{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-bead75b0f9233e05", "name": "No API endpoints detected", "shortDescription": {"text": "No API endpoints detected"}, "fullDescription": {"text": "The scanner did not find FastAPI/Flask/Express/NestJS/GraphQL/gRPC routes. If this repo exposes APIs, the framework may be unsupported."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "info", "confidence": 1.0}}, {"id": "scanner-d988b9be02a2249f", "name": "Stray `console.log` in TS/JS \u2014 scripts/sync-datamitsu-version.ts:110", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 scripts/sync-datamitsu-version.ts:110"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d38a13224a498934", "name": "Stray `console.log` in TS/JS \u2014 scripts/generate-docs-tools.ts:108", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 scripts/generate-docs-tools.ts:108"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b6e507abfacce302", "name": "Stray `console.log` in TS/JS \u2014 scripts/pull-external-apps.ts:100", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 scripts/pull-external-apps.ts:100"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fa07e2c7a7810393", "name": "Stray `console.log` in TS/JS \u2014 scripts/generate-dockerfiles.ts:143", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 scripts/generate-dockerfiles.ts:143"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7c574e6e050de78a", "name": "Stray `console.log` in TS/JS \u2014 scripts/generate-docs-setup-configs.ts:124", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 scripts/generate-docs-setup-configs.ts:124"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fd72db2af4c7cb10", "name": "Stray `console.log` in TS/JS \u2014 scripts/generate-docs-project-types.ts:99", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 scripts/generate-docs-project-types.ts:99"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0d44ef0a11683c22", "name": "Stray `console.log` in TS/JS \u2014 scripts/gen-tsconfig-md.ts:32", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 scripts/gen-tsconfig-md.ts:32"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-897be7c32198fae8", "name": "Stray `console.log` in TS/JS \u2014 scripts/generate-docs-apps.ts:260", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 scripts/generate-docs-apps.ts:260"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1ff7216a760a5014", "name": "Stray `console.log` in TS/JS \u2014 scripts/oci-bundle-postprocess.ts:275", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 scripts/oci-bundle-postprocess.ts:275"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1125ad184a0cd000", "name": "Stray `console.log` in TS/JS \u2014 scripts/inject-oci-pin.ts:56", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 scripts/inject-oci-pin.ts:56"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7d94e045e9647547", "name": "Stray `console.log` in TS/JS \u2014 scripts/bundle-dist-inline.ts:34", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 scripts/bundle-dist-inline.ts:34"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8fd0a96a4eee1478", "name": "Stray `console.log` in TS/JS \u2014 scripts/test-platforms.ts:473", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 scripts/test-platforms.ts:473"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-13ebaa8e4716bd05", "name": "Stray `console.log` in TS/JS \u2014 scripts/eslint-typegen.ts:30", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 scripts/eslint-typegen.ts:30"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4952d4e7d2e05d7d", "name": "Stray `console.log` in TS/JS \u2014 scripts/validate-registry-blocklist.ts:165", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 scripts/validate-registry-blocklist.ts:165"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d00be30fcb9d9b61", "name": "Stray `console.log` in TS/JS \u2014 scripts/inject-jsdoc.ts:163", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 scripts/inject-jsdoc.ts:163"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-50b9e57facd0f6b6", "name": "Stray `console.log` in TS/JS \u2014 scripts/gen-skills.ts:134", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 scripts/gen-skills.ts:134"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-854aa1430b669ab3", "name": "Stray `console.log` in TS/JS \u2014 scripts/gen-agents-md.ts:106", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 scripts/gen-agents-md.ts:106"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e2f08aba5d682a41", "name": "Stray `console.log` in TS/JS \u2014 scripts/lib/write-and-fix.ts:39", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 scripts/lib/write-and-fix.ts:39"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b0a45797e2d6a1b4", "name": "Stray `console.log` in TS/JS \u2014 src/s0/cmd/pulumi/cleanupState.ts:105", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 src/s0/cmd/pulumi/cleanupState.ts:105"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7a003fb631b68a56", "name": "Stray `console.log` in TS/JS \u2014 src/s0/cmd/pulumi/decryptState.ts:15", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 src/s0/cmd/pulumi/decryptState.ts:15"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9b61202049179f82", "name": "Stray `console.log` in TS/JS \u2014 src/s0/cmd/pulumi/encryptState.ts:113", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 src/s0/cmd/pulumi/encryptState.ts:113"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7bc7266d6c249732", "name": "TODO/FIXME marker in shipping code \u2014 src/apps/eslint/plugins/react.ts:22", "shortDescription": {"text": "TODO/FIXME marker in shipping code \u2014 src/apps/eslint/plugins/react.ts:22"}, "fullDescription": {"text": "Track in /reviews or /issues, not as a code comment that rots.