{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-019caa780129c845", "name": "Possibly dead Python function: reset_room", "shortDescription": {"text": "Possibly dead Python function: reset_room"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3a3e813773dd571d", "name": "Possibly dead Python function: append_many", "shortDescription": {"text": "Possibly dead Python function: append_many"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-56ba30c9905ad534", "name": "Possibly dead Python function: with_route", "shortDescription": {"text": "Possibly dead Python function: with_route"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f27fd05cfb4889bd", "name": "Possibly dead Python function: should_publish_consensus_end", "shortDescription": {"text": "Possibly dead Python function: should_publish_consensus_end"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9710c8d059e53154", "name": "No frontend routes/components detected", "shortDescription": {"text": "No frontend routes/components detected"}, "fullDescription": {"text": "No React/Vue/Next routes were found. This is fine for backend-only repos."}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-732e3b3517f08b29", "name": "Insecure pattern 'cors_wildcard' in src/decision_room/runtime/http_api.py:351", "shortDescription": {"text": "Insecure pattern 'cors_wildcard' in src/decision_room/runtime/http_api.py:351"}, "fullDescription": {"text": "Found a known-risky pattern (cors_wildcard). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6372cebde0220094", "name": "No auth library detected", "shortDescription": {"text": "No auth library detected"}, "fullDescription": {"text": "The scanner did not find any standard auth library (JWT, OAuth, NextAuth, Auth0, etc.). The repo has auth/admin/session surface indicators, so auth may live in custom code, in a separate service, or be missing."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1a50467f36b413ec", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "astral-sh/setup-uv@v3 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-aba64590253b8cb7", "name": "Very large file: tests/test_room_runtime.py (1163 lines)", "shortDescription": {"text": "Very large file: tests/test_room_runtime.py (1163 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 68 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea240a7d413a2da7", "name": "Commented-code block (5 lines) in tests/test_room_runtime.py:950", "shortDescription": {"text": "Commented-code block (5 lines) in tests/test_room_runtime.py:950"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-7d66e8de2779d4b6", "name": "Commented-code block (5 lines) in tests/test_room_executor.py:169", "shortDescription": {"text": "Commented-code block (5 lines) in tests/test_room_executor.py:169"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-d7ead6b6f7becf11", "name": "Commented-code block (5 lines) in src/decision_room/agents/specialist_agent.py:51", "shortDescription": {"text": "Commented-code block (5 lines) in src/decision_room/agents/specialist_agent.py:51"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-bcb103a8c7c4d8c4", "name": "Commented-code block (5 lines) in src/decision_room/orchestration/central_mas.py:487", "shortDescription": {"text": "Commented-code block (5 lines) in src/decision_room/orchestration/central_mas.py:487"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-59af8368178c8c7f", "name": "Commented-code block (5 lines) in src/decision_room/orchestration/room_executor.py:118", "shortDescription": {"text": "Commented-code block (5 lines) in src/decision_room/orchestration/room_executor.py:118"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-908734438b2f97d9", "name": "Commented-code block (5 lines) in src/decision_room/orchestration/pre_room_planning.py:850", "shortDescription": {"text": "Commented-code block (5 lines) in src/decision_room/orchestration/pre_room_planning.py:850"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-b334d875f2339fa1", "name": "5 env vars used in code but missing from .env.example", "shortDescription": {"text": "5 env vars used in code but missing from .env.example"}, "fullDescription": {"text": "Drift between code and config docs. The first few: `DOTENV_DISABLE_AUTOLOAD`, `MEETKAT_MEMORY_DIR`, `ROOM_RUNTIME_HOST`, `ROOM_RUNTIME_PORT`, `VITE_RUNTIME_BASE_URL`. Add them (with a placeholder/comment) to .env.example so onboarding doesn't break."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-be46ea126aa5d8dc", "name": "Near-duplicate function bodies in 3 places", "shortDescription": {"text": "Near-duplicate function bodies in 3 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nsrc/decision_room/memory/types.py:to_payload, src/decision_room/memory/types.py:to_payload, src/decision_room/memory/types.py:to_payload\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2c04133e54348533", "name": "Near-duplicate function bodies in 2 places", "shortDescription": {"text": "Near-duplicate function bodies in 2 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nsrc/decision_room/memory/store.py:storage_dir, src/decision_room/memory/store.py:storage_dir\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-49c98f7cedd9c977", "name": "Near-duplicate function bodies in 4 places", "shortDescription": {"text": "Near-duplicate function bodies in 4 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nsrc/decision_room/orchestration/central_mas.py:plan_round, src/decision_room/orchestration/speaker_strategies.py:plan_speakers, src/decision_room/orchestration/speaker_strategies.py:plan_speakers, src/decision_room/orchestration/speaker_strategies.py:plan_speakers\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-65812a486375cd94", "name": "FastAPI