{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-9710c8d059e53154", "name": "No frontend routes/components detected", "shortDescription": {"text": "No frontend routes/components detected"}, "fullDescription": {"text": "No React/Vue/Next routes were found. This is fine for backend-only repos."}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-f1bf8f0d5aa0e98f", "name": "Insecure pattern 'node_child_process' in loom/scripts/validate-m0.mjs:4", "shortDescription": {"text": "Insecure pattern 'node_child_process' in loom/scripts/validate-m0.mjs:4"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c1378bc659955282", "name": "Insecure pattern 'node_child_process' in loom/scripts/affected-shots.mjs:16", "shortDescription": {"text": "Insecure pattern 'node_child_process' in loom/scripts/affected-shots.mjs:16"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c9b29ce7230f7100", "name": "Insecure pattern 'node_child_process' in loom/scripts/validate-m5.mjs:9", "shortDescription": {"text": "Insecure pattern 'node_child_process' in loom/scripts/validate-m5.mjs:9"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d7606ab3749bb0c2", "name": "Insecure pattern 'node_child_process' in loom/scripts/validate-stdlib.mjs:7", "shortDescription": {"text": "Insecure pattern 'node_child_process' in loom/scripts/validate-stdlib.mjs:7"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-29a1f53fdf983fdd", "name": "Insecure pattern 'node_child_process' in loom/scripts/validate-projects.mjs:10", "shortDescription": {"text": "Insecure pattern 'node_child_process' in loom/scripts/validate-projects.mjs:10"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b4044e7562d5109b", "name": "Insecure pattern 'node_child_process' in loom/scripts/validate-panic.mjs:10", "shortDescription": {"text": "Insecure pattern 'node_child_process' in loom/scripts/validate-panic.mjs:10"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1151d1f3723a00d2", "name": "Insecure pattern 'node_child_process' in loom/scripts/validate-m1.mjs:4", "shortDescription": {"text": "Insecure pattern 'node_child_process' in loom/scripts/validate-m1.mjs:4"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a798b88aaf5e6503", "name": "Insecure pattern 'node_child_process' in loom/scripts/validate-m4.mjs:9", "shortDescription": {"text": "Insecure pattern 'node_child_process' in loom/scripts/validate-m4.mjs:9"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c67825e727d7dbc4", "name": "Insecure pattern 'node_child_process' in loom/scripts/validate-modulators.mjs:8", "shortDescription": {"text": "Insecure pattern 'node_child_process' in loom/scripts/validate-modulators.mjs:8"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-da108ebede9e49c8", "name": "Insecure pattern 'node_child_process' in loom/scripts/validate-m11.mjs:9", "shortDescription": {"text": "Insecure pattern 'node_child_process' in loom/scripts/validate-m11.mjs:9"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-938553df087da7cb", "name": "Insecure pattern 'node_child_process' in loom/scripts/validate-m3.mjs:8", "shortDescription": {"text": "Insecure pattern 'node_child_process' in loom/scripts/validate-m3.mjs:8"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ad725fe01e6a0912", "name": "Insecure pattern 'node_child_process' in loom/scripts/validate-m9.mjs:8", "shortDescription": {"text": "Insecure pattern 'node_child_process' in loom/scripts/validate-m9.mjs:8"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e375cf03442a6bf5", "name": "Insecure pattern 'node_child_process' in loom/scripts/validate-m2.mjs:8", "shortDescription": {"text": "Insecure pattern 'node_child_process' in loom/scripts/validate-m2.mjs:8"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e60ebd802d996ec1", "name": "Insecure pattern 'node_child_process' in loom/scripts/validate-m8.mjs:10", "shortDescription": {"text": "Insecure pattern 'node_child_process' in loom/scripts/validate-m8.mjs:10"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e22b1a663792359f", "name": "Insecure pattern 'node_child_process' in loom/scripts/validate-fixtures.mjs:9", "shortDescription": {"text": "Insecure pattern 'node_child_process' in loom/scripts/validate-fixtures.mjs:9"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-dc13cca442b8ef85", "name": "Insecure pattern 'node_child_process' in loom/scripts/validate-layers.mjs:10", "shortDescription": {"text": "Insecure pattern 'node_child_process' in loom/scripts/validate-layers.mjs:10"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6da1c1d405ac49af", "name": "Insecure pattern 'node_child_process' in loom/scripts/validate-m6.mjs:10", "shortDescription": {"text": "Insecure pattern 'node_child_process' in loom/scripts/validate-m6.mjs:10"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2e9a5395c74c05f0", "name": "Insecure pattern 'node_child_process' in loom/scripts/validate-m7.mjs:10", "shortDescription": {"text": "Insecure pattern 'node_child_process' in loom/scripts/validate-m7.mjs:10"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9b26537bf31bda70", "name": "Insecure pattern 'node_child_process' in loom/scripts/shoot.mjs:21", "shortDescription": {"text": "Insecure pattern 'node_child_process' in loom/scripts/shoot.mjs:21"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-90a24c1106594ef6", "name": "Insecure pattern 'node_child_process' in loom/packages/engine-app/vite.config.ts:1", "shortDescription": {"text": "Insecure pattern 'node_child_process' in loom/packages/engine-app/vite.config.ts:1"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6372cebde0220094", "name": "No auth library detected", "shortDescription": {"text": "No auth library detected"}, "fullDescription": {"text": "The scanner did not find any standard auth library (JWT, OAuth, NextAuth, Auth0, etc.). The repo has auth/admin/session surface indicators, so auth may live in custom code, in a separate service, or be missing."