{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-971c0426e317ec6c", "name": "`truncate` class without `title=` for hover reveal \u2014 ui/src/components/WorkerNodeWizard.tsx:356", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 ui/src/components/WorkerNodeWizard.tsx:356"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-4610f6de967c53e6", "name": "`truncate` class without `title=` for hover reveal \u2014 ui/src/components/Sidebar.tsx:279", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 ui/src/components/Sidebar.tsx:279"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-3e3104097e5c1854", "name": "`truncate` class without `title=` for hover reveal \u2014 ui/src/pages/ConfigManagement.tsx:339", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 ui/src/pages/ConfigManagement.tsx:339"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-ca9cd7cad570855f", "name": "`truncate` class without `title=` for hover reveal \u2014 ui/src/pages/Publish.tsx:532", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 ui/src/pages/Publish.tsx:532"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-cb2c72e33cbf4d76", "name": "`truncate` class without `title=` for hover reveal \u2014 ui/src/pages/Setup.tsx:748", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 ui/src/pages/Setup.tsx:748"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-f4ae3964ab296956", "name": "`truncate` class without `title=` for hover reveal \u2014 ui/src/pages/Dashboard.tsx:378", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 ui/src/pages/Dashboard.tsx:378"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-092c8cf4055f0f44", "name": "`truncate` class without `title=` for hover reveal \u2014 ui/src/pages/GeoData.tsx:134", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 ui/src/pages/GeoData.tsx:134"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-245b1338840c0da4", "name": "`truncate` class without `title=` for hover reveal \u2014 ui/src/pages/PerDeviceRules.tsx:627", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 ui/src/pages/PerDeviceRules.tsx:627"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-f27ca23ca7f6a174", "name": "`truncate` class without `title=` for hover reveal \u2014 ui/src/pages/ActivityLog.tsx:120", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 ui/src/pages/ActivityLog.tsx:120"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-561c9984a700d841", "name": "`truncate` class without `title=` for hover reveal \u2014 ui/src/pages/QuickStart.tsx:810", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 ui/src/pages/QuickStart.tsx:810"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-b72ab606ad13e981", "name": "`truncate` class without `title=` for hover reveal \u2014 ui/src/pages/Connections.tsx:50", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 ui/src/pages/Connections.tsx:50"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-4b73989f69b6cc03", "name": "`truncate` class without `title=` for hover reveal \u2014 ui/src/pages/Subscriptions.tsx:24", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 ui/src/pages/Subscriptions.tsx:24"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-5f88b3ba95d28d85", "name": "`truncate` class without `title=` for hover reveal \u2014 ui/src/pages/Nodes.tsx:659", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 ui/src/pages/Nodes.tsx:659"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-d63da3583b14afc0", "name": "Dockerfile runs as root: Dockerfile", "shortDescription": {"text": "Dockerfile runs as root: Dockerfile"}, "fullDescription": {"text": "No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-835eae4c7f17a2f8", "name": "Docker base image is tag-pinned but not digest-pinned: node:22-alpine", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: node:22-alpine"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-86f709d148d54907", "name": "Docker base image is tag-pinned but not digest-pinned: golang:1.25-alpine", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: golang:1.25-alpine"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9bcd3af8b3298f74", "name": "Docker base image is tag-pinned but not digest-pinned: alpine:3.19", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: alpine:3.19"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a4d3fa835cc7f9ab", "name": "Dockerfile runs as root: tests/docker/Dockerfile", "shortDescription": {"text": "Dockerfile runs as root: tests/docker/Dockerfile"}, "fullDescription": {"text": "No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-695d5293107bf876", "name": "Docker base image is tag-pinned but not digest-pinned: golang:1.25-alpine", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: golang:1.25-alpine"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2b88949ff03b120c", "name": "Docker base image is tag-pinned but not digest-pinned: alpine:3.19", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: alpine:3.19"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-aa5acaa49eb8315b", "name": "Containers defined but no K8s/orchestration manifest found", "shortDescription": {"text": "Containers defined but no K8s/orchestration manifest found"}, "fullDescription": {"text": "Repo has Dockerfiles/compose but no Kubernetes/Nomad manifests. If the target deployment is K8s, the manifests may live in a separate ops repo."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3f8ba27461fee663", "name": "Insecure pattern 'direct_innerhtml_assignment' in openwrt/files/www/luci-static/resources/view/clashforge/main.js:295", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in openwrt/files/www/luci-static/resources/view/clashforge/main.js:295"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0758dd4a83699808", "name": "Insecure pattern 'cors_wildcard' in internal/api/middleware.go:32", "shortDescription": {"text": "Insecure pattern 'cors_wildcard' in internal/api/middleware.go:32"}, "fullDescription": {"text": "Found a known-risky pattern (cors_wildcard). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6372cebde0220094", "name": "No auth library detected", "shortDescription": {"text": "No auth library detected"}, "fullDescription": {"text": "The scanner did not find any standard auth library (JWT, OAuth, NextAuth, Auth0, etc.). The repo has auth/admin/session surface indicators, so auth may live in custom code, in a separate service, or be missing."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1c94821082fb8c9b", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/upload-artifact@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2052bf25e4e4c7af", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-510def1477caf385", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/setup-go@v5 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-df37fc6abce64eb2", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/setup-java@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fe57a4f6bc98c26a", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-46c644c6227e4d4a", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/upload-artifact@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1838a141491ce38c", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4608456217cfce4d", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e4f658c0c00de0d4", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v5 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-448d8837178ae57a", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-05e40eb0945baf4b", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-bda6deb11902724f", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9aa4ba4d9fb94c7b", "name": "Very large file: internal/api/handler_overview.go (2191 lines)", "shortDescription": {"text": "Very large file: internal/api/handler_overview.go (2191 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c1e0623b97e5fcaf", "name": "Very large file: ui/src/pages/Publish.tsx (2352 lines)", "shortDescription": {"text": "Very large file: ui/src/pages/Publish.tsx (2352 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-976348318f788afe", "name": "Very large file: ui/src/pages/Setup.tsx (3040 lines)", "shortDescription": {"text": "Very large file: ui/src/pages/Setup.tsx (3040 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-80cd3c86f7179c92", "name": "Very large file: ui/src/pages/Dashboard.tsx (1626 lines)", "shortDescription": {"text": "Very large file: ui/src/pages/Dashboard.tsx (1626 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9d45be0f2bd30d79", "name": "Very large file: ui/src/pages/PerDeviceRules.tsx (2273 lines)", "shortDescription": {"text": "Very large file: ui/src/pages/PerDeviceRules.tsx (2273 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-479ddd73794454c4", "name": "Very large file: ui/src/pages/QuickStart.tsx (1358 lines)", "shortDescription": {"text": "Very large file: ui/src/pages/QuickStart.tsx (1358 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cb8f5424cf95f175", "name": "Very large file: ui/src/pages/Nodes.tsx (3160 lines)", "shortDescription": {"text": "Very large file: ui/src/pages/Nodes.tsx (3160 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5de81702fd438950", "name": "Very large file: scripts/clashforgectl.sh (1582 lines)", "shortDescription": {"text": "Very large file: scripts/clashforgectl.sh (1582 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ea3b5e389d8c9c0f", "name": "Low test-to-source ratio", "shortDescription": {"text": "Low test-to-source ratio"}, "fullDescription": {"text": "30 tests / 159 src (ratio 0.19)."