\n\nWhy: Drift control \u2014 shouldn't be the same as Quality TODO scanner.\nRule id: fq.todo-marker"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-9e254d339554cfea", "name": "Stray `console.log` in TS/JS \u2014 src/datamitsu-config/datamitsu.config.d.ts:1280", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 src/datamitsu-config/datamitsu.config.d.ts:1280"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-47636e33caef255d", "name": "Dockerfile runs as root: docker/Dockerfile", "shortDescription": {"text": "Dockerfile runs as root: docker/Dockerfile"}, "fullDescription": {"text": "No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d4031031109f0aa5", "name": "Docker base image is tag-pinned but not digest-pinned: ghcr.io/datamitsu/datamitsu:0.1.3", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: ghcr.io/datamitsu/datamitsu:0.1.3"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-aa5acaa49eb8315b", "name": "Containers defined but no K8s/orchestration manifest found", "shortDescription": {"text": "Containers defined but no K8s/orchestration manifest found"}, "fullDescription": {"text": "Repo has Dockerfiles/compose but no Kubernetes/Nomad manifests. If the target deployment is K8s, the manifests may live in a separate ops repo."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9710c8d059e53154", "name": "No frontend routes/components detected", "shortDescription": {"text": "No frontend routes/components detected"}, "fullDescription": {"text": "No React/Vue/Next routes were found. This is fine for backend-only repos."}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-f3bd2548e3fcda84", "name": "Insecure pattern 'node_child_process' in tsdown.config.eslint.ts:1", "shortDescription": {"text": "Insecure pattern 'node_child_process' in tsdown.config.eslint.ts:1"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ef1d20dd98043d2e", "name": "Insecure pattern 'node_child_process' in tsdown.config.knip.ts:1", "shortDescription": {"text": "Insecure pattern 'node_child_process' in tsdown.config.knip.ts:1"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f498d739259ef21b", "name": "Insecure pattern 'node_child_process' in tsdown.config.commitlint.ts:1", "shortDescription": {"text": "Insecure pattern 'node_child_process' in tsdown.config.commitlint.ts:1"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-bfe8d5026850732e", "name": "Insecure pattern 'node_child_process' in tsdown.config.cspell.ts:1", "shortDescription": {"text": "Insecure pattern 'node_child_process' in tsdown.config.cspell.ts:1"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-abe34ef1b1fb91d5", "name": "Insecure pattern 'node_child_process' in tsdown.config.ts:1", "shortDescription": {"text": "Insecure pattern 'node_child_process' in tsdown.config.ts:1"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-14c241c7be080155", "name": "Insecure pattern 'node_child_process' in tsdown.config.oxfmt.ts:1", "shortDescription": {"text": "Insecure pattern 'node_child_process' in tsdown.config.oxfmt.ts:1"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9b0667b80d7e1b61", "name": "Insecure pattern 'node_child_process' in tsdown.config.prettier.ts:1", "shortDescription": {"text": "Insecure pattern 'node_child_process' in tsdown.config.prettier.ts:1"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-81723cf49b9ffe9c", "name": "Insecure pattern 'node_child_process' in scripts/generate-docs-tools.ts:1", "shortDescription": {"text": "Insecure pattern 'node_child_process' in scripts/generate-docs-tools.ts:1"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e4af4b670df44e06", "name": "Insecure pattern 'node_child_process' in scripts/generate-docs-setup-configs.ts:1", "shortDescription": {"text": "Insecure pattern 'node_child_process' in scripts/generate-docs-setup-configs.ts:1"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a6c0c1fc006c78b7", "name": "Insecure pattern 'node_child_process' in scripts/generate-docs-project-types.ts:1", "shortDescription": {"text": "Insecure pattern 'node_child_process' in scripts/generate-docs-project-types.ts:1"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7e256bb9def3e193", "name": "Insecure pattern 'node_child_process' in scripts/generate-docs-apps.ts:1", "shortDescription": {"text": "Insecure pattern 'node_child_process' in scripts/generate-docs-apps.ts:1"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1d8e7132587cf0d4", "name": "Insecure pattern 'node_child_process' in scripts/bundle-dist-inline.ts:1", "shortDescription": {"text": "Insecure pattern 'node_child_process' in scripts/bundle-dist-inline.ts:1"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8341867a0a12015d", "name": "Insecure pattern 'exec_used' in src/lib/datamitsu.ts:30", "shortDescription": {"text": "Insecure pattern 'exec_used' in src/lib/datamitsu.ts:30"}, "fullDescription": {"text": "Found a known-risky pattern (exec_used). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-e74f294b720edd78", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0763d85002569570", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-14ce8614dd03f409", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-46c644c6227e4d4a", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1838a141491ce38c", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-cb639d9a10a47b23", "name": "package.json defines install-time lifecycle scripts", "shortDescription": {"text": "package.json defines install-time lifecycle scripts"}, "fullDescription": {"text": "preinstall/install/postinstall/prepare scripts execute during dependency installation. Review them carefully for network calls, obfuscation, shell execution, or credential access."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ea3b5e389d8c9c0f", "name": "Low test-to-source ratio", "shortDescription": {"text": "Low test-to-source ratio"}, "fullDescription": {"text": "25 tests / 135 src (ratio 0.19)."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 61 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-72b2a6250083a784", "name": "Placeholder or mock-heavy implementation detected", "shortDescription": {"text": "Placeholder or mock-heavy implementation detected"}, "fullDescription": {"text": "Found 18 placeholder/mock markers across 5 source files. This often means the repo looks complete while core flows still use generated scaffolding or fake data."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-170c255bfd3158db", "name": "Agent authority lacks a verifier contract: .claude/skills/update-docs.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/skills/update-docs.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-422945e98ab0971b", "name": "Commented-code block (5 lines) in vitest.setup.ts:3", "shortDescription": {"text": "Commented-code block (5 lines) in vitest.setup.ts:3"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-f90bef0e00e08c45", "name": "`fetch()` without try/.catch or AbortSignal \u2014 scripts/pull-external-apps.ts:55", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 scripts/pull-external-apps.ts:55"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-83d561730936fdc9", "name": "Commented-code block (5 lines) in scripts/oci-bundle-postprocess.ts:223", "shortDescription": {"text": "Commented-code block (5 lines) in scripts/oci-bundle-postprocess.ts:223"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-7f27b830aee9c71a", "name": "`fetch()` without try/.catch or AbortSignal \u2014 scripts/oci-bundle-postprocess.ts:175", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 scripts/oci-bundle-postprocess.ts:175"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b6619e61dc4c3f84", "name": "Commented-code block (5 lines) in scripts/eslint-typegen.ts:1", "shortDescription": {"text": "Commented-code block (5 lines) in scripts/eslint-typegen.ts:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-5d9bb694e22aa516", "name": "Commented-code block (5 lines) in src/apps/eslint/globals.d.ts:44", "shortDescription": {"text": "Commented-code block (5 lines) in src/apps/eslint/globals.d.ts:44"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-ed974534c7fa5ca3", "name": "Commented-code block (8 lines) in src/apps/eslint/plugins/n.ts:9", "shortDescription": {"text": "Commented-code block (8 lines) in src/apps/eslint/plugins/n.ts:9"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-289b18569fc9cb98", "name": "Commented-code block (8 lines) in src/apps/eslint/plugins/unicorn.ts:6", "shortDescription": {"text": "Commented-code block (8 lines) in src/apps/eslint/plugins/unicorn.ts:6"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-808eca9fad169c05", "name": "Commented-code block (8 lines) in src/apps/eslint/plugins/no-use-extend-native.ts:9", "shortDescription": {"text": "Commented-code block (8 lines) in src/apps/eslint/plugins/no-use-extend-native.ts:9"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-63c46ab1696f5c9d", "name": "Commented-code block (5 lines) in src/apps/eslint/plugins/json.ts:12", "shortDescription": {"text": "Commented-code block (5 lines) in src/apps/eslint/plugins/json.ts:12"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-60897aeda28ac69e", "name": "Commented-code block (8 lines) in src/apps/eslint/plugins/json-schema-validator.ts:9", "shortDescription": {"text": "Commented-code block (8 lines) in src/apps/eslint/plugins/json-schema-validator.ts:9"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-2a1cee97c1532dd1", "name": "Commented-code block (10 lines) in src/apps/eslint/plugins/vanilla-extract.ts:9", "shortDescription": {"text": "Commented-code block (10 lines) in src/apps/eslint/plugins/vanilla-extract.ts:9"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-c5b0a00272260f82", "name": "Commented-code block (8 lines) in src/apps/eslint/plugins/playwright.ts:9", "shortDescription": {"text": "Commented-code block (8 lines) in src/apps/eslint/plugins/playwright.ts:9"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-300c6b4cab6bf0d2", "name": "Commented-code block (11 lines) in src/apps/eslint/plugins/perfectionist.ts:60", "shortDescription": {"text": "Commented-code block (11 lines) in