{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-ea6fdbbc0b52ea8f", "name": "Stray `console.log` in TS/JS \u2014 tools/merodb/src/gui/static/js/state-tree-visualizer.js:47", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 tools/merodb/src/gui/static/js/state-tree-visualizer.js:47"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e19f61d7e9a05142", "name": "Stray `console.log` in TS/JS \u2014 tools/merodb/src/gui/static/js/api-service.js:16", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 tools/merodb/src/gui/static/js/api-service.js:16"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8300fe4bc7076901", "name": "Stray `console.log` in TS/JS \u2014 tools/merodb/src/gui/static/js/app.js:51", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 tools/merodb/src/gui/static/js/app.js:51"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-45b9ffdd5b418792", "name": "Icon-only button without accessible name \u2014 tools/merodb/src/gui/static/js/folder-viewer.js:318", "shortDescription": {"text": "Icon-only button without accessible name \u2014 tools/merodb/src/gui/static/js/folder-viewer.js:318"}, "fullDescription": {"text": "A `<button>` whose only child is a single glyph or symbol needs `title=` or `aria-label=` so screen readers (and tooltips on hover) work.\n\nWhy: P3 in CHECKLIST.md \u2014 icon-only buttons skipped a title.\nRule id: fq.button.no-label"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3faa7db45758ecf2", "name": "Stray `console.log` in TS/JS \u2014 tools/merodb/src/gui/static/js/app-state.js:63", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 tools/merodb/src/gui/static/js/app-state.js:63"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3c75aec02be48a4d", "name": "Docker base image is tag-pinned but not digest-pinned: rust:${RUST_VERSION}-slim-bookworm", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: rust:${RUST_VERSION}-slim-bookworm"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-84019dfd8d98a34d", "name": "Docker base image is tag-pinned but not digest-pinned: debian:bookworm-slim", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: debian:bookworm-slim"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1d79b3561604a749", "name": "Insecure pattern 'direct_innerhtml_assignment' in architecture/dependency-explorer.html:388", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in architecture/dependency-explorer.html:388"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9ad60c6605369df5", "name": "Insecure pattern 'direct_innerhtml_assignment' in architecture/nav.js:117", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in architecture/nav.js:117"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-18ca01c71e0d55a1", "name": "Insecure pattern 'domparser_html_parse' in architecture/nav.js:62", "shortDescription": {"text": "Insecure pattern 'domparser_html_parse' in architecture/nav.js:62"}, "fullDescription": {"text": "Found a known-risky pattern (domparser_html_parse). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-29638841447aa8ab", "name": "Insecure pattern 'direct_innerhtml_assignment' in tools/merodb/src/gui/static/js/state-tree-visualizer.js:154", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in tools/merodb/src/gui/static/js/state-tree-visualizer.js:154"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-42a47dd0ba45b458", "name": "Insecure pattern 'direct_innerhtml_assignment' in tools/merodb/src/gui/static/js/jq-manager.js:46", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in tools/merodb/src/gui/static/js/jq-manager.js:46"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a42ee809c7b8d680", "name": "Insecure pattern 'direct_innerhtml_assignment' in tools/merodb/src/gui/static/js/dag-visualizer.js:81", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in tools/merodb/src/gui/static/js/dag-visualizer.js:81"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-91a0bd1e39a2f767", "name": "Insecure pattern 'direct_innerhtml_assignment' in tools/merodb/src/gui/static/js/json-renderer.js:23", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in tools/merodb/src/gui/static/js/json-renderer.js:23"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a8b960f09274ca07", "name": "Insecure pattern 'direct_innerhtml_assignment' in tools/merodb/src/gui/static/js/app.js:744", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in tools/merodb/src/gui/static/js/app.js:744"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c1c1d49acb13b9ba", "name": "Insecure pattern 'direct_innerhtml_assignment' in tools/merodb/src/gui/static/js/folder-viewer.js:22", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in tools/merodb/src/gui/static/js/folder-viewer.js:22"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9694635a03043895", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0c74beb4592f09f9", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/download-artifact@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4bc98b47beddbbd4", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-aab9b3729f729b78", "name": "pull_request_target workflow appears to check out untrusted PR code", "shortDescription": {"text": "pull_request_target workflow appears to check out untrusted PR code"}, "fullDescription": {"text": "pull_request_target runs with base-repo privileges. Checking out PR head code in that context can expose repository tokens or secrets to attacker-controlled code."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "high", "confidence": 1.0}}, {"id": "scanner-5552d3442fa86674", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-eb1bd7868bb4d591", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ca70b2cd9fcad599", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-201ca7a5d844477c", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/upload-artifact@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e4f658c0c00de0d4", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/deploy-pages@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-448d8837178ae57a", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-46c644c6227e4d4a", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1838a141491ce38c", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-65aa740cba4a4a73", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5fba86015798afbb", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-dbc0d9bb013b1fd6", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fa54b85c1e293a99", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4cb21838d560719d", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/stale@v9.0.0 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a1ede6d000f74683", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6eedcd144fcd2e5f", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6c78a2ad41ed71ff", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-bff4e4fd99e17f72", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-186d5b4069bcd1b9", "name": "Very large file: tools/merodb/src/export.rs (4197 lines)", "shortDescription": {"text": "Very large file: tools/merodb/src/export.rs (4197 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-406e868ccd65dc86", "name": "Very large file: tools/merodb/src/migration/execute.rs (2064 lines)", "shortDescription": {"text": "Very large file: tools/merodb/src/migration/execute.rs (2064 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4d824af59fa0b067", "name": "Very large file: tools/merodb/src/migration/dry_run.rs (2005 lines)", "shortDescription": {"text": "Very large file: tools/merodb/src/migration/dry_run.rs (2005 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-79d49303952dd95b", "name": "Very large file: tools/merodb/src/migration/plan.rs (1532 lines)", "shortDescription": {"text": "Very large file: tools/merodb/src/migration/plan.rs (1532 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-06ead78e7a5bd9d7", "name": "Very