{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-e3c0ff1e7ef90c99", "name": "Insecure pattern 'direct_innerhtml_assignment' in meditations.html:1263", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in meditations.html:1263"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-5cfea0dfe1b1dd62", "name": "Insecure pattern 'direct_innerhtml_assignment' in prince.html:1093", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in prince.html:1093"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b15f8250f76132eb", "name": "Insecure pattern 'direct_innerhtml_assignment' in index.html:1747", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in index.html:1747"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-cd26956d3518097f", "name": "Insecure pattern 'direct_innerhtml_assignment' in dune.html:1256", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in dune.html:1256"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ecc043c6c766427e", "name": "Insecure pattern 'direct_innerhtml_assignment' in gatsby.html:1290", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in gatsby.html:1290"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4edc1a4ba7d9ccf6", "name": "Insecure pattern 'direct_innerhtml_assignment' in rilke.html:1351", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in rilke.html:1351"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-dd049650ee9ed2f9", "name": "Insecure pattern 'direct_innerhtml_assignment' in 1984.html:1342", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in 1984.html:1342"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6372cebde0220094", "name": "No auth library detected", "shortDescription": {"text": "No auth library detected"}, "fullDescription": {"text": "The scanner did not find any standard auth library (JWT, OAuth, NextAuth, Auth0, etc.). The repo has auth/admin/session surface indicators, so auth may live in custom code, in a separate service, or be missing."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-bea357a6497a2d5d", "name": "Agent authority lacks a verifier contract: CLAUDE.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: CLAUDE.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/28874"}, "properties": {"repository": "rafixan/down-the-rabbit-hole", "repoUrl": "https://github.com/rafixan/down-the-rabbit-hole", "branch": "main"}, "results": [{"ruleId": "scanner-e3c0ff1e7ef90c99", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in meditations.html:1263"}, "properties": {"repobilityId": "a4307b066480154a", "scanner": "scanner-primary", "fingerprint": "e3c0ff1e7ef90c99", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "meditations.html"}, "region": {"startLine": 1263}}}]}, {"ruleId": "scanner-5cfea0dfe1b1dd62", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in prince.html:1093"}, "properties": {"repobilityId": "3bc56c124fd2da23", "scanner": "scanner-primary", "fingerprint": "5cfea0dfe1b1dd62", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "prince.html"}, "region": {"startLine": 1093}}}]}, {"ruleId": "scanner-b15f8250f76132eb", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in index.html:1747"}, "properties": {"repobilityId": "f91708437a3a5445", "scanner": "scanner-primary", "fingerprint": "b15f8250f76132eb", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "index.html"}, "region": {"startLine": 1747}}}]}, {"ruleId": "scanner-cd26956d3518097f", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in dune.html:1256"}, "properties": {"repobilityId": "976a92546d0df76b", "scanner": "scanner-primary", "fingerprint": "cd26956d3518097f", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "dune.html"}, "region": {"startLine": 1256}}}]}, {"ruleId": "scanner-ecc043c6c766427e", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in gatsby.html:1290"}, "properties": {"repobilityId": "c3e134b94fcc8e0c", "scanner": "scanner-primary", "fingerprint": "ecc043c6c766427e", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "gatsby.html"}, "region": {"startLine": 1290}}}]}, {"ruleId": "scanner-4edc1a4ba7d9ccf6", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in rilke.html:1351"}, "properties": {"repobilityId": "2b8d878c5cd7a642", "scanner": "scanner-primary", "fingerprint": "4edc1a4ba7d9ccf6", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "rilke.html"}, "region": {"startLine": 1351}}}]}, {"ruleId": "scanner-dd049650ee9ed2f9", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in 1984.html:1342"}, "properties": {"repobilityId": "33cb1b5e47362317", "scanner": "scanner-primary", "fingerprint": "dd049650ee9ed2f9", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "1984.html"}, "region": {"startLine": 1342}}}]}, {"ruleId": "scanner-6372cebde0220094", "level": "warning", "message": {"text": "No auth library detected"}, "properties": {"repobilityId": "a5b6035a5bbf8054", "scanner": "scanner-primary", "fingerprint": "6372cebde0220094", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["coverage", "auth"]}}, {"ruleId": "scanner-bea357a6497a2d5d", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: CLAUDE.md"}, "properties": {"repobilityId": "aae72df3934829ac", "scanner": "scanner-primary", "fingerprint": "bea357a6497a2d5d", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "CLAUDE.md"}, "region": {"startLine": 1}}}]}]}]}