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d82ec1a2e86f50c6", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "marocchino/sticky-pull-request-comment@v2 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea3b5e389d8c9c0f", "name": "Low test-to-source ratio", "shortDescription": {"text": "Low test-to-source ratio"}, "fullDescription": {"text": "46 tests / 213 src (ratio 0.22)."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-141b30a41e03817b", "name": "No license file detected", "shortDescription": {"text": "No license file detected"}, "fullDescription": {"text": "No LICENSE/COPYING/NOTICE file was found. Generated repositories often omit licensing, which blocks reuse and automated intake."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d732835e2dd1d37e", "name": "Node manifest has dependencies but no lockfile: loom/packages/engine-app/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: loom/packages/engine-app/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e5c57a8afd1e4719", "name": "Node manifest has dependencies but no lockfile: loom/packages/runtime/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: loom/packages/runtime/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-dd82546ffb71ad43", "name": "Node manifest has dependencies but no lockfile: loom/packages/sidecar/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: loom/packages/sidecar/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 55 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-72b2a6250083a784", "name": "Placeholder or mock-heavy implementation detected", "shortDescription": {"text": "Placeholder or mock-heavy implementation detected"}, "fullDescription": {"text": "Found 17 placeholder/mock markers across 10 source files. This often means the repo looks complete while core flows still use generated scaffolding or fake data."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b9088664ace7f748", "name": "Composite production-readiness gap", "shortDescription": {"text": "Composite production-readiness gap"}, "fullDescription": {"text": "Multiple low-cost hardening controls are missing together: license, lockfile. Opus verification showed these co-occurring gaps are a better readiness signal than reading each flag in isolation."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-749d4bc1bd66df5f", "name": "Agent instructions exist but release-hardening basics are missing", "shortDescription": {"text": "Agent instructions exist but release-hardening basics are missing"}, "fullDescription": {"text": "AI-coder instruction files were found, but the repo is missing license, lockfile. Treat this as a contract gap: the agent is guided, but the generated output is not yet guarded by the controls that make it repeatable."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-65528ebbf5df0baf", "name": "Agent authority lacks a verifier contract: loom/.mcp.json", "shortDescription": {"text": "Agent authority lacks a verifier contract: loom/.mcp.json"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-71173ff29e487a30", "name": "Commented-code block (6 lines) in loom/scripts/_browser.mjs:12", "shortDescription": {"text": "Commented-code block (6 lines) in loom/scripts/_browser.mjs:12"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-804488c1916c2747", "name": "Commented-code block (5 lines) in loom/scripts/build-catalog.mjs:1", "shortDescription": {"text": "Commented-code block (5 lines) in loom/scripts/build-catalog.mjs:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-dd9a727eb23359a2", "name": "Commented-code block (5 lines) in loom/scripts/affected-shots.mjs:8", "shortDescription": {"text": "Commented-code block (5 lines) in loom/scripts/affected-shots.mjs:8"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-c12b08113d8d0bc6", "name": "Commented-code block (6 lines) in loom/scripts/validate-m5.mjs:1", "shortDescription": {"text": "Commented-code block (6 lines) in loom/scripts/validate-m5.mjs:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-cbd9d3e98670febe", "name": "Commented-code block (6 lines) in loom/scripts/validate-stdlib.mjs:1", "shortDescription": {"text": "Commented-code block (6 lines) in loom/scripts/validate-stdlib.mjs:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-eeafa48eb80a3915", "name": "Commented-code block (7 lines) in loom/scripts/validate-projects.mjs:1", "shortDescription": {"text": "Commented-code block (7 lines) in loom/scripts/validate-projects.mjs:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-ef4e9198225ae256", "name": "Commented-code block (7 lines) in loom/scripts/validate-panic.mjs:1", "shortDescription": {"text": "Commented-code block (7 lines) in loom/scripts/validate-panic.mjs:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-cd001d912e1d8abf", "name": "Commented-code block (7 lines) in loom/scripts/validate-m1.mjs:180", "shortDescription": {"text": "Commented-code block (7 lines) in loom/scripts/validate-m1.mjs:180"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-078f9998fc9ddc82", "name": "Commented-code block (6 lines) in loom/scripts/validate-m4.mjs:1", "shortDescription": {"text": "Commented-code block (6 lines) in loom/scripts/validate-m4.mjs:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-7857fafb9b8eb49b", "name": "Commented-code block (5 lines) in loom/scripts/validate-modulators.mjs:1", "shortDescription": {"text": "Commented-code block (5 lines) in loom/scripts/validate-modulators.mjs:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-10f9a0da427754b1", "name": "Commented-code block (6 lines) in loom/scripts/validate-m11.mjs:1", "shortDescription": {"text": "Commented-code block (6 lines) in