{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-88f4186f172d6a7a", "name": "Stray `console.log` in TS/JS \u2014 generate-master-key.js:10", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 generate-master-key.js:10"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1a5b80bebb3a0580", "name": "Stray `console.log` in TS/JS \u2014 arbiter/index.js:124", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 arbiter/index.js:124"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-905f34f33ac11ae6", "name": "Stray `console.log` in TS/JS \u2014 scripts/gen-animation-frames.js:207", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 scripts/gen-animation-frames.js:207"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0ef7a69d226f583e", "name": "Stray `console.log` in TS/JS \u2014 scripts/gen-player-action-poses.js:149", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 scripts/gen-player-action-poses.js:149"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8d016e24b12aae87", "name": "Stray `console.log` in TS/JS \u2014 scripts/redraw-phase-879-batch-a.js:230", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 scripts/redraw-phase-879-batch-a.js:230"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ca9ddadbd0344562", "name": "Stray `console.log` in TS/JS \u2014 scripts/normalize-asset-palette.js:28", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 scripts/normalize-asset-palette.js:28"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6aa0482a9617d442", "name": "Stray `console.log` in TS/JS \u2014 scripts/keygen.js:8", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 scripts/keygen.js:8"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8cc10aaddb63a9bf", "name": "Stray `console.log` in TS/JS \u2014 scripts/validate-content.js:13", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 scripts/validate-content.js:13"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-61f95ecbb16a0fef", "name": "Stray `console.log` in TS/JS \u2014 scripts/gen-character-walk-strips.js:162", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 scripts/gen-character-walk-strips.js:162"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-170e392659a9f764", "name": "Stray `console.log` in TS/JS \u2014 scripts/bootstrap-starter-assets.js:150", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 scripts/bootstrap-starter-assets.js:150"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-555dc347423e977e", "name": "Stray `console.log` in TS/JS \u2014 scripts/compile-assets.js:10", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 scripts/compile-assets.js:10"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8475e11c5964d8fe", "name": "Stray `console.log` in TS/JS \u2014 scripts/load-tester.js:13", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 scripts/load-tester.js:13"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6240f941a3b056d2", "name": "Stray `console.log` in TS/JS \u2014 coverage/lcov-report/prettify.js:2", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 coverage/lcov-report/prettify.js:2"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c4594b6fa46df9e8", "name": "Stray `console.log` in TS/JS \u2014 src/tests/content.test.js:11", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 src/tests/content.test.js:11"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-50946b65d194d1ef", "name": "Stray `console.log` in TS/JS \u2014 src/tests/terrain-gen.test.js:69", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 src/tests/terrain-gen.test.js:69"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ee9d0fe5493c14b9", "name": "Stray `console.log` in TS/JS \u2014 src/network/diagnostics.js:247", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 src/network/diagnostics.js:247"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fa82975f8edf9c9c", "name": "Stray `console.log` in TS/JS \u2014 src/network/index.js:567", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 src/network/index.js:567"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-15d4bc28fd433927", "name": "Stray `console.log` in TS/JS \u2014 src/ui/log.js:13", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 src/ui/log.js:13"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-54ce7ebff31cb69a", "name": "Stray `console.log` in TS/JS \u2014 src/engine/ads.js:15", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 src/engine/ads.js:15"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9710c8d059e53154", "name": "No frontend routes/components detected", "shortDescription": {"text": "No frontend routes/components detected"}, "fullDescription": {"text": "No React/Vue/Next routes were found. This is fine for backend-only repos."}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-c16e547ad2fd5891", "name": "Insecure pattern 'cors_wildcard' in arbiter/index.js:430", "shortDescription": {"text": "Insecure pattern 'cors_wildcard' in arbiter/index.js:430"}, "fullDescription": {"text": "Found a known-risky pattern (cors_wildcard). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4f5b0ced6d19b5db", "name": "Insecure pattern 'node_child_process' in scripts/browser-ice-game-test.mjs:20", "shortDescription": {"text": "Insecure pattern 'node_child_process' in scripts/browser-ice-game-test.mjs:20"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3dad6deab42f9a48", "name": "Insecure pattern 'node_child_process' in scripts/browser-two-peer-reconnect-live.mjs:5", "shortDescription": {"text": "Insecure pattern 'node_child_process' in scripts/browser-two-peer-reconnect-live.mjs:5"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-46946f62b41da749", "name": "Insecure pattern 'node_child_process' in scripts/browser-ice-test.mjs:24", "shortDescription": {"text": "Insecure pattern 'node_child_process' in scripts/browser-ice-test.mjs:24"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d7b614293cf62d73", "name": "Insecure pattern 'node_child_process' in scripts/browser-two-peer.mjs:5", "shortDescription": {"text": "Insecure pattern 'node_child_process' in scripts/browser-two-peer.mjs:5"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6656d93689a3ab89", "name": "Insecure pattern 'node_child_process' in scripts/probe-trackers.mjs:4", "shortDescription": {"text": "Insecure pattern 'node_child_process' in scripts/probe-trackers.mjs:4"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ce46ad0cc076e590", "name": "Insecure pattern 'node_child_process' in scripts/browser-two-peer-live.mjs:5", "shortDescription": {"text": "Insecure pattern 'node_child_process' in scripts/browser-two-peer-live.mjs:5"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9abfdf91c0b3377f", "name": "Insecure pattern 'direct_innerhtml_assignment' in tools/editor.js:215", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in tools/editor.js:215"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-561cf4fb66e16a0c", "name": "Insecure pattern 'direct_innerhtml_assignment' in coverage/lcov-report/sorter.js:84", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in coverage/lcov-report/sorter.js:84"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d38ab4c821f6de46", "name": "Insecure pattern 'direct_innerhtml_assignment' in coverage/lcov-report/prettify.js:2", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in coverage/lcov-report/prettify.js:2"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e528275fc71ce9f7", "name": "Insecure pattern 'insert_adjacent_html' in src/adapters/dom/shell.js:55", "shortDescription": {"text": "Insecure pattern 'insert_adjacent_html' in src/adapters/dom/shell.js:55"}, "fullDescription": {"text": "Found a known-risky pattern (insert_adjacent_html). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-28c4a04bd807da0c", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ad6701f0a8405e22", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-09d06526a1afe8ec", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-dcb27914fe7aa877", "name": "GitHub Action tracks a moving branch", "shortDescription": {"text": "GitHub Action tracks a moving branch"}, "fullDescription": {"text": "appleboy/ssh-action@master can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "high", "confidence": 1.0}}, {"id": "scanner-c2678f050a43c281", "name": "Very large file: tools/editor.js (1383 lines)", "shortDescription": {"text": "Very large file: tools/editor.js (1383 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a2962c6e2fdea7f7", "name": "Very large file: src/generated/assets/compiled-assets.js (1836 lines)", "shortDescription": {"text": "Very large file: src/generated/assets/compiled-assets.js (1836 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-70364da1a6ca59ae", "name": "Very large file: src/network/index.js (1484 lines)", "shortDescription": {"text": "Very large file: src/network/index.js (1484 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1fbff2e62a3aef6c", "name": "Very large file: src/graphics/graphics.js (1809 lines)", "shortDescription": {"text": "Very large file: src/graphics/graphics.js (1809 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-141b30a41e03817b", "name": "No license file detected", "shortDescription": {"text": "No license file detected"}, "fullDescription": {"text": "No LICENSE/COPYING/NOTICE file was found. Generated repositories often omit licensing, which blocks reuse and automated intake."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 198 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-72b2a6250083a784", "name": "Placeholder or mock-heavy implementation detected", "shortDescription": {"text": "Placeholder or mock-heavy implementation detected"}, "fullDescription": {"text": "Found 22 placeholder/mock markers across 7 source files. This often means the repo looks complete while core flows still use generated scaffolding or fake data."