large file: tools/merodb/src/gui/static/js/state-tree-visualizer.js (1345 lines)", "shortDescription": {"text": "Very large file: tools/merodb/src/gui/static/js/state-tree-visualizer.js (1345 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c7e8ee2eb45dfb68", "name": "Very large file: crates/network/src/discovery/state_tests.rs (1347 lines)", "shortDescription": {"text": "Very large file: crates/network/src/discovery/state_tests.rs (1347 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2f201cad7b004dd4", "name": "Very large file: crates/context/tests/local_group_governance_convergence.rs (1676 lines)", "shortDescription": {"text": "Very large file: crates/context/tests/local_group_governance_convergence.rs (1676 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3053f759143071d1", "name": "Very large file: crates/context/src/self_purge.rs (2311 lines)", "shortDescription": {"text": "Very large file: crates/context/src/self_purge.rs (2311 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-bffdbec1ee47338c", "name": "Very large file: crates/context/src/handlers/upgrade_group.rs (1969 lines)", "shortDescription": {"text": "Very large file: crates/context/src/handlers/upgrade_group.rs (1969 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cd2e5bdb2cb67bda", "name": "Very large file: crates/context/src/handlers/update_application/mod.rs (2686 lines)", "shortDescription": {"text": "Very large file: crates/context/src/handlers/update_application/mod.rs (2686 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f051823760be7cdb", "name": "Very large file: crates/context/src/handlers/execute/mod.rs (2420 lines)", "shortDescription": {"text": "Very large file: crates/context/src/handlers/execute/mod.rs (2420 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-22edb841ad3c7a59", "name": "Very large file: crates/context/primitives/src/group.rs (1542 lines)", "shortDescription": {"text": "Very large file: crates/context/primitives/src/group.rs (1542 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cfe9dcdf53526af0", "name": "Very large file: crates/context/primitives/src/client/mod.rs (2317 lines)", "shortDescription": {"text": "Very large file: crates/context/primitives/src/client/mod.rs (2317 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-403c6b49d8f2eece", "name": "Very large file: crates/governance-store/src/lib.rs (1478 lines)", "shortDescription": {"text": "Very large file: crates/governance-store/src/lib.rs (1478 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-005a4702c46231d4", "name": "Very large file: crates/governance-store/src/tests.rs (5986 lines)", "shortDescription": {"text": "Very large file: crates/governance-store/src/tests.rs (5986 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ec8a3f2ecdcde6ac", "name": "Very large file: crates/governance-store/src/membership/tests.rs (2281 lines)", "shortDescription": {"text": "Very large file: crates/governance-store/src/membership/tests.rs (2281 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-523438381f89fb91", "name": "Very large file: crates/governance-store/src/namespace/governance.rs (1561 lines)", "shortDescription": {"text": "Very large file: crates/governance-store/src/namespace/governance.rs (1561 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8ead5a9617c426e4", "name": "Very large file: crates/governance-store/src/namespace/tests.rs (3601 lines)", "shortDescription": {"text": "Very large file: crates/governance-store/src/namespace/tests.rs (3601 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4b58cfe46d5658cd", "name": "Very large file: crates/server/primitives/src/admin/mod.rs (3094 lines)", "shortDescription": {"text": "Very large file: crates/server/primitives/src/admin/mod.rs (3094 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-79e26d150072bcc1", "name": "Very large file: crates/runtime/src/logic.rs (1274 lines)", "shortDescription": {"text": "Very large file: crates/runtime/src/logic.rs (1274 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e10f94beda34d53f", "name": "Very large file: crates/runtime/src/logic/host_functions/js_collections.rs (1803 lines)", "shortDescription": {"text": "Very large file: crates/runtime/src/logic/host_functions/js_collections.rs (1803 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-41aa2960489be88b", "name": "Very large file: crates/runtime/src/logic/host_functions/system.rs (1638 lines)", "shortDescription": {"text": "Very large file: crates/runtime/src/logic/host_functions/system.rs (1638 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f4bbb3df441703a3", "name": "Very large file: crates/store/src/key/group/mod.rs (2721 lines)", "shortDescription": {"text": "Very large file: crates/store/src/key/group/mod.rs (2721 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-00bade16e7629ea3", "name": "Very large file: crates/storage/src/interface.rs (3898 lines)", "shortDescription": {"text": "Very large file: crates/storage/src/interface.rs (3898 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a3f9cb2918528b38", "name": "Very large file: crates/storage/src/tests/index.rs (1876 lines)", "shortDescription": {"text": "Very large file: crates/storage/src/tests/index.rs (1876 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6d46a4824c5ba431", "name": "Very large file: crates/storage/src/tests/merge_integration.rs (3618 lines)", "shortDescription": {"text": "Very large file: crates/storage/src/tests/merge_integration.rs (3618 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-09c9f4ca12e5a5d5", "name": "Very large file: crates/storage/src/tests/interface.rs (3168 lines)", "shortDescription": {"text": "Very large file: crates/storage/src/tests/interface.rs (3168 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d49167649afe4fc4", "name": "Very large file: crates/storage/src/collections/sorted_map.rs (1798 lines)", "shortDescription": {"text": "Very large file: crates/storage/src/collections/sorted_map.rs (1798 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-819de298b860193d", "name": "Very large file: crates/storage/src/collections/unordered_map.rs (1631 lines)", "shortDescription": {"text": "Very large file: crates/storage/src/collections/unordered_map.rs (1631 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2c4f114afdd242f2", "name": "Very large file: crates/merod/src/kms/mod.rs (2666 lines)", "shortDescription": {"text": "Very large file: crates/merod/src/kms/mod.rs (2666 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4c0332dc217b267f", "name": "Very large file: crates/node/tests/sync_sim/protocol.rs (1997 lines)", "shortDescription": {"text": "Very large file: crates/node/tests/sync_sim/protocol.rs (1997 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-69bd3e2748140b9c", "name": "Very large file: crates/node/src/migration_status.rs (1473 lines)", "shortDescription": {"text": "Very large file: crates/node/src/migration_status.rs (1473 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4eb5a0b356dbb833", "name": "Very large file: crates/node/src/delta_store.rs (3807 lines)", "shortDescription": {"text": "Very large file: crates/node/src/delta_store.rs (3807 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-979bf791df040869", "name": "Very large file: crates/node/src/sync/snapshot.rs (2485 lines)", "shortDescription": {"text": "Very large file: crates/node/src/sync/snapshot.rs (2485 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-593999c2bd755388", "name": "Very large file: crates/node/src/sync/hash_comparison_protocol.rs (2298 lines)", "shortDescription": {"text": "Very large file: crates/node/src/sync/hash_comparison_protocol.rs (2298 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-85c9c6698616ffa4", "name": "Very large file: crates/node/src/sync/helpers.rs (1280 lines)", "shortDescription": {"text": "Very large file: crates/node/src/sync/helpers.rs (1280 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7dcadda8dd20752d", "name": "Very