{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-297148a7ef94aeb9", "name": "`truncate` class without `title=` for hover reveal \u2014 templates/qa-agent/src/components/qa-tester.tsx:425", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 templates/qa-agent/src/components/qa-tester.tsx:425"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-b31cac24b4ff482e", "name": "TODO/FIXME marker in shipping code \u2014 templates/embeddable-credits/src/app/api/llmgateway/session/route.ts:24", "shortDescription": {"text": "TODO/FIXME marker in shipping code \u2014 templates/embeddable-credits/src/app/api/llmgateway/session/route.ts:24"}, "fullDescription": {"text": "Track in /reviews or /issues, not as a code comment that rots.\n\nWhy: Drift control \u2014 shouldn't be the same as Quality TODO scanner.\nRule id: fq.todo-marker"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-542b4243bd76d90f", "name": "Stray `console.log` in TS/JS \u2014 packages/llmgateway-cli/src/commands/orgs.ts:18", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 packages/llmgateway-cli/src/commands/orgs.ts:18"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-bd6b0b409a185f7c", "name": "Stray `console.log` in TS/JS \u2014 packages/llmgateway-cli/src/commands/list.ts:10", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 packages/llmgateway-cli/src/commands/list.ts:10"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-45c4148d44b9c5e7", "name": "Stray `console.log` in TS/JS \u2014 packages/llmgateway-cli/src/commands/models.ts:50", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 packages/llmgateway-cli/src/commands/models.ts:50"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6100ae18f3115650", "name": "Stray `console.log` in TS/JS \u2014 packages/llmgateway-cli/src/commands/keys.ts:97", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 packages/llmgateway-cli/src/commands/keys.ts:97"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-48dbfbb64d16ac69", "name": "Stray `console.log` in TS/JS \u2014 packages/llmgateway-cli/src/commands/usage.ts:92", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 packages/llmgateway-cli/src/commands/usage.ts:92"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d24c9dea2f92e54c", "name": "Stray `console.log` in TS/JS \u2014 packages/llmgateway-cli/src/utils/logger.ts:4", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 packages/llmgateway-cli/src/utils/logger.ts:4"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c6e64e75ba818434", "name": "Stray `console.log` in TS/JS \u2014 agents/data-extractor-agent/src/index.ts:49", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 agents/data-extractor-agent/src/index.ts:49"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-02a54beedb181d67", "name": "Stray `console.log` in TS/JS \u2014 agents/email-drafter-agent/src/index.ts:64", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 agents/email-drafter-agent/src/index.ts:64"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-55c95649c6d55606", "name": "Stray `console.log` in TS/JS \u2014 agents/sentiment-analyzer-agent/src/index.ts:72", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 agents/sentiment-analyzer-agent/src/index.ts:72"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-05ecc163e02db2f9", "name": "Stray `console.log` in TS/JS \u2014 agents/changelog-generator-agent/src/index.ts:10", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 agents/changelog-generator-agent/src/index.ts:10"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b13288e51751c4ab", "name": "Stray `console.log` in TS/JS \u2014 agents/lead-agent/src/index.ts:12", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 agents/lead-agent/src/index.ts:12"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a542abd29ab5da03", "name": "Stray `console.log` in TS/JS \u2014 agents/weather-agent/src/index.ts:144", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 agents/weather-agent/src/index.ts:144"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6a2dc13e3f7e7a7e", "name": "Insecure pattern 'node_child_process' in packages/llmgateway-cli/src/commands/init.ts:6", "shortDescription": {"text": "Insecure pattern 'node_child_process' in packages/llmgateway-cli/src/commands/init.ts:6"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-86f4048eef53a76b", "name": "Insecure pattern 'node_child_process' in packages/llmgateway-cli/src/commands/dev.ts:1", "shortDescription": {"text": "Insecure pattern 'node_child_process' in packages/llmgateway-cli/src/commands/dev.ts:1"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a3dc3196d16ada33", "name": "Insecure pattern 'node_child_process' in packages/llmgateway-cli/src/commands/upgrade.ts:1", "shortDescription": {"text": "Insecure pattern 'node_child_process' in packages/llmgateway-cli/src/commands/upgrade.ts:1"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-97945c5e2bc7e069", "name": "Insecure pattern 'node_child_process' in agents/changelog-generator-agent/src/index.ts:4", "shortDescription": {"text": "Insecure pattern 'node_child_process' in agents/changelog-generator-agent/src/index.ts:4"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6372cebde0220094", "name": "No auth library detected", "shortDescription": {"text": "No auth library detected"}, "fullDescription": {"text": "The scanner did not find any standard auth library (JWT, OAuth, NextAuth, Auth0, etc.). The repo has auth/admin/session surface indicators, so auth may live in custom code, in a separate service, or be missing."