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-749d4bc1bd66df5f", "name": "Agent instructions exist but release-hardening basics are missing", "shortDescription": {"text": "Agent instructions exist but release-hardening basics are missing"}, "fullDescription": {"text": "AI-coder instruction files were found, but the repo is missing license. Treat this as a contract gap: the agent is guided, but the generated output is not yet guarded by the controls that make it repeatable."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-e725d2ab884fbd49", "name": "Multiple root agent instruction files without precedence", "shortDescription": {"text": "Multiple root agent instruction files without precedence"}, "fullDescription": {"text": "The repo has multiple top-level AI-coder instruction files. Without precedence rules, different agents may follow different policies."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0fb7a0abb5abb09d", "name": "Commented-code block (5 lines) in arbiter/index.js:71", "shortDescription": {"text": "Commented-code block (5 lines) in arbiter/index.js:71"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-9e03a4bdd39d102f", "name": "`fetch()` without try/.catch or AbortSignal \u2014 scripts/browser-ice-game-test.mjs:145", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 scripts/browser-ice-game-test.mjs:145"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4bb7cd62d896e0f7", "name": "Commented-code block (5 lines) in scripts/conform-asset.mjs:2", "shortDescription": {"text": "Commented-code block (5 lines) in scripts/conform-asset.mjs:2"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-6502dcaba0e49139", "name": "Commented-code block (6 lines) in scripts/lib/asset-pipeline.js:247", "shortDescription": {"text": "Commented-code block (6 lines) in scripts/lib/asset-pipeline.js:247"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-7eb6363908f1243c", "name": "Legacy-named symbol `hearthwick_editor_v1` in tools/editor.js:1346", "shortDescription": {"text": "Legacy-named symbol `hearthwick_editor_v1` in tools/editor.js:1346"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d8dc3b6b6e58ea20", "name": "Legacy-named symbol `_worldstate_v1` in src/state/store.js:13", "shortDescription": {"text": "Legacy-named symbol `_worldstate_v1` in src/state/store.js:13"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fe0c6d226219ca63", "name": "Commented-code block (6 lines) in src/state/store.js:22", "shortDescription": {"text": "Commented-code block (6 lines) in src/state/store.js:22"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-afe172bc034dd7da", "name": "Commented-code block (5 lines) in src/tests/network.test.js:110", "shortDescription": {"text": "Commented-code block (5 lines) in src/tests/network.test.js:110"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-8a5bae7f4f3969d3", "name": "Legacy-named symbol `fenhollow_audio_settings_v1` in src/tests/audio.test.js:76", "shortDescription": {"text": "Legacy-named symbol `fenhollow_audio_settings_v1` in src/tests/audio.test.js:76"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ee9db120dbc9dc5d", "name": "Legacy-named symbol `fenhollow_introducers_v2` in src/tests/networking.bugfix.test.js:130", "shortDescription": {"text": "Legacy-named symbol `fenhollow_introducers_v2` in src/tests/networking.bugfix.test.js:130"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e9508a5d790ba68e", "name": "Legacy-named symbol `fenhollow_introducers_v2` in src/tests/networking.reconnect.test.js:431", "shortDescription": {"text": "Legacy-named symbol `fenhollow_introducers_v2` in src/tests/networking.reconnect.test.js:431"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7092a8029a79f5d0", "name": "Commented-code block (6 lines) in src/commands/helpers.js:44", "shortDescription": {"text": "Commented-code block (6 lines) in src/commands/helpers.js:44"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-3460bce92db8fa31", "name": "Legacy-named symbol `_introducers_v1` in src/commands/admin.js:51", "shortDescription": {"text": "Legacy-named symbol `_introducers_v1` in src/commands/admin.js:51"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-bd344ee123a47594", "name": "Commented-code block (5 lines) in src/network/arbiter-state.js:12", "shortDescription": {"text": "Commented-code block (5 lines) in src/network/arbiter-state.js:12"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-ae6253c30b9fee0b", "name": "Commented-code block (6 lines) in src/network/minisketch.js:3", "shortDescription": {"text": "Commented-code block (6 lines) in src/network/minisketch.js:3"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-87759de497b36ddf", "name": "Commented-code block (12 lines) in src/network/config.js:22", "shortDescription": {"text": "Commented-code block (12 lines) in src/network/config.js:22"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-e2b2fa811664d701", "name": "Legacy-named symbol `_introducers_v2` in