{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-67d60095cb9cea10", "name": "Stray `console.log` in TS/JS \u2014 assets/custom-date-picker.js:188", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 assets/custom-date-picker.js:188"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5b4538ef8e6c5821", "name": "Stray `console.log` in TS/JS \u2014 assets/loop_bundle.js:436", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 assets/loop_bundle.js:436"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a0ee7d7fd72f59d3", "name": "Stray `console.log` in TS/JS \u2014 assets/embla.js:1", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 assets/embla.js:1"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ce82da52d8f28150", "name": "Stray `console.log` in TS/JS \u2014 assets/selling-plans-integration.js:297", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 assets/selling-plans-integration.js:297"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1c38163a176b801d", "name": "Stray `console.log` in TS/JS \u2014 assets/box-builder.js:898", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 assets/box-builder.js:898"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2e6017660a3175a0", "name": "Stray `console.log` in TS/JS \u2014 assets/upsell-modal.js:20", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 assets/upsell-modal.js:20"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e7cb403cf11ae45b", "name": "Insecure pattern 'cors_wildcard' in cloudflare/agent-discovery/README.md:38", "shortDescription": {"text": "Insecure pattern 'cors_wildcard' in cloudflare/agent-discovery/README.md:38"}, "fullDescription": {"text": "Found a known-risky pattern (cors_wildcard). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9cca21967c0fc12b", "name": "Insecure pattern 'cors_wildcard' in cloudflare/agent-discovery/src/lib.js:152", "shortDescription": {"text": "Insecure pattern 'cors_wildcard' in cloudflare/agent-discovery/src/lib.js:152"}, "fullDescription": {"text": "Found a known-risky pattern (cors_wildcard). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b22e059e60ffcf63", "name": "Insecure pattern 'direct_innerhtml_assignment' in assets/custom-date-picker.js:20", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in assets/custom-date-picker.js:20"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-fe2fa8095de20565", "name": "Insecure pattern 'direct_innerhtml_assignment' in assets/loop_bundle.js:604", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in assets/loop_bundle.js:604"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2cf54d2c3b622981", "name": "Insecure pattern 'direct_innerhtml_assignment' in assets/quick-order-list.js:126", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in assets/quick-order-list.js:126"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f00d3288826d03f8", "name": "Insecure pattern 'domparser_html_parse' in assets/quick-order-list.js:124", "shortDescription": {"text": "Insecure pattern 'domparser_html_parse' in assets/quick-order-list.js:124"}, "fullDescription": {"text": "Found a known-risky pattern (domparser_html_parse). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7f632e2df8a3fc88", "name": "Insecure pattern 'direct_innerhtml_assignment' in assets/cart-drawer.js:87", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in assets/cart-drawer.js:87"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-340eae6b1e3f9c62", "name": "Insecure pattern 'domparser_html_parse' in assets/cart-drawer.js:105", "shortDescription": {"text": "Insecure pattern 'domparser_html_parse' in assets/cart-drawer.js:105"}, "fullDescription": {"text": "Found a known-risky pattern (domparser_html_parse). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ba9a4d582ced3417", "name": "Insecure pattern 'direct_innerhtml_assignment' in assets/localization-form.js:165", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in assets/localization-form.js:165"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-270909aad566ccdf", "name": "Insecure pattern 'direct_innerhtml_assignment' in assets/recipient-form.js:142", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in assets/recipient-form.js:142"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1f525c328184e1a2", "name": "Insecure pattern 'direct_innerhtml_assignment' in assets/predictive-search.js:234", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in assets/predictive-search.js:234"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-83c68164b2ff59a0", "name": "Insecure pattern 'domparser_html_parse' in assets/predictive-search.js:192", "shortDescription": {"text": "Insecure pattern 'domparser_html_parse' in assets/predictive-search.js:192"}, "fullDescription": {"text": "Found a known-risky pattern (domparser_html_parse). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c02d16bdd534f3e6", "name": "Insecure pattern 'direct_innerhtml_assignment' in assets/cart-notification.js:41", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in assets/cart-notification.js:41"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-78ab133c06bcf02c", "name": "Insecure pattern 'domparser_html_parse' in assets/cart-notification.js:64", "shortDescription": {"text": "Insecure pattern 'domparser_html_parse' in assets/cart-notification.js:64"}, "fullDescription": {"text": "Found a known-risky pattern (domparser_html_parse). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7644abe43ef45b40", "name": "Insecure pattern 'direct_innerhtml_assignment' in assets/cart.js:78", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in assets/cart.js:78"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-415d047cf36b3d21", "name": "Insecure pattern 'domparser_html_parse' in assets/cart.js:59", "shortDescription": {"text": "Insecure pattern 'domparser_html_parse' in assets/cart.js:59"}, "fullDescription": {"text": "Found a known-risky pattern (domparser_html_parse). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ce1dde3ed68c841b", "name": "Insecure pattern 'direct_innerhtml_assignment' in assets/price-per-item.js:78", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in assets/price-per-item.js:78"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c01bce42faff7857", "name": "Insecure pattern 'direct_innerhtml_assignment' in assets/media-gallery.js:84", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in assets/media-gallery.js:84"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7ef275a7352c03da", "name": "Insecure pattern 'direct_innerhtml_assignment' in assets/facets.js:83", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in assets/facets.js:83"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c8dd3c902fb8d742", "name": "Insecure pattern 'direct_outerhtml_assignment' in assets/facets.js:203", "shortDescription": {"text": "Insecure pattern 'direct_outerhtml_assignment' in assets/facets.js:203"}, "fullDescription": {"text": "Found a known-risky pattern (direct_outerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b2160d654e9d5c38", "name": "Insecure pattern 'domparser_html_parse' in assets/facets.js:83", "shortDescription": {"text": "Insecure pattern 'domparser_html_parse' in assets/facets.js:83"}, "fullDescription": {"text": "Found a known-risky pattern (domparser_html_parse). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2fb65fbff07d934f", "name": "Insecure pattern 'direct_innerhtml_assignment' in assets/quick-add.js:13", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in assets/quick-add.js:13"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2c6da10222d549d4", "name": "Insecure pattern 'domparser_html_parse' in assets/quick-add.js:27", "shortDescription": {"text": "Insecure pattern 'domparser_html_parse' in assets/quick-add.js:27"}, "fullDescription": {"text": "Found a known-risky pattern (domparser_html_parse). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3faee74e4c2dd688", "name": "Insecure pattern 'direct_innerhtml_assignment' in assets/product-info.js:93", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in assets/product-info.js:93"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-478deac5fcb5834a", "name": "Insecure pattern 'domparser_html_parse' in assets/product-info.js:67", "shortDescription": {"text": "Insecure pattern 'domparser_html_parse' in assets/product-info.js:67"}, "fullDescription": {"text": "Found a known-risky pattern (domparser_html_parse). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8ec357daf876dfc1", "name": "Insecure pattern 'direct_innerhtml_assignment' in assets/selling-plans-integration.js:204", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in assets/selling-plans-integration.js:204"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-44b4d71fffb0fa7b", "name": "Insecure pattern 'direct_innerhtml_assignment' in assets/global.js:323", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in assets/global.js:323"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-aae59b97024c34fc", "name": "Insecure pattern 'domparser_html_parse' in assets/global.js:1128", "shortDescription": {"text": "Insecure pattern 'domparser_html_parse' in assets/global.js:1128"}, "fullDescription": {"text": "Found a known-risky pattern (domparser_html_parse). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-68b62290186dbc2b", "name": "Insecure pattern 'direct_innerhtml_assignment' in assets/pickup-availability.js:42", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in assets/pickup-availability.js:42"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7386aab1b58b2946", "name": "Insecure pattern 'domparser_html_parse' in assets/pickup-availability.js:25", "shortDescription": {"text": "Insecure pattern 'domparser_html_parse' in assets/pickup-availability.js:25"}, "fullDescription": {"text": "Found a known-risky pattern (domparser_html_parse). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b9da75961c39323a", "name": "Insecure pattern 'direct_innerhtml_assignment' in assets/box-builder.js:590", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in assets/box-builder.js:590"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-92335600b4937335", "name": "Insecure pattern 'direct_innerhtml_assignment' in assets/box-builder-facets.js:83", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in assets/box-builder-facets.js:83"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0b92064f950092a6", "name": "Insecure pattern 'direct_outerhtml_assignment' in assets/box-builder-facets.js:225", "shortDescription": {"text": "Insecure pattern 'direct_outerhtml_assignment' in assets/box-builder-facets.js:225"}, "fullDescription": {"text": "Found a known-risky pattern (direct_outerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4af860779aca7564", "name": "Insecure pattern 'domparser_html_parse' in assets/box-builder-facets.js:83", "shortDescription": {"text": "Insecure pattern 'domparser_html_parse' in assets/box-builder-facets.js:83"}, "fullDescription": {"text": "Found a known-risky pattern (domparser_html_parse). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1f9f15f365fc495c", "name": "Very large file: assets/box-builder.js (1473 lines)", "shortDescription": {"text": "Very large file: assets/box-builder.js (1473 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6893a6c8b0861585", "name": "Very low test-to-source ratio", "shortDescription": {"text": "Very low test-to-source ratio"}, "fullDescription": {"text": "2 test file(s) for 42 source file(s) (ratio 0.05). Consider adding integration or unit tests for critical paths."