large file: crates/node/src/sync/session.rs (1543 lines)", "shortDescription": {"text": "Very large file: crates/node/src/sync/session.rs (1543 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7b86cc336136e0c8", "name": "Very large file: crates/node/src/sync/manager/namespace_sync.rs (1564 lines)", "shortDescription": {"text": "Very large file: crates/node/src/sync/manager/namespace_sync.rs (1564 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3b0b3a6a84cac25e", "name": "Very large file: crates/node/src/sync/manager/mod.rs (3567 lines)", "shortDescription": {"text": "Very large file: crates/node/src/sync/manager/mod.rs (3567 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b0ce30a6476b60d7", "name": "Very large file: crates/node/src/handlers/state_delta/mod.rs (2606 lines)", "shortDescription": {"text": "Very large file: crates/node/src/handlers/state_delta/mod.rs (2606 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-feaa8df9be7713d0", "name": "Very large file: crates/node/primitives/tests/bundle_installation.rs (2374 lines)", "shortDescription": {"text": "Very large file: crates/node/primitives/tests/bundle_installation.rs (2374 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fd09c2bf685a075a", "name": "Very large file: crates/node/primitives/src/sync/snapshot.rs (1524 lines)", "shortDescription": {"text": "Very large file: crates/node/primitives/src/sync/snapshot.rs (1524 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ab34fce3fda15368", "name": "Very large file: crates/node/primitives/src/sync/hash_comparison.rs (1319 lines)", "shortDescription": {"text": "Very large file: crates/node/primitives/src/sync/hash_comparison.rs (1319 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-528e6b4ba8c03f2c", "name": "Very large file: crates/sdk/macros/src/state.rs (1616 lines)", "shortDescription": {"text": "Very large file: crates/sdk/macros/src/state.rs (1616 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ea3b5e389d8c9c0f", "name": "Low test-to-source ratio", "shortDescription": {"text": "Low test-to-source ratio"}, "fullDescription": {"text": "177 tests / 957 src (ratio 0.18)."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-348c9f9e7acb70c6", "name": "66 TODO/FIXME markers", "shortDescription": {"text": "66 TODO/FIXME markers"}, "fullDescription": {"text": "High count of TODO/FIXME/HACK markers \u2014 track them as issues so they're not forgotten."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 62 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-72b2a6250083a784", "name": "Placeholder or mock-heavy implementation detected", "shortDescription": {"text": "Placeholder or mock-heavy implementation detected"}, "fullDescription": {"text": "Found 426 placeholder/mock markers across 72 source files. This often means the repo looks complete while core flows still use generated scaffolding or fake data."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-01f42fbb3d543d88", "name": "Agent authority lacks a verifier contract: .cursor/skills/dead-code-cleanup/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .cursor/skills/dead-code-cleanup/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c0e0b984a8abfd0e", "name": "Agent authority lacks a verifier contract: apps/AGENTS.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: apps/AGENTS.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-fe747b0cb13b2207", "name": "Agent authority lacks a verifier contract: crates/merod/AGENTS.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: crates/merod/AGENTS.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d3880078bad438e5", "name": "`fetch()` without try/.catch or AbortSignal \u2014 architecture/nav.js:61", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 architecture/nav.js:61"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9fab163340b7c9fe", "name": "`fetch()` without try/.catch or AbortSignal \u2014 tools/merodb/src/gui/static/js/api-service.js:68", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 tools/merodb/src/gui/static/js/api-service.js:68"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/24806"}, "properties": {"repository": "calimero-network/core", "repoUrl": "https://github.com/calimero-network/core", "branch": "main"}, "results": [{"ruleId": "scanner-ea6fdbbc0b52ea8f", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 tools/merodb/src/gui/static/js/state-tree-visualizer.js:47"}, "properties": {"repobilityId": "a09c9a46db56d577", "scanner": "scanner-primary", "fingerprint": "ea6fdbbc0b52ea8f", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-e19f61d7e9a05142", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 tools/merodb/src/gui/static/js/api-service.js:16"}, "properties": {"repobilityId": "91f8d27240f99182", "scanner": "scanner-primary", "fingerprint": "e19f61d7e9a05142", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-8300fe4bc7076901", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 tools/merodb/src/gui/static/js/app.js:51"}, "properties": {"repobilityId": "c73d4c266a861b54", "scanner": "scanner-primary", "fingerprint": "8300fe4bc7076901", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-45b9ffdd5b418792", "level": "note", "message": {"text": "Icon-only button without accessible name \u2014 tools/merodb/src/gui/static/js/folder-viewer.js:318"}, "properties": {"repobilityId": "b8d44288103356fa", "scanner": "scanner-primary", "fingerprint": "45b9ffdd5b418792", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.button.no-label"]}}, {"ruleId": "scanner-3faa7db45758ecf2", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 tools/merodb/src/gui/static/js/app-state.js:63"}, "properties": {"repobilityId": "e0012ef73328c460", "scanner": "scanner-primary", "fingerprint": "3faa7db45758ecf2", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-3c75aec02be48a4d", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: rust:${RUST_VERSION}-slim-bookworm"}, "properties": {"repobilityId": "78ec96cea58433bb", "scanner": "scanner-primary", "fingerprint": "3c75aec02be48a4d", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Dockerfile"}, "region": {"startLine": 7}}}]}, {"ruleId": "scanner-84019dfd8d98a34d", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: debian:bookworm-slim"}, "properties": {"repobilityId": "872eb2fab0f004fa", "scanner": "scanner-primary", "fingerprint": "84019dfd8d98a34d", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Dockerfile"}, "region": {"startLine": 45}}}]}, {"ruleId": "scanner-1d79b3561604a749", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in architecture/dependency-explorer.html:388"}, "properties": {"repobilityId": "e24502bf31405e76", "scanner": "scanner-primary", "fingerprint": "1d79b3561604a749", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "architecture/dependency-explorer.html"}, "region": {"startLine": 388}}}]}, {"ruleId": "scanner-9ad60c6605369df5", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in architecture/nav.js:117"}, "properties": {"repobilityId": "951c88ee145e537d", "scanner": "scanner-primary", "fingerprint": "9ad60c6605369df5", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "architecture/nav.js"}, "region": {"startLine": 117}}}]}, {"ruleId": "scanner-18ca01c71e0d55a1", "level": "warning", "message": {"text": "Insecure pattern 'domparser_html_parse' in architecture/nav.js:62"}, "properties": {"repobilityId": "1107b295bec08a98", "scanner": "scanner-primary", "fingerprint": "18ca01c71e0d55a1", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "domparser_html_parse"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "architecture/nav.js"}, "region": {"startLine": 62}}}]}, {"ruleId": "scanner-29638841447aa8ab", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in