src/network/index.js:167", "shortDescription": {"text": "Legacy-named symbol `_introducers_v2` in src/network/index.js:167"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-be7142d270bc4dcc", "name": "Commented-code block (5 lines) in src/network/index.js:162", "shortDescription": {"text": "Commented-code block (5 lines) in src/network/index.js:162"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-a13463752f87f6f3", "name": "Commented-code block (5 lines) in src/content/multi-palettes.js:7", "shortDescription": {"text": "Commented-code block (5 lines) in src/content/multi-palettes.js:7"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-5731fcad04c8d80c", "name": "Commented-code block (5 lines) in src/engine/platform.js:1", "shortDescription": {"text": "Commented-code block (5 lines) in src/engine/platform.js:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-28a7e3f820719bf0", "name": "Legacy-named symbol `_audio_settings_v1` in src/engine/audio.js:7", "shortDescription": {"text": "Legacy-named symbol `_audio_settings_v1` in src/engine/audio.js:7"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8dd345177004cd8b", "name": "Commented-code block (5 lines) in src/infra/constants.js:9", "shortDescription": {"text": "Commented-code block (5 lines) in src/infra/constants.js:9"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-354d50792fbfd5a1", "name": "Commented-code block (9 lines) in src/graphics/graphics.js:1432", "shortDescription": {"text": "Commented-code block (9 lines) in src/graphics/graphics.js:1432"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-9f67e81f6589fa43", "name": "Commented-code block (5 lines) in src/graphics/renderer.js:202", "shortDescription": {"text": "Commented-code block (5 lines) in src/graphics/renderer.js:202"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-09405cc11adb4bc5", "name": "Commented-code block (5 lines) in src/systems/patrol-system.js:44", "shortDescription": {"text": "Commented-code block (5 lines) in src/systems/patrol-system.js:44"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-194c3951bc3c0372", "name": "Commented-code block (5 lines) in src/systems/entity-render-system.js:55", "shortDescription": {"text": "Commented-code block (5 lines) in src/systems/entity-render-system.js:55"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-3482f7e5dd70cd1a", "name": "6 env vars used in code but missing from .env.example", "shortDescription": {"text": "6 env vars used in code but missing from .env.example"}, "fullDescription": {"text": "Drift between code and config docs. The first few: `ARBITER_FILTER_NETWORK_NOISE`, `ARBITER_TRACE_WARNINGS`, `METERED_TURN_CREDENTIAL`, `METERED_TURN_USERNAME`, `NODE_ENV`, `PORT`. Add them (with a placeholder/comment) to .env.example so onboarding doesn't break."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/21648"}, "properties": {"repository": "tross78/untitled-micro-mmo", "repoUrl": "https://github.com/tross78/untitled-micro-mmo", "branch": "main"}, "results": [{"ruleId": "scanner-88f4186f172d6a7a", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 generate-master-key.js:10"}, "properties": {"repobilityId": "addc1e63bc5d710a", "scanner": "scanner-primary", "fingerprint": "88f4186f172d6a7a", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-1a5b80bebb3a0580", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 arbiter/index.js:124"}, "properties": {"repobilityId": "e0d9073b7bbc5be8", "scanner": "scanner-primary", "fingerprint": "1a5b80bebb3a0580", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-905f34f33ac11ae6", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 scripts/gen-animation-frames.js:207"}, "properties": {"repobilityId": "f81fac0f0e65996e", "scanner": "scanner-primary", "fingerprint": "905f34f33ac11ae6", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-0ef7a69d226f583e", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 scripts/gen-player-action-poses.js:149"}, "properties": {"repobilityId": "50acee119b33c3ec", "scanner": "scanner-primary", "fingerprint": "0ef7a69d226f583e", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-8d016e24b12aae87", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 scripts/redraw-phase-879-batch-a.js:230"}, "properties": {"repobilityId": "63118c5db21acb26", "scanner": "scanner-primary", "fingerprint": "8d016e24b12aae87", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-ca9ddadbd0344562", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 scripts/normalize-asset-palette.js:28"}, "properties": {"repobilityId": "de39683e67849a9c", "scanner": "scanner-primary", "fingerprint": "ca9ddadbd0344562", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-6aa0482a9617d442", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 scripts/keygen.js:8"}, "properties": {"repobilityId": "e93f0c62dc587916", "scanner": "scanner-primary", "fingerprint": "6aa0482a9617d442", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-8cc10aaddb63a9bf", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 