{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-0588c1106ae6581c", "name": "Stray `console.log` in TS/JS \u2014 apps/demo-react-native/App.tsx:65", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 apps/demo-react-native/App.tsx:65"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cc1ff8b19344c6f2", "name": "Stray `console.log` in TS/JS \u2014 packages/react/src/PulsePlayer.tsx:29", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 packages/react/src/PulsePlayer.tsx:29"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0a371521a47ae349", "name": "Stray `console.log` in TS/JS \u2014 packages/svelte/src/index.ts:26", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 packages/svelte/src/index.ts:26"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b94b62776d14fa97", "name": "Insecure pattern 'node_child_process' in scripts/consumer-smoke.mjs:28", "shortDescription": {"text": "Insecure pattern 'node_child_process' in scripts/consumer-smoke.mjs:28"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-72414f068e60c906", "name": "Insecure pattern 'node_child_process' in scripts/registry-guard.mjs:24", "shortDescription": {"text": "Insecure pattern 'node_child_process' in scripts/registry-guard.mjs:24"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0db0f94fcdd0d406", "name": "Insecure pattern 'node_child_process' in scripts/check-lib-byte-identical.mjs:31", "shortDescription": {"text": "Insecure pattern 'node_child_process' in scripts/check-lib-byte-identical.mjs:31"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-149d1cdb094a11a1", "name": "Insecure pattern 'node_child_process' in scripts/generate-player-shells.mjs:22", "shortDescription": {"text": "Insecure pattern 'node_child_process' in scripts/generate-player-shells.mjs:22"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e709f208039cf40f", "name": "Insecure pattern 'node_child_process' in scripts/setup-demo-audio.mjs:28", "shortDescription": {"text": "Insecure pattern 'node_child_process' in scripts/setup-demo-audio.mjs:28"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-dd404f75097487e8", "name": "Insecure pattern 'node_child_process' in scripts/publish-dry-run.mjs:15", "shortDescription": {"text": "Insecure pattern 'node_child_process' in scripts/publish-dry-run.mjs:15"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-65aa740cba4a4a73", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-749156c4dcc8bd03", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-eea92d7748146c20", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "googleapis/release-please-action@v5 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-cbe310f193a6df9f", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-bfd54584c16c5961", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-24b7d46a15674d19", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ea87e6a25d94fe6d", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-27924aa79fa4a517", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e4f658c0c00de0d4", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/setup-node@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-448d8837178ae57a", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-66e40d9d6cb55b2b", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/setup-node@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3295c3ff963f5b76", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1c36a91f58f18236", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/setup-node@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cb639d9a10a47b23", "name": "package.json defines install-time lifecycle scripts", "shortDescription": {"text": "package.json defines install-time lifecycle scripts"}, "fullDescription": {"text": "preinstall/install/postinstall/prepare scripts execute during dependency installation. Review them carefully for network calls, obfuscation, shell execution, or credential access."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-078718d853c0184c", "name": "package.json defines install-time lifecycle scripts", "shortDescription": {"text": "package.json defines install-time lifecycle scripts"}, "fullDescription": {"text": "preinstall/install/postinstall/prepare scripts execute during dependency installation. Review them carefully for network calls, obfuscation, shell execution, or credential access."