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 20 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-72b2a6250083a784", "name": "Placeholder or mock-heavy implementation detected", "shortDescription": {"text": "Placeholder or mock-heavy implementation detected"}, "fullDescription": {"text": "Found 212 placeholder/mock markers across 38 source files. This often means the repo looks complete while core flows still use generated scaffolding or fake data."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-b670acef6a3a5cde", "name": "`fetch()` without try/.catch or AbortSignal \u2014 openwrt/files/www/luci-static/resources/view/clashforge/main.js:297", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 openwrt/files/www/luci-static/resources/view/clashforge/main.js:297"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-203167586239e056", "name": "`fetch()` without try/.catch or AbortSignal \u2014 ui/src/api/client.ts:5", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 ui/src/api/client.ts:5"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e46bc161782f46b9", "name": "`fetch()` without try/.catch or AbortSignal \u2014 ui/src/components/CFConfig.tsx:82", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 ui/src/components/CFConfig.tsx:82"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-206127d4e2b1403e", "name": "Commented-code block (6 lines) in ui/src/pages/Setup.tsx:919", "shortDescription": {"text": "Commented-code block (6 lines) in ui/src/pages/Setup.tsx:919"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-061c43531ffaf25f", "name": "`fetch()` without try/.catch or AbortSignal \u2014 ui/src/pages/Dashboard.tsx:1265", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 ui/src/pages/Dashboard.tsx:1265"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ccc16efcc8050f45", "name": "`fetch()` without try/.catch or AbortSignal \u2014 ui/src/pages/Nodes.tsx:2194", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 ui/src/pages/Nodes.tsx:2194"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ecd3b7c22ae94a76", "name": "Network/subprocess call without timeout or try/except \u2014 scripts/build_ipk.py:122", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/build_ipk.py:122"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3aac186985667147", "name": "Frontend route `/geodata` has no Link/navigate to it \u2014 ui/src/App.tsx", "shortDescription": {"text": "Frontend route `/geodata` has no Link/navigate to it \u2014 ui/src/App.tsx"}, "fullDescription": {"text": "The route is registered but no `<Link to=\u2026>` or `navigate(\u2026)` in the codebase navigates here. Either it's reachable only via direct URL (intentional), it's dead, or the link broke during a refactor."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/22926"}, "properties": {"repository": "wujun4code/clashforge", "repoUrl": "https://github.com/wujun4code/clashforge", "branch": "main"}, "results": [{"ruleId": "scanner-971c0426e317ec6c", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 ui/src/components/WorkerNodeWizard.tsx:356"}, "properties": {"repobilityId": "d4d3837afd8b3bb0", "scanner": "scanner-primary", "fingerprint": "971c0426e317ec6c", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-4610f6de967c53e6", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 ui/src/components/Sidebar.tsx:279"}, "properties": {"repobilityId": "6af664b06244e010", "scanner": "scanner-primary", "fingerprint": "4610f6de967c53e6", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-3e3104097e5c1854", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 ui/src/pages/ConfigManagement.tsx:339"}, "properties": {"repobilityId": "649980e402e3eb89", "scanner": "scanner-primary", "fingerprint": "3e3104097e5c1854", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-ca9cd7cad570855f", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 ui/src/pages/Publish.tsx:532"}, "properties": {"repobilityId": "d6178dcbd777e13c", "scanner": "scanner-primary", "fingerprint": "ca9cd7cad570855f", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-cb2c72e33cbf4d76", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 ui/src/pages/Setup.tsx:748"}, "properties": {"repobilityId": "721b853a8cb97f56", "scanner": "scanner-primary", "fingerprint": "cb2c72e33cbf4d76", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-f4ae3964ab296956", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 