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-27924aa79fa4a517", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a53bf972e19b52fd", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7ffa33751be3d771", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6893a6c8b0861585", "name": "Very low test-to-source ratio", "shortDescription": {"text": "Very low test-to-source ratio"}, "fullDescription": {"text": "2 test file(s) for 175 source file(s) (ratio 0.01). Consider adding integration or unit tests for critical paths."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4d36613e85d916bf", "name": "Node manifest has dependencies but no lockfile: templates/feedback-dashboard/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: templates/feedback-dashboard/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0f47f9da79ec3b99", "name": "Node manifest has dependencies but no lockfile: templates/og-image-generator/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: templates/og-image-generator/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d42e9e9ffc9effda", "name": "Node manifest has dependencies but no lockfile: templates/ai-chatbot/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: templates/ai-chatbot/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-564768c983964c1f", "name": "Node manifest has dependencies but no lockfile: templates/qa-agent/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: templates/qa-agent/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-326657a56b056a91", "name": "Node manifest has dependencies but no lockfile: templates/ai-slides/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: templates/ai-slides/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b6beb775bc37611a", "name": "Node manifest has dependencies but no lockfile: templates/writing-assistant/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: templates/writing-assistant/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0d369946ba605b6e", "name": "Node manifest has dependencies but no lockfile: templates/embeddable-credits/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: templates/embeddable-credits/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fee79aacac518e98", "name": "Node manifest has dependencies but no lockfile: templates/image-generation/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: templates/image-generation/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f1f0c52db7c97cef", "name": "Node manifest has dependencies but no lockfile: packages/client/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: packages/client/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4fbb49da7341846c", "name": "Node manifest has dependencies but no lockfile: packages/llmgateway-cli/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: packages/llmgateway-cli/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b739f2f2be1d714d", "name": "Node manifest has dependencies but no lockfile: packages/server/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: packages/server/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a53b0f51bdfd16e7", "name": "Node manifest has dependencies but no lockfile: packages/elements/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: packages/elements/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9cf7631e8bddbe70", "name": "Node manifest has dependencies but no lockfile: agents/data-extractor-agent/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: agents/data-extractor-agent/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f1f665b9fdce4f06", "name": "Node manifest has dependencies but no lockfile: agents/email-drafter-agent/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: agents/email-drafter-agent/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-41bac325b276c835", "name": "Node manifest has dependencies but no lockfile: agents/sentiment-analyzer-agent/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: agents/sentiment-analyzer-agent/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d4a753be26f6a1e6", "name": "Node manifest has dependencies but no lockfile: agents/changelog-generator-agent/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: agents/changelog-generator-agent/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8e01b5710d9611bf", "name": "Node manifest has dependencies but no lockfile: agents/lead-agent/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: agents/lead-agent/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c3c92a2f3bc0245d", "name": "Node manifest has dependencies but no lockfile: agents/weather-agent/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: agents/weather-agent/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 83 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-72b2a6250083a784", "name": "Placeholder or mock-heavy implementation detected", "shortDescription": {"text": "Placeholder or mock-heavy implementation detected"}, "fullDescription": {"text": "Found 67 placeholder/mock markers across 27 source files. This often means the repo looks complete while core flows still use generated scaffolding or fake data."