{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-fb5b867f561f07fb", "name": "`truncate` class without `title=` for hover reveal \u2014 src/components/layout/Sidebar.jsx:140", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 src/components/layout/Sidebar.jsx:140"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-61e521333eb0a6b3", "name": "`truncate` class without `title=` for hover reveal \u2014 src/components/layout/Topbar.jsx:161", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 src/components/layout/Topbar.jsx:161"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-1ffd60e79b8c6dbe", "name": "`truncate` class without `title=` for hover reveal \u2014 src/pages/Settings.jsx:1006", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 src/pages/Settings.jsx:1006"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-30944820bc3bd33e", "name": "`truncate` class without `title=` for hover reveal \u2014 src/pages/WaiterView.jsx:261", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 src/pages/WaiterView.jsx:261"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-73457f7b319691d7", "name": "`truncate` class without `title=` for hover reveal \u2014 src/pages/Reports.jsx:517", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 src/pages/Reports.jsx:517"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-0e16578f02de3a01", "name": "`truncate` class without `title=` for hover reveal \u2014 src/pages/CashierTables.jsx:349", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 src/pages/CashierTables.jsx:349"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-54c48adf4e1ea890", "name": "`truncate` class without `title=` for hover reveal \u2014 src/pages/POSTerminal.jsx:440", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 src/pages/POSTerminal.jsx:440"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-a62a75dbcc9351e8", "name": "`truncate` class without `title=` for hover reveal \u2014 src/pages/Dashboard.jsx:208", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 src/pages/Dashboard.jsx:208"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-13456172b6704d95", "name": "`truncate` class without `title=` for hover reveal \u2014 src/pages/Billing.jsx:409", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 src/pages/Billing.jsx:409"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-564b45d270cf0238", "name": "Runtime dotenv file present in repo: .env.production", "shortDescription": {"text": "Runtime dotenv file present in repo: .env.production"}, "fullDescription": {"text": "`.env.production` looks like a runtime dotenv file. No high-confidence secret value was matched, but runtime dotenv files often drift into live credentials. Move real values to a secret manager and keep only `.env.example` style templates in source control."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-9c220b4fc29fbdea", "name": "Insecure pattern 'node_child_process' in scripts/release-all.mjs:15", "shortDescription": {"text": "Insecure pattern 'node_child_process' in scripts/release-all.mjs:15"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-19849ad81166eeb6", "name": "Insecure pattern 'node_child_process' in scripts/make-ota-bundle.mjs:15", "shortDescription": {"text": "Insecure pattern 'node_child_process' in scripts/make-ota-bundle.mjs:15"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-5a53a7315112809f", "name": "Insecure pattern 'document_write' in src/components/ui/ReceiptView.jsx:179", "shortDescription": {"text": "Insecure pattern 'document_write' in src/components/ui/ReceiptView.jsx:179"}, "fullDescription": {"text": "Found a known-risky pattern (document_write). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b0969cae95f960eb", "name": "Insecure pattern 'document_write' in src/components/ui/KOTView.jsx:142", "shortDescription": {"text": "Insecure pattern 'document_write' in src/components/ui/KOTView.jsx:142"}, "fullDescription": {"text": "Found a known-risky pattern (document_write). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4601e3ad3bb28677", "name": "No CI/CD pipelines detected", "shortDescription": {"text": "No CI/CD pipelines detected"}, "fullDescription": {"text": "No GitHub Actions, GitLab CI, or CircleCI configs found. Without CI you can't gate deploys on tests/lints."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-5be15c4d25528bac", "name": "Very large file: src/pages/Settings.jsx (1128 lines)", "shortDescription": {"text": "Very large file: src/pages/Settings.jsx (1128 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6893a6c8b0861585", "name": "Very low test-to-source ratio", "shortDescription": {"text": "Very low test-to-source ratio"}, "fullDescription": {"text": "0 test file(s) for 64 source file(s) (ratio 0.00). Consider adding integration or unit tests for critical paths."