ui/src/pages/Dashboard.tsx:378"}, "properties": {"repobilityId": "88fc145d807aab04", "scanner": "scanner-primary", "fingerprint": "f4ae3964ab296956", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-092c8cf4055f0f44", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 ui/src/pages/GeoData.tsx:134"}, "properties": {"repobilityId": "5a635e65d7f04f99", "scanner": "scanner-primary", "fingerprint": "092c8cf4055f0f44", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-245b1338840c0da4", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 ui/src/pages/PerDeviceRules.tsx:627"}, "properties": {"repobilityId": "5f78aebedc9c6172", "scanner": "scanner-primary", "fingerprint": "245b1338840c0da4", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-f27ca23ca7f6a174", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 ui/src/pages/ActivityLog.tsx:120"}, "properties": {"repobilityId": "a5e435028f064fb5", "scanner": "scanner-primary", "fingerprint": "f27ca23ca7f6a174", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-561c9984a700d841", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 ui/src/pages/QuickStart.tsx:810"}, "properties": {"repobilityId": "16db36bdc45869b3", "scanner": "scanner-primary", "fingerprint": "561c9984a700d841", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-b72ab606ad13e981", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 ui/src/pages/Connections.tsx:50"}, "properties": {"repobilityId": "32356815f15cd868", "scanner": "scanner-primary", "fingerprint": "b72ab606ad13e981", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-4b73989f69b6cc03", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 ui/src/pages/Subscriptions.tsx:24"}, "properties": {"repobilityId": "982dbfccc83298d6", "scanner": "scanner-primary", "fingerprint": "4b73989f69b6cc03", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-5f88b3ba95d28d85", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 ui/src/pages/Nodes.tsx:659"}, "properties": {"repobilityId": "3acacbe07b33beff", "scanner": "scanner-primary", "fingerprint": "5f88b3ba95d28d85", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-d63da3583b14afc0", "level": "warning", "message": {"text": "Dockerfile runs as root: Dockerfile"}, "properties": {"repobilityId": "a2ed1bd120e507db", "scanner": "scanner-primary", "fingerprint": "d63da3583b14afc0", "layer": "hardware", "severity": "medium", "confidence": 1.0, "tags": ["security", "container"]}}, {"ruleId": "scanner-835eae4c7f17a2f8", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: node:22-alpine"}, "properties": {"repobilityId": "44456641f7319fcf", "scanner": "scanner-primary", "fingerprint": "835eae4c7f17a2f8", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Dockerfile"}, "region": {"startLine": 4}}}]}, {"ruleId": "scanner-86f709d148d54907", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: golang:1.25-alpine"}, "properties": {"repobilityId": "d509a19b2165b9a2", "scanner": "scanner-primary", "fingerprint": "86f709d148d54907", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Dockerfile"}, "region": {"startLine": 19}}}]}, {"ruleId": "scanner-9bcd3af8b3298f74", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: alpine:3.19"}, "properties": {"repobilityId": "c967bfad3ebc088a", "scanner": "scanner-primary", "fingerprint": "9bcd3af8b3298f74", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Dockerfile"}, "region": {"startLine": 49}}}]}, {"ruleId": "scanner-a4d3fa835cc7f9ab", "level": "warning", "message": {"text": "Dockerfile runs as root: tests/docker/Dockerfile"}, "properties": {"repobilityId": "ad9660bcb566bc24", "scanner": "scanner-primary", "fingerprint": "a4d3fa835cc7f9ab", "layer": "hardware", "severity": "medium", "confidence": 1.0, "tags": ["security", "container"]}}, {"ruleId": "scanner-695d5293107bf876", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: golang:1.25-alpine"}, "properties": {"repobilityId": "3bcf667496bc0127", "scanner": "scanner-primary", "fingerprint": "695d5293107bf876", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/docker/Dockerfile"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-2b88949ff03b120c", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: alpine:3.19"}, "properties": {"repobilityId": "b63c3b2e4d79394a", "scanner": "scanner-primary", "fingerprint": "2b88949ff03b120c", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/docker/Dockerfile"}, "region": {"startLine": 12}}}]}, {"ruleId": "scanner-aa5acaa49eb8315b", "level": "note", "message": {"text": "Containers defined but no K8s/orchestration manifest