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-7a0d6a519f5a08d3", "name": "`fetch()` without try/.catch or AbortSignal \u2014 templates/og-image-generator/src/app/page.tsx:69", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 templates/og-image-generator/src/app/page.tsx:69"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9a6a78b3524f1652", "name": "`fetch()` without try/.catch or AbortSignal \u2014 templates/qa-agent/src/app/page.tsx:5", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 templates/qa-agent/src/app/page.tsx:5"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-656fa7806d95f25e", "name": "`fetch()` without try/.catch or AbortSignal \u2014 templates/ai-slides/src/app/api/models/route.ts:13", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 templates/ai-slides/src/app/api/models/route.ts:13"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-38b2057e7f9a964d", "name": "`fetch()` without try/.catch or AbortSignal \u2014 templates/embeddable-credits/src/app/page.tsx:20", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 templates/embeddable-credits/src/app/page.tsx:20"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c916efffc47a8c08", "name": "`fetch()` without try/.catch or AbortSignal \u2014 packages/client/src/index.ts:12", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 packages/client/src/index.ts:12"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1b413209cf263601", "name": "`fetch()` without try/.catch or AbortSignal \u2014 packages/llmgateway-cli/src/utils/api.ts:79", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 packages/llmgateway-cli/src/utils/api.ts:79"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e2719bd13db2f1cc", "name": "`fetch()` without try/.catch or AbortSignal \u2014 packages/server/src/index.ts:38", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 packages/server/src/index.ts:38"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-5596aa42a3f2fd8a", "name": "`fetch()` without try/.catch or AbortSignal \u2014 agents/changelog-generator-agent/src/index.ts:35", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 agents/changelog-generator-agent/src/index.ts:35"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e74c017cc4162053", "name": "`fetch()` without try/.catch or AbortSignal \u2014 agents/lead-agent/src/index.ts:18", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 agents/lead-agent/src/index.ts:18"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3482f7e5dd70cd1a", "name": "6 env vars used in code but missing from .env.example", "shortDescription": {"text": "6 env vars used in code but missing from .env.example"}, "fullDescription": {"text": "Drift between code and config docs. The first few: `LLMGATEWAY_API_URL`, `LLMGATEWAY_GATEWAY_URL`, `LLMGATEWAY_ORIGIN_URL`, `MODEL`, `NEXT_PUBLIC_LLMGATEWAY_API_URL`, `NEXT_PUBLIC_LLMGATEWAY_GATEWAY_URL`. Add them (with a placeholder/comment) to .env.example so onboarding doesn't break."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/21126"}, "properties": {"repository": "theopenco/llmgateway-templates", "repoUrl": "https://github.com/theopenco/llmgateway-templates", "branch": "main"}, "results": [{"ruleId": "scanner-297148a7ef94aeb9", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 templates/qa-agent/src/components/qa-tester.tsx:425"}, "properties": {"repobilityId": "f49e4b2d6f6c7613", "scanner": "scanner-primary", "fingerprint": "297148a7ef94aeb9", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-b31cac24b4ff482e", "level": "none", "message": {"text": "TODO/FIXME marker in shipping code \u2014 templates/embeddable-credits/src/app/api/llmgateway/session/route.ts:24"}, "properties": {"repobilityId": "29d79cf9c81e71cd", "scanner": "scanner-primary", "fingerprint": "b31cac24b4ff482e", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.todo-marker"]}}, {"ruleId": "scanner-542b4243bd76d90f", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 packages/llmgateway-cli/src/commands/orgs.ts:18"}, "properties": {"repobilityId": "6f20af437f62ae02", "scanner": "scanner-primary", "fingerprint": "542b4243bd76d90f", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-bd6b0b409a185f7c", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 packages/llmgateway-cli/src/commands/list.ts:10"}, "properties": {"repobilityId": "f5562541ce2f0c54", "scanner": "scanner-primary", "fingerprint": "bd6b0b409a185f7c", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-45c4148d44b9c5e7", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 packages/llmgateway-cli/src/commands/models.ts:50"}, "properties": {"repobilityId": "a8201279ce48a9eb", "scanner": "scanner-primary", "fingerprint": "45c4148d44b9c5e7", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-6100ae18f3115650", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 