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-141b30a41e03817b", "name": "No license file detected", "shortDescription": {"text": "No license file detected"}, "fullDescription": {"text": "No LICENSE/COPYING/NOTICE file was found. Generated repositories often omit licensing, which blocks reuse and automated intake."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 7 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-72b2a6250083a784", "name": "Placeholder or mock-heavy implementation detected", "shortDescription": {"text": "Placeholder or mock-heavy implementation detected"}, "fullDescription": {"text": "Found 103 placeholder/mock markers across 13 source files. This often means the repo looks complete while core flows still use generated scaffolding or fake data."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b9088664ace7f748", "name": "Composite production-readiness gap", "shortDescription": {"text": "Composite production-readiness gap"}, "fullDescription": {"text": "Multiple low-cost hardening controls are missing together: license, ci. Opus verification showed these co-occurring gaps are a better readiness signal than reading each flag in isolation."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-749d4bc1bd66df5f", "name": "Agent instructions exist but release-hardening basics are missing", "shortDescription": {"text": "Agent instructions exist but release-hardening basics are missing"}, "fullDescription": {"text": "AI-coder instruction files were found, but the repo is missing license, ci. Treat this as a contract gap: the agent is guided, but the generated output is not yet guarded by the controls that make it repeatable."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-006b2e73583badfe", "name": "Commented-code block (5 lines) in scripts/release-all.mjs:6", "shortDescription": {"text": "Commented-code block (5 lines) in scripts/release-all.mjs:6"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-2b19779b353c7e49", "name": "Commented-code block (7 lines) in src/main.jsx:13", "shortDescription": {"text": "Commented-code block (7 lines) in src/main.jsx:13"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-977dd60108cc2ad9", "name": "Legacy-named symbol `isOld` in src/pages/KitchenDisplay.jsx:168", "shortDescription": {"text": "Legacy-named symbol `isOld` in src/pages/KitchenDisplay.jsx:168"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-33b18ead566a6aab", "name": "Commented-code block (5 lines) in src/native/liveUpdate.js:3", "shortDescription": {"text": "Commented-code block (5 lines) in src/native/liveUpdate.js:3"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-2eafc3188c36bb02", "name": "3 env vars used in code but missing from .env.example", "shortDescription": {"text": "3 env vars used in code but missing from .env.example"}, "fullDescription": {"text": "Drift between code and config docs. The first few: `GH_TOKEN`, `OTA_BASE_URL`, `VITE_OTA_MANIFEST_URL`. Add them (with a placeholder/comment) to .env.example so onboarding doesn't break."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-8ded93d2c1a6d31d", "name": "Frontend route `/terms` has no Link/navigate to it \u2014 src/App.jsx", "shortDescription": {"text": "Frontend route `/terms` has no Link/navigate to it \u2014 src/App.jsx"}, "fullDescription": {"text": "The route is registered but no `<Link to=\u2026>` or `navigate(\u2026)` in the codebase navigates here. Either it's reachable only via direct URL (intentional), it's dead, or the link broke during a refactor."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-57bb3d8d384ccadf", "name": "Frontend route `/privacy` has no Link/navigate to it \u2014 src/App.jsx", "shortDescription": {"text": "Frontend route `/privacy` has no Link/navigate to it \u2014 src/App.jsx"}, "fullDescription": {"text": "The route is registered but no `<Link to=\u2026>` or `navigate(\u2026)` in the codebase navigates here. Either it's reachable only via direct URL (intentional), it's dead, or the link broke during a refactor."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2970cba2db42d1c2", "name": "Frontend route `pos` has no Link/navigate to it \u2014 src/App.jsx", "shortDescription": {"text": "Frontend route `pos` has no Link/navigate to it \u2014 src/App.jsx"}, "fullDescription": {"text": "The route is registered but no `<Link to=\u2026>` or `navigate(\u2026)` in the codebase navigates here. Either it's reachable only via direct URL (intentional), it's dead, or the link broke during a refactor."