src/apps/eslint/plugins/perfectionist.ts:60"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-e59f70930ae7d573", "name": "Commented-code block (8 lines) in src/apps/eslint/plugins/turbo.ts:9", "shortDescription": {"text": "Commented-code block (8 lines) in src/apps/eslint/plugins/turbo.ts:9"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-f0c06a383ad41194", "name": "Legacy-named symbol `gomodguard_v2` in src/datamitsu-config/cmdSetup.ts:408", "shortDescription": {"text": "Legacy-named symbol `gomodguard_v2` in src/datamitsu-config/cmdSetup.ts:408"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8a53073bc6cdc3f0", "name": "Commented-code block (9 lines) in src/datamitsu-config/cmdSetup.ts:204", "shortDescription": {"text": "Commented-code block (9 lines) in src/datamitsu-config/cmdSetup.ts:204"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-73544d6e5adada95", "name": "Commented-code block (11 lines) in src/datamitsu-config/tools.ts:288", "shortDescription": {"text": "Commented-code block (11 lines) in src/datamitsu-config/tools.ts:288"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/19469"}, "properties": {"repository": "shibanet0/datamitsu-config", "repoUrl": "https://github.com/shibanet0/datamitsu-config", "branch": "main"}, "results": [{"ruleId": "scanner-bead75b0f9233e05", "level": "none", "message": {"text": "No API endpoints detected"}, "properties": {"repobilityId": "0f8bb852027c38f8", "scanner": "scanner-primary", "fingerprint": "bead75b0f9233e05", "layer": "api", "severity": "info", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-d988b9be02a2249f", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 scripts/sync-datamitsu-version.ts:110"}, "properties": {"repobilityId": "bb2989fcf83d03e9", "scanner": "scanner-primary", "fingerprint": "d988b9be02a2249f", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-d38a13224a498934", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 scripts/generate-docs-tools.ts:108"}, "properties": {"repobilityId": "e74a46566e86971c", "scanner": "scanner-primary", "fingerprint": "d38a13224a498934", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-b6e507abfacce302", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 scripts/pull-external-apps.ts:100"}, "properties": {"repobilityId": "f231c8bbff831a21", "scanner": "scanner-primary", "fingerprint": "b6e507abfacce302", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-fa07e2c7a7810393", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 scripts/generate-dockerfiles.ts:143"}, "properties": {"repobilityId": "a05ac440741ec15c", "scanner": "scanner-primary", "fingerprint": "fa07e2c7a7810393", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-7c574e6e050de78a", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 scripts/generate-docs-setup-configs.ts:124"}, "properties": {"repobilityId": "cfd2ef4fb1f0e7e8", "scanner": "scanner-primary", "fingerprint": "7c574e6e050de78a", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-fd72db2af4c7cb10", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 scripts/generate-docs-project-types.ts:99"}, "properties": {"repobilityId": "69af94c74a5f7f73", "scanner": "scanner-primary", "fingerprint": "fd72db2af4c7cb10", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-0d44ef0a11683c22", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 scripts/gen-tsconfig-md.ts:32"}, "properties": {"repobilityId": "2e77dc4a9e3732ad", "scanner": "scanner-primary", "fingerprint": "0d44ef0a11683c22", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-897be7c32198fae8", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 scripts/generate-docs-apps.ts:260"}, "properties": {"repobilityId": "3ab523eaa5c6007c", "scanner": "scanner-primary", "fingerprint": "897be7c32198fae8", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-1ff7216a760a5014", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 scripts/oci-bundle-postprocess.ts:275"}, "properties": {"repobilityId": "0e9e1f01d91b9451", "scanner": "scanner-primary", "fingerprint": "1ff7216a760a5014", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-1125ad184a0cd000", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 scripts/inject-oci-pin.ts:56"}, "properties": {"repobilityId": "4657b9ded4a2009a", "scanner": "scanner-primary", "fingerprint": "1125ad184a0cd000", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-7d94e045e9647547", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 scripts/bundle-dist-inline.ts:34"}, "properties": {"repobilityId": "f6d4c64ae01505f0", "scanner": "scanner-primary", "fingerprint": "7d94e045e9647547", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-8fd0a96a4eee1478", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 scripts/test-platforms.ts:473"}, "properties": {"repobilityId": "79f8e286a3f159bc", "scanner": "scanner-primary", "fingerprint": "8fd0a96a4eee1478", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-13ebaa8e4716bd05", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 scripts/eslint-typegen.ts:30"}, "properties": {"repobilityId": "9b1757eb82b9f89b", "scanner": "scanner-primary", "fingerprint": "13ebaa8e4716bd05", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-4952d4e7d2e05d7d", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 