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-141b30a41e03817b", "name": "No license file detected", "shortDescription": {"text": "No license file detected"}, "fullDescription": {"text": "No LICENSE/COPYING/NOTICE file was found. Generated repositories often omit licensing, which blocks reuse and automated intake."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 9 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b9088664ace7f748", "name": "Composite production-readiness gap", "shortDescription": {"text": "Composite production-readiness gap"}, "fullDescription": {"text": "Multiple low-cost hardening controls are missing together: license, ci. Opus verification showed these co-occurring gaps are a better readiness signal than reading each flag in isolation."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-749d4bc1bd66df5f", "name": "Agent instructions exist but release-hardening basics are missing", "shortDescription": {"text": "Agent instructions exist but release-hardening basics are missing"}, "fullDescription": {"text": "AI-coder instruction files were found, but the repo is missing license, ci. Treat this as a contract gap: the agent is guided, but the generated output is not yet guarded by the controls that make it repeatable."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-bea357a6497a2d5d", "name": "Agent authority lacks a verifier contract: CLAUDE.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: CLAUDE.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-af18e8abc4b2dd99", "name": "`fetch()` without try/.catch or AbortSignal \u2014 cloudflare/agent-discovery/src/worker.js:74", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 cloudflare/agent-discovery/src/worker.js:74"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1d5e00eaf69c0d0b", "name": "`fetch()` without try/.catch or AbortSignal \u2014 assets/custom-date-picker.js:210", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 assets/custom-date-picker.js:210"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-92fc85ff99d35225", "name": "`fetch()` without try/.catch or AbortSignal \u2014 assets/loop_bundle.js:410", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 assets/loop_bundle.js:410"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-5db3deec98293282", "name": "`fetch()` without try/.catch or AbortSignal \u2014 assets/quick-order-list.js:238", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 assets/quick-order-list.js:238"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c7aee4c8acfc8225", "name": "Commented-code block (5 lines) in assets/webmcp.js:1", "shortDescription": {"text": "Commented-code block (5 lines) in assets/webmcp.js:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-a3517dafb45f5c1b", "name": "`fetch()` without try/.catch or AbortSignal \u2014 assets/webmcp.js:185", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 assets/webmcp.js:185"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a2f1e3f488c3856a", "name": "`fetch()` without try/.catch or AbortSignal \u2014 assets/predictive-search.js:179", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 assets/predictive-search.js:179"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4ab2081b4f47e989", "name": "`fetch()` without try/.catch or AbortSignal \u2014 assets/cart.js:56", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 assets/cart.js:56"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d7398e0570ef3a32", "name": "Legacy-named symbol `button__copy` in assets/share.js:26", "shortDescription": {"text": "Legacy-named symbol `button__copy` in assets/share.js:26"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2a52623031d42a0b", "name": "`fetch()` without try/.catch or AbortSignal \u2014 assets/facets.js:62", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 assets/facets.js:62"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1bea0fe1d317a414", "name": "`fetch()` without try/.catch or AbortSignal \u2014 assets/quick-add.js:24", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 assets/quick-add.js:24"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b33c402d4d8e1377", "name": "`fetch()` without try/.catch or AbortSignal \u2014 assets/product-info.js:62", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 assets/product-info.js:62"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4901a6cefb6241a5", "name": "`fetch()` without try/.catch or AbortSignal \u2014 assets/global.js:1119", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 assets/global.js:1119"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9c0664b6b07c3cfc", "name": "Commented-code block (6 lines) in assets/box-builder.js:747", "shortDescription": {"text": "Commented-code block (6 lines) in assets/box-builder.js:747"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-3191aa2d4f953c64", "name": "`fetch()` without try/.catch or AbortSignal \u2014 assets/box-builder.js:912", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 assets/box-builder.js:912"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-057486ea44c09d18", "name": "Commented-code block (16 lines) in assets/upsell-modal.js:21", "shortDescription": {"text": "Commented-code block (16 lines) in assets/upsell-modal.js:21"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-9027602a49a848e4", "name": "`fetch()` without try/.catch or AbortSignal \u2014 assets/box-builder-facets.js:62", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 assets/box-builder-facets.js:62"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f4a829f25f19372f", "name": "`fetch()` without try/.catch or AbortSignal \u2014 assets/product-form.js:44", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 assets/product-form.js:44"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/24572"}, "properties": {"repository": "beyondjames/pots-for-tots-2", "repoUrl": "https://github.com/beyondjames/pots-for-tots-2", "branch": "main"}, "results": [{"ruleId": "scanner-67d60095cb9cea10", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 