loom/scripts/validate-m11.mjs:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-522684ca9bf986c9", "name": "Commented-code block (5 lines) in loom/scripts/validate-m3.mjs:1", "shortDescription": {"text": "Commented-code block (5 lines) in loom/scripts/validate-m3.mjs:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-51d49f17d62f17dc", "name": "`fetch()` without try/.catch or AbortSignal \u2014 loom/scripts/validate-m3.mjs:178", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 loom/scripts/validate-m3.mjs:178"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0126a4746461ed7a", "name": "Commented-code block (5 lines) in loom/scripts/validate-m9.mjs:1", "shortDescription": {"text": "Commented-code block (5 lines) in loom/scripts/validate-m9.mjs:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-a28095008e37db06", "name": "`fetch()` without try/.catch or AbortSignal \u2014 loom/scripts/validate-m9.mjs:250", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 loom/scripts/validate-m9.mjs:250"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-fa265ea51f42f21b", "name": "Commented-code block (5 lines) in loom/scripts/validate-m2.mjs:1", "shortDescription": {"text": "Commented-code block (5 lines) in loom/scripts/validate-m2.mjs:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-d0db2cebc8ec07c8", "name": "Commented-code block (7 lines) in loom/scripts/validate-m8.mjs:1", "shortDescription": {"text": "Commented-code block (7 lines) in loom/scripts/validate-m8.mjs:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-8a7f71cdc441e34a", "name": "Commented-code block (6 lines) in loom/scripts/validate-fixtures.mjs:1", "shortDescription": {"text": "Commented-code block (6 lines) in loom/scripts/validate-fixtures.mjs:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-7965089cb7b6eeda", "name": "Commented-code block (7 lines) in loom/scripts/validate-layers.mjs:1", "shortDescription": {"text": "Commented-code block (7 lines) in loom/scripts/validate-layers.mjs:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-64fc24adefc37a0e", "name": "Commented-code block (7 lines) in loom/scripts/validate-m6.mjs:1", "shortDescription": {"text": "Commented-code block (7 lines) in loom/scripts/validate-m6.mjs:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-630f375d64b25b37", "name": "Commented-code block (5 lines) in loom/scripts/preview-comment.mjs:6", "shortDescription": {"text": "Commented-code block (5 lines) in loom/scripts/preview-comment.mjs:6"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-b86b3503ff01d39d", "name": "Commented-code block (7 lines) in loom/scripts/validate-m7.mjs:1", "shortDescription": {"text": "Commented-code block (7 lines) in loom/scripts/validate-m7.mjs:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-9a23f9fff3d5e98f", "name": "Commented-code block (5 lines) in loom/scripts/shoot.mjs:3", "shortDescription": {"text": "Commented-code block (5 lines) in loom/scripts/shoot.mjs:3"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-87c073a141d382c0", "name": "Commented-code block (7 lines) in loom/packages/engine-app/vite.config.ts:8", "shortDescription": {"text": "Commented-code block (7 lines) in loom/packages/engine-app/vite.config.ts:8"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-1d4a21baf02eae27", "name": "Commented-code block (6 lines) in loom/packages/engine-app/src/main.ts:131", "shortDescription": {"text": "Commented-code block (6 lines) in loom/packages/engine-app/src/main.ts:131"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-29665fcf883eb463", "name": "`fetch()` without try/.catch or AbortSignal \u2014 loom/packages/engine-app/src/main.ts:412", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 loom/packages/engine-app/src/main.ts:412"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-af5105e638a7f72e", "name": "Commented-code block (8 lines) in loom/packages/engine-app/src/ui/console/TileGrid.tsx:37", "shortDescription": {"text": "Commented-code block (8 lines) in loom/packages/engine-app/src/ui/console/TileGrid.tsx:37"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-e495683db2b27f06", "name": "Commented-code block (6 lines) in loom/packages/runtime/src/chain.ts:272", "shortDescription": {"text": "Commented-code block (6 lines) in loom/packages/runtime/src/chain.ts:272"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-22f28b29a2ccf542", "name": "Commented-code block (5 lines) in loom/content/scenes/panic.scene.ts:1", "shortDescription": {"text": "Commented-code block (5 lines) in loom/content/scenes/panic.scene.ts:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-b1399440615e59d1", "name": "`fetch()` without try/.catch or AbortSignal \u2014 loom/content/test/setup.ts:2", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 loom/content/test/setup.ts:2"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7f3e636f44bd95c1", "name": "Dangling fetch: POST /loom/effects/${encodeURIComponent(name)} (loom/packages/engine-app/src/main.ts:305)", "shortDescription": {"text": "Dangling fetch: POST /loom/effects/${encodeURIComponent(name)} (loom/packages/engine-app/src/main.ts:305)"}, "fullDescription": {"text": "`loom/packages/engine-app/src/main.ts:305` calls `POST /loom/effects/${encodeURIComponent(name)}` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/loom/effects/<p>`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-7a4a41c7ef1f3510", "name": "Dangling fetch: GET /loom/state-list/${StateDir.projects} (loom/packages/engine-app/src/main.ts:375)", "shortDescription": {"text": "Dangling fetch: GET /loom/state-list/${StateDir.projects} (loom/packages/engine-app/src/main.ts:375)"}, "fullDescription": {"text": "`loom/packages/engine-app/src/main.ts:375` calls `GET /loom/state-list/${StateDir.projects}` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/loom/state-list/<p>`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-075cc112986d3a27", "name": "Dangling