found"}, "properties": {"repobilityId": "b230ea9b68736081", "scanner": "scanner-primary", "fingerprint": "aa5acaa49eb8315b", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["coverage", "deployment"]}}, {"ruleId": "scanner-3f8ba27461fee663", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in openwrt/files/www/luci-static/resources/view/clashforge/main.js:295"}, "properties": {"repobilityId": "09bf67a164989a60", "scanner": "scanner-primary", "fingerprint": "3f8ba27461fee663", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "openwrt/files/www/luci-static/resources/view/clashforge/main.js"}, "region": {"startLine": 295}}}]}, {"ruleId": "scanner-0758dd4a83699808", "level": "warning", "message": {"text": "Insecure pattern 'cors_wildcard' in internal/api/middleware.go:32"}, "properties": {"repobilityId": "46cf9e4e60a7fcd8", "scanner": "scanner-primary", "fingerprint": "0758dd4a83699808", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "cors_wildcard"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "internal/api/middleware.go"}, "region": {"startLine": 32}}}]}, {"ruleId": "scanner-6372cebde0220094", "level": "warning", "message": {"text": "No auth library detected"}, "properties": {"repobilityId": "a5b6035a5bbf8054", "scanner": "scanner-primary", "fingerprint": "6372cebde0220094", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["coverage", "auth"]}}, {"ruleId": "scanner-1c94821082fb8c9b", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "ee00cd0810d71676", "scanner": "scanner-primary", "fingerprint": "1c94821082fb8c9b", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ios-ci.yml"}, "region": {"startLine": 127}}}]}, {"ruleId": "scanner-2052bf25e4e4c7af", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "d4d7142202475472", "scanner": "scanner-primary", "fingerprint": "2052bf25e4e4c7af", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/e2e-openwrt.yml"}, "region": {"startLine": 58}}}]}, {"ruleId": "scanner-2052bf25e4e4c7af", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "0755cbbb9aae7874", "scanner": "scanner-primary", "fingerprint": "2052bf25e4e4c7af", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/e2e-openwrt.yml"}, "region": {"startLine": 61}}}]}, {"ruleId": "scanner-2052bf25e4e4c7af", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "260e39df6f40a808", "scanner": "scanner-primary", "fingerprint": "2052bf25e4e4c7af", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/e2e-openwrt.yml"}, "region": {"startLine": 67}}}]}, {"ruleId": "scanner-2052bf25e4e4c7af", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "5e02835280f79e5e", "scanner": "scanner-primary", "fingerprint": "2052bf25e4e4c7af", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/e2e-openwrt.yml"}, "region": {"startLine": 189}}}]}, {"ruleId": "scanner-2052bf25e4e4c7af", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "5e02835280f79e5e", "scanner": "scanner-primary", "fingerprint": "2052bf25e4e4c7af", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/e2e-openwrt.yml"}, "region": {"startLine": 197}}}]}, {"ruleId": "scanner-2052bf25e4e4c7af", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "d4d7142202475472", "scanner": "scanner-primary", "fingerprint": "2052bf25e4e4c7af", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/e2e-openwrt.yml"}, "region": {"startLine": 214}}}]}, {"ruleId": "scanner-2052bf25e4e4c7af", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "8a4d5fbd2b774405", "scanner": "scanner-primary", "fingerprint": "2052bf25e4e4c7af", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/e2e-openwrt.yml"}, "region": {"startLine": 272}}}]}, {"ruleId": "scanner-2052bf25e4e4c7af", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "8a4d5fbd2b774405", "scanner": "scanner-primary", "fingerprint": "2052bf25e4e4c7af", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/e2e-openwrt.yml"}, "region": {"startLine": 389}}}]}, {"ruleId": "scanner-510def1477caf385", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "5338b40299d60162", "scanner": "scanner-primary", "fingerprint": "510def1477caf385", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/android-ci.yml"}, "region": {"startLine": 60}}}]}, {"ruleId": "scanner-510def1477caf385", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "9a9b35e984463b6e", "scanner": "scanner-primary", "fingerprint": "510def1477caf385", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/android-ci.yml"}, "region": {"startLine": 106}}}]}, {"ruleId": "scanner-510def1477caf385", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "977342ff5ffbd280", "scanner": "scanner-primary", "fingerprint": "510def1477caf385", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/android-ci.yml"}, "region": {"startLine": 