tools/merodb/src/gui/static/js/state-tree-visualizer.js:154"}, "properties": {"repobilityId": "f68487b9c09ebaf6", "scanner": "scanner-primary", "fingerprint": "29638841447aa8ab", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/merodb/src/gui/static/js/state-tree-visualizer.js"}, "region": {"startLine": 154}}}]}, {"ruleId": "scanner-42a47dd0ba45b458", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in tools/merodb/src/gui/static/js/jq-manager.js:46"}, "properties": {"repobilityId": "aa53d7863ce170a3", "scanner": "scanner-primary", "fingerprint": "42a47dd0ba45b458", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/merodb/src/gui/static/js/jq-manager.js"}, "region": {"startLine": 46}}}]}, {"ruleId": "scanner-a42ee809c7b8d680", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in tools/merodb/src/gui/static/js/dag-visualizer.js:81"}, "properties": {"repobilityId": "2bc8afad1ab1bb47", "scanner": "scanner-primary", "fingerprint": "a42ee809c7b8d680", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/merodb/src/gui/static/js/dag-visualizer.js"}, "region": {"startLine": 81}}}]}, {"ruleId": "scanner-91a0bd1e39a2f767", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in tools/merodb/src/gui/static/js/json-renderer.js:23"}, "properties": {"repobilityId": "306f13669d6bb058", "scanner": "scanner-primary", "fingerprint": "91a0bd1e39a2f767", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/merodb/src/gui/static/js/json-renderer.js"}, "region": {"startLine": 23}}}]}, {"ruleId": "scanner-a8b960f09274ca07", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in tools/merodb/src/gui/static/js/app.js:744"}, "properties": {"repobilityId": "33c483b62522f3e9", "scanner": "scanner-primary", "fingerprint": "a8b960f09274ca07", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/merodb/src/gui/static/js/app.js"}, "region": {"startLine": 744}}}]}, {"ruleId": "scanner-c1c1d49acb13b9ba", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in tools/merodb/src/gui/static/js/folder-viewer.js:22"}, "properties": {"repobilityId": "7083d7052a46c9f3", "scanner": "scanner-primary", "fingerprint": "c1c1d49acb13b9ba", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/merodb/src/gui/static/js/folder-viewer.js"}, "region": {"startLine": 22}}}]}, {"ruleId": "scanner-9694635a03043895", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "9c886f6c66418782", "scanner": "scanner-primary", "fingerprint": "9694635a03043895", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/doc-update.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-0c74beb4592f09f9", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "90f99af648ac0afd", "scanner": "scanner-primary", "fingerprint": "0c74beb4592f09f9", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/comment.yml"}, "region": {"startLine": 33}}}]}, {"ruleId": "scanner-0c74beb4592f09f9", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "b2bd48e12f780720", "scanner": "scanner-primary", "fingerprint": "0c74beb4592f09f9", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/comment.yml"}, "region": {"startLine": 53}}}]}, {"ruleId": "scanner-4bc98b47beddbbd4", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "39172d295699cf8c", "scanner": "scanner-primary", "fingerprint": "4bc98b47beddbbd4", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/new-issue-or-pr.yml"}, "region": {"startLine": 17}}}]}, {"ruleId": "scanner-4bc98b47beddbbd4", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "f5f29048e85edbca", "scanner": "scanner-primary", "fingerprint": "4bc98b47beddbbd4", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/new-issue-or-pr.yml"}, "region": {"startLine": 22}}}]}, {"ruleId": "scanner-4bc98b47beddbbd4", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "f5f29048e85edbca", "scanner": "scanner-primary", "fingerprint": "4bc98b47beddbbd4", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/new-issue-or-pr.yml"}, "region": {"startLine": 59}}}]}, {"ruleId": "scanner-4bc98b47beddbbd4", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "f5f29048e85edbca", "scanner": "scanner-primary", "fingerprint": "4bc98b47beddbbd4", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/new-issue-or-pr.yml"}, "region": {"startLine": 69}}}]}, {"ruleId": "scanner-4bc98b47beddbbd4", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "f5f29048e85edbca", "scanner": "scanner-primary", "fingerprint": "4bc98b47beddbbd4", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/new-issue-or-pr.yml"}, "region": {"startLine": 115}}}]}, {"ruleId": "scanner-4bc98b47beddbbd4", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "f1088fa325a44861", "scanner": "scanner-primary", "fingerprint": "4bc98b47beddbbd4", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/new-issue-or-pr.yml"}, "region": {"startLine": 146}}}]}, {"ruleId": "scanner-aab9b3729f729b78", "level": "error", "message": {"text": "pull_request_target workflow appears to check out untrusted PR code"}, "properties": {"repobilityId": "3bb6dc6ce3a37c7d", "scanner": "scanner-primary", "fingerprint": "aab9b3729f729b78", "layer": "cicd", "severity": "high", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pull-request-target"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/new-issue-or-pr.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-5552d3442fa86674", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "8d33a822f34887b6", "scanner": "scanner-primary", "fingerprint": "5552d3442fa86674", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/tidy-docker.yml"}, "region": {"startLine": 43}}}]}, {"ruleId": "scanner-5552d3442fa86674", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "68020d56e67fa71c", "scanner": "scanner-primary", "fingerprint": "5552d3442fa86674", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/tidy-docker.yml"}, "region": {"startLine": 48}}}]}, {"ruleId": "scanner-5552d3442fa86674", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "68020d56e67fa71c", "scanner": "scanner-primary", "fingerprint": "5552d3442fa86674", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/tidy-docker.yml"}, "region": {"startLine": 75}}}]}, {"ruleId": "scanner-eb1bd7868bb4d591", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "550068569c403259", "scanner": "scanner-primary", "fingerprint": "eb1bd7868bb4d591", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/tidy-docker.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ca70b2cd9fcad599", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "b557273a3a3ca4fc", "scanner": "scanner-primary", "fingerprint": "ca70b2cd9fcad599", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/sync-regression.yml"}, "region": {"startLine": 63}}}]}, {"ruleId": "scanner-ca70b2cd9fcad599", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "b27c8cf6721b36f7", "scanner": "scanner-primary", "fingerprint": "ca70b2cd9fcad599", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/sync-regression.yml"}, "region": {"startLine": 127}}}]}, {"ruleId": "scanner-201ca7a5d844477c", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "5645be32b8d29516", "scanner": "scanner-primary", "fingerprint": "201ca7a5d844477c", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/pr-title-lint.yml"}, "region": {"startLine": 52}}}]}, {"ruleId": "scanner-e4f658c0c00de0d4", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "25e1fa3783e7cb32", "scanner": "scanner-primary", "fingerprint": "e4f658c0c00de0d4", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/pages.yml"}, "region": {"startLine": 31}}}]}, {"ruleId": "scanner-448d8837178ae57a", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "13af6451e15656fc", "scanner": "scanner-primary", "fingerprint": "448d8837178ae57a", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/pages.