fetch: GET /loom/state/${StateDir.fixtures}/${encodeURIComponent(name)} (loom/packages/engine-app/src/main.ts:4", "shortDescription": {"text": "Dangling fetch: GET /loom/state/${StateDir.fixtures}/${encodeURIComponent(name)} (loom/packages/engine-app/src/main.ts:412)"}, "fullDescription": {"text": "`loom/packages/engine-app/src/main.ts:412` calls `GET /loom/state/${StateDir.fixtures}/${encodeURIComponent(name)}` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/loom/state/<p>/<p>`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-c893163e5e7f198d", "name": "Dangling fetch: POST /loom/state/${StateDir.fixtures}/${encodeURIComponent(r.name)} (loom/packages/engine-app/src/main.t", "shortDescription": {"text": "Dangling fetch: POST /loom/state/${StateDir.fixtures}/${encodeURIComponent(r.name)} (loom/packages/engine-app/src/main.ts:513)"}, "fullDescription": {"text": "`loom/packages/engine-app/src/main.ts:513` calls `POST /loom/state/${StateDir.fixtures}/${encodeURIComponent(r.name)}` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/loom/state/<p>/<p>`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-56ca0bde3ac97427", "name": "Dangling fetch: POST /loom/state/${StateDir.projects}/${encodeURIComponent(name)} (loom/packages/engine-app/src/main.ts:", "shortDescription": {"text": "Dangling fetch: POST /loom/state/${StateDir.projects}/${encodeURIComponent(name)} (loom/packages/engine-app/src/main.ts:538)"}, "fullDescription": {"text": "`loom/packages/engine-app/src/main.ts:538` calls `POST /loom/state/${StateDir.projects}/${encodeURIComponent(name)}` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/loom/state/<p>/<p>`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-d3f93c151b402954", "name": "Dangling fetch: GET /loom/state/${StateDir.projects}/${encodeURIComponent(name)} (loom/packages/engine-app/src/main.ts:5", "shortDescription": {"text": "Dangling fetch: GET /loom/state/${StateDir.projects}/${encodeURIComponent(name)} (loom/packages/engine-app/src/main.ts:549)"}, "fullDescription": {"text": "`loom/packages/engine-app/src/main.ts:549` calls `GET /loom/state/${StateDir.projects}/${encodeURIComponent(name)}` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/loom/state/<p>/<p>`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-c474864c464a84a4", "name": "Dangling fetch: GET /loom/state/${name} (loom/packages/engine-app/src/state.ts:65)", "shortDescription": {"text": "Dangling fetch: GET /loom/state/${name} (loom/packages/engine-app/src/state.ts:65)"}, "fullDescription": {"text": "`loom/packages/engine-app/src/state.ts:65` calls `GET /loom/state/${name}` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/loom/state/<p>`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-36830c4bf4d6c9d8", "name": "Dangling fetch: POST /loom/state/${name} (loom/packages/engine-app/src/state.ts:82)", "shortDescription": {"text": "Dangling fetch: POST /loom/state/${name} (loom/packages/engine-app/src/state.ts:82)"}, "fullDescription": {"text": "`loom/packages/engine-app/src/state.ts:82` calls `POST /loom/state/${name}` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/loom/state/<p>`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-70c2ff0e8e2d3727", "name": "Unused endpoint: USE /loom/state/", "shortDescription": {"text": "Unused endpoint: USE /loom/state/"}, "fullDescription": {"text": "`loom/packages/engine-app/vite.config.ts` declares `USE /loom/state/` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8e5ae5ab84834534", "name": "Unused endpoint: USE /loom/media", "shortDescription": {"text": "Unused endpoint: USE /loom/media"}, "fullDescription": {"text": "`loom/packages/engine-app/vite.config.ts` declares `USE /loom/media` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-efa0fd925b14875f", "name": "Unused endpoint: USE /loom/mediafs/", "shortDescription": {"text": "Unused endpoint: USE /loom/mediafs/"}, "fullDescription": {"text": "`loom/packages/engine-app/vite.config.ts` declares `USE /loom/mediafs/` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fa26d2fec6101c40", "name": "Unused endpoint: USE /loom/state-list/", "shortDescription": {"text": "Unused endpoint: USE /loom/state-list/"}, "fullDescription": {"text": "`loom/packages/engine-app/vite.config.ts` declares `USE /loom/state-list/` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-644789d20171bfbc", "name": "Unused endpoint: USE /loom/effects/", "shortDescription": {"text": "Unused endpoint: USE /loom/effects/"}, "fullDescription": {"text": "`loom/packages/engine-app/vite.config.ts` declares `USE /loom/effects/` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/23507"}, "properties": {"repository": "ZackMFleischman/ai-experiments", "repoUrl": "https://github.com/ZackMFleischman/ai-experiments", "branch": "main"}, "results": [{"ruleId": "scanner-9710c8d059e53154", "level": "none", "message": {"text": "No frontend routes/components detected"}, "properties": {"repobilityId": "44ca61485762e494", "scanner": "scanner-primary", "fingerprint": "9710c8d059e53154", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-f1bf8f0d5aa0e98f", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in loom/scripts/validate-m0.mjs:4"}, "properties": {"repobilityId": "86a24c2188763d5b", "scanner": "scanner-primary", "fingerprint": "f1bf8f0d5aa0e98f", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "loom/scripts/validate-m0.mjs"}, "region": {"startLine": 4}}}]}, {"ruleId": "scanner-c1378bc659955282", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in loom/scripts/affected-shots.mjs:16"}, "properties": {"repobilityId": "f0cdeca283a885ef", "scanner": "scanner-primary", "fingerprint": "c1378bc659955282", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "loom/scripts/affected-shots.mjs"}, "region": {"startLine": 