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7ba7d1acbfea7848", "name": "Node manifest has dependencies but no lockfile: apps/demo-svelte/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: apps/demo-svelte/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2336eb106e688ce5", "name": "Node manifest has dependencies but no lockfile: apps/demo-react/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: apps/demo-react/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-86012a9d81fac7a7", "name": "Node manifest has dependencies but no lockfile: apps/demo-react-native/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: apps/demo-react-native/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c6fa5e71c3c6cbed", "name": "Node manifest has dependencies but no lockfile: packages/react-native/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: packages/react-native/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f75585e48a80a595", "name": "Node manifest has dependencies but no lockfile: packages/react/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: packages/react/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-09805ebcf52bce18", "name": "Node manifest has dependencies but no lockfile: packages/web-component/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: packages/web-component/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f06af79d597da549", "name": "Node manifest has dependencies but no lockfile: packages/vue/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: packages/vue/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-28e92806c0db3cd2", "name": "Node manifest has dependencies but no lockfile: packages/core/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: packages/core/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-88bf2119d59ddfdb", "name": "Node manifest has dependencies but no lockfile: packages/svelte/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: packages/svelte/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2e8d9805464f763d", "name": "Node manifest has dependencies but no lockfile: packages/angular/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: packages/angular/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-41b506d0bdfc3632", "name": "Node manifest has dependencies but no lockfile: examples/02-custom-playlist/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: examples/02-custom-playlist/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c4fa9a0b40a3a4e1", "name": "Node manifest has dependencies but no lockfile: examples/01-vite-spa/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: examples/01-vite-spa/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-acd880b45bfe4466", "name": "Node manifest has dependencies but no lockfile: examples/03-event-subscriptions/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: examples/03-event-subscriptions/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 49 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-749d4bc1bd66df5f", "name": "Agent instructions exist but release-hardening basics are missing", "shortDescription": {"text": "Agent instructions exist but release-hardening basics are missing"}, "fullDescription": {"text": "AI-coder instruction files were found, but the repo is missing lockfile. Treat this as a contract gap: the agent is guided, but the generated output is not yet guarded by the controls that make it repeatable."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-3f8d5ac2c066841e", "name": "Commented-code block (5 lines) in playwright.config.ts:26", "shortDescription": {"text": "Commented-code block (5 lines) in playwright.config.ts:26"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-e0c6747282bc054b", "name": "Commented-code block (5 lines) in .eslintrc.cjs:67", "shortDescription": {"text": "Commented-code block (5 lines) in .eslintrc.cjs:67"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-03dfffd59da856dd", "name": "Commented-code block (7 lines) in vitest.config.ts:16", "shortDescription": {"text": "Commented-code block (7 lines) in vitest.config.ts:16"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-5c5a49c85fc85d8c", "name": "Commented-code block (6 lines) in tests/visual/a11y.spec.ts:44", "shortDescription": {"text": "Commented-code block (6 lines) in tests/visual/a11y.spec.ts:44"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-2eebc24033ef6e21", "name": "Commented-code block (6 lines) in tests/visual/pages-live.spec.ts:49", "shortDescription": {"text": "Commented-code block (6 lines) in tests/visual/pages-live.spec.ts:49"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-dbc64ce0c2312b0c", "name": "Commented-code block (7 lines) in scripts/registry-guard.mjs:47", "shortDescription": {"text": "Commented-code block (7 lines) in scripts/registry-guard.mjs:47"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-e6b196f0c3d4835a", "name": "Commented-code block (6 lines) in scripts/generate-player-shells.mjs:87", "shortDescription": {"text": "Commented-code block (6 lines) in scripts/generate-player-shells.mjs:87"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-1a767a4f856ac001", "name": "Commented-code block (7 lines) in scripts/setup-demo-audio.mjs:77", "shortDescription": {"text": "Commented-code block (7 lines) in scripts/setup-demo-audio.mjs:77"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-c0b1cc3134faeb5a", "name": "Commented-code block (5 lines) in