scripts/validate-content.js:13"}, "properties": {"repobilityId": "d20ce129358c9fab", "scanner": "scanner-primary", "fingerprint": "8cc10aaddb63a9bf", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-61f95ecbb16a0fef", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 scripts/gen-character-walk-strips.js:162"}, "properties": {"repobilityId": "c575f54f42314ebf", "scanner": "scanner-primary", "fingerprint": "61f95ecbb16a0fef", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-170e392659a9f764", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 scripts/bootstrap-starter-assets.js:150"}, "properties": {"repobilityId": "9f274d1e8e093f80", "scanner": "scanner-primary", "fingerprint": "170e392659a9f764", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-555dc347423e977e", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 scripts/compile-assets.js:10"}, "properties": {"repobilityId": "af29aebbcfba656a", "scanner": "scanner-primary", "fingerprint": "555dc347423e977e", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-8475e11c5964d8fe", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 scripts/load-tester.js:13"}, "properties": {"repobilityId": "b34f283df0292a24", "scanner": "scanner-primary", "fingerprint": "8475e11c5964d8fe", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-6240f941a3b056d2", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 coverage/lcov-report/prettify.js:2"}, "properties": {"repobilityId": "f5469c712b31777f", "scanner": "scanner-primary", "fingerprint": "6240f941a3b056d2", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-c4594b6fa46df9e8", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 src/tests/content.test.js:11"}, "properties": {"repobilityId": "9d36dfa2f2a4cac7", "scanner": "scanner-primary", "fingerprint": "c4594b6fa46df9e8", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-50946b65d194d1ef", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 src/tests/terrain-gen.test.js:69"}, "properties": {"repobilityId": "c1763952fdf2f043", "scanner": "scanner-primary", "fingerprint": "50946b65d194d1ef", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-ee9d0fe5493c14b9", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 src/network/diagnostics.js:247"}, "properties": {"repobilityId": "f6401800d593cb2b", "scanner": "scanner-primary", "fingerprint": "ee9d0fe5493c14b9", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-fa82975f8edf9c9c", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 src/network/index.js:567"}, "properties": {"repobilityId": "369fffcefba0a37e", "scanner": "scanner-primary", "fingerprint": "fa82975f8edf9c9c", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-15d4bc28fd433927", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 src/ui/log.js:13"}, "properties": {"repobilityId": "b7e3a105994a321c", "scanner": "scanner-primary", "fingerprint": "15d4bc28fd433927", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-54ce7ebff31cb69a", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 src/engine/ads.js:15"}, "properties": {"repobilityId": "7cb9a91cade87461", "scanner": "scanner-primary", "fingerprint": "54ce7ebff31cb69a", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-9710c8d059e53154", "level": "none", "message": {"text": "No frontend routes/components detected"}, "properties": {"repobilityId": "44ca61485762e494", "scanner": "scanner-primary", "fingerprint": "9710c8d059e53154", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-c16e547ad2fd5891", "level": "warning", "message": {"text": "Insecure pattern 'cors_wildcard' in arbiter/index.js:430"}, "properties": {"repobilityId": "5a2ffd306216e0eb", "scanner": "scanner-primary", "fingerprint": "c16e547ad2fd5891", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "cors_wildcard"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "arbiter/index.js"}, "region": {"startLine": 430}}}]}, {"ruleId": "scanner-4f5b0ced6d19b5db", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in scripts/browser-ice-game-test.mjs:20"}, "properties": {"repobilityId": "db1d0f591197ca54", "scanner": "scanner-primary", "fingerprint": "4f5b0ced6d19b5db", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/browser-ice-game-test.mjs"}, "region": {"startLine": 20}}}]}, {"ruleId": "scanner-3dad6deab42f9a48", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in scripts/browser-two-peer-reconnect-live.mjs:5"}, "properties": {"repobilityId": "7292b687a516123a", "scanner": "scanner-primary", "fingerprint": "3dad6deab42f9a48", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/browser-two-peer-reconnect-live.mjs"}, "region": {"startLine": 5}}}]}, {"ruleId": "scanner-46946f62b41da749", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in scripts/browser-ice-test.mjs:24"}, "properties": {"repobilityId": "ce0ef751f2fd9d84", "scanner": "scanner-primary", "fingerprint": "46946f62b41da749", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/browser-ice-test.mjs"}, "region": {"startLine": 