16}}}]}, {"ruleId": "scanner-c9b29ce7230f7100", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in loom/scripts/validate-m5.mjs:9"}, "properties": {"repobilityId": "b37470a46e3901d5", "scanner": "scanner-primary", "fingerprint": "c9b29ce7230f7100", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "loom/scripts/validate-m5.mjs"}, "region": {"startLine": 9}}}]}, {"ruleId": "scanner-d7606ab3749bb0c2", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in loom/scripts/validate-stdlib.mjs:7"}, "properties": {"repobilityId": "8a74421aabcdb37a", "scanner": "scanner-primary", "fingerprint": "d7606ab3749bb0c2", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "loom/scripts/validate-stdlib.mjs"}, "region": {"startLine": 7}}}]}, {"ruleId": "scanner-29a1f53fdf983fdd", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in loom/scripts/validate-projects.mjs:10"}, "properties": {"repobilityId": "2500af4c9a9fcf44", "scanner": "scanner-primary", "fingerprint": "29a1f53fdf983fdd", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "loom/scripts/validate-projects.mjs"}, "region": {"startLine": 10}}}]}, {"ruleId": "scanner-b4044e7562d5109b", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in loom/scripts/validate-panic.mjs:10"}, "properties": {"repobilityId": "e30b7013e546cd57", "scanner": "scanner-primary", "fingerprint": "b4044e7562d5109b", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "loom/scripts/validate-panic.mjs"}, "region": {"startLine": 10}}}]}, {"ruleId": "scanner-1151d1f3723a00d2", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in loom/scripts/validate-m1.mjs:4"}, "properties": {"repobilityId": "50910b3585af0aeb", "scanner": "scanner-primary", "fingerprint": "1151d1f3723a00d2", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "loom/scripts/validate-m1.mjs"}, "region": {"startLine": 4}}}]}, {"ruleId": "scanner-a798b88aaf5e6503", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in loom/scripts/validate-m4.mjs:9"}, "properties": {"repobilityId": "a00c3a0e052a3715", "scanner": "scanner-primary", "fingerprint": "a798b88aaf5e6503", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "loom/scripts/validate-m4.mjs"}, "region": {"startLine": 9}}}]}, {"ruleId": "scanner-c67825e727d7dbc4", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in loom/scripts/validate-modulators.mjs:8"}, "properties": {"repobilityId": "d6f0d466d616a00f", "scanner": "scanner-primary", "fingerprint": "c67825e727d7dbc4", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "loom/scripts/validate-modulators.mjs"}, "region": {"startLine": 8}}}]}, {"ruleId": "scanner-da108ebede9e49c8", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in loom/scripts/validate-m11.mjs:9"}, "properties": {"repobilityId": "90ddf0709a8ebfc5", "scanner": "scanner-primary", "fingerprint": "da108ebede9e49c8", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "loom/scripts/validate-m11.mjs"}, "region": {"startLine": 9}}}]}, {"ruleId": "scanner-938553df087da7cb", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in loom/scripts/validate-m3.mjs:8"}, "properties": {"repobilityId": "03c782d80607adc1", "scanner": "scanner-primary", "fingerprint": "938553df087da7cb", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "loom/scripts/validate-m3.mjs"}, "region": {"startLine": 8}}}]}, {"ruleId": "scanner-ad725fe01e6a0912", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in loom/scripts/validate-m9.mjs:8"}, "properties": {"repobilityId": "433f04b171e39aad", "scanner": "scanner-primary", "fingerprint": "ad725fe01e6a0912", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "loom/scripts/validate-m9.mjs"}, "region": {"startLine": 8}}}]}, {"ruleId": "scanner-e375cf03442a6bf5", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in loom/scripts/validate-m2.mjs:8"}, "properties": {"repobilityId": "6a6316d5917c0459", "scanner": "scanner-primary", "fingerprint": "e375cf03442a6bf5", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "loom/scripts/validate-m2.mjs"}, "region": {"startLine": 8}}}]}, {"ruleId": "scanner-e60ebd802d996ec1", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in loom/scripts/validate-m8.mjs:10"}, "properties": {"repobilityId": "70f959cfac4d3048", "scanner": "scanner-primary", "fingerprint": "e60ebd802d996ec1", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "loom/scripts/validate-m8.mjs"}, "region": {"startLine": 10}}}]}, {"ruleId": "scanner-e22b1a663792359f", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in loom/scripts/validate-fixtures.mjs:9"}, "properties": {"repobilityId": "195b7d63aacf72b8", "scanner": "scanner-primary", "fingerprint": "e22b1a663792359f", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "loom/scripts/validate-fixtures.mjs"}, "region": {"startLine": 9}}}]}, {"ruleId": "scanner-dc13cca442b8ef85", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in loom/scripts/validate-layers.mjs:10"}, "properties": {"repobilityId": "81a0094e14da3d20", "scanner": "scanner-primary", "fingerprint": "dc13cca442b8ef85", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "loom/scripts/validate-layers.mjs"}, "region": {"startLine": 10}}}]}, {"ruleId": "scanner-6da1c1d405ac49af", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in loom/scripts/validate-m6.mjs:10"}, "properties": {"repobilityId": "3c4e5a95df6055be", "scanner": "scanner-primary", "fingerprint": "6da1c1d405ac49af", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "loom/scripts/validate-m6.mjs"}, "region": {"startLine": 10}}}]}, {"ruleId": "scanner-2e9a5395c74c05f0", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in loom/scripts/validate-m7.mjs:10"}, "properties": {"repobilityId": "3e76db8969187ec9", "scanner": "scanner-primary", "fingerprint": "2e9a5395c74c05f0", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "loom/scripts/validate-m7.mjs"}, "region": {"startLine": 