packages/react/src/index.ts:23", "shortDescription": {"text": "Commented-code block (5 lines) in packages/react/src/index.ts:23"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-0bfe16f55fd32f79", "name": "Commented-code block (5 lines) in packages/web-component/tests/elements.test.ts:26", "shortDescription": {"text": "Commented-code block (5 lines) in packages/web-component/tests/elements.test.ts:26"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-c00069abba49d21a", "name": "Commented-code block (6 lines) in packages/web-component/src/PulsePlayer.ts:117", "shortDescription": {"text": "Commented-code block (6 lines) in packages/web-component/src/PulsePlayer.ts:117"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-86736ae8b4360a36", "name": "Commented-code block (7 lines) in packages/web-component/src/PulseFab.ts:177", "shortDescription": {"text": "Commented-code block (7 lines) in packages/web-component/src/PulseFab.ts:177"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-90666d1d6afd375d", "name": "Commented-code block (5 lines) in src/main.ts:15", "shortDescription": {"text": "Commented-code block (5 lines) in src/main.ts:15"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-53a205a900d2c894", "name": "Commented-code block (6 lines) in src/composables/useDemoSpotlight.ts:117", "shortDescription": {"text": "Commented-code block (6 lines) in src/composables/useDemoSpotlight.ts:117"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-e5659a791b15a6af", "name": "Commented-code block (7 lines) in src/composables/useAdvancedMotion.ts:31", "shortDescription": {"text": "Commented-code block (7 lines) in src/composables/useAdvancedMotion.ts:31"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-bcb1574f986b5eb0", "name": "Commented-code block (6 lines) in src/composables/useDemoTour.ts:104", "shortDescription": {"text": "Commented-code block (6 lines) in src/composables/useDemoTour.ts:104"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-40b39ca5023d8fa8", "name": "Commented-code block (6 lines) in src/composables/usePremiumMotion.ts:156", "shortDescription": {"text": "Commented-code block (6 lines) in src/composables/usePremiumMotion.ts:156"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-30f551a5fc0a7887", "name": "Commented-code block (6 lines) in src/lib/useAudioStore.ts:141", "shortDescription": {"text": "Commented-code block (6 lines) in src/lib/useAudioStore.ts:141"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/23133"}, "properties": {"repository": "YamadaBlog/pulse-player", "repoUrl": "https://github.com/YamadaBlog/pulse-player", "branch": "main"}, "results": [{"ruleId": "scanner-0588c1106ae6581c", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 apps/demo-react-native/App.tsx:65"}, "properties": {"repobilityId": "c5b3a8330f4bed7f", "scanner": "scanner-primary", "fingerprint": "0588c1106ae6581c", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-cc1ff8b19344c6f2", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 packages/react/src/PulsePlayer.tsx:29"}, "properties": {"repobilityId": "f8530e6a58c66995", "scanner": "scanner-primary", "fingerprint": "cc1ff8b19344c6f2", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-0a371521a47ae349", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 packages/svelte/src/index.ts:26"}, "properties": {"repobilityId": "7c05b83b6d278066", "scanner": "scanner-primary", "fingerprint": "0a371521a47ae349", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-b94b62776d14fa97", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in scripts/consumer-smoke.mjs:28"}, "properties": {"repobilityId": "ee63407430f8b4dd", "scanner": "scanner-primary", "fingerprint": "b94b62776d14fa97", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/consumer-smoke.mjs"}, "region": {"startLine": 28}}}]}, {"ruleId": "scanner-72414f068e60c906", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in scripts/registry-guard.mjs:24"}, "properties": {"repobilityId": "d33c05c80559a1d2", "scanner": "scanner-primary", "fingerprint": "72414f068e60c906", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/registry-guard.mjs"}, "region": {"startLine": 24}}}]}, {"ruleId": "scanner-0db0f94fcdd0d406", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in scripts/check-lib-byte-identical.mjs:31"}, "properties": {"repobilityId": "f63d1850f9deec48", "scanner": "scanner-primary", "fingerprint": "0db0f94fcdd0d406", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/check-lib-byte-identical.mjs"}, "region": {"startLine": 31}}}]}, {"ruleId": "scanner-149d1cdb094a11a1", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in scripts/generate-player-shells.mjs:22"}, "properties": {"repobilityId": "c10f34ced3caccba", "scanner": "scanner-primary", "fingerprint": "149d1cdb094a11a1", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/generate-player-shells.mjs"}, "region": {"startLine": 