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8eb014cafb6e096c", "name": "Frontend route `billing` has no Link/navigate to it \u2014 src/App.jsx", "shortDescription": {"text": "Frontend route `billing` has no Link/navigate to it \u2014 src/App.jsx"}, "fullDescription": {"text": "The route is registered but no `<Link to=\u2026>` or `navigate(\u2026)` in the codebase navigates here. Either it's reachable only via direct URL (intentional), it's dead, or the link broke during a refactor."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6e541e82b1a86e27", "name": "Frontend route `tables` has no Link/navigate to it \u2014 src/App.jsx", "shortDescription": {"text": "Frontend route `tables` has no Link/navigate to it \u2014 src/App.jsx"}, "fullDescription": {"text": "The route is registered but no `<Link to=\u2026>` or `navigate(\u2026)` in the codebase navigates here. Either it's reachable only via direct URL (intentional), it's dead, or the link broke during a refactor."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6fdbbd3590be3771", "name": "Frontend route `orders` has no Link/navigate to it \u2014 src/App.jsx", "shortDescription": {"text": "Frontend route `orders` has no Link/navigate to it \u2014 src/App.jsx"}, "fullDescription": {"text": "The route is registered but no `<Link to=\u2026>` or `navigate(\u2026)` in the codebase navigates here. Either it's reachable only via direct URL (intentional), it's dead, or the link broke during a refactor."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b1b03c83903e49e3", "name": "Frontend route `online-orders` has no Link/navigate to it \u2014 src/App.jsx", "shortDescription": {"text": "Frontend route `online-orders` has no Link/navigate to it \u2014 src/App.jsx"}, "fullDescription": {"text": "The route is registered but no `<Link to=\u2026>` or `navigate(\u2026)` in the codebase navigates here. Either it's reachable only via direct URL (intentional), it's dead, or the link broke during a refactor."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8b41e1ac38a36a97", "name": "Frontend route `menu` has no Link/navigate to it \u2014 src/App.jsx", "shortDescription": {"text": "Frontend route `menu` has no Link/navigate to it \u2014 src/App.jsx"}, "fullDescription": {"text": "The route is registered but no `<Link to=\u2026>` or `navigate(\u2026)` in the codebase navigates here. Either it's reachable only via direct URL (intentional), it's dead, or the link broke during a refactor."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4f543865b46206bc", "name": "Frontend route `inventory` has no Link/navigate to it \u2014 src/App.jsx", "shortDescription": {"text": "Frontend route `inventory` has no Link/navigate to it \u2014 src/App.jsx"}, "fullDescription": {"text": "The route is registered but no `<Link to=\u2026>` or `navigate(\u2026)` in the codebase navigates here. Either it's reachable only via direct URL (intentional), it's dead, or the link broke during a refactor."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-77992f0e8a926c4a", "name": "Frontend route `crm` has no Link/navigate to it \u2014 src/App.jsx", "shortDescription": {"text": "Frontend route `crm` has no Link/navigate to it \u2014 src/App.jsx"}, "fullDescription": {"text": "The route is registered but no `<Link to=\u2026>` or `navigate(\u2026)` in the codebase navigates here. Either it's reachable only via direct URL (intentional), it's dead, or the link broke during a refactor."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-889b1dae79aecba9", "name": "Frontend route `staff` has no Link/navigate to it \u2014 src/App.jsx", "shortDescription": {"text": "Frontend route `staff` has no Link/navigate to it \u2014 src/App.jsx"}, "fullDescription": {"text": "The route is registered but no `<Link to=\u2026>` or `navigate(\u2026)` in the codebase navigates here. Either it's reachable only via direct URL (intentional), it's dead, or the link broke during a refactor."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ad161fd98b8a15b6", "name": "Frontend route `reports` has no Link/navigate to it \u2014 src/App.jsx", "shortDescription": {"text": "Frontend route `reports` has no Link/navigate to it \u2014 src/App.jsx"}, "fullDescription": {"text": "The route is registered but no `<Link to=\u2026>` or `navigate(\u2026)` in the codebase navigates here. Either it's reachable only via direct URL (intentional), it's dead, or the link broke during a refactor."