113}}}]}, {"ruleId": "scanner-510def1477caf385", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "9a9b35e984463b6e", "scanner": "scanner-primary", "fingerprint": "510def1477caf385", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/android-ci.yml"}, "region": {"startLine": 162}}}]}, {"ruleId": "scanner-510def1477caf385", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "977342ff5ffbd280", "scanner": "scanner-primary", "fingerprint": "510def1477caf385", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/android-ci.yml"}, "region": {"startLine": 169}}}]}, {"ruleId": "scanner-510def1477caf385", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "5338b40299d60162", "scanner": "scanner-primary", "fingerprint": "510def1477caf385", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/android-ci.yml"}, "region": {"startLine": 181}}}]}, {"ruleId": "scanner-510def1477caf385", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "48045ae14507eba5", "scanner": "scanner-primary", "fingerprint": "510def1477caf385", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/android-ci.yml"}, "region": {"startLine": 289}}}]}, {"ruleId": "scanner-df37fc6abce64eb2", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "239da5cf229f7c1b", "scanner": "scanner-primary", "fingerprint": "df37fc6abce64eb2", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/android-release.yml"}, "region": {"startLine": 53}}}]}, {"ruleId": "scanner-df37fc6abce64eb2", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "e0bdef3e0eaadc91", "scanner": "scanner-primary", "fingerprint": "df37fc6abce64eb2", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/android-release.yml"}, "region": {"startLine": 59}}}]}, {"ruleId": "scanner-df37fc6abce64eb2", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "428f1410423abdbf", "scanner": "scanner-primary", "fingerprint": "df37fc6abce64eb2", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/android-release.yml"}, "region": {"startLine": 65}}}]}, {"ruleId": "scanner-df37fc6abce64eb2", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "ef7c360a028414a0", "scanner": "scanner-primary", "fingerprint": "df37fc6abce64eb2", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/android-release.yml"}, "region": {"startLine": 240}}}]}, {"ruleId": "scanner-fe57a4f6bc98c26a", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "da54dbb605565a8a", "scanner": "scanner-primary", "fingerprint": "fe57a4f6bc98c26a", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/android-release.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "5ab0c5bd71e63ad8", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 56}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "b0f359fc82dc1097", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 92}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "5ab0c5bd71e63ad8", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 115}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "5ab0c5bd71e63ad8", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 162}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "b0f359fc82dc1097", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 203}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "b0f359fc82dc1097", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 221}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "5ab0c5bd71e63ad8", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 310}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "b0f359fc82dc1097", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 357}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "b0f359fc82dc1097", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 375}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "5ab0c5bd71e63ad8", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 490}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "b0f359fc82dc1097", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 541}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "b0f359fc82dc1097", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 548}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "b0f359fc82dc1097", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 555}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "f0dc584a111ffc00", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 572}}}]}, {"ruleId": "scanner-1838a141491ce38c", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "b8fd4f5048f96576", "scanner": "scanner-primary", "fingerprint": "1838a141491ce38c", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-4608456217cfce4d", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "1ffb39d857dff109", "scanner": "scanner-primary", "fingerprint": "4608456217cfce4d", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/e2e-node-server.yml"}, "region": {"startLine": 