22}}}]}, {"ruleId": "scanner-e709f208039cf40f", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in scripts/setup-demo-audio.mjs:28"}, "properties": {"repobilityId": "c5d81797953444c3", "scanner": "scanner-primary", "fingerprint": "e709f208039cf40f", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/setup-demo-audio.mjs"}, "region": {"startLine": 28}}}]}, {"ruleId": "scanner-dd404f75097487e8", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in scripts/publish-dry-run.mjs:15"}, "properties": {"repobilityId": "19f13e894ce46222", "scanner": "scanner-primary", "fingerprint": "dd404f75097487e8", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/publish-dry-run.mjs"}, "region": {"startLine": 15}}}]}, {"ruleId": "scanner-65aa740cba4a4a73", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "8860eac61a1ebe26", "scanner": "scanner-primary", "fingerprint": "65aa740cba4a4a73", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/codeql.yml"}, "region": {"startLine": 39}}}]}, {"ruleId": "scanner-65aa740cba4a4a73", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "549a2de1ac0c3fa9", "scanner": "scanner-primary", "fingerprint": "65aa740cba4a4a73", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/codeql.yml"}, "region": {"startLine": 42}}}]}, {"ruleId": "scanner-65aa740cba4a4a73", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "a4f0ab9334543546", "scanner": "scanner-primary", "fingerprint": "65aa740cba4a4a73", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/codeql.yml"}, "region": {"startLine": 51}}}]}, {"ruleId": "scanner-65aa740cba4a4a73", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "a5721e15e3a54aa2", "scanner": "scanner-primary", "fingerprint": "65aa740cba4a4a73", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/codeql.yml"}, "region": {"startLine": 54}}}]}, {"ruleId": "scanner-749156c4dcc8bd03", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "b72ec3163538b8f2", "scanner": "scanner-primary", "fingerprint": "749156c4dcc8bd03", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/coverage.yml"}, "region": {"startLine": 41}}}]}, {"ruleId": "scanner-749156c4dcc8bd03", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "8801038db1ed2771", "scanner": "scanner-primary", "fingerprint": "749156c4dcc8bd03", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/coverage.yml"}, "region": {"startLine": 44}}}]}, {"ruleId": "scanner-749156c4dcc8bd03", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "a8cf0d28e0d675ac", "scanner": "scanner-primary", "fingerprint": "749156c4dcc8bd03", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/coverage.yml"}, "region": {"startLine": 57}}}]}, {"ruleId": "scanner-eea92d7748146c20", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "1295e3fbe434e573", "scanner": "scanner-primary", "fingerprint": "eea92d7748146c20", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release-please.yml"}, "region": {"startLine": 45}}}]}, {"ruleId": "scanner-cbe310f193a6df9f", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "573212e145c44806", "scanner": "scanner-primary", "fingerprint": "cbe310f193a6df9f", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release-please.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-bfd54584c16c5961", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "0f394441fdae5160", "scanner": "scanner-primary", "fingerprint": "bfd54584c16c5961", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/responsive.yml"}, "region": {"startLine": 39}}}]}, {"ruleId": "scanner-bfd54584c16c5961", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "1abd4ebc9333114d", "scanner": "scanner-primary", "fingerprint": "bfd54584c16c5961", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/responsive.yml"}, "region": {"startLine": 42}}}]}, {"ruleId": "scanner-bfd54584c16c5961", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "758d86ed74b21347", "scanner": "scanner-primary", "fingerprint": "bfd54584c16c5961", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/responsive.yml"}, "region": {"startLine": 60}}}]}, {"ruleId": "scanner-24b7d46a15674d19", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "4caeb76425411e42", "scanner": "scanner-primary", "fingerprint": "24b7d46a15674d19", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/visual.yml"}, "region": {"startLine": 29}}}]}, {"ruleId": "scanner-24b7d46a15674d19", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "aee69bf8b325debe", "scanner": "scanner-primary", "fingerprint": "24b7d46a15674d19", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/visual.yml"}, "region": {"startLine": 32}}}]}, {"ruleId": "scanner-24b7d46a15674d19", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "daf963f63b5545f1", "scanner": "scanner-primary", "fingerprint": "24b7d46a15674d19", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/visual.yml"}, "region": {"startLine": 