "fingerprint": "bead75b0f9233e05", "layer": "api", "severity": "info", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-2ff9a194078e39ff", "level": "warning", "message": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 packages/analytics/src/GoogleTagManager.tsx:36"}, "properties": {"repobilityId": "55b7268a969ad429", "scanner": "scanner-primary", "fingerprint": "2ff9a194078e39ff", "layer": "frontend", "severity": "medium", "confidence": 1.0, "tags": ["frontend-quality", "fq.dangerous-html"]}}, {"ruleId": "scanner-fe8cf2dc1c8e3136", "level": "warning", "message": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 packages/analytics/src/GtagBootstrap.tsx:69"}, "properties": {"repobilityId": "2e1f09d09fde3d76", "scanner": "scanner-primary", "fingerprint": "fe8cf2dc1c8e3136", "layer": "frontend", "severity": "medium", "confidence": 1.0, "tags": ["frontend-quality", "fq.dangerous-html"]}}, {"ruleId": "scanner-a972e1d05221ebe3", "level": "warning", "message": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 packages/analytics/src/LinkedInInsightTag.tsx:45"}, "properties": {"repobilityId": "57b4196658e54270", "scanner": "scanner-primary", "fingerprint": "a972e1d05221ebe3", "layer": "frontend", "severity": "medium", "confidence": 1.0, "tags": ["frontend-quality", "fq.dangerous-html"]}}, {"ruleId": "scanner-e959b956bade2088", "level": "warning", "message": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 packages/analytics/src/FacebookPixel.tsx:66"}, "properties": {"repobilityId": "afd842a9226ca445", "scanner": "scanner-primary", "fingerprint": "e959b956bade2088", "layer": "frontend", "severity": "medium", "confidence": 1.0, "tags": ["frontend-quality", "fq.dangerous-html"]}}, {"ruleId": "scanner-1eac594b4d862c45", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 packages/switch-env/test/shared/kitchenSinkScenarios.ts:76"}, "properties": {"repobilityId": "dd71e031baa63ae2", "scanner": "scanner-primary", "fingerprint": "1eac594b4d862c45", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-aa5acaa49eb8315b", "level": "note", "message": {"text": "Containers defined but no K8s/orchestration manifest found"}, "properties": {"repobilityId": "b230ea9b68736081", "scanner": "scanner-primary", "fingerprint": "aa5acaa49eb8315b", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["coverage", "deployment"]}}, {"ruleId": "scanner-60d8a0a6e5ff7918", "level": "error", "message": {"text": "Runtime dotenv file present in repo: packages/payload-utilities/dev/.env.development"}, "properties": {"repobilityId": "0d48912bf26c82d9", "scanner": "scanner-primary", "fingerprint": "60d8a0a6e5ff7918", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets", "config", "env-file", "runtime-env", "env_file_with_secret"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/payload-utilities/dev/.env.development"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-857ddaf3f21414b8", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in scripts/resolve-payload-matrix.mjs:2"}, "properties": {"repobilityId": "4324bb4010c088c2", "scanner": "scanner-primary", "fingerprint": "857ddaf3f21414b8", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/resolve-payload-matrix.mjs"}, "region": {"startLine": 2}}}]}, {"ruleId": "scanner-956c5ecbd8cb1bec", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in scripts/check-package-exports.mjs:2"}, "properties": {"repobilityId": "1dfffba734be3cc1", "scanner": "scanner-primary", "fingerprint": "956c5ecbd8cb1bec", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/check-package-exports.mjs"}, "region": {"startLine": 2}}}]}, {"ruleId": "scanner-619cb7938022317c", "level": "warning", "message": {"text": "Insecure pattern 'dangerous_innerhtml' in packages/analytics/src/GoogleTagManager.tsx:36"}, "properties": {"repobilityId": "5985198c4ad55bd2", "scanner": "scanner-primary", "fingerprint": "619cb7938022317c", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "dangerous_innerhtml"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/analytics/src/GoogleTagManager.tsx"}, "region": {"startLine": 36}}}]}, {"ruleId": "scanner-7939f1355e30762e", "level": "warning", "message": {"text": "Insecure pattern 'dangerous_innerhtml' in