packages/llmgateway-cli/src/commands/keys.ts:97"}, "properties": {"repobilityId": "da1daf6ffc3bce73", "scanner": "scanner-primary", "fingerprint": "6100ae18f3115650", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-48dbfbb64d16ac69", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 packages/llmgateway-cli/src/commands/usage.ts:92"}, "properties": {"repobilityId": "2e5cd228ba35218d", "scanner": "scanner-primary", "fingerprint": "48dbfbb64d16ac69", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-d24c9dea2f92e54c", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 packages/llmgateway-cli/src/utils/logger.ts:4"}, "properties": {"repobilityId": "6b4df4af3730da3a", "scanner": "scanner-primary", "fingerprint": "d24c9dea2f92e54c", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-c6e64e75ba818434", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 agents/data-extractor-agent/src/index.ts:49"}, "properties": {"repobilityId": "00d1a2189ed65013", "scanner": "scanner-primary", "fingerprint": "c6e64e75ba818434", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-02a54beedb181d67", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 agents/email-drafter-agent/src/index.ts:64"}, "properties": {"repobilityId": "1fbb24472930aef1", "scanner": "scanner-primary", "fingerprint": "02a54beedb181d67", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-55c95649c6d55606", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 agents/sentiment-analyzer-agent/src/index.ts:72"}, "properties": {"repobilityId": "e6bc83d1104f5303", "scanner": "scanner-primary", "fingerprint": "55c95649c6d55606", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-05ecc163e02db2f9", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 agents/changelog-generator-agent/src/index.ts:10"}, "properties": {"repobilityId": "8efbf26a92a95f25", "scanner": "scanner-primary", "fingerprint": "05ecc163e02db2f9", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-b13288e51751c4ab", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 agents/lead-agent/src/index.ts:12"}, "properties": {"repobilityId": "1a948ddce3468be2", "scanner": "scanner-primary", "fingerprint": "b13288e51751c4ab", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-a542abd29ab5da03", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 agents/weather-agent/src/index.ts:144"}, "properties": {"repobilityId": "ee48dfd6278eb2c1", "scanner": "scanner-primary", "fingerprint": "a542abd29ab5da03", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-6a2dc13e3f7e7a7e", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in packages/llmgateway-cli/src/commands/init.ts:6"}, "properties": {"repobilityId": "88cb8307a05c0709", "scanner": "scanner-primary", "fingerprint": "6a2dc13e3f7e7a7e", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/llmgateway-cli/src/commands/init.ts"}, "region": {"startLine": 6}}}]}, {"ruleId": "scanner-86f4048eef53a76b", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in packages/llmgateway-cli/src/commands/dev.ts:1"}, "properties": {"repobilityId": "ae27816d66dab1f2", "scanner": "scanner-primary", "fingerprint": "86f4048eef53a76b", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/llmgateway-cli/src/commands/dev.ts"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a3dc3196d16ada33", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in packages/llmgateway-cli/src/commands/upgrade.ts:1"}, "properties": {"repobilityId": "49ada477f4c9d605", "scanner": "scanner-primary", "fingerprint": "a3dc3196d16ada33", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/llmgateway-cli/src/commands/upgrade.ts"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-97945c5e2bc7e069", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in agents/changelog-generator-agent/src/index.ts:4"}, "properties": {"repobilityId": "9bd9022325fd57ed", "scanner": "scanner-primary", "fingerprint": "97945c5e2bc7e069", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "agents/changelog-generator-agent/src/index.ts"}, "region": {"startLine": 4}}}]}, {"ruleId": "scanner-6372cebde0220094", "level": "warning", "message": {"text": "No auth library detected"}, "properties": {"repobilityId": "a5b6035a5bbf8054", "scanner": "scanner-primary", "fingerprint": "6372cebde0220094", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["coverage", "auth"]}}, {"ruleId": "scanner-27924aa79fa4a517", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "ae16880318b99912", "scanner": "scanner-primary", "fingerprint": "27924aa79fa4a517", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 15}}}]}, {"ruleId": "scanner-a53bf972e19b52fd", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "ddd59a95ad7ec776", "scanner": "scanner-primary", "fingerprint": "a53bf972e19b52fd", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/publish.yml"}, "region": {"startLine": 19}}}]}, {"ruleId": "scanner-7ffa33751be3d771", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "491a3ad29cbaf189", "scanner": "scanner-primary", "fingerprint": "7ffa33751be3d771", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/publish.