54}}}]}, {"ruleId": "scanner-ea87e6a25d94fe6d", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "302f0b2195d5c3e9", "scanner": "scanner-primary", "fingerprint": "ea87e6a25d94fe6d", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/a11y.yml"}, "region": {"startLine": 43}}}]}, {"ruleId": "scanner-ea87e6a25d94fe6d", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "a5685a3537733375", "scanner": "scanner-primary", "fingerprint": "ea87e6a25d94fe6d", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/a11y.yml"}, "region": {"startLine": 46}}}]}, {"ruleId": "scanner-ea87e6a25d94fe6d", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "afe2faf9973dffc6", "scanner": "scanner-primary", "fingerprint": "ea87e6a25d94fe6d", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/a11y.yml"}, "region": {"startLine": 62}}}]}, {"ruleId": "scanner-27924aa79fa4a517", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "97a9a5de61d82fcd", "scanner": "scanner-primary", "fingerprint": "27924aa79fa4a517", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 27}}}]}, {"ruleId": "scanner-27924aa79fa4a517", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "4a63b1fd6887cae9", "scanner": "scanner-primary", "fingerprint": "27924aa79fa4a517", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 30}}}]}, {"ruleId": "scanner-e4f658c0c00de0d4", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "0a1d8846d20526c1", "scanner": "scanner-primary", "fingerprint": "e4f658c0c00de0d4", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/pages.yml"}, "region": {"startLine": 36}}}]}, {"ruleId": "scanner-e4f658c0c00de0d4", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "e1a9cc0aa0ef1a08", "scanner": "scanner-primary", "fingerprint": "e4f658c0c00de0d4", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/pages.yml"}, "region": {"startLine": 79}}}]}, {"ruleId": "scanner-e4f658c0c00de0d4", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "3d5c6f08903dde90", "scanner": "scanner-primary", "fingerprint": "e4f658c0c00de0d4", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/pages.yml"}, "region": {"startLine": 93}}}]}, {"ruleId": "scanner-e4f658c0c00de0d4", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "0a1d8846d20526c1", "scanner": "scanner-primary", "fingerprint": "e4f658c0c00de0d4", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/pages.yml"}, "region": {"startLine": 109}}}]}, {"ruleId": "scanner-e4f658c0c00de0d4", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "c3a025732f0cb3e2", "scanner": "scanner-primary", "fingerprint": "e4f658c0c00de0d4", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/pages.yml"}, "region": {"startLine": 127}}}]}, {"ruleId": "scanner-448d8837178ae57a", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "13af6451e15656fc", "scanner": "scanner-primary", "fingerprint": "448d8837178ae57a", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/pages.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-66e40d9d6cb55b2b", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "00dd699f591cffa6", "scanner": "scanner-primary", "fingerprint": "66e40d9d6cb55b2b", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/publish-packages.yml"}, "region": {"startLine": 58}}}]}, {"ruleId": "scanner-3295c3ff963f5b76", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "bfc1f26a78b1e54e", "scanner": "scanner-primary", "fingerprint": "3295c3ff963f5b76", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/publish-packages.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-1c36a91f58f18236", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "91ccbe93a34c3905", "scanner": "scanner-primary", "fingerprint": "1c36a91f58f18236", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/consumer-smoke.yml"}, "region": {"startLine": 31}}}]}, {"ruleId": "scanner-cb639d9a10a47b23", "level": "note", "message": {"text": "package.json defines install-time lifecycle scripts"}, "properties": {"repobilityId": "b86179956da3a4a8", "scanner": "scanner-primary", "fingerprint": "cb639d9a10a47b23", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "npm", "install-scripts"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-078718d853c0184c", "level": "note", "message": {"text": "package.json defines install-time lifecycle scripts"}, "properties": {"repobilityId": "ea08cadf10fdf6b2", "scanner": "scanner-primary", "fingerprint": "078718d853c0184c", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "npm", "install-scripts"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/demo-react-native/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-7ba7d1acbfea7848", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: apps/demo-svelte/package.json"}, "properties": {"repobilityId": "e678d4fba53a870e", "scanner": "scanner-primary", "fingerprint": "7ba7d1acbfea7848", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/demo-svelte/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-2336eb106e688ce5", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: apps/demo-react/package.json"}, "properties": {"repobilityId": "774670ae39c5bde0", "scanner": "scanner-primary", "fingerprint": "2336eb106e688ce5", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/demo-react/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-86012a9d81fac7a7", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: apps/demo-react-native/package.json"}, "properties": {"repobilityId": "5afce566241cf4ce", "scanner": "scanner-primary", "fingerprint": "86012a9d81fac7a7", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/demo-react-native/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c6fa5e71c3c6cbed", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: packages/react-native/package.json"}, "properties": {"repobilityId": "60afb18d01f64b96", "scanner": "scanner-primary", "fingerprint": "c6fa5e71c3c6cbed", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/react-native/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f75585e48a80a595", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: packages/react/package.json"}, "properties": {"repobilityId": "280ebcdfd6337c69", "scanner": "scanner-primary", "fingerprint": "f75585e48a80a595", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/react/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-09805ebcf52bce18", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: packages/web-component/package.json"}, "properties": {"repobilityId": "d36b4095e0fa5b75", "scanner": "scanner-primary", "fingerprint": "09805ebcf52bce18", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/web-component/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f06af79d597da549", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: packages/vue/package.json"}, "properties": {"repobilityId": "e73f25a308dc0748", "scanner": "scanner-primary", "fingerprint": "f06af79d597da549", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/vue/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-28e92806c0db3cd2", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: packages/core/package.json"}, "properties": {"repobilityId": "8640e46be7e3f9b2", "scanner": "scanner-primary", "fingerprint": "28e92806c0db3cd2", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/core/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-88bf2119d59ddfdb", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: packages/svelte/package.json"}, "properties": {"repobilityId": "f703cf46837bb041", "scanner": "scanner-primary", "fingerprint": "88bf2119d59ddfdb", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/svelte/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-2e8d9805464f763d", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: packages/angular/package.json"}, "properties": {"repobilityId": "489b29049a3ec3c4", "scanner": "scanner-primary", "fingerprint": "2e8d9805464f763d", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/angular/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-41b506d0bdfc3632", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: examples/02-custom-playlist/package.json"}, "properties": {"repobilityId": "49f26e5b040e700d", "scanner": "scanner-primary", "fingerprint": "41b506d0bdfc3632", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "examples/02-custom-playlist/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c4fa9a0b40a3a4e1", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: examples/01-vite-spa/package.json"}, "properties": {"repobilityId": "6038e80903e27c9a", "scanner": "scanner-primary", "fingerprint": "c4fa9a0b40a3a4e1", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "examples/01-vite-spa/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-acd880b45bfe4466", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: examples/03-event-subscriptions/package.json"}, "properties": {"repobilityId": "71cf84b58ef419d0", "scanner": "scanner-primary", "fingerprint": "acd880b45bfe4466", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "examples/03-event-subscriptions/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "5cece2e402a92f57", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-749d4bc1bd66df5f", "level": "warning", "message": {"text": "Agent instructions exist but release-hardening basics are missing"}, "properties": {"repobilityId": "2ca9f746c6c17a21", "scanner": "scanner-primary", "fingerprint": "749d4bc1bd66df5f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "64b4ddc2d6228b99", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "eda18710e5dd9b75", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-3f8d5ac2c066841e", "level": "none", "message": {"text": "Commented-code block (5 lines) in playwright.config.ts:26"}, "properties": {"repobilityId": "9fd54253fb4b1dc4", "scanner": "scanner-primary", "fingerprint": "3f8d5ac2c066841e", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-e0c6747282bc054b", "level": "none", "message": {"text": "Commented-code block (5 