10}}}]}, {"ruleId": "scanner-9b26537bf31bda70", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in loom/scripts/shoot.mjs:21"}, "properties": {"repobilityId": "e75b3365c99585f1", "scanner": "scanner-primary", "fingerprint": "9b26537bf31bda70", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "loom/scripts/shoot.mjs"}, "region": {"startLine": 21}}}]}, {"ruleId": "scanner-90a24c1106594ef6", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in loom/packages/engine-app/vite.config.ts:1"}, "properties": {"repobilityId": "6093de709f073de8", "scanner": "scanner-primary", "fingerprint": "90a24c1106594ef6", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "loom/packages/engine-app/vite.config.ts"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6372cebde0220094", "level": "warning", "message": {"text": "No auth library detected"}, "properties": {"repobilityId": "a5b6035a5bbf8054", "scanner": "scanner-primary", "fingerprint": "6372cebde0220094", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["coverage", "auth"]}}, {"ruleId": "scanner-d82ec1a2e86f50c6", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "219df5b0513cf4e3", "scanner": "scanner-primary", "fingerprint": "d82ec1a2e86f50c6", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/loom-ci.yml"}, "region": {"startLine": 125}}}]}, {"ruleId": "scanner-ea3b5e389d8c9c0f", "level": "note", "message": {"text": "Low test-to-source ratio"}, "properties": {"repobilityId": "ef7b2552cc00a375", "scanner": "scanner-primary", "fingerprint": "ea3b5e389d8c9c0f", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["tests"]}}, {"ruleId": "scanner-141b30a41e03817b", "level": "note", "message": {"text": "No license file detected"}, "properties": {"repobilityId": "72479c39e90d9a12", "scanner": "scanner-primary", "fingerprint": "141b30a41e03817b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["license", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-d732835e2dd1d37e", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: loom/packages/engine-app/package.json"}, "properties": {"repobilityId": "25ef4c6354590ffc", "scanner": "scanner-primary", "fingerprint": "d732835e2dd1d37e", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "loom/packages/engine-app/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e5c57a8afd1e4719", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: loom/packages/runtime/package.json"}, "properties": {"repobilityId": "050dec8de1d19e72", "scanner": "scanner-primary", "fingerprint": "e5c57a8afd1e4719", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "loom/packages/runtime/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-dd82546ffb71ad43", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: loom/packages/sidecar/package.json"}, "properties": {"repobilityId": "67f0430072b598fc", "scanner": "scanner-primary", "fingerprint": "dd82546ffb71ad43", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "loom/packages/sidecar/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "1b7e3a0d7c34bd84", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-72b2a6250083a784", "level": "warning", "message": {"text": "Placeholder or mock-heavy implementation detected"}, "properties": {"repobilityId": "163c733a465b0447", "scanner": "scanner-primary", "fingerprint": "72b2a6250083a784", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "incomplete", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "084364b15cbdcf4f", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-b9088664ace7f748", "level": "note", "message": {"text": "Composite production-readiness gap"}, "properties": {"repobilityId": "f62da377dc3f86e9", "scanner": "scanner-primary", "fingerprint": "b9088664ace7f748", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["production-readiness", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-749d4bc1bd66df5f", "level": "warning", "message": {"text": "Agent instructions exist but release-hardening basics are missing"}, "properties": {"repobilityId": "c47a25d6d56c401c", "scanner": "scanner-primary", "fingerprint": "749d4bc1bd66df5f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "8b1e16ce736f4dfb", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "7492f787c93b4533", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-65528ebbf5df0baf", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: loom/.mcp.json"}, "properties": {"repobilityId": "5b31e9404044f309", "scanner": "scanner-primary", "fingerprint": "65528ebbf5df0baf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "mcp_config"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "loom/.mcp.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-71173ff29e487a30", "level": "none", "message": {"text": "Commented-code block (6 lines) in loom/scripts/_browser.mjs:12"}, "properties": {"repobilityId": "23f38e15030b7ce1", "scanner": "scanner-primary", "fingerprint": "71173ff29e487a30", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-804488c1916c2747", "level": "none", "message": {"text": "Commented-code block (5 lines) in loom/scripts/build-catalog.mjs:1"}, "properties": {"repobilityId": "bceef044c385c37c", "scanner": "scanner-primary", "fingerprint": "804488c1916c2747", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-dd9a727eb23359a2", "level": "none", "message": {"text": "Commented-code block (5 lines) in loom/scripts/affected-shots.mjs:8"}, "properties": {"repobilityId": "2b91dd463a868a6f", "scanner": "scanner-primary", "fingerprint": "dd9a727eb23359a2", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-c12b08113d8d0bc6", "level": "none", "message": {"text": "Commented-code block (6 lines) in loom/scripts/validate-m5.mjs:1"}, "properties": {"repobilityId": "363e54289c139a3b", "scanner": "scanner-primary", "fingerprint": "c12b08113d8d0bc6", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-cbd9d3e98670febe", "level": "none", "message": {"text": "Commented-code