24}}}]}, {"ruleId": "scanner-d7b614293cf62d73", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in scripts/browser-two-peer.mjs:5"}, "properties": {"repobilityId": "38156c23262231ea", "scanner": "scanner-primary", "fingerprint": "d7b614293cf62d73", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/browser-two-peer.mjs"}, "region": {"startLine": 5}}}]}, {"ruleId": "scanner-6656d93689a3ab89", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in scripts/probe-trackers.mjs:4"}, "properties": {"repobilityId": "28a185539f5c016d", "scanner": "scanner-primary", "fingerprint": "6656d93689a3ab89", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/probe-trackers.mjs"}, "region": {"startLine": 4}}}]}, {"ruleId": "scanner-ce46ad0cc076e590", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in scripts/browser-two-peer-live.mjs:5"}, "properties": {"repobilityId": "376dd1329db659ee", "scanner": "scanner-primary", "fingerprint": "ce46ad0cc076e590", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/browser-two-peer-live.mjs"}, "region": {"startLine": 5}}}]}, {"ruleId": "scanner-9abfdf91c0b3377f", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in tools/editor.js:215"}, "properties": {"repobilityId": "b09f44dd0722881b", "scanner": "scanner-primary", "fingerprint": "9abfdf91c0b3377f", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/editor.js"}, "region": {"startLine": 215}}}]}, {"ruleId": "scanner-561cf4fb66e16a0c", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in coverage/lcov-report/sorter.js:84"}, "properties": {"repobilityId": "3e42e111e0f73064", "scanner": "scanner-primary", "fingerprint": "561cf4fb66e16a0c", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "coverage/lcov-report/sorter.js"}, "region": {"startLine": 84}}}]}, {"ruleId": "scanner-d38ab4c821f6de46", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in coverage/lcov-report/prettify.js:2"}, "properties": {"repobilityId": "f20a7741f511e6ea", "scanner": "scanner-primary", "fingerprint": "d38ab4c821f6de46", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "coverage/lcov-report/prettify.js"}, "region": {"startLine": 2}}}]}, {"ruleId": "scanner-e528275fc71ce9f7", "level": "warning", "message": {"text": "Insecure pattern 'insert_adjacent_html' in src/adapters/dom/shell.js:55"}, "properties": {"repobilityId": "77dbc352cefc9552", "scanner": "scanner-primary", "fingerprint": "e528275fc71ce9f7", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "insert_adjacent_html"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/adapters/dom/shell.js"}, "region": {"startLine": 55}}}]}, {"ruleId": "scanner-28c4a04bd807da0c", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "2aee2e2d969c7c6b", "scanner": "scanner-primary", "fingerprint": "28c4a04bd807da0c", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/deploy.yml"}, "region": {"startLine": 16}}}]}, {"ruleId": "scanner-28c4a04bd807da0c", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "1fa8f3b41aa6898b", "scanner": "scanner-primary", "fingerprint": "28c4a04bd807da0c", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/deploy.yml"}, "region": {"startLine": 31}}}]}, {"ruleId": "scanner-ad6701f0a8405e22", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "8384c23520d55657", "scanner": "scanner-primary", "fingerprint": "ad6701f0a8405e22", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/deploy.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-09d06526a1afe8ec", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "0bdc2041da9dda04", "scanner": "scanner-primary", "fingerprint": "09d06526a1afe8ec", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/deploy-pi.yml"}, "region": {"startLine": 20}}}]}, {"ruleId": "scanner-09d06526a1afe8ec", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "54356d40a0be5304", "scanner": "scanner-primary", "fingerprint": "09d06526a1afe8ec", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/deploy-pi.yml"}, "region": {"startLine": 23}}}]}, {"ruleId": "scanner-dcb27914fe7aa877", "level": "error", "message": {"text": "GitHub Action tracks a moving branch"}, "properties": {"repobilityId": "796718e2b88c7d33", "scanner": "scanner-primary", "fingerprint": "dcb27914fe7aa877", "layer": "cicd", "severity": "high", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/deploy-pi.yml"}, "region": {"startLine": 30}}}]}, {"ruleId": "scanner-c2678f050a43c281", "level": "note", "message": {"text": "Very large file: tools/editor.js (1383 lines)"}, "properties": {"repobilityId": "f7f671957152916c", "scanner": "scanner-primary", "fingerprint": "c2678f050a43c281", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-a2962c6e2fdea7f7", "level": "note", "message": {"text": "Very large file: src/generated/assets/compiled-assets.js (1836 