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0397b9bfef44ecc0", "name": "Frontend route `settings` has no Link/navigate to it \u2014 src/App.jsx", "shortDescription": {"text": "Frontend route `settings` has no Link/navigate to it \u2014 src/App.jsx"}, "fullDescription": {"text": "The route is registered but no `<Link to=\u2026>` or `navigate(\u2026)` in the codebase navigates here. Either it's reachable only via direct URL (intentional), it's dead, or the link broke during a refactor."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/18387"}, "properties": {"repository": "rohail642/BillByte-Frontend", "repoUrl": "https://github.com/rohail642/BillByte-Frontend", "branch": "main"}, "results": [{"ruleId": "scanner-fb5b867f561f07fb", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 src/components/layout/Sidebar.jsx:140"}, "properties": {"repobilityId": "86cc1d7e19f26a28", "scanner": "scanner-primary", "fingerprint": "fb5b867f561f07fb", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-61e521333eb0a6b3", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 src/components/layout/Topbar.jsx:161"}, "properties": {"repobilityId": "84e5d4d6dc477519", "scanner": "scanner-primary", "fingerprint": "61e521333eb0a6b3", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-1ffd60e79b8c6dbe", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 src/pages/Settings.jsx:1006"}, "properties": {"repobilityId": "b82b655c8f8efe99", "scanner": "scanner-primary", "fingerprint": "1ffd60e79b8c6dbe", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-30944820bc3bd33e", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 src/pages/WaiterView.jsx:261"}, "properties": {"repobilityId": "0af30a8534565762", "scanner": "scanner-primary", "fingerprint": "30944820bc3bd33e", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-73457f7b319691d7", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 src/pages/Reports.jsx:517"}, "properties": {"repobilityId": "9518cdd597b992b5", "scanner": "scanner-primary", "fingerprint": "73457f7b319691d7", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-0e16578f02de3a01", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 src/pages/CashierTables.jsx:349"}, "properties": {"repobilityId": "da662050b520ce79", "scanner": "scanner-primary", "fingerprint": "0e16578f02de3a01", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-54c48adf4e1ea890", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 src/pages/POSTerminal.jsx:440"}, "properties": {"repobilityId": "97c619ed77af244d", "scanner": "scanner-primary", "fingerprint": "54c48adf4e1ea890", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-a62a75dbcc9351e8", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 src/pages/Dashboard.jsx:208"}, "properties": {"repobilityId": "3ff9c29cae69be55", "scanner": "scanner-primary", "fingerprint": "a62a75dbcc9351e8", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-13456172b6704d95", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 src/pages/Billing.jsx:409"}, "properties": {"repobilityId": "a68be6b5180f8c81", "scanner": "scanner-primary", "fingerprint": "13456172b6704d95", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-564b45d270cf0238", "level": "error", "message": {"text": "Runtime dotenv file present in repo: .env.production"}, "properties": {"repobilityId": "da3016501941bee3", "scanner": "scanner-primary", "fingerprint": "564b45d270cf0238", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["secrets", "config", "env-file", "runtime-env"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".env.production"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-9c220b4fc29fbdea", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in scripts/release-all.mjs:15"}, "properties": {"repobilityId": "e40abe2790accb05", "scanner": "scanner-primary", "fingerprint": "9c220b4fc29fbdea", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/release-all.mjs"}, "region": {"startLine": 15}}}]}, {"ruleId": "scanner-19849ad81166eeb6", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in scripts/make-ota-bundle.mjs:15"}, "properties": {"repobilityId": "3376d29c0e3acd1e", "scanner": "scanner-primary", "fingerprint": "19849ad81166eeb6", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/make-ota-bundle.mjs"}, "region": {"startLine": 15}}}]}, {"ruleId": "scanner-5a53a7315112809f", "level": "note", "message": {"text": "Insecure pattern 'document_write' in