block (6 lines) in loom/scripts/validate-stdlib.mjs:1"}, "properties": {"repobilityId": "773268f3f74d5401", "scanner": "scanner-primary", "fingerprint": "cbd9d3e98670febe", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-eeafa48eb80a3915", "level": "none", "message": {"text": "Commented-code block (7 lines) in loom/scripts/validate-projects.mjs:1"}, "properties": {"repobilityId": "5d0e195df2127cbb", "scanner": "scanner-primary", "fingerprint": "eeafa48eb80a3915", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-ef4e9198225ae256", "level": "none", "message": {"text": "Commented-code block (7 lines) in loom/scripts/validate-panic.mjs:1"}, "properties": {"repobilityId": "2da3872c36f1aa54", "scanner": "scanner-primary", "fingerprint": "ef4e9198225ae256", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-cd001d912e1d8abf", "level": "none", "message": {"text": "Commented-code block (7 lines) in loom/scripts/validate-m1.mjs:180"}, "properties": {"repobilityId": "ee3948cff213dad4", "scanner": "scanner-primary", "fingerprint": "cd001d912e1d8abf", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-078f9998fc9ddc82", "level": "none", "message": {"text": "Commented-code block (6 lines) in loom/scripts/validate-m4.mjs:1"}, "properties": {"repobilityId": "de2189793742897c", "scanner": "scanner-primary", "fingerprint": "078f9998fc9ddc82", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-7857fafb9b8eb49b", "level": "none", "message": {"text": "Commented-code block (5 lines) in loom/scripts/validate-modulators.mjs:1"}, "properties": {"repobilityId": "e76f7992fc100644", "scanner": "scanner-primary", "fingerprint": "7857fafb9b8eb49b", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-10f9a0da427754b1", "level": "none", "message": {"text": "Commented-code block (6 lines) in loom/scripts/validate-m11.mjs:1"}, "properties": {"repobilityId": "e1e3ff18b31eeb3d", "scanner": "scanner-primary", "fingerprint": "10f9a0da427754b1", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-522684ca9bf986c9", "level": "none", "message": {"text": "Commented-code block (5 lines) in loom/scripts/validate-m3.mjs:1"}, "properties": {"repobilityId": "f94d8d90cbfefb88", "scanner": "scanner-primary", "fingerprint": "522684ca9bf986c9", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-51d49f17d62f17dc", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 loom/scripts/validate-m3.mjs:178"}, "properties": {"repobilityId": "4432239d77b2c58f", "scanner": "scanner-primary", "fingerprint": "51d49f17d62f17dc", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-0126a4746461ed7a", "level": "none", "message": {"text": "Commented-code block (5 lines) in loom/scripts/validate-m9.mjs:1"}, "properties": {"repobilityId": "c96a6db5157dc121", "scanner": "scanner-primary", "fingerprint": "0126a4746461ed7a", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-a28095008e37db06", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 loom/scripts/validate-m9.mjs:250"}, "properties": {"repobilityId": "0f918cda794128fe", "scanner": "scanner-primary", "fingerprint": "a28095008e37db06", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-fa265ea51f42f21b", "level": "none", "message": {"text": "Commented-code block (5 lines) in loom/scripts/validate-m2.mjs:1"}, "properties": {"repobilityId": "2d4d089f8922a228", "scanner": "scanner-primary", "fingerprint": "fa265ea51f42f21b", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-d0db2cebc8ec07c8", "level": "none", "message": {"text": "Commented-code block (7 lines) in loom/scripts/validate-m8.mjs:1"}, "properties": {"repobilityId": "9fbb829264161861", "scanner": "scanner-primary", "fingerprint": "d0db2cebc8ec07c8", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-8a7f71cdc441e34a", "level": "none", "message": {"text": "Commented-code block (6 lines) in loom/scripts/validate-fixtures.mjs:1"}, "properties": {"repobilityId": "6a01c71b73e3a795", "scanner": "scanner-primary", "fingerprint": "8a7f71cdc441e34a", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-7965089cb7b6eeda", "level": "none", "message": {"text": "Commented-code block (7 lines) in loom/scripts/validate-layers.mjs:1"}, "properties": {"repobilityId": "e7019e4f6f0c0810", "scanner": "scanner-primary", "fingerprint": "7965089cb7b6eeda", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-64fc24adefc37a0e", "level": "none", "message": {"text": "Commented-code block (7 lines) in loom/scripts/validate-m6.mjs:1"}, "properties": {"repobilityId": "0afa918598c5afc5", "scanner": "scanner-primary", "fingerprint": "64fc24adefc37a0e", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-630f375d64b25b37", "level": "none", "message": {"text": "Commented-code block (5 lines) in loom/scripts/preview-comment.mjs:6"}, "properties": {"repobilityId": "dab7909080a91931", "scanner": "scanner-primary", "fingerprint": "630f375d64b25b37", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-b86b3503ff01d39d", "level": "none", "message": {"text": "Commented-code block (7 lines) in loom/scripts/validate-m7.mjs:1"}, "properties": {"repobilityId": "3729889ef2ce00cd", "scanner": "scanner-primary", "fingerprint": "b86b3503ff01d39d", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-9a23f9fff3d5e98f", "level": "none", "message": {"text": "Commented-code block (5 lines) in loom/scripts/shoot.mjs:3"}, "properties": {"repobilityId": "1cfdb3e82ac38573", "scanner": "scanner-primary", "fingerprint": "9a23f9fff3d5e98f", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-87c073a141d382c0", "level": "none", "message": {"text": "Commented-code block (7 lines) in loom/packages/engine-app/vite.config.ts:8"}, "properties": {"repobilityId": "f2801905b2b1eb5c", "scanner": "scanner-primary", "fingerprint": "87c073a141d382c0", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-1d4a21baf02eae27", "level": "none", "message": {"text": "Commented-code