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "2644034c718fb80d", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 68}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "2644034c718fb80d", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 147}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "a0f3bb36d11e757e", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 152}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "5ab0c5bd71e63ad8", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 211}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "5ab0c5bd71e63ad8", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 219}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "2644034c718fb80d", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 237}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "b0f359fc82dc1097", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 242}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "b0f359fc82dc1097", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 249}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "b0f359fc82dc1097", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 256}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "feb6d31e0ad29c30", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 262}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "8d176680620f6310", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 280}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "2644034c718fb80d", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 285}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "9e54fac6c290138e", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 291}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "a0f3bb36d11e757e", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 297}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "2644034c718fb80d", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 348}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "2644034c718fb80d", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 379}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "2644034c718fb80d", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 417}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "2a34e9494c5ba4b2", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 444}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "2644034c718fb80d", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 454}}}]}, {"ruleId": "scanner-1838a141491ce38c", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "b8fd4f5048f96576", "scanner": "scanner-primary", "fingerprint": "1838a141491ce38c", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-65aa740cba4a4a73", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "8860eac61a1ebe26", "scanner": "scanner-primary", "fingerprint": "65aa740cba4a4a73", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/codeql.yml"}, "region": {"startLine": 31}}}]}, {"ruleId": "scanner-65aa740cba4a4a73", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "549a2de1ac0c3fa9", "scanner": "scanner-primary", "fingerprint": "65aa740cba4a4a73", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/codeql.yml"}, "region": {"startLine": 36}}}]}, {"ruleId": "scanner-65aa740cba4a4a73", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "a4f0ab9334543546", "scanner": "scanner-primary", "fingerprint": "65aa740cba4a4a73", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/codeql.yml"}, "region": {"startLine": 42}}}]}, {"ruleId": "scanner-65aa740cba4a4a73", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "a5721e15e3a54aa2", "scanner": "scanner-primary", "fingerprint": "65aa740cba4a4a73", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/codeql.yml"}, "region": {"startLine": 45}}}]}, {"ruleId": "scanner-5fba86015798afbb", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "6e0188f816aea25a", "scanner": "scanner-primary", "fingerprint": "5fba86015798afbb", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/e2e-rust-apps-release.yml"}, "region": {"startLine": 41}}}]}, {"ruleId": "scanner-5fba86015798afbb", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "cb25de5f162673d1", "scanner": "scanner-primary", "fingerprint": "5fba86015798afbb", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/e2e-rust-apps-release.yml"}, "region": {"startLine": 68}}}]}, {"ruleId": "scanner-5fba86015798afbb", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "6e0188f816aea25a", "scanner": "scanner-primary", "fingerprint": "5fba86015798afbb", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/e2e-rust-apps-release.yml"}, "region": {"startLine": 85}}}]}, {"ruleId": "scanner-5fba86015798afbb", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "24ee6b3d6e6ec766", "scanner": "scanner-primary", "fingerprint": "5fba86015798afbb", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/e2e-rust-apps-release.yml"}, "region": {"startLine": 90}}}]}, {"ruleId": "scanner-5fba86015798afbb", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "cb25de5f162673d1", "scanner": "scanner-primary", "fingerprint": "5fba86015798afbb", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/e2e-rust-apps-release.yml"}, "region": {"startLine": 369}}}]}, {"ruleId": "scanner-5fba86015798afbb", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "cb25de5f162673d1", "scanner": "scanner-primary", "fingerprint": "5fba86015798afbb", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/e2e-rust-apps-release.yml"}, "region": {"startLine": 385}}}]}, {"ruleId": "scanner-dbc0d9bb013b1fd6", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "3d849d77c4acf950", "scanner": "scanner-primary", "fingerprint": "dbc0d9bb013b1fd6", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/app-migration-e2e.yml"}, "region": {"startLine": 70}}}]}, {"ruleId": "scanner-dbc0d9bb013b1fd6", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "7dc5e94c09c81c4b", "scanner": "scanner-primary", "fingerprint": "dbc0d9bb013b1fd6", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/app-migration-e2e.yml"}, "region": {"startLine": 101}}}]}, {"ruleId": "scanner-dbc0d9bb013b1fd6", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "7dc5e94c09c81c4b", "scanner": "scanner-primary", "fingerprint": "dbc0d9bb013b1fd6", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/app-migration-e2e.yml"}, "region": {"startLine": 108}}}]}, {"ruleId": "scanner-dbc0d9bb013b1fd6", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "3d849d77c4acf950", "scanner": "scanner-primary", "fingerprint": "dbc0d9bb013b1fd6", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/app-migration-e2e.yml"}, "region": {"startLine": 131}}}]}, {"ruleId": "scanner-dbc0d9bb013b1fd6", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "3d849d77c4acf950", "scanner": "scanner-primary", "fingerprint": "dbc0d9bb013b1fd6", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/app-migration-e2e.yml"}, "region": {"startLine": 224}}}]}, {"ruleId": "scanner-dbc0d9bb013b1fd6", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "17d5096c1f76bdcb", "scanner": "scanner-primary", "fingerprint": "dbc0d9bb013b1fd6", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/app-migration-e2e.yml"}, "region": {"startLine": 229}}}]}, {"ruleId": "scanner-dbc0d9bb013b1fd6", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "17d5096c1f76bdcb", "scanner": "scanner-primary", "fingerprint": "dbc0d9bb013b1fd6", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/app-migration-e2e.yml"}, "region": {"startLine": 240}}}]}, {"ruleId": "scanner-dbc0d9bb013b1fd6", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "7dc5e94c09c81c4b", "scanner": "scanner-primary", "fingerprint": "dbc0d9bb013b1fd6", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/app-migration-e2e.yml"}, "region": {"startLine": 276}}}]}, {"ruleId": "scanner-fa54b85c1e293a99", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "9805450fa4e63b8f", "scanner": "scanner-primary", "fingerprint": "fa54b85c1e293a99", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/fuzzy-load-test.yml"}, "region": {"startLine": 104}}}]}, {"ruleId": "scanner-fa54b85c1e293a99", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "642224938e29d869", "scanner": "scanner-primary", "fingerprint": "fa54b85c1e293a99", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/fuzzy-load-test.yml"}, "region": {"startLine": 