src/components/ui/ReceiptView.jsx:179"}, "properties": {"repobilityId": "b7f8d5277b2a117f", "scanner": "scanner-primary", "fingerprint": "5a53a7315112809f", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["owasp", "document_write"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/components/ui/ReceiptView.jsx"}, "region": {"startLine": 179}}}]}, {"ruleId": "scanner-b0969cae95f960eb", "level": "note", "message": {"text": "Insecure pattern 'document_write' in src/components/ui/KOTView.jsx:142"}, "properties": {"repobilityId": "517563e353ee948f", "scanner": "scanner-primary", "fingerprint": "b0969cae95f960eb", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["owasp", "document_write"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/components/ui/KOTView.jsx"}, "region": {"startLine": 142}}}]}, {"ruleId": "scanner-4601e3ad3bb28677", "level": "warning", "message": {"text": "No CI/CD pipelines detected"}, "properties": {"repobilityId": "c3ee439bce2bc51e", "scanner": "scanner-primary", "fingerprint": "4601e3ad3bb28677", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-5be15c4d25528bac", "level": "note", "message": {"text": "Very large file: src/pages/Settings.jsx (1128 lines)"}, "properties": {"repobilityId": "9bb16a7351c04361", "scanner": "scanner-primary", "fingerprint": "5be15c4d25528bac", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-6893a6c8b0861585", "level": "warning", "message": {"text": "Very low test-to-source ratio"}, "properties": {"repobilityId": "54a7de3f06314bf0", "scanner": "scanner-primary", "fingerprint": "6893a6c8b0861585", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["tests", "coverage"]}}, {"ruleId": "scanner-141b30a41e03817b", "level": "note", "message": {"text": "No license file detected"}, "properties": {"repobilityId": "a9f852d4676539d1", "scanner": "scanner-primary", "fingerprint": "141b30a41e03817b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["license", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "8e65a31743f80414", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-72b2a6250083a784", "level": "warning", "message": {"text": "Placeholder or mock-heavy implementation detected"}, "properties": {"repobilityId": "813f00b31b2016fa", "scanner": "scanner-primary", "fingerprint": "72b2a6250083a784", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "incomplete", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "3182540e19f31727", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-b9088664ace7f748", "level": "note", "message": {"text": "Composite production-readiness gap"}, "properties": {"repobilityId": "0c144f9c6358b14d", "scanner": "scanner-primary", "fingerprint": "b9088664ace7f748", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["production-readiness", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-749d4bc1bd66df5f", "level": "warning", "message": {"text": "Agent instructions exist but release-hardening basics are missing"}, "properties": {"repobilityId": "a120410cbe2600cf", "scanner": "scanner-primary", "fingerprint": "749d4bc1bd66df5f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "684c56668118cea0", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "728b242914c81e11", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-006b2e73583badfe", "level": "none", "message": {"text": "Commented-code block (5 lines) in scripts/release-all.mjs:6"}, "properties": {"repobilityId": "72d5fecc245471f1", "scanner": "scanner-primary", "fingerprint": "006b2e73583badfe", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-2b19779b353c7e49", "level": "none", "message": {"text": "Commented-code block (7 lines) in src/main.jsx:13"}, "properties": {"repobilityId": "e974f724faeadc10", "scanner": "scanner-primary", "fingerprint": "2b19779b353c7e49", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-977dd60108cc2ad9", "level": "note", "message": {"text": "Legacy-named symbol `isOld` in src/pages/KitchenDisplay.jsx:168"}, "properties": {"repobilityId": "1a54d79511d00b24", "scanner": "scanner-primary", "fingerprint": "977dd60108cc2ad9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-33b18ead566a6aab", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/native/liveUpdate.js:3"}, "properties": {"repobilityId": "e4e5bf1f529a12d3", "scanner": "scanner-primary", "fingerprint": "33b18ead566a6aab", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-2eafc3188c36bb02", "level": "none", "message": {"text": "3 env vars used in code but missing from .env.example"}, "properties": {"repobilityId": "bd934ba112b02ffa", "scanner": "scanner-primary", "fingerprint": "2eafc3188c36bb02", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "config-drift"]}}, {"ruleId": "scanner-8ded93d2c1a6d31d", "level": "warning", "message": {"text": "Frontend