45}}}]}, {"ruleId": "scanner-4608456217cfce4d", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "e728b16286f26cf7", "scanner": "scanner-primary", "fingerprint": "4608456217cfce4d", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/e2e-node-server.yml"}, "region": {"startLine": 48}}}]}, {"ruleId": "scanner-4608456217cfce4d", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "80ade96a5dd94f84", "scanner": "scanner-primary", "fingerprint": "4608456217cfce4d", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/e2e-node-server.yml"}, "region": {"startLine": 54}}}]}, {"ruleId": "scanner-4608456217cfce4d", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "edd3b93fcaa7a23d", "scanner": "scanner-primary", "fingerprint": "4608456217cfce4d", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/e2e-node-server.yml"}, "region": {"startLine": 83}}}]}, {"ruleId": "scanner-4608456217cfce4d", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "1ffb39d857dff109", "scanner": "scanner-primary", "fingerprint": "4608456217cfce4d", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/e2e-node-server.yml"}, "region": {"startLine": 100}}}]}, {"ruleId": "scanner-4608456217cfce4d", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "d4859325a08fd255", "scanner": "scanner-primary", "fingerprint": "4608456217cfce4d", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/e2e-node-server.yml"}, "region": {"startLine": 104}}}]}, {"ruleId": "scanner-e4f658c0c00de0d4", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "0f065cf4cb3b28fa", "scanner": "scanner-primary", "fingerprint": "e4f658c0c00de0d4", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/pages.yml"}, "region": {"startLine": 25}}}]}, {"ruleId": "scanner-e4f658c0c00de0d4", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "0a1d8846d20526c1", "scanner": "scanner-primary", "fingerprint": "e4f658c0c00de0d4", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/pages.yml"}, "region": {"startLine": 28}}}]}, {"ruleId": "scanner-e4f658c0c00de0d4", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "38cf1c8b667d348e", "scanner": "scanner-primary", "fingerprint": "e4f658c0c00de0d4", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/pages.yml"}, "region": {"startLine": 45}}}]}, {"ruleId": "scanner-e4f658c0c00de0d4", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "e1a9cc0aa0ef1a08", "scanner": "scanner-primary", "fingerprint": "e4f658c0c00de0d4", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/pages.yml"}, "region": {"startLine": 51}}}]}, {"ruleId": "scanner-e4f658c0c00de0d4", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "25e1fa3783e7cb32", "scanner": "scanner-primary", "fingerprint": "e4f658c0c00de0d4", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/pages.yml"}, "region": {"startLine": 64}}}]}, {"ruleId": "scanner-448d8837178ae57a", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "13af6451e15656fc", "scanner": "scanner-primary", "fingerprint": "448d8837178ae57a", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/pages.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-05e40eb0945baf4b", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "f1516d317ce3cbe4", "scanner": "scanner-primary", "fingerprint": "05e40eb0945baf4b", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/auto-tag.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-bda6deb11902724f", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "52fa6a3933670e49", "scanner": "scanner-primary", "fingerprint": "bda6deb11902724f", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/auto-merge.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-9aa4ba4d9fb94c7b", "level": "note", "message": {"text": "Very large file: internal/api/handler_overview.go (2191 lines)"}, "properties": {"repobilityId": "fdfa2331beee69c6", "scanner": "scanner-primary", "fingerprint": "9aa4ba4d9fb94c7b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-c1e0623b97e5fcaf", "level": "note", "message": {"text": "Very large file: ui/src/pages/Publish.tsx (2352 lines)"}, "properties": {"repobilityId": "20cce560c0d1c916", "scanner": "scanner-primary", "fingerprint": "c1e0623b97e5fcaf", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-976348318f788afe", "level": "note", "message": {"text": "Very large file: ui/src/pages/Setup.tsx (3040 lines)"}, "properties": {"repobilityId": "18f91c9053b1826d", "scanner": "scanner-primary", "fingerprint": "976348318f788afe", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-80cd3c86f7179c92", "level": "note", "message": {"text": "Very