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6893a6c8b0861585", "level": "warning", "message": {"text": "Very low test-to-source ratio"}, "properties": {"repobilityId": "54a7de3f06314bf0", "scanner": "scanner-primary", "fingerprint": "6893a6c8b0861585", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["tests", "coverage"]}}, {"ruleId": "scanner-4d36613e85d916bf", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: templates/feedback-dashboard/package.json"}, "properties": {"repobilityId": "e4bedc785e8dc3a1", "scanner": "scanner-primary", "fingerprint": "4d36613e85d916bf", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "templates/feedback-dashboard/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-0f47f9da79ec3b99", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: templates/og-image-generator/package.json"}, "properties": {"repobilityId": "fd94291df2a7f4ab", "scanner": "scanner-primary", "fingerprint": "0f47f9da79ec3b99", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "templates/og-image-generator/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d42e9e9ffc9effda", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: templates/ai-chatbot/package.json"}, "properties": {"repobilityId": "577bfd36863de0b5", "scanner": "scanner-primary", "fingerprint": "d42e9e9ffc9effda", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "templates/ai-chatbot/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-564768c983964c1f", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: templates/qa-agent/package.json"}, "properties": {"repobilityId": "60c4009dc7a574b3", "scanner": "scanner-primary", "fingerprint": "564768c983964c1f", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "templates/qa-agent/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-326657a56b056a91", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: templates/ai-slides/package.json"}, "properties": {"repobilityId": "7f80fc49eabe8512", "scanner": "scanner-primary", "fingerprint": "326657a56b056a91", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "templates/ai-slides/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b6beb775bc37611a", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: templates/writing-assistant/package.json"}, "properties": {"repobilityId": "2ebf5c047040752a", "scanner": "scanner-primary", "fingerprint": "b6beb775bc37611a", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "templates/writing-assistant/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-0d369946ba605b6e", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: templates/embeddable-credits/package.json"}, "properties": {"repobilityId": "6b4fcd416618b301", "scanner": "scanner-primary", "fingerprint": "0d369946ba605b6e", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "templates/embeddable-credits/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-fee79aacac518e98", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: templates/image-generation/package.json"}, "properties": {"repobilityId": "c514cd4c06067428", "scanner": "scanner-primary", "fingerprint": "fee79aacac518e98", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "templates/image-generation/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f1f0c52db7c97cef", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: packages/client/package.json"}, "properties": {"repobilityId": "708197ec3b624f59", "scanner": "scanner-primary", "fingerprint": "f1f0c52db7c97cef", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/client/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-4fbb49da7341846c", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: packages/llmgateway-cli/package.json"}, "properties": {"repobilityId": "453bdbbfda6bff9d", "scanner": "scanner-primary", "fingerprint": "4fbb49da7341846c", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/llmgateway-cli/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b739f2f2be1d714d", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: packages/server/package.json"}, "properties": {"repobilityId": "d7cb4fafc3b292b2", "scanner": "scanner-primary", "fingerprint": "b739f2f2be1d714d", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/server/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a53b0f51bdfd16e7", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: packages/elements/package.json"}, "properties": {"repobilityId": "5bce7ffeddbf9480", "scanner": "scanner-primary", "fingerprint": "a53b0f51bdfd16e7", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/elements/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-9cf7631e8bddbe70", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: agents/data-extractor-agent/package.json"}, "properties": {"repobilityId": "2b0cc29153a4e398", "scanner": "scanner-primary", "fingerprint": "9cf7631e8bddbe70", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "agents/data-extractor-agent/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f1f665b9fdce4f06", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: agents/email-drafter-agent/package.json"}, "properties": {"repobilityId": "5ca3dd5d5dec92f5", "scanner": "scanner-primary", "fingerprint": "f1f665b9fdce4f06", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "agents/email-drafter-agent/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-41bac325b276c835", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: agents/sentiment-analyzer-agent/package.json"}, "properties": {"repobilityId": "fc3a16e8b69346bc", "scanner": "scanner-primary", "fingerprint": "41bac325b276c835", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "agents/sentiment-analyzer-agent/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d4a753be26f6a1e6", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: agents/changelog-generator-agent/package.json"}, "properties": {"repobilityId": "98bf1efce736811a", "scanner": "scanner-primary", "fingerprint": "d4a753be26f6a1e6", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "agents/changelog-generator-agent/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-8e01b5710d9611bf", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: agents/lead-agent/package.json"}, "properties": {"repobilityId": "cd9efc3b9c7b5ebb", "scanner": "scanner-primary", "fingerprint": "8e01b5710d9611bf", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "agents/lead-agent/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c3c92a2f3bc0245d", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: agents/weather-agent/package.json"}, "properties": {"repobilityId": "9555ddb73c325dca", "scanner": "scanner-primary", "fingerprint": "c3c92a2f3bc0245d", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "agents/weather-agent/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "a1c371c1b69e2504", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-72b2a6250083a784", "level": "warning", "message": {"text": "Placeholder or mock-heavy implementation detected"}, "properties": {"repobilityId": "67b7bdb84193ea5e", "scanner": "scanner-primary", "fingerprint": "72b2a6250083a784", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "incomplete", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "69f7bd73b46ac6df", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "d7e94047ccd2a538", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "bd356177d9709a81", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-7a0d6a519f5a08d3", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 templates/og-image-generator/src/app/page.tsx:69"}, "properties": {"repobilityId": "4641a242ba99224e", "scanner": "scanner-primary", "fingerprint": "7a0d6a519f5a08d3", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-9a6a78b3524f1652", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 templates/qa-agent/src/app/page.tsx:5"}, "properties": {"repobilityId": "d99ddf6c5aee458f", "scanner": "scanner-primary", "fingerprint": "9a6a78b3524f1652", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-656fa7806d95f25e", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 templates/ai-slides/src/app/api/models/route.ts:13"}, "properties": {"repobilityId": "01c44ec5b214f413", "scanner": "scanner-primary", "fingerprint": "656fa7806d95f25e", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-38b2057e7f9a964d", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 templates/embeddable-credits/src/app/page.tsx:20"}, "properties": {"repobilityId": "93cbb9482356d67d", "scanner": "scanner-primary", "fingerprint": "38b2057e7f9a964d", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-c916efffc47a8c08", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 packages/client/src/index.ts:12"}, "properties": {"repobilityId": "78d7aa9dd869729c", "scanner": "scanner-primary", "fingerprint": "c916efffc47a8c08", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-1b413209cf263601", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 packages/llmgateway-cli/src/utils/api.ts:79"}, "properties": {"repobilityId": "70ea4531cd66f825", "scanner": "scanner-primary", "fingerprint": "1b413209cf263601", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-e2719bd13db2f1cc", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 packages/server/src/index.ts:38"}, "properties": {"repobilityId": "e1e53a9d8796bf45", "scanner": "scanner-primary", "fingerprint": "e2719bd13db2f1cc", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-5596aa42a3f2fd8a", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 agents/changelog-generator-agent/src/index.ts:35"}, "properties": {"repobilityId": "06d6011360b9315f", "scanner": "scanner-primary", "fingerprint": "5596aa42a3f2fd8a", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-e74c017cc4162053", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 agents/lead-agent/src/index.ts:18"}, "properties": {"repobilityId": "2cb85eda14942821", "scanner": "scanner-primary", "fingerprint": "e74c017cc4162053", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-3482f7e5dd70cd1a", "level": "note", "message": {"text": "6 env vars used in code but missing from .env.example"}, "properties": {"repobilityId": "1da70f25aa46f6e9", "scanner": "scanner-primary", "fingerprint": "3482f7e5dd70cd1a", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "config-drift"]}}]}]}