scripts/validate-registry-blocklist.ts:165"}, "properties": {"repobilityId": "eaf5b48edfd5e825", "scanner": "scanner-primary", "fingerprint": "4952d4e7d2e05d7d", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-d00be30fcb9d9b61", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 scripts/inject-jsdoc.ts:163"}, "properties": {"repobilityId": "872a1411f51503ae", "scanner": "scanner-primary", "fingerprint": "d00be30fcb9d9b61", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-50b9e57facd0f6b6", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 scripts/gen-skills.ts:134"}, "properties": {"repobilityId": "d6960b8a0f56e740", "scanner": "scanner-primary", "fingerprint": "50b9e57facd0f6b6", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-854aa1430b669ab3", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 scripts/gen-agents-md.ts:106"}, "properties": {"repobilityId": "ea6ef39898beb935", "scanner": "scanner-primary", "fingerprint": "854aa1430b669ab3", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-e2f08aba5d682a41", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 scripts/lib/write-and-fix.ts:39"}, "properties": {"repobilityId": "793ec330ab878b49", "scanner": "scanner-primary", "fingerprint": "e2f08aba5d682a41", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-b0a45797e2d6a1b4", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 src/s0/cmd/pulumi/cleanupState.ts:105"}, "properties": {"repobilityId": "78d3e8bb3b1ba8c5", "scanner": "scanner-primary", "fingerprint": "b0a45797e2d6a1b4", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-7a003fb631b68a56", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 src/s0/cmd/pulumi/decryptState.ts:15"}, "properties": {"repobilityId": "cd85f44fe0ffafb0", "scanner": "scanner-primary", "fingerprint": "7a003fb631b68a56", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-9b61202049179f82", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 src/s0/cmd/pulumi/encryptState.ts:113"}, "properties": {"repobilityId": "2d11520473050c08", "scanner": "scanner-primary", "fingerprint": "9b61202049179f82", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-7bc7266d6c249732", "level": "none", "message": {"text": "TODO/FIXME marker in shipping code \u2014 src/apps/eslint/plugins/react.ts:22"}, "properties": {"repobilityId": "1b0412784b13c0f5", "scanner": "scanner-primary", "fingerprint": "7bc7266d6c249732", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.todo-marker"]}}, {"ruleId": "scanner-9e254d339554cfea", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 src/datamitsu-config/datamitsu.config.d.ts:1280"}, "properties": {"repobilityId": "c3331edbb5144942", "scanner": "scanner-primary", "fingerprint": "9e254d339554cfea", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-47636e33caef255d", "level": "warning", "message": {"text": "Dockerfile runs as root: docker/Dockerfile"}, "properties": {"repobilityId": "8a345ba4198453bd", "scanner": "scanner-primary", "fingerprint": "47636e33caef255d", "layer": "hardware", "severity": "medium", "confidence": 1.0, "tags": ["security", "container"]}}, {"ruleId": "scanner-d4031031109f0aa5", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: ghcr.io/datamitsu/datamitsu:0.1.3"}, "properties": {"repobilityId": "f9168e092425d1e3", "scanner": "scanner-primary", "fingerprint": "d4031031109f0aa5", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docker/Dockerfile"}, "region": {"startLine": 8}}}]}, {"ruleId": "scanner-aa5acaa49eb8315b", "level": "note", "message": {"text": "Containers defined but no K8s/orchestration manifest found"}, "properties": {"repobilityId": "b230ea9b68736081", "scanner": "scanner-primary", "fingerprint": "aa5acaa49eb8315b", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["coverage", "deployment"]}}, {"ruleId": "scanner-9710c8d059e53154", "level": "none", "message": {"text": "No frontend routes/components detected"}, "properties": {"repobilityId": "44ca61485762e494", "scanner": "scanner-primary", "fingerprint": "9710c8d059e53154", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-f3bd2548e3fcda84", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in tsdown.config.eslint.ts:1"}, "properties": {"repobilityId": "57e1b31a1b538e50", "scanner": "scanner-primary", "fingerprint": "f3bd2548e3fcda84", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tsdown.config.eslint.ts"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ef1d20dd98043d2e", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in tsdown.config.knip.ts:1"}, "properties": {"repobilityId": "e408ea00ff426f17", "scanner": "scanner-primary", "fingerprint": "ef1d20dd98043d2e", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tsdown.config.knip.ts"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f498d739259ef21b", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in tsdown.config.commitlint.ts:1"}, "properties": {"repobilityId": "6ca91926773697c1", "scanner": "scanner-primary", "fingerprint": "f498d739259ef21b", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tsdown.config.commitlint.ts"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-bfe8d5026850732e", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in tsdown.config.cspell.ts:1"}, "properties": {"repobilityId": "0f4adfbfc11bf428", "scanner": "scanner-primary", "fingerprint": "bfe8d5026850732e", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tsdown.config.cspell.ts"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-abe34ef1b1fb91d5", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in