large file: ui/src/pages/Dashboard.tsx (1626 lines)"}, "properties": {"repobilityId": "6d5adfbfcb168625", "scanner": "scanner-primary", "fingerprint": "80cd3c86f7179c92", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-9d45be0f2bd30d79", "level": "note", "message": {"text": "Very large file: ui/src/pages/PerDeviceRules.tsx (2273 lines)"}, "properties": {"repobilityId": "094eb102cb3044cb", "scanner": "scanner-primary", "fingerprint": "9d45be0f2bd30d79", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-479ddd73794454c4", "level": "note", "message": {"text": "Very large file: ui/src/pages/QuickStart.tsx (1358 lines)"}, "properties": {"repobilityId": "e03282f0dd851815", "scanner": "scanner-primary", "fingerprint": "479ddd73794454c4", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-cb8f5424cf95f175", "level": "note", "message": {"text": "Very large file: ui/src/pages/Nodes.tsx (3160 lines)"}, "properties": {"repobilityId": "887775ddd0239828", "scanner": "scanner-primary", "fingerprint": "cb8f5424cf95f175", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-5de81702fd438950", "level": "note", "message": {"text": "Very large file: scripts/clashforgectl.sh (1582 lines)"}, "properties": {"repobilityId": "a72394ee50efd8e6", "scanner": "scanner-primary", "fingerprint": "5de81702fd438950", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-ea3b5e389d8c9c0f", "level": "note", "message": {"text": "Low test-to-source ratio"}, "properties": {"repobilityId": "ef7b2552cc00a375", "scanner": "scanner-primary", "fingerprint": "ea3b5e389d8c9c0f", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["tests"]}}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "2c6212cb51a459a7", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-72b2a6250083a784", "level": "warning", "message": {"text": "Placeholder or mock-heavy implementation detected"}, "properties": {"repobilityId": "e12c85ac597038ef", "scanner": "scanner-primary", "fingerprint": "72b2a6250083a784", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "incomplete", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "be14823fa5ae12fe", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "dca76e2aff363f4e", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "63c64876f038a735", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-b670acef6a3a5cde", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 openwrt/files/www/luci-static/resources/view/clashforge/main.js:297"}, "properties": {"repobilityId": "3dd2e626798a7d47", "scanner": "scanner-primary", "fingerprint": "b670acef6a3a5cde", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-203167586239e056", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 ui/src/api/client.ts:5"}, "properties": {"repobilityId": "15020882f8837bcb", "scanner": "scanner-primary", "fingerprint": "203167586239e056", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-e46bc161782f46b9", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 ui/src/components/CFConfig.tsx:82"}, "properties": {"repobilityId": "8cee380baf088ed1", "scanner": "scanner-primary", "fingerprint": "e46bc161782f46b9", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-206127d4e2b1403e", "level": "none", "message": {"text": "Commented-code block (6 lines) in ui/src/pages/Setup.tsx:919"}, "properties": {"repobilityId": "07da3eb292174493", "scanner": "scanner-primary", "fingerprint": "206127d4e2b1403e", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-061c43531ffaf25f", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 ui/src/pages/Dashboard.tsx:1265"}, "properties": {"repobilityId": "e8b08e20e25d4706", "scanner": "scanner-primary", "fingerprint": "061c43531ffaf25f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-ccc16efcc8050f45", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 ui/src/pages/Nodes.tsx:2194"}, "properties": {"repobilityId": "19c9b4a9c90df141", "scanner": "scanner-primary", "fingerprint": "ccc16efcc8050f45", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-ecd3b7c22ae94a76", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/build_ipk.py:122"}, "properties": {"repobilityId": "8213b747907007a6", "scanner": "scanner-primary", "fingerprint": "ecd3b7c22ae94a76", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-3aac186985667147", "level": "warning", "message": {"text": "Frontend route `/geodata` has no Link/navigate to it \u2014 ui/src/App.tsx"}, "properties": {"repobilityId": "c52dda3512aac37c", "scanner": "scanner-primary", "fingerprint": "3aac186985667147", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "orphan-page", "wiring"]}}]}]}