POST `create_room` without auth dependency \u2014 src/decision_room/runtime/http_api.py:412", "shortDescription": {"text": "FastAPI POST `create_room` without auth dependency \u2014 src/decision_room/runtime/http_api.py:412"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-c1f78f5d9835bb11", "name": "FastAPI POST `preflight_room` without auth dependency \u2014 src/decision_room/runtime/http_api.py:447", "shortDescription": {"text": "FastAPI POST `preflight_room` without auth dependency \u2014 src/decision_room/runtime/http_api.py:447"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-ff3e5b8fca1c621f", "name": "FastAPI POST `post_human_message` without auth dependency \u2014 src/decision_room/runtime/http_api.py:499", "shortDescription": {"text": "FastAPI POST `post_human_message` without auth dependency \u2014 src/decision_room/runtime/http_api.py:499"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-9f2fc69e9aabd7ad", "name": "FastAPI POST `post_human_override` without auth dependency \u2014 src/decision_room/runtime/http_api.py:508", "shortDescription": {"text": "FastAPI POST `post_human_override` without auth dependency \u2014 src/decision_room/runtime/http_api.py:508"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/24969"}, "properties": {"repository": "ChristopheZhao/Meetkat", "repoUrl": "https://github.com/ChristopheZhao/Meetkat", "branch": "main"}, "results": [{"ruleId": "scanner-019caa780129c845", "level": "note", "message": {"text": "Possibly dead Python function: reset_room"}, "properties": {"repobilityId": "560ada2d67c58e9f", "scanner": "scanner-primary", "fingerprint": "019caa780129c845", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/decision_room/memory/store.py:160"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3a3e813773dd571d", "level": "note", "message": {"text": "Possibly dead Python function: append_many"}, "properties": {"repobilityId": "69fdf1d9ee0fd58f", "scanner": "scanner-primary", "fingerprint": "3a3e813773dd571d", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/decision_room/memory/store.py:243"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-56ba30c9905ad534", "level": "note", "message": {"text": "Possibly dead Python function: with_route"}, "properties": {"repobilityId": "b56e151cc8cf210c", "scanner": "scanner-primary", "fingerprint": "56ba30c9905ad534", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/decision_room/agents/base.py:102"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f27fd05cfb4889bd", "level": "note", "message": {"text": "Possibly dead Python function: should_publish_consensus_end"}, "properties": {"repobilityId": "8adc36d9244ec893", "scanner": "scanner-primary", "fingerprint": "f27fd05cfb4889bd", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/decision_room/policies/room_control.py:52"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-9710c8d059e53154", "level": "none", "message": {"text": "No frontend routes/components detected"}, "properties": {"repobilityId": "44ca61485762e494", "scanner": "scanner-primary", "fingerprint": "9710c8d059e53154", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-732e3b3517f08b29", "level": "warning", "message": {"text": "Insecure pattern 'cors_wildcard' in src/decision_room/runtime/http_api.py:351"}, "properties": {"repobilityId": "502ef2f0dd149460", "scanner": "scanner-primary", "fingerprint": "732e3b3517f08b29", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "cors_wildcard"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/decision_room/runtime/http_api.py"}, "region": {"startLine": 351}}}]}, {"ruleId": "scanner-6372cebde0220094", "level": "warning", "message": {"text": "No auth library detected"}, "properties": {"repobilityId": "a5b6035a5bbf8054", "scanner": "scanner-primary", "fingerprint": "6372cebde0220094", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["coverage", "auth"]}}, {"ruleId": "scanner-1a50467f36b413ec", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "a6f618d912443a4c", "scanner": "scanner-primary", "fingerprint": "1a50467f36b413ec", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/tests.yml"}, "region": {"startLine": 26}}}]}, {"ruleId": "scanner-aba64590253b8cb7", "level": "note", "message": {"text": "Very large file: tests/test_room_runtime.py (1163 lines)"}, "properties": {"repobilityId": "050d852a77c0c2ec", "scanner": "scanner-primary", "fingerprint": "aba64590253b8cb7", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "5d95ac2bafa37b10", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "aa03d63fe88b6f17", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea240a7d413a2da7", "level": "none", "message": {"text": "Commented-code block (5 lines) in tests/test_room_runtime.py:950"}, "properties": {"repobilityId": "cbdfe0cb9436ee1d", "scanner": "scanner-primary", "fingerprint": "ea240a7d413a2da7", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-7d66e8de2779d4b6", "level": "none", "message": {"text": "Commented-code block (5 lines) in