tsdown.config.ts:1"}, "properties": {"repobilityId": "6c51d16502634b5d", "scanner": "scanner-primary", "fingerprint": "abe34ef1b1fb91d5", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tsdown.config.ts"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-14c241c7be080155", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in tsdown.config.oxfmt.ts:1"}, "properties": {"repobilityId": "8ab6fdc0076171c6", "scanner": "scanner-primary", "fingerprint": "14c241c7be080155", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tsdown.config.oxfmt.ts"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-9b0667b80d7e1b61", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in tsdown.config.prettier.ts:1"}, "properties": {"repobilityId": "2963a282aee7f781", "scanner": "scanner-primary", "fingerprint": "9b0667b80d7e1b61", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tsdown.config.prettier.ts"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-81723cf49b9ffe9c", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in scripts/generate-docs-tools.ts:1"}, "properties": {"repobilityId": "5f6433a43d192800", "scanner": "scanner-primary", "fingerprint": "81723cf49b9ffe9c", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/generate-docs-tools.ts"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e4af4b670df44e06", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in scripts/generate-docs-setup-configs.ts:1"}, "properties": {"repobilityId": "b60dd6a1f60c4356", "scanner": "scanner-primary", "fingerprint": "e4af4b670df44e06", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/generate-docs-setup-configs.ts"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a6c0c1fc006c78b7", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in scripts/generate-docs-project-types.ts:1"}, "properties": {"repobilityId": "eb4281259ef93294", "scanner": "scanner-primary", "fingerprint": "a6c0c1fc006c78b7", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/generate-docs-project-types.ts"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-7e256bb9def3e193", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in scripts/generate-docs-apps.ts:1"}, "properties": {"repobilityId": "9d818a4c4783bafc", "scanner": "scanner-primary", "fingerprint": "7e256bb9def3e193", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/generate-docs-apps.ts"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-1d8e7132587cf0d4", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in scripts/bundle-dist-inline.ts:1"}, "properties": {"repobilityId": "1af6577aeac0ed89", "scanner": "scanner-primary", "fingerprint": "1d8e7132587cf0d4", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/bundle-dist-inline.ts"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-8341867a0a12015d", "level": "error", "message": {"text": "Insecure pattern 'exec_used' in src/lib/datamitsu.ts:30"}, "properties": {"repobilityId": "85a23cc495a2ece8", "scanner": "scanner-primary", "fingerprint": "8341867a0a12015d", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "exec_used"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/lib/datamitsu.ts"}, "region": {"startLine": 30}}}]}, {"ruleId": "scanner-e74f294b720edd78", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "0696e5e65da713e8", "scanner": "scanner-primary", "fingerprint": "e74f294b720edd78", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/pr-checks.yml"}, "region": {"startLine": 7}}}]}, {"ruleId": "scanner-e74f294b720edd78", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "04154129cb8aea7d", "scanner": "scanner-primary", "fingerprint": "e74f294b720edd78", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/pr-checks.yml"}, "region": {"startLine": 48}}}]}, {"ruleId": "scanner-e74f294b720edd78", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "0696e5e65da713e8", "scanner": "scanner-primary", "fingerprint": "e74f294b720edd78", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/pr-checks.yml"}, "region": {"startLine": 65}}}]}, {"ruleId": "scanner-e74f294b720edd78", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "d896b9075e873b38", "scanner": "scanner-primary", "fingerprint": "e74f294b720edd78", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/pr-checks.yml"}, "region": {"startLine": 67}}}]}, {"ruleId": "scanner-e74f294b720edd78", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "0eab4d5f1c847c11", "scanner": "scanner-primary", "fingerprint": "e74f294b720edd78", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/pr-checks.yml"}, "region": {"startLine": 72}}}]}, {"ruleId": "scanner-e74f294b720edd78", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "10d1026334a5bc8a", "scanner": "scanner-primary", "fingerprint": "e74f294b720edd78", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/pr-checks.yml"}, "region": {"startLine": 74}}}]}, {"ruleId": "scanner-e74f294b720edd78", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "5a41825dcbac69df", "scanner": "scanner-primary", "fingerprint": "e74f294b720edd78", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/pr-checks.yml"}, "region": {"startLine": 78}}}]}, {"ruleId": "scanner-0763d85002569570", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "7090289cd4bb35c1", "scanner": "scanner-primary", "fingerprint": "0763d85002569570", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/docs.yml"}, "region": {"startLine": 