lines)"}, "properties": {"repobilityId": "5fac0788e1cb04d9", "scanner": "scanner-primary", "fingerprint": "a2962c6e2fdea7f7", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-70364da1a6ca59ae", "level": "note", "message": {"text": "Very large file: src/network/index.js (1484 lines)"}, "properties": {"repobilityId": "99ca256fbb9c4e53", "scanner": "scanner-primary", "fingerprint": "70364da1a6ca59ae", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-1fbff2e62a3aef6c", "level": "note", "message": {"text": "Very large file: src/graphics/graphics.js (1809 lines)"}, "properties": {"repobilityId": "1c0c4e1a442aeb10", "scanner": "scanner-primary", "fingerprint": "1fbff2e62a3aef6c", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-141b30a41e03817b", "level": "note", "message": {"text": "No license file detected"}, "properties": {"repobilityId": "8eddae00693faa39", "scanner": "scanner-primary", "fingerprint": "141b30a41e03817b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["license", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "c2ca0bebc474edb0", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-72b2a6250083a784", "level": "warning", "message": {"text": "Placeholder or mock-heavy implementation detected"}, "properties": {"repobilityId": "db94b9e2fce25343", "scanner": "scanner-primary", "fingerprint": "72b2a6250083a784", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "incomplete", "generated-repo-pattern"]}}, {"ruleId": "scanner-749d4bc1bd66df5f", "level": "warning", "message": {"text": "Agent instructions exist but release-hardening basics are missing"}, "properties": {"repobilityId": "1b5fa522f025ae01", "scanner": "scanner-primary", "fingerprint": "749d4bc1bd66df5f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "2ec4517dc3d59cb8", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "25464e8144f5aee8", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-e725d2ab884fbd49", "level": "note", "message": {"text": "Multiple root agent instruction files without precedence"}, "properties": {"repobilityId": "1953db6c89508d22", "scanner": "scanner-primary", "fingerprint": "e725d2ab884fbd49", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["agent-instructions", "governance"]}}, {"ruleId": "scanner-0fb7a0abb5abb09d", "level": "none", "message": {"text": "Commented-code block (5 lines) in arbiter/index.js:71"}, "properties": {"repobilityId": "d3d8afb45e5ba14a", "scanner": "scanner-primary", "fingerprint": "0fb7a0abb5abb09d", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-9e03a4bdd39d102f", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 scripts/browser-ice-game-test.mjs:145"}, "properties": {"repobilityId": "1b16a288ddf48d5d", "scanner": "scanner-primary", "fingerprint": "9e03a4bdd39d102f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-4bb7cd62d896e0f7", "level": "none", "message": {"text": "Commented-code block (5 lines) in scripts/conform-asset.mjs:2"}, "properties": {"repobilityId": "8b3032cb98b375f2", "scanner": "scanner-primary", "fingerprint": "4bb7cd62d896e0f7", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-6502dcaba0e49139", "level": "none", "message": {"text": "Commented-code block (6 lines) in scripts/lib/asset-pipeline.js:247"}, "properties": {"repobilityId": "8150d7289a7fbe0a", "scanner": "scanner-primary", "fingerprint": "6502dcaba0e49139", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-7eb6363908f1243c", "level": "note", "message": {"text": "Legacy-named symbol `hearthwick_editor_v1` in tools/editor.js:1346"}, "properties": {"repobilityId": "1e2f9e162d068fd0", "scanner": "scanner-primary", "fingerprint": "7eb6363908f1243c", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-d8dc3b6b6e58ea20", "level": "note", "message": {"text": "Legacy-named symbol `_worldstate_v1` in src/state/store.js:13"}, "properties": {"repobilityId": "3abb10188fca6294", "scanner": "scanner-primary", "fingerprint": "d8dc3b6b6e58ea20", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-fe0c6d226219ca63", "level": "none", "message": {"text": "Commented-code block (6 lines) in src/state/store.js:22"}, "properties": {"repobilityId": "798dcdf3132812e0", "scanner": "scanner-primary", "fingerprint": "fe0c6d226219ca63", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-afe172bc034dd7da", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/tests/network.test.js:110"}, "properties": {"repobilityId": "4d696668449f234c", "scanner": "scanner-primary", "fingerprint": "afe172bc034dd7da", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-8a5bae7f4f3969d3", "level": "note", "message": {"text": "Legacy-named symbol `fenhollow_audio_settings_v1` in src/tests/audio.test.js:76"}, "properties": {"repobilityId": "b8599b6f348d74ea", "scanner": "scanner-primary", "fingerprint": "8a5bae7f4f3969d3", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-ee9db120dbc9dc5d", "level": "note", "message": {"text": "Legacy-named symbol `fenhollow_introducers_v2` in