152}}}]}, {"ruleId": "scanner-fa54b85c1e293a99", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "9805450fa4e63b8f", "scanner": "scanner-primary", "fingerprint": "fa54b85c1e293a99", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/fuzzy-load-test.yml"}, "region": {"startLine": 172}}}]}, {"ruleId": "scanner-fa54b85c1e293a99", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "b1c32d25b3c2c270", "scanner": "scanner-primary", "fingerprint": "fa54b85c1e293a99", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/fuzzy-load-test.yml"}, "region": {"startLine": 181}}}]}, {"ruleId": "scanner-fa54b85c1e293a99", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "642224938e29d869", "scanner": "scanner-primary", "fingerprint": "fa54b85c1e293a99", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/fuzzy-load-test.yml"}, "region": {"startLine": 376}}}]}, {"ruleId": "scanner-fa54b85c1e293a99", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "9805450fa4e63b8f", "scanner": "scanner-primary", "fingerprint": "fa54b85c1e293a99", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/fuzzy-load-test.yml"}, "region": {"startLine": 395}}}]}, {"ruleId": "scanner-fa54b85c1e293a99", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "b1c32d25b3c2c270", "scanner": "scanner-primary", "fingerprint": "fa54b85c1e293a99", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/fuzzy-load-test.yml"}, "region": {"startLine": 404}}}]}, {"ruleId": "scanner-fa54b85c1e293a99", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "642224938e29d869", "scanner": "scanner-primary", "fingerprint": "fa54b85c1e293a99", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/fuzzy-load-test.yml"}, "region": {"startLine": 592}}}]}, {"ruleId": "scanner-fa54b85c1e293a99", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "9805450fa4e63b8f", "scanner": "scanner-primary", "fingerprint": "fa54b85c1e293a99", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/fuzzy-load-test.yml"}, "region": {"startLine": 611}}}]}, {"ruleId": "scanner-fa54b85c1e293a99", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "b1c32d25b3c2c270", "scanner": "scanner-primary", "fingerprint": "fa54b85c1e293a99", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/fuzzy-load-test.yml"}, "region": {"startLine": 616}}}]}, {"ruleId": "scanner-fa54b85c1e293a99", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "642224938e29d869", "scanner": "scanner-primary", "fingerprint": "fa54b85c1e293a99", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/fuzzy-load-test.yml"}, "region": {"startLine": 802}}}]}, {"ruleId": "scanner-fa54b85c1e293a99", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "9805450fa4e63b8f", "scanner": "scanner-primary", "fingerprint": "fa54b85c1e293a99", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/fuzzy-load-test.yml"}, "region": {"startLine": 821}}}]}, {"ruleId": "scanner-fa54b85c1e293a99", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "b1c32d25b3c2c270", "scanner": "scanner-primary", "fingerprint": "fa54b85c1e293a99", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/fuzzy-load-test.yml"}, "region": {"startLine": 826}}}]}, {"ruleId": "scanner-fa54b85c1e293a99", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "642224938e29d869", "scanner": "scanner-primary", "fingerprint": "fa54b85c1e293a99", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/fuzzy-load-test.yml"}, "region": {"startLine": 1012}}}]}, {"ruleId": "scanner-4cb21838d560719d", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "6a20e89d375dc5fb", "scanner": "scanner-primary", "fingerprint": "4cb21838d560719d", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/stale.yml"}, "region": {"startLine": 17}}}]}, {"ruleId": "scanner-a1ede6d000f74683", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "813f33cf65e947a2", "scanner": "scanner-primary", "fingerprint": "a1ede6d000f74683", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/contributions.yml"}, "region": {"startLine": 16}}}]}, {"ruleId": "scanner-6eedcd144fcd2e5f", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "273785ff32c4279c", "scanner": "scanner-primary", "fingerprint": "6eedcd144fcd2e5f", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/e2e-rust-apps.yml"}, "region": {"startLine": 51}}}]}, {"ruleId": "scanner-6eedcd144fcd2e5f", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "93079c73c76fc637", "scanner": "scanner-primary", "fingerprint": "6eedcd144fcd2e5f", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/e2e-rust-apps.yml"}, "region": {"startLine": 72}}}]}, {"ruleId": "scanner-6eedcd144fcd2e5f", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "273785ff32c4279c", "scanner": "scanner-primary", "fingerprint": "6eedcd144fcd2e5f", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/e2e-rust-apps.yml"}, "region": {"startLine": 85}}}]}, {"ruleId": "scanner-6eedcd144fcd2e5f", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "93079c73c76fc637", "scanner": "scanner-primary", "fingerprint": "6eedcd144fcd2e5f", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/e2e-rust-apps.yml"}, "region": {"startLine": 123}}}]}, {"ruleId": "scanner-6eedcd144fcd2e5f", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "273785ff32c4279c", "scanner": "scanner-primary", "fingerprint": "6eedcd144fcd2e5f", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/e2e-rust-apps.yml"}, "region": {"startLine": 376}}}]}, {"ruleId": "scanner-6eedcd144fcd2e5f", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "db2313a151049365", "scanner": "scanner-primary", "fingerprint": "6eedcd144fcd2e5f", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/e2e-rust-apps.yml"}, "region": {"startLine": 381}}}]}, {"ruleId": "scanner-6eedcd144fcd2e5f", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "db2313a151049365", "scanner": "scanner-primary", "fingerprint": "6eedcd144fcd2e5f", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/e2e-rust-apps.yml"}, "region": {"startLine": 390}}}]}, {"ruleId": "scanner-6eedcd144fcd2e5f", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "93079c73c76fc637", "scanner": "scanner-primary", "fingerprint": "6eedcd144fcd2e5f", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/e2e-rust-apps.yml"}, "region": {"startLine": 460}}}]}, {"ruleId": "scanner-6eedcd144fcd2e5f", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "93079c73c76fc637", "scanner": "scanner-primary", "fingerprint": "6eedcd144fcd2e5f", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/e2e-rust-apps.yml"}, "region": {"startLine": 520}}}]}, {"ruleId": "scanner-6c78a2ad41ed71ff", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "9980d12aa246543f", "scanner": "scanner-primary", "fingerprint": "6c78a2ad41ed71ff", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci-checks.yml"}, "region": {"startLine": 29}}}]}, {"ruleId": "scanner-bff4e4fd99e17f72", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "ab695288127f203e", "scanner": "scanner-primary", "fingerprint": "bff4e4fd99e17f72", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/abi-guard.yml"}, "region": {"startLine": 23}}}]}, {"ruleId": "scanner-bff4e4fd99e17f72", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "bf13fc579855f6f2", "scanner": "scanner-primary", "fingerprint": "bff4e4fd99e17f72", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/abi-guard.yml"}, "region": {"startLine": 28}}}]}, {"ruleId": "scanner-bff4e4fd99e17f72", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "c8f4900a30f6530a", "scanner": "scanner-primary", "fingerprint": "bff4e4fd99e17f72", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/abi-guard.yml"}, "region": {"startLine": 35}}}]}, {"ruleId": "scanner-186d5b4069bcd1b9", "level": "note", "message": {"text": "Very large file: tools/merodb/src/export.rs (4197 