route `/terms` has no Link/navigate to it \u2014 src/App.jsx"}, "properties": {"repobilityId": "0547115a0e4a195f", "scanner": "scanner-primary", "fingerprint": "8ded93d2c1a6d31d", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "orphan-page", "wiring"]}}, {"ruleId": "scanner-57bb3d8d384ccadf", "level": "warning", "message": {"text": "Frontend route `/privacy` has no Link/navigate to it \u2014 src/App.jsx"}, "properties": {"repobilityId": "a1101891737047ba", "scanner": "scanner-primary", "fingerprint": "57bb3d8d384ccadf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "orphan-page", "wiring"]}}, {"ruleId": "scanner-2970cba2db42d1c2", "level": "warning", "message": {"text": "Frontend route `pos` has no Link/navigate to it \u2014 src/App.jsx"}, "properties": {"repobilityId": "5e67573214da6fb0", "scanner": "scanner-primary", "fingerprint": "2970cba2db42d1c2", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "orphan-page", "wiring"]}}, {"ruleId": "scanner-8eb014cafb6e096c", "level": "warning", "message": {"text": "Frontend route `billing` has no Link/navigate to it \u2014 src/App.jsx"}, "properties": {"repobilityId": "cc351952afa35d91", "scanner": "scanner-primary", "fingerprint": "8eb014cafb6e096c", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "orphan-page", "wiring"]}}, {"ruleId": "scanner-6e541e82b1a86e27", "level": "warning", "message": {"text": "Frontend route `tables` has no Link/navigate to it \u2014 src/App.jsx"}, "properties": {"repobilityId": "7c1710cfe904af13", "scanner": "scanner-primary", "fingerprint": "6e541e82b1a86e27", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "orphan-page", "wiring"]}}, {"ruleId": "scanner-6fdbbd3590be3771", "level": "warning", "message": {"text": "Frontend route `orders` has no Link/navigate to it \u2014 src/App.jsx"}, "properties": {"repobilityId": "70e55163c63a61ed", "scanner": "scanner-primary", "fingerprint": "6fdbbd3590be3771", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "orphan-page", "wiring"]}}, {"ruleId": "scanner-b1b03c83903e49e3", "level": "warning", "message": {"text": "Frontend route `online-orders` has no Link/navigate to it \u2014 src/App.jsx"}, "properties": {"repobilityId": "a5eb189cf4d633e8", "scanner": "scanner-primary", "fingerprint": "b1b03c83903e49e3", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "orphan-page", "wiring"]}}, {"ruleId": "scanner-8b41e1ac38a36a97", "level": "warning", "message": {"text": "Frontend route `menu` has no Link/navigate to it \u2014 src/App.jsx"}, "properties": {"repobilityId": "ec5e2af04eeec219", "scanner": "scanner-primary", "fingerprint": "8b41e1ac38a36a97", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "orphan-page", "wiring"]}}, {"ruleId": "scanner-4f543865b46206bc", "level": "warning", "message": {"text": "Frontend route `inventory` has no Link/navigate to it \u2014 src/App.jsx"}, "properties": {"repobilityId": "db8c97261b77fa70", "scanner": "scanner-primary", "fingerprint": "4f543865b46206bc", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "orphan-page", "wiring"]}}, {"ruleId": "scanner-77992f0e8a926c4a", "level": "warning", "message": {"text": "Frontend route `crm` has no Link/navigate to it \u2014 src/App.jsx"}, "properties": {"repobilityId": "fd66874165153e6d", "scanner": "scanner-primary", "fingerprint": "77992f0e8a926c4a", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "orphan-page", "wiring"]}}, {"ruleId": "scanner-889b1dae79aecba9", "level": "warning", "message": {"text": "Frontend route `staff` has no Link/navigate to it \u2014 src/App.jsx"}, "properties": {"repobilityId": "a957b59bee8f5858", "scanner": "scanner-primary", "fingerprint": "889b1dae79aecba9", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "orphan-page", "wiring"]}}, {"ruleId": "scanner-ad161fd98b8a15b6", "level": "warning", "message": {"text": "Frontend route `reports` has no Link/navigate to it \u2014 src/App.jsx"}, "properties": {"repobilityId": "e40a2eb847535e4f", "scanner": "scanner-primary", "fingerprint": "ad161fd98b8a15b6", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "orphan-page", "wiring"]}}, {"ruleId": "scanner-0397b9bfef44ecc0", "level": "warning", "message": {"text": "Frontend route `settings` has no Link/navigate to it \u2014 src/App.jsx"}, "properties": {"repobilityId": "6e65d164ae2ddbbb", "scanner": "scanner-primary", "fingerprint": "0397b9bfef44ecc0", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "orphan-page", "wiring"]}}]}]}