src/tests/networking.bugfix.test.js:130"}, "properties": {"repobilityId": "a0092aeb2a802d71", "scanner": "scanner-primary", "fingerprint": "ee9db120dbc9dc5d", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-e9508a5d790ba68e", "level": "note", "message": {"text": "Legacy-named symbol `fenhollow_introducers_v2` in src/tests/networking.reconnect.test.js:431"}, "properties": {"repobilityId": "f3bf1018cf9a3260", "scanner": "scanner-primary", "fingerprint": "e9508a5d790ba68e", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-7092a8029a79f5d0", "level": "none", "message": {"text": "Commented-code block (6 lines) in src/commands/helpers.js:44"}, "properties": {"repobilityId": "d867fb1511b8ae5c", "scanner": "scanner-primary", "fingerprint": "7092a8029a79f5d0", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-3460bce92db8fa31", "level": "note", "message": {"text": "Legacy-named symbol `_introducers_v1` in src/commands/admin.js:51"}, "properties": {"repobilityId": "5ec93e9d3ee4cf64", "scanner": "scanner-primary", "fingerprint": "3460bce92db8fa31", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-bd344ee123a47594", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/network/arbiter-state.js:12"}, "properties": {"repobilityId": "3b23f9ac7c306382", "scanner": "scanner-primary", "fingerprint": "bd344ee123a47594", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-ae6253c30b9fee0b", "level": "none", "message": {"text": "Commented-code block (6 lines) in src/network/minisketch.js:3"}, "properties": {"repobilityId": "69f1940b162c04f0", "scanner": "scanner-primary", "fingerprint": "ae6253c30b9fee0b", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-87759de497b36ddf", "level": "none", "message": {"text": "Commented-code block (12 lines) in src/network/config.js:22"}, "properties": {"repobilityId": "9635b3722007d4c1", "scanner": "scanner-primary", "fingerprint": "87759de497b36ddf", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-e2b2fa811664d701", "level": "note", "message": {"text": "Legacy-named symbol `_introducers_v2` in src/network/index.js:167"}, "properties": {"repobilityId": "b551ce12156d1626", "scanner": "scanner-primary", "fingerprint": "e2b2fa811664d701", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-be7142d270bc4dcc", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/network/index.js:162"}, "properties": {"repobilityId": "1f8bfa45095cb662", "scanner": "scanner-primary", "fingerprint": "be7142d270bc4dcc", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-a13463752f87f6f3", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/content/multi-palettes.js:7"}, "properties": {"repobilityId": "f111a06544078920", "scanner": "scanner-primary", "fingerprint": "a13463752f87f6f3", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-5731fcad04c8d80c", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/engine/platform.js:1"}, "properties": {"repobilityId": "0f729395fbbc7f8b", "scanner": "scanner-primary", "fingerprint": "5731fcad04c8d80c", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-28a7e3f820719bf0", "level": "note", "message": {"text": "Legacy-named symbol `_audio_settings_v1` in src/engine/audio.js:7"}, "properties": {"repobilityId": "ef25994dc669ee21", "scanner": "scanner-primary", "fingerprint": "28a7e3f820719bf0", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-8dd345177004cd8b", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/infra/constants.js:9"}, "properties": {"repobilityId": "2589058c4b20c400", "scanner": "scanner-primary", "fingerprint": "8dd345177004cd8b", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-354d50792fbfd5a1", "level": "none", "message": {"text": "Commented-code block (9 lines) in src/graphics/graphics.js:1432"}, "properties": {"repobilityId": "2dff883949c842d9", "scanner": "scanner-primary", "fingerprint": "354d50792fbfd5a1", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-9f67e81f6589fa43", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/graphics/renderer.js:202"}, "properties": {"repobilityId": "eceb17f599aef19f", "scanner": "scanner-primary", "fingerprint": "9f67e81f6589fa43", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-09405cc11adb4bc5", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/systems/patrol-system.js:44"}, "properties": {"repobilityId": "880fea544e772d53", "scanner": "scanner-primary", "fingerprint": "09405cc11adb4bc5", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-194c3951bc3c0372", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/systems/entity-render-system.js:55"}, "properties": {"repobilityId": "d37314d7fc2a3fe7", "scanner": "scanner-primary", "fingerprint": "194c3951bc3c0372", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-3482f7e5dd70cd1a", "level": "note", "message": {"text": "6 env vars used in code but missing from .env.example"}, "properties": {"repobilityId": "1da70f25aa46f6e9", "scanner": "scanner-primary", "fingerprint": "3482f7e5dd70cd1a", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "config-drift"]}}]}]}