lines)"}, "properties": {"repobilityId": "0dfcedcae72027f3", "scanner": "scanner-primary", "fingerprint": "186d5b4069bcd1b9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-406e868ccd65dc86", "level": "note", "message": {"text": "Very large file: tools/merodb/src/migration/execute.rs (2064 lines)"}, "properties": {"repobilityId": "fcac912651b2d908", "scanner": "scanner-primary", "fingerprint": "406e868ccd65dc86", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-4d824af59fa0b067", "level": "note", "message": {"text": "Very large file: tools/merodb/src/migration/dry_run.rs (2005 lines)"}, "properties": {"repobilityId": "c225d7d5441c6483", "scanner": "scanner-primary", "fingerprint": "4d824af59fa0b067", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-79d49303952dd95b", "level": "note", "message": {"text": "Very large file: tools/merodb/src/migration/plan.rs (1532 lines)"}, "properties": {"repobilityId": "7b38c54e7821b211", "scanner": "scanner-primary", "fingerprint": "79d49303952dd95b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-06ead78e7a5bd9d7", "level": "note", "message": {"text": "Very large file: tools/merodb/src/gui/static/js/state-tree-visualizer.js (1345 lines)"}, "properties": {"repobilityId": "de6e05ef6f59e6ba", "scanner": "scanner-primary", "fingerprint": "06ead78e7a5bd9d7", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-c7e8ee2eb45dfb68", "level": "note", "message": {"text": "Very large file: crates/network/src/discovery/state_tests.rs (1347 lines)"}, "properties": {"repobilityId": "dbe6acc4caaa0639", "scanner": "scanner-primary", "fingerprint": "c7e8ee2eb45dfb68", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-2f201cad7b004dd4", "level": "note", "message": {"text": "Very large file: crates/context/tests/local_group_governance_convergence.rs (1676 lines)"}, "properties": {"repobilityId": "8e8151365fc406ed", "scanner": "scanner-primary", "fingerprint": "2f201cad7b004dd4", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-3053f759143071d1", "level": "note", "message": {"text": "Very large file: crates/context/src/self_purge.rs (2311 lines)"}, "properties": {"repobilityId": "a9f98e069d91146f", "scanner": "scanner-primary", "fingerprint": "3053f759143071d1", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-bffdbec1ee47338c", "level": "note", "message": {"text": "Very large file: crates/context/src/handlers/upgrade_group.rs (1969 lines)"}, "properties": {"repobilityId": "851c18aa6ad643de", "scanner": "scanner-primary", "fingerprint": "bffdbec1ee47338c", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-cd2e5bdb2cb67bda", "level": "note", "message": {"text": "Very large file: crates/context/src/handlers/update_application/mod.rs (2686 lines)"}, "properties": {"repobilityId": "ba0b643cc3167d1c", "scanner": "scanner-primary", "fingerprint": "cd2e5bdb2cb67bda", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-f051823760be7cdb", "level": "note", "message": {"text": "Very large file: crates/context/src/handlers/execute/mod.rs (2420 lines)"}, "properties": {"repobilityId": "319fa36847595e25", "scanner": "scanner-primary", "fingerprint": "f051823760be7cdb", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-22edb841ad3c7a59", "level": "note", "message": {"text": "Very large file: crates/context/primitives/src/group.rs (1542 lines)"}, "properties": {"repobilityId": "00f9667f9cb5b715", "scanner": "scanner-primary", "fingerprint": "22edb841ad3c7a59", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-cfe9dcdf53526af0", "level": "note", "message": {"text": "Very large file: crates/context/primitives/src/client/mod.rs (2317 lines)"}, "properties": {"repobilityId": "b6c6758980e7bffe", "scanner": "scanner-primary", "fingerprint": "cfe9dcdf53526af0", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-403c6b49d8f2eece", "level": "note", "message": {"text": "Very large file: crates/governance-store/src/lib.rs (1478 lines)"}, "properties": {"repobilityId": "71845e1391f49621", "scanner": "scanner-primary", "fingerprint": "403c6b49d8f2eece", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-005a4702c46231d4", "level": "note", "message": {"text": "Very large file: crates/governance-store/src/tests.rs (5986 lines)"}, "properties": {"repobilityId": "25e7a7475e0ef591", "scanner": "scanner-primary", "fingerprint": "005a4702c46231d4", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-ec8a3f2ecdcde6ac", "level": "note", "message": {"text": "Very large file: crates/governance-store/src/membership/tests.rs (2281 lines)"}, "properties": {"repobilityId": "8b228a5e950f0cdd", "scanner": "scanner-primary", "fingerprint": "ec8a3f2ecdcde6ac", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-523438381f89fb91", "level": "note", "message": {"text": "Very large file: crates/governance-store/src/namespace/governance.rs (1561 lines)"}, "properties": {"repobilityId": "6ebd29753bbaf3e7", "scanner": "scanner-primary", "fingerprint": "523438381f89fb91", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-8ead5a9617c426e4", "level": "note", "message": {"text": "Very large file: crates/governance-store/src/namespace/tests.rs (3601 lines)"}, "properties": {"repobilityId": "f0d5ea967b3f51d9", "scanner": "scanner-primary", "fingerprint": "8ead5a9617c426e4", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-4b58cfe46d5658cd", "level": "note", "message": {"text": "Very large file: crates/server/primitives/src/admin/mod.rs (3094 lines)"}, "properties": {"repobilityId": "ddb6263735273abb", "scanner": "scanner-primary", "fingerprint": "4b58cfe46d5658cd", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-79e26d150072bcc1", "level": "note", "message": {"text": "Very large file: crates/runtime/src/logic.rs (1274 lines)"}, "properties": {"repobilityId": "3af22013c75488f9", "scanner": "scanner-primary", "fingerprint": "79e26d150072bcc1", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-e10f94beda34d53f", "level": "note", "message": {"text": "Very large file: crates/runtime/src/logic/host_functions/js_collections.rs (1803 lines)"}, "properties": {"repobilityId": "df01189340f08805", "scanner": "scanner-primary", "fingerprint": "e10f94beda34d53f", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-41aa2960489be88b", "level": "note", "message": {"text": "Very large file: crates/runtime/src/logic/host_functions/system.rs (1638 lines)"}, "properties": {"repobilityId": "ba92d74eee1a576e", "scanner": "scanner-primary", "fingerprint": "41aa2960489be88b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-f4bbb3df441703a3", "level": "note", "message": {"text": "Very large file: crates/store/src/key/group/mod.rs (2721 lines)"}, "properties": {"repobilityId": "ca680d6be098e0b4", "scanner": "scanner-primary", "fingerprint": "f4bbb3df441703a3", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-00bade16e7629ea3", "level": "note", "message": {"text": "Very large file: crates/storage/src/interface.rs (3898 lines)"}, "properties": {"repobilityId": "91aac9025287e1e4", "scanner": "scanner-primary", "fingerprint": "00bade16e7629ea3", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-a3f9cb2918528b38", "level": "note", "message": {"text": "Very large file: crates/storage/src/tests/index.rs (1876 lines)"}, "properties": {"repobilityId": "0ef4fa127d18a74f", "scanner": "scanner-primary", "fingerprint": "a3f9cb2918528b38", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-6d46a4824c5ba431", "level": "note", "message": {"text": "Very large file: crates/storage/src/tests/merge_integration.rs (3618 lines)"}, "properties": {"repobilityId": "04d2e53a5c881d5c", "scanner": "scanner-primary", "fingerprint": "6d46a4824c5ba431", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-09c9f4ca12e5a5d5", "level": "note", "message": {"text": "Very large file: crates/storage/src/tests/interface.rs (3168 lines)"}, "properties": {"repobilityId": "80a161bbb70a87b1", "scanner": "scanner-primary", "fingerprint": "09c9f4ca12e5a5d5", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-d49167649afe4fc4", "level": "note", "message": {"text": "Very