9}}}]}, {"ruleId": "scanner-0763d85002569570", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "932ede9197f66143", "scanner": "scanner-primary", "fingerprint": "0763d85002569570", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/docs.yml"}, "region": {"startLine": 17}}}]}, {"ruleId": "scanner-0763d85002569570", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "e4610670d3104927", "scanner": "scanner-primary", "fingerprint": "0763d85002569570", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/docs.yml"}, "region": {"startLine": 29}}}]}, {"ruleId": "scanner-14ce8614dd03f409", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "81c5c697653f94e8", "scanner": "scanner-primary", "fingerprint": "14ce8614dd03f409", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/docs.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "04f6c832d67a7838", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 20}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "40de0ea74eab3ee8", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 51}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "04f6c832d67a7838", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 109}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "04f6c832d67a7838", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 139}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "1051a99633356d7b", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 143}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "d23ec816d11b45e5", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 148}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "242206db1caa02bb", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 150}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "2f410469668d834b", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 154}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "325eb799a895e23c", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 172}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "9a38b98594265645", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 187}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "04f6c832d67a7838", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 216}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "1051a99633356d7b", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 222}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "2f410469668d834b", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 227}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "2f410469668d834b", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 233}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "04f6c832d67a7838", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 295}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "1051a99633356d7b", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 301}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "f0c3d4499b6cd885", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 321}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "04f6c832d67a7838", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 376}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "1051a99633356d7b", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 384}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "04f6c832d67a7838", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 443}}}]}, {"ruleId": "scanner-1838a141491ce38c", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "b8fd4f5048f96576", "scanner": "scanner-primary", "fingerprint": "1838a141491ce38c", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-cb639d9a10a47b23", "level": "note", "message": {"text": "package.json defines install-time lifecycle scripts"}, "properties": {"repobilityId": "b86179956da3a4a8", "scanner": "scanner-primary", "fingerprint": "cb639d9a10a47b23", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "npm", "install-scripts"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ea3b5e389d8c9c0f", "level": "note", "message": {"text": "Low test-to-source ratio"}, "properties": {"repobilityId": "ef7b2552cc00a375", "scanner": "scanner-primary", "fingerprint": "ea3b5e389d8c9c0f", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["tests"]}}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "2d1c417cfb20e95e", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-72b2a6250083a784", "level": "warning", "message": {"text": "Placeholder or mock-heavy implementation detected"}, "properties": {"repobilityId": "ba32224688c73221", "scanner": "scanner-primary", "fingerprint": "72b2a6250083a784", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "incomplete", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "82e72f7c9b8f176a", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "226e49ae8f489a6a", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "b44c4ab6b2015039", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-170c255bfd3158db", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/skills/update-docs.md"}, "properties": {"repobilityId": "218499a596e2c9f0", "scanner": "scanner-primary", "fingerprint": "170c255bfd3158db", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/update-docs.