tests/test_room_executor.py:169"}, "properties": {"repobilityId": "145f7ece6fc68655", "scanner": "scanner-primary", "fingerprint": "7d66e8de2779d4b6", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-d7ead6b6f7becf11", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/decision_room/agents/specialist_agent.py:51"}, "properties": {"repobilityId": "ec2b922d5651fcc1", "scanner": "scanner-primary", "fingerprint": "d7ead6b6f7becf11", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-bcb103a8c7c4d8c4", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/decision_room/orchestration/central_mas.py:487"}, "properties": {"repobilityId": "f8e73465a0d87bd8", "scanner": "scanner-primary", "fingerprint": "bcb103a8c7c4d8c4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-59af8368178c8c7f", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/decision_room/orchestration/room_executor.py:118"}, "properties": {"repobilityId": "a753acbad9f57293", "scanner": "scanner-primary", "fingerprint": "59af8368178c8c7f", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-908734438b2f97d9", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/decision_room/orchestration/pre_room_planning.py:850"}, "properties": {"repobilityId": "bf7d4a6ee56966c2", "scanner": "scanner-primary", "fingerprint": "908734438b2f97d9", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-b334d875f2339fa1", "level": "note", "message": {"text": "5 env vars used in code but missing from .env.example"}, "properties": {"repobilityId": "faa38682016f5d53", "scanner": "scanner-primary", "fingerprint": "b334d875f2339fa1", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "config-drift"]}}, {"ruleId": "scanner-be46ea126aa5d8dc", "level": "note", "message": {"text": "Near-duplicate function bodies in 3 places"}, "properties": {"repobilityId": "ca3807f4c74e3ce4", "scanner": "scanner-primary", "fingerprint": "be46ea126aa5d8dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "158ada353aad0769", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "2b09fc0df936f0a9", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-be46ea126aa5d8dc", "level": "note", "message": {"text": "Near-duplicate function bodies in 3 places"}, "properties": {"repobilityId": "e3a2419b4d27e243", "scanner": "scanner-primary", "fingerprint": "be46ea126aa5d8dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-49c98f7cedd9c977", "level": "note", "message": {"text": "Near-duplicate function bodies in 4 places"}, "properties": {"repobilityId": "cdd0d7c326e4e623", "scanner": "scanner-primary", "fingerprint": "49c98f7cedd9c977", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-be46ea126aa5d8dc", "level": "note", "message": {"text": "Near-duplicate function bodies in 3 places"}, "properties": {"repobilityId": "3d0c32425575bc79", "scanner": "scanner-primary", "fingerprint": "be46ea126aa5d8dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "ca71e40c168519bd", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "e9efefd8e8b15c92", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "55be0ddab1ee5b8d", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "c3880c3d52c60a0f", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-be46ea126aa5d8dc", "level": "note", "message": {"text": "Near-duplicate function bodies in 3 places"}, "properties": {"repobilityId": "a0828098b8165f7b", "scanner": "scanner-primary", "fingerprint": "be46ea126aa5d8dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "08d9d824a051318b", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "eeb1e7c0264a09b0", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "cda837cc5d4292b6", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-be46ea126aa5d8dc", "level": "note", "message": {"text": "Near-duplicate function bodies in 3 places"}, "properties": {"repobilityId": "7b21dc4397e3675d", "scanner": "scanner-primary", "fingerprint": "be46ea126aa5d8dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "5304090f27871e65", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-49c98f7cedd9c977", "level": "note", "message": {"text": "Near-duplicate function bodies in 4 places"}, "properties": {"repobilityId": "8d61911eae05e424", "scanner": "scanner-primary", "fingerprint": "49c98f7cedd9c977", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "9f3470d08f9841af", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "422739d4148a54fc", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "8d084f729ae52e42", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-65812a486375cd94", "level": "error", "message": {"text": "FastAPI POST `create_room` without auth dependency \u2014 src/decision_room/runtime/http_api.py:412"}, "properties": {"repobilityId": "aabcbf511fe792f8", "scanner": "scanner-primary", "fingerprint": "65812a486375cd94", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/decision_room/runtime/http_api.py"}, "region": {"startLine": 412}}}]}, {"ruleId": "scanner-c1f78f5d9835bb11", "level": "error", "message": {"text": "FastAPI POST `preflight_room` without auth dependency \u2014 src/decision_room/runtime/http_api.py:447"}, "properties": {"repobilityId": "eef8627f4a90e8b3", "scanner": "scanner-primary", "fingerprint": "c1f78f5d9835bb11", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/decision_room/runtime/http_api.py"}, "region": {"startLine": 447}}}]}, {"ruleId": "scanner-ff3e5b8fca1c621f", "level": "error", "message": {"text": "FastAPI POST `post_human_message` without auth dependency \u2014 src/decision_room/runtime/http_api.py:499"}, "properties": {"repobilityId": "8b71ef800c3252bf", "scanner": "scanner-primary", "fingerprint": "ff3e5b8fca1c621f", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/decision_room/runtime/http_api.py"}, "region": {"startLine": 499}}}]}, {"ruleId": "scanner-9f2fc69e9aabd7ad", "level": "error", "message": {"text": "FastAPI POST `post_human_override` without auth dependency \u2014 src/decision_room/runtime/http_api.py:508"}, "properties": {"repobilityId": "0f077874f1d27476", "scanner": "scanner-primary", "fingerprint": "9f2fc69e9aabd7ad", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/decision_room/runtime/http_api.py"}, "region": {"startLine": 508}}}]}]}]}