lines) in .eslintrc.cjs:67"}, "properties": {"repobilityId": "d4882e00b7a745c5", "scanner": "scanner-primary", "fingerprint": "e0c6747282bc054b", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-03dfffd59da856dd", "level": "none", "message": {"text": "Commented-code block (7 lines) in vitest.config.ts:16"}, "properties": {"repobilityId": "c25bb03180d1dfd8", "scanner": "scanner-primary", "fingerprint": "03dfffd59da856dd", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-5c5a49c85fc85d8c", "level": "none", "message": {"text": "Commented-code block (6 lines) in tests/visual/a11y.spec.ts:44"}, "properties": {"repobilityId": "77e67df432c3bdbc", "scanner": "scanner-primary", "fingerprint": "5c5a49c85fc85d8c", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-2eebc24033ef6e21", "level": "none", "message": {"text": "Commented-code block (6 lines) in tests/visual/pages-live.spec.ts:49"}, "properties": {"repobilityId": "0becbb8e57bd3845", "scanner": "scanner-primary", "fingerprint": "2eebc24033ef6e21", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-dbc64ce0c2312b0c", "level": "none", "message": {"text": "Commented-code block (7 lines) in scripts/registry-guard.mjs:47"}, "properties": {"repobilityId": "66a17486c73ae778", "scanner": "scanner-primary", "fingerprint": "dbc64ce0c2312b0c", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-e6b196f0c3d4835a", "level": "none", "message": {"text": "Commented-code block (6 lines) in scripts/generate-player-shells.mjs:87"}, "properties": {"repobilityId": "39dd3d774354016a", "scanner": "scanner-primary", "fingerprint": "e6b196f0c3d4835a", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-1a767a4f856ac001", "level": "none", "message": {"text": "Commented-code block (7 lines) in scripts/setup-demo-audio.mjs:77"}, "properties": {"repobilityId": "b8673d6fef80aac4", "scanner": "scanner-primary", "fingerprint": "1a767a4f856ac001", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-c0b1cc3134faeb5a", "level": "none", "message": {"text": "Commented-code block (5 lines) in packages/react/src/index.ts:23"}, "properties": {"repobilityId": "2bd490e6c15aa760", "scanner": "scanner-primary", "fingerprint": "c0b1cc3134faeb5a", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-0bfe16f55fd32f79", "level": "none", "message": {"text": "Commented-code block (5 lines) in packages/web-component/tests/elements.test.ts:26"}, "properties": {"repobilityId": "1f31c9dd751ef35c", "scanner": "scanner-primary", "fingerprint": "0bfe16f55fd32f79", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-c00069abba49d21a", "level": "none", "message": {"text": "Commented-code block (6 lines) in packages/web-component/src/PulsePlayer.ts:117"}, "properties": {"repobilityId": "856a6052aedab900", "scanner": "scanner-primary", "fingerprint": "c00069abba49d21a", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-86736ae8b4360a36", "level": "none", "message": {"text": "Commented-code block (7 lines) in packages/web-component/src/PulseFab.ts:177"}, "properties": {"repobilityId": "c46f2be2741c0478", "scanner": "scanner-primary", "fingerprint": "86736ae8b4360a36", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-90666d1d6afd375d", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/main.ts:15"}, "properties": {"repobilityId": "be09dd0894dc007d", "scanner": "scanner-primary", "fingerprint": "90666d1d6afd375d", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-53a205a900d2c894", "level": "none", "message": {"text": "Commented-code block (6 lines) in src/composables/useDemoSpotlight.ts:117"}, "properties": {"repobilityId": "d7602b07858e925e", "scanner": "scanner-primary", "fingerprint": "53a205a900d2c894", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-e5659a791b15a6af", "level": "none", "message": {"text": "Commented-code block (7 lines) in src/composables/useAdvancedMotion.ts:31"}, "properties": {"repobilityId": "11894751d730f4a6", "scanner": "scanner-primary", "fingerprint": "e5659a791b15a6af", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-bcb1574f986b5eb0", "level": "none", "message": {"text": "Commented-code block (6 lines) in src/composables/useDemoTour.ts:104"}, "properties": {"repobilityId": "228e1cb18d7f7b6f", "scanner": "scanner-primary", "fingerprint": "bcb1574f986b5eb0", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-40b39ca5023d8fa8", "level": "none", "message": {"text": "Commented-code block (6 lines) in src/composables/usePremiumMotion.ts:156"}, "properties": {"repobilityId": "3f178d3e38e5f089", "scanner": "scanner-primary", "fingerprint": "40b39ca5023d8fa8", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-30f551a5fc0a7887", "level": "none", "message": {"text": "Commented-code block (6 lines) in src/lib/useAudioStore.ts:141"}, "properties": {"repobilityId": "1aed0a96fbdd0076", "scanner": "scanner-primary", "fingerprint": "30f551a5fc0a7887", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}]}]}