packages/analytics/src/GtagBootstrap.tsx:69"}, "properties": {"repobilityId": "c190568b332e546d", "scanner": "scanner-primary", "fingerprint": "7939f1355e30762e", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "dangerous_innerhtml"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/analytics/src/GtagBootstrap.tsx"}, "region": {"startLine": 69}}}]}, {"ruleId": "scanner-28b683ba17898980", "level": "warning", "message": {"text": "Insecure pattern 'dangerous_innerhtml' in packages/analytics/src/LinkedInInsightTag.tsx:45"}, "properties": {"repobilityId": "2b31b2b1af4cf689", "scanner": "scanner-primary", "fingerprint": "28b683ba17898980", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "dangerous_innerhtml"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/analytics/src/LinkedInInsightTag.tsx"}, "region": {"startLine": 45}}}]}, {"ruleId": "scanner-fd43ed8733e55b25", "level": "warning", "message": {"text": "Insecure pattern 'dangerous_innerhtml' in packages/analytics/src/FacebookPixel.tsx:66"}, "properties": {"repobilityId": "bba2997a4230ac7b", "scanner": "scanner-primary", "fingerprint": "fd43ed8733e55b25", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "dangerous_innerhtml"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/analytics/src/FacebookPixel.tsx"}, "region": {"startLine": 66}}}]}, {"ruleId": "scanner-1838a141491ce38c", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "b8fd4f5048f96576", "scanner": "scanner-primary", "fingerprint": "1838a141491ce38c", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ea3b5e389d8c9c0f", "level": "note", "message": {"text": "Low test-to-source ratio"}, "properties": {"repobilityId": "ef7b2552cc00a375", "scanner": "scanner-primary", "fingerprint": "ea3b5e389d8c9c0f", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["tests"]}}, {"ruleId": "scanner-3fe7d4fef20a9c84", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: packages/select-search-field/package.json"}, "properties": {"repobilityId": "32232bb1dc64e9a6", "scanner": "scanner-primary", "fingerprint": "3fe7d4fef20a9c84", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/select-search-field/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-95d55dd25357c15e", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: packages/analytics/package.json"}, "properties": {"repobilityId": "45ff49581bf000e8", "scanner": "scanner-primary", "fingerprint": "95d55dd25357c15e", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/analytics/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-bca37daaeefbecd8", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: packages/payload-utilities/package.json"}, "properties": {"repobilityId": "5dc401d15c9df492", "scanner": "scanner-primary", "fingerprint": "bca37daaeefbecd8", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/payload-utilities/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-5833d09574732e44", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: packages/block-settings/package.json"}, "properties": {"repobilityId": "cf3271f4d394fe4b", "scanner": "scanner-primary", "fingerprint": "5833d09574732e44", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/block-settings/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-cfffa27b3dc88bfa", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: packages/switch-env/package.json"}, "properties": {"repobilityId": "c822635cd6d55a76", "scanner": "scanner-primary", "fingerprint": "cfffa27b3dc88bfa", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/switch-env/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a14d56e1587b5d21", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: tools/dev-fixture/package.json"}, "properties": {"repobilityId": "b141750eceffde1e", "scanner": "scanner-primary", "fingerprint": "a14d56e1587b5d21", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/dev-fixture/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-749d4bc1bd66df5f", "level": "warning", "message": {"text": "Agent instructions exist but release-hardening basics are missing"}, "properties": {"repobilityId": "b0222d3889c75b7f", "scanner": "scanner-primary", "fingerprint": "749d4bc1bd66df5f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "3dd2aa16f32fe884", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "5c799c0f2ce82176", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-2679282aa1c484b5", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: AGENTS.md"}, "properties": {"repobilityId": "27d579812e6be614", "scanner": "scanner-primary", "fingerprint": "2679282aa1c484b5", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "agents_md"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "AGENTS.