large file: crates/storage/src/collections/sorted_map.rs (1798 lines)"}, "properties": {"repobilityId": "1c00e92489d09e7e", "scanner": "scanner-primary", "fingerprint": "d49167649afe4fc4", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-819de298b860193d", "level": "note", "message": {"text": "Very large file: crates/storage/src/collections/unordered_map.rs (1631 lines)"}, "properties": {"repobilityId": "7ffba5fac4b29632", "scanner": "scanner-primary", "fingerprint": "819de298b860193d", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-2c4f114afdd242f2", "level": "note", "message": {"text": "Very large file: crates/merod/src/kms/mod.rs (2666 lines)"}, "properties": {"repobilityId": "9d12d0280410533c", "scanner": "scanner-primary", "fingerprint": "2c4f114afdd242f2", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-4c0332dc217b267f", "level": "note", "message": {"text": "Very large file: crates/node/tests/sync_sim/protocol.rs (1997 lines)"}, "properties": {"repobilityId": "39f2ee4b932ee260", "scanner": "scanner-primary", "fingerprint": "4c0332dc217b267f", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-69bd3e2748140b9c", "level": "note", "message": {"text": "Very large file: crates/node/src/migration_status.rs (1473 lines)"}, "properties": {"repobilityId": "6a2944b3d0109cde", "scanner": "scanner-primary", "fingerprint": "69bd3e2748140b9c", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-4eb5a0b356dbb833", "level": "note", "message": {"text": "Very large file: crates/node/src/delta_store.rs (3807 lines)"}, "properties": {"repobilityId": "e341a00ce216754d", "scanner": "scanner-primary", "fingerprint": "4eb5a0b356dbb833", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-979bf791df040869", "level": "note", "message": {"text": "Very large file: crates/node/src/sync/snapshot.rs (2485 lines)"}, "properties": {"repobilityId": "b664ec24ce18eeba", "scanner": "scanner-primary", "fingerprint": "979bf791df040869", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-593999c2bd755388", "level": "note", "message": {"text": "Very large file: crates/node/src/sync/hash_comparison_protocol.rs (2298 lines)"}, "properties": {"repobilityId": "b92e41565142d6d6", "scanner": "scanner-primary", "fingerprint": "593999c2bd755388", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-85c9c6698616ffa4", "level": "note", "message": {"text": "Very large file: crates/node/src/sync/helpers.rs (1280 lines)"}, "properties": {"repobilityId": "bb98b13977c63b2d", "scanner": "scanner-primary", "fingerprint": "85c9c6698616ffa4", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-7dcadda8dd20752d", "level": "note", "message": {"text": "Very large file: crates/node/src/sync/session.rs (1543 lines)"}, "properties": {"repobilityId": "6f6077bce344cf3c", "scanner": "scanner-primary", "fingerprint": "7dcadda8dd20752d", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-7b86cc336136e0c8", "level": "note", "message": {"text": "Very large file: crates/node/src/sync/manager/namespace_sync.rs (1564 lines)"}, "properties": {"repobilityId": "6bf7335f2c2c814c", "scanner": "scanner-primary", "fingerprint": "7b86cc336136e0c8", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-3b0b3a6a84cac25e", "level": "note", "message": {"text": "Very large file: crates/node/src/sync/manager/mod.rs (3567 lines)"}, "properties": {"repobilityId": "4aa3669ed47e5a99", "scanner": "scanner-primary", "fingerprint": "3b0b3a6a84cac25e", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-b0ce30a6476b60d7", "level": "note", "message": {"text": "Very large file: crates/node/src/handlers/state_delta/mod.rs (2606 lines)"}, "properties": {"repobilityId": "627914fc49029839", "scanner": "scanner-primary", "fingerprint": "b0ce30a6476b60d7", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-feaa8df9be7713d0", "level": "note", "message": {"text": "Very large file: crates/node/primitives/tests/bundle_installation.rs (2374 lines)"}, "properties": {"repobilityId": "32a9326c8122582b", "scanner": "scanner-primary", "fingerprint": "feaa8df9be7713d0", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-fd09c2bf685a075a", "level": "note", "message": {"text": "Very large file: crates/node/primitives/src/sync/snapshot.rs (1524 lines)"}, "properties": {"repobilityId": "a8b816149a9b1797", "scanner": "scanner-primary", "fingerprint": "fd09c2bf685a075a", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-ab34fce3fda15368", "level": "note", "message": {"text": "Very large file: crates/node/primitives/src/sync/hash_comparison.rs (1319 lines)"}, "properties": {"repobilityId": "bfd282af70829be2", "scanner": "scanner-primary", "fingerprint": "ab34fce3fda15368", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-528e6b4ba8c03f2c", "level": "note", "message": {"text": "Very large file: crates/sdk/macros/src/state.rs (1616 lines)"}, "properties": {"repobilityId": "d6e166b36f852bc9", "scanner": "scanner-primary", "fingerprint": "528e6b4ba8c03f2c", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-ea3b5e389d8c9c0f", "level": "note", "message": {"text": "Low test-to-source ratio"}, "properties": {"repobilityId": "ef7b2552cc00a375", "scanner": "scanner-primary", "fingerprint": "ea3b5e389d8c9c0f", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["tests"]}}, {"ruleId": "scanner-348c9f9e7acb70c6", "level": "note", "message": {"text": "66 TODO/FIXME markers"}, "properties": {"repobilityId": "4b38c118003e07d2", "scanner": "scanner-primary", "fingerprint": "348c9f9e7acb70c6", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["maintenance"]}}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "beff8a147a9c4221", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-72b2a6250083a784", "level": "warning", "message": {"text": "Placeholder or mock-heavy implementation detected"}, "properties": {"repobilityId": "a5fdc5d284eda3e0", "scanner": "scanner-primary", "fingerprint": "72b2a6250083a784", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "incomplete", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "e8ef9bef913aab58", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-01f42fbb3d543d88", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .cursor/skills/dead-code-cleanup/SKILL.md"}, "properties": {"repobilityId": "dd5d918d2db04090", "scanner": "scanner-primary", "fingerprint": "01f42fbb3d543d88", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "cursor_rule"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".cursor/skills/dead-code-cleanup/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c0e0b984a8abfd0e", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: apps/AGENTS.md"}, "properties": {"repobilityId": "f55725ff4baa69c3", "scanner": "scanner-primary", "fingerprint": "c0e0b984a8abfd0e", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "agents_md"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/AGENTS.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-fe747b0cb13b2207", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: crates/merod/AGENTS.md"}, "properties": {"repobilityId": "d400cbaeca9c26d2", "scanner": "scanner-primary", "fingerprint": "fe747b0cb13b2207", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "agents_md"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "crates/merod/AGENTS.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d3880078bad438e5", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 architecture/nav.js:61"}, "properties": {"repobilityId": "bee2bc4039d468d7", "scanner": "scanner-primary", "fingerprint": "d3880078bad438e5", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-9fab163340b7c9fe", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 tools/merodb/src/gui/static/js/api-service.js:68"}, "properties": {"repobilityId": "131e0948020b566d", "scanner": "scanner-primary", "fingerprint": "9fab163340b7c9fe", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}]}]}