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-422945e98ab0971b", "level": "none", "message": {"text": "Commented-code block (5 lines) in vitest.setup.ts:3"}, "properties": {"repobilityId": "6b71287938301b7a", "scanner": "scanner-primary", "fingerprint": "422945e98ab0971b", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-f90bef0e00e08c45", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 scripts/pull-external-apps.ts:55"}, "properties": {"repobilityId": "2ea8077a0eed08c4", "scanner": "scanner-primary", "fingerprint": "f90bef0e00e08c45", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-83d561730936fdc9", "level": "none", "message": {"text": "Commented-code block (5 lines) in scripts/oci-bundle-postprocess.ts:223"}, "properties": {"repobilityId": "0f96e5f97f160168", "scanner": "scanner-primary", "fingerprint": "83d561730936fdc9", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-7f27b830aee9c71a", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 scripts/oci-bundle-postprocess.ts:175"}, "properties": {"repobilityId": "b7d6c08f214794cb", "scanner": "scanner-primary", "fingerprint": "7f27b830aee9c71a", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-b6619e61dc4c3f84", "level": "none", "message": {"text": "Commented-code block (5 lines) in scripts/eslint-typegen.ts:1"}, "properties": {"repobilityId": "6e230fae788eb189", "scanner": "scanner-primary", "fingerprint": "b6619e61dc4c3f84", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-5d9bb694e22aa516", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/apps/eslint/globals.d.ts:44"}, "properties": {"repobilityId": "03f6989dc98e0f1e", "scanner": "scanner-primary", "fingerprint": "5d9bb694e22aa516", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-ed974534c7fa5ca3", "level": "none", "message": {"text": "Commented-code block (8 lines) in src/apps/eslint/plugins/n.ts:9"}, "properties": {"repobilityId": "7879c9f40a3d95bc", "scanner": "scanner-primary", "fingerprint": "ed974534c7fa5ca3", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-289b18569fc9cb98", "level": "none", "message": {"text": "Commented-code block (8 lines) in src/apps/eslint/plugins/unicorn.ts:6"}, "properties": {"repobilityId": "040bc63970f0a497", "scanner": "scanner-primary", "fingerprint": "289b18569fc9cb98", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-808eca9fad169c05", "level": "none", "message": {"text": "Commented-code block (8 lines) in src/apps/eslint/plugins/no-use-extend-native.ts:9"}, "properties": {"repobilityId": "79f0b039fed7b580", "scanner": "scanner-primary", "fingerprint": "808eca9fad169c05", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-63c46ab1696f5c9d", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/apps/eslint/plugins/json.ts:12"}, "properties": {"repobilityId": "daff96537283ea82", "scanner": "scanner-primary", "fingerprint": "63c46ab1696f5c9d", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-60897aeda28ac69e", "level": "none", "message": {"text": "Commented-code block (8 lines) in src/apps/eslint/plugins/json-schema-validator.ts:9"}, "properties": {"repobilityId": "9f7147eb8ff23f80", "scanner": "scanner-primary", "fingerprint": "60897aeda28ac69e", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-2a1cee97c1532dd1", "level": "none", "message": {"text": "Commented-code block (10 lines) in src/apps/eslint/plugins/vanilla-extract.ts:9"}, "properties": {"repobilityId": "ec249b905ff2bbba", "scanner": "scanner-primary", "fingerprint": "2a1cee97c1532dd1", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-c5b0a00272260f82", "level": "none", "message": {"text": "Commented-code block (8 lines) in src/apps/eslint/plugins/playwright.ts:9"}, "properties": {"repobilityId": "e7ef5d608ce12002", "scanner": "scanner-primary", "fingerprint": "c5b0a00272260f82", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-300c6b4cab6bf0d2", "level": "none", "message": {"text": "Commented-code block (11 lines) in src/apps/eslint/plugins/perfectionist.ts:60"}, "properties": {"repobilityId": "99c108c5df33bc56", "scanner": "scanner-primary", "fingerprint": "300c6b4cab6bf0d2", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-e59f70930ae7d573", "level": "none", "message": {"text": "Commented-code block (8 lines) in src/apps/eslint/plugins/turbo.ts:9"}, "properties": {"repobilityId": "7a5210b3966ce39e", "scanner": "scanner-primary", "fingerprint": "e59f70930ae7d573", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-f0c06a383ad41194", "level": "note", "message": {"text": "Legacy-named symbol `gomodguard_v2` in src/datamitsu-config/cmdSetup.ts:408"}, "properties": {"repobilityId": "2f6ca4a1449395ad", "scanner": "scanner-primary", "fingerprint": "f0c06a383ad41194", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-8a53073bc6cdc3f0", "level": "none", "message": {"text": "Commented-code block (9 lines) in src/datamitsu-config/cmdSetup.ts:204"}, "properties": {"repobilityId": "de05066aa41fb6cb", "scanner": "scanner-primary", "fingerprint": "8a53073bc6cdc3f0", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-73544d6e5adada95", "level": "none", "message": {"text": "Commented-code block (11 lines) in src/datamitsu-config/tools.ts:288"}, "properties": {"repobilityId": "9111b20eb203a94b", "scanner": "scanner-primary", "fingerprint": "73544d6e5adada95", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}]}]}