block (6 lines) in loom/packages/engine-app/src/main.ts:131"}, "properties": {"repobilityId": "acdb4972dba9c38e", "scanner": "scanner-primary", "fingerprint": "1d4a21baf02eae27", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-29665fcf883eb463", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 loom/packages/engine-app/src/main.ts:412"}, "properties": {"repobilityId": "0a049645d1e64afc", "scanner": "scanner-primary", "fingerprint": "29665fcf883eb463", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-af5105e638a7f72e", "level": "none", "message": {"text": "Commented-code block (8 lines) in loom/packages/engine-app/src/ui/console/TileGrid.tsx:37"}, "properties": {"repobilityId": "e4273d9003f47b6e", "scanner": "scanner-primary", "fingerprint": "af5105e638a7f72e", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-e495683db2b27f06", "level": "none", "message": {"text": "Commented-code block (6 lines) in loom/packages/runtime/src/chain.ts:272"}, "properties": {"repobilityId": "b6476eef71fb85dd", "scanner": "scanner-primary", "fingerprint": "e495683db2b27f06", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-22f28b29a2ccf542", "level": "none", "message": {"text": "Commented-code block (5 lines) in loom/content/scenes/panic.scene.ts:1"}, "properties": {"repobilityId": "be8430959e021e8d", "scanner": "scanner-primary", "fingerprint": "22f28b29a2ccf542", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-b1399440615e59d1", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 loom/content/test/setup.ts:2"}, "properties": {"repobilityId": "bc8ed622aff09933", "scanner": "scanner-primary", "fingerprint": "b1399440615e59d1", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-7f3e636f44bd95c1", "level": "error", "message": {"text": "Dangling fetch: POST /loom/effects/${encodeURIComponent(name)} (loom/packages/engine-app/src/main.ts:305)"}, "properties": {"repobilityId": "ada979c381ed2c48", "scanner": "scanner-primary", "fingerprint": "7f3e636f44bd95c1", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-7a4a41c7ef1f3510", "level": "error", "message": {"text": "Dangling fetch: GET /loom/state-list/${StateDir.projects} (loom/packages/engine-app/src/main.ts:375)"}, "properties": {"repobilityId": "c812095b1b384e3b", "scanner": "scanner-primary", "fingerprint": "7a4a41c7ef1f3510", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-075cc112986d3a27", "level": "error", "message": {"text": "Dangling fetch: GET /loom/state/${StateDir.fixtures}/${encodeURIComponent(name)} (loom/packages/engine-app/src/main.ts:412)"}, "properties": {"repobilityId": "b9e77b4a6771a3f6", "scanner": "scanner-primary", "fingerprint": "075cc112986d3a27", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-c893163e5e7f198d", "level": "error", "message": {"text": "Dangling fetch: POST /loom/state/${StateDir.fixtures}/${encodeURIComponent(r.name)} (loom/packages/engine-app/src/main.ts:513)"}, "properties": {"repobilityId": "27e1e7f65dd55d9c", "scanner": "scanner-primary", "fingerprint": "c893163e5e7f198d", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-56ca0bde3ac97427", "level": "error", "message": {"text": "Dangling fetch: POST /loom/state/${StateDir.projects}/${encodeURIComponent(name)} (loom/packages/engine-app/src/main.ts:538)"}, "properties": {"repobilityId": "77df0a59ee541471", "scanner": "scanner-primary", "fingerprint": "56ca0bde3ac97427", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-d3f93c151b402954", "level": "error", "message": {"text": "Dangling fetch: GET /loom/state/${StateDir.projects}/${encodeURIComponent(name)} (loom/packages/engine-app/src/main.ts:549)"}, "properties": {"repobilityId": "151b108571ef5d4a", "scanner": "scanner-primary", "fingerprint": "d3f93c151b402954", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-c474864c464a84a4", "level": "error", "message": {"text": "Dangling fetch: GET /loom/state/${name} (loom/packages/engine-app/src/state.ts:65)"}, "properties": {"repobilityId": "ab6dc11c4076c1ed", "scanner": "scanner-primary", "fingerprint": "c474864c464a84a4", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-36830c4bf4d6c9d8", "level": "error", "message": {"text": "Dangling fetch: POST /loom/state/${name} (loom/packages/engine-app/src/state.ts:82)"}, "properties": {"repobilityId": "c9a92f88569a51db", "scanner": "scanner-primary", "fingerprint": "36830c4bf4d6c9d8", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-70c2ff0e8e2d3727", "level": "note", "message": {"text": "Unused endpoint: USE /loom/state/"}, "properties": {"repobilityId": "f780a05226daf7ae", "scanner": "scanner-primary", "fingerprint": "70c2ff0e8e2d3727", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-8e5ae5ab84834534", "level": "note", "message": {"text": "Unused endpoint: USE /loom/media"}, "properties": {"repobilityId": "11dd87559a1b96c1", "scanner": "scanner-primary", "fingerprint": "8e5ae5ab84834534", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-efa0fd925b14875f", "level": "note", "message": {"text": "Unused endpoint: USE /loom/mediafs/"}, "properties": {"repobilityId": "72828a5592552ce8", "scanner": "scanner-primary", "fingerprint": "efa0fd925b14875f", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-fa26d2fec6101c40", "level": "note", "message": {"text": "Unused endpoint: USE /loom/state-list/"}, "properties": {"repobilityId": "5adc3d8632281575", "scanner": "scanner-primary", "fingerprint": "fa26d2fec6101c40", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-644789d20171bfbc", "level": "note", "message": {"text": "Unused endpoint: USE /loom/effects/"}, "properties": {"repobilityId": "dd77580fb5475ed3", "scanner": "scanner-primary", "fingerprint": "644789d20171bfbc", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}]}]}