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e725d2ab884fbd49", "level": "note", "message": {"text": "Multiple root agent instruction files without precedence"}, "properties": {"repobilityId": "1953db6c89508d22", "scanner": "scanner-primary", "fingerprint": "e725d2ab884fbd49", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["agent-instructions", "governance"]}}, {"ruleId": "scanner-e23ab6e535f23c2f", "level": "none", "message": {"text": "Commented-code block (9 lines) in packages/analytics/dev/postcss.config.mjs:5"}, "properties": {"repobilityId": "38bf6db84fcd3d87", "scanner": "scanner-primary", "fingerprint": "e23ab6e535f23c2f", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-56d221f5e7574f5e", "level": "none", "message": {"text": "Commented-code block (5 lines) in packages/switch-env/test/shared/kitchenSinkScenarios.ts:144"}, "properties": {"repobilityId": "0eaf90467c8d0285", "scanner": "scanner-primary", "fingerprint": "56d221f5e7574f5e", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-c8c1cea3905a1b48", "level": "none", "message": {"text": "Commented-code block (7 lines) in packages/switch-env/test/mongo/superseded-filename-index.spec.ts:10"}, "properties": {"repobilityId": "30d988db4768fdff", "scanner": "scanner-primary", "fingerprint": "c8c1cea3905a1b48", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-11bec7400c0afcad", "level": "none", "message": {"text": "Commented-code block (6 lines) in packages/switch-env/test/sqlite/prod-push-disabled.spec.ts:35"}, "properties": {"repobilityId": "cf743aa23d56d904", "scanner": "scanner-primary", "fingerprint": "11bec7400c0afcad", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-04fa2c55df7c4d5b", "level": "none", "message": {"text": "Commented-code block (7 lines) in packages/switch-env/test/sqlite/upload-dedup.spec.ts:26"}, "properties": {"repobilityId": "7fb26eebf22cb31f", "scanner": "scanner-primary", "fingerprint": "04fa2c55df7c4d5b", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-4e1b83c20494998e", "level": "none", "message": {"text": "Commented-code block (8 lines) in packages/switch-env/src/plugin.ts:224"}, "properties": {"repobilityId": "f1f7074422ce98da", "scanner": "scanner-primary", "fingerprint": "4e1b83c20494998e", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-71fec4f83a5daa68", "level": "none", "message": {"text": "Commented-code block (5 lines) in packages/switch-env/src/lib/collectionConfig.ts:112"}, "properties": {"repobilityId": "f226a93ed4c3baa9", "scanner": "scanner-primary", "fingerprint": "71fec4f83a5daa68", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-d1039e7a938b1829", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 packages/switch-env/src/lib/api-endpoints/switch.ts:167"}, "properties": {"repobilityId": "ed1d677e5237d741", "scanner": "scanner-primary", "fingerprint": "d1039e7a938b1829", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-a53a17ad230c9297", "level": "none", "message": {"text": "Commented-code block (5 lines) in packages/switch-env/src/lib/db/sql.ts:393"}, "properties": {"repobilityId": "87866bb17bad9ee6", "scanner": "scanner-primary", "fingerprint": "a53a17ad230c9297", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-6d271b1bcfc8dbac", "level": "none", "message": {"text": "Commented-code block (6 lines) in packages/switch-env/src/lib/db/getDbaFunction.ts:7"}, "properties": {"repobilityId": "3cf3efc4740befde", "scanner": "scanner-primary", "fingerprint": "6d271b1bcfc8dbac", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-8da4eaacb2c7baa7", "level": "none", "message": {"text": "Commented-code block (5 lines) in packages/switch-env/src/lib/db/dropSupersededFilenameIndexes.ts:139"}, "properties": {"repobilityId": "09adfeffb0d08c28", "scanner": "scanner-primary", "fingerprint": "8da4eaacb2c7baa7", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-d785c17821858dcb", "level": "note", "message": {"text": "22 env vars used in code but missing from .env.example"}, "properties": {"repobilityId": "f5222babac44ad42", "scanner": "scanner-primary", "fingerprint": "d785c17821858dcb", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "config-drift"]}}]}]}