assets/custom-date-picker.js:188"}, "properties": {"repobilityId": "268d5a40e4a71114", "scanner": "scanner-primary", "fingerprint": "67d60095cb9cea10", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-5b4538ef8e6c5821", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 assets/loop_bundle.js:436"}, "properties": {"repobilityId": "312c3c881d930e31", "scanner": "scanner-primary", "fingerprint": "5b4538ef8e6c5821", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-a0ee7d7fd72f59d3", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 assets/embla.js:1"}, "properties": {"repobilityId": "5526085609d437a7", "scanner": "scanner-primary", "fingerprint": "a0ee7d7fd72f59d3", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-ce82da52d8f28150", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 assets/selling-plans-integration.js:297"}, "properties": {"repobilityId": "3cd7a37ccb80dd33", "scanner": "scanner-primary", "fingerprint": "ce82da52d8f28150", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-1c38163a176b801d", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 assets/box-builder.js:898"}, "properties": {"repobilityId": "adb8c3c9378233b7", "scanner": "scanner-primary", "fingerprint": "1c38163a176b801d", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-2e6017660a3175a0", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 assets/upsell-modal.js:20"}, "properties": {"repobilityId": "6c9cddd6e0e8bb33", "scanner": "scanner-primary", "fingerprint": "2e6017660a3175a0", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-e7cb403cf11ae45b", "level": "warning", "message": {"text": "Insecure pattern 'cors_wildcard' in cloudflare/agent-discovery/README.md:38"}, "properties": {"repobilityId": "53b76b4ec6cf06a3", "scanner": "scanner-primary", "fingerprint": "e7cb403cf11ae45b", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "cors_wildcard"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "cloudflare/agent-discovery/README.md"}, "region": {"startLine": 38}}}]}, {"ruleId": "scanner-9cca21967c0fc12b", "level": "warning", "message": {"text": "Insecure pattern 'cors_wildcard' in cloudflare/agent-discovery/src/lib.js:152"}, "properties": {"repobilityId": "27a2726a53dfe2d3", "scanner": "scanner-primary", "fingerprint": "9cca21967c0fc12b", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "cors_wildcard"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "cloudflare/agent-discovery/src/lib.js"}, "region": {"startLine": 152}}}]}, {"ruleId": "scanner-b22e059e60ffcf63", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in assets/custom-date-picker.js:20"}, "properties": {"repobilityId": "af425a996a0fb939", "scanner": "scanner-primary", "fingerprint": "b22e059e60ffcf63", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "assets/custom-date-picker.js"}, "region": {"startLine": 20}}}]}, {"ruleId": "scanner-fe2fa8095de20565", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in assets/loop_bundle.js:604"}, "properties": {"repobilityId": "ec387d9863d1865c", "scanner": "scanner-primary", "fingerprint": "fe2fa8095de20565", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "assets/loop_bundle.js"}, "region": {"startLine": 604}}}]}, {"ruleId": "scanner-2cf54d2c3b622981", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in assets/quick-order-list.js:126"}, "properties": {"repobilityId": "0556944c9a8cf781", "scanner": "scanner-primary", "fingerprint": "2cf54d2c3b622981", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "assets/quick-order-list.js"}, "region": {"startLine": 126}}}]}, {"ruleId": "scanner-f00d3288826d03f8", "level": "warning", "message": {"text": "Insecure pattern 'domparser_html_parse' in assets/quick-order-list.js:124"}, "properties": {"repobilityId": "79875a9f60553a78", "scanner": "scanner-primary", "fingerprint": "f00d3288826d03f8", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "domparser_html_parse"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "assets/quick-order-list.js"}, "region": {"startLine": 124}}}]}, {"ruleId": "scanner-7f632e2df8a3fc88", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in assets/cart-drawer.js:87"}, "properties": {"repobilityId": "731434e54a7ef077", "scanner": "scanner-primary", "fingerprint": "7f632e2df8a3fc88", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "assets/cart-drawer.js"}, "region": {"startLine": 87}}}]}, {"ruleId": "scanner-340eae6b1e3f9c62", "level": "warning", "message": {"text": "Insecure pattern 'domparser_html_parse' in assets/cart-drawer.js:105"}, "properties": {"repobilityId": "1d8ee15e37c8098b", "scanner": "scanner-primary", "fingerprint": "340eae6b1e3f9c62", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "domparser_html_parse"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "assets/cart-drawer.js"}, "region": {"startLine": 105}}}]}, {"ruleId": "scanner-ba9a4d582ced3417", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in assets/localization-form.js:165"}, "properties": {"repobilityId": "25a51031b95d4eb0", "scanner": "scanner-primary", "fingerprint": "ba9a4d582ced3417", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "assets/localization-form.js"}, "region": {"startLine": 165}}}]}, {"ruleId": "scanner-270909aad566ccdf", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in assets/recipient-form.js:142"}, "properties": {"repobilityId": "195b67c0bfe733a4", "scanner": "scanner-primary", "fingerprint": "270909aad566ccdf", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "assets/recipient-form.js"}, "region": {"startLine": 142}}}]}, {"ruleId": "scanner-1f525c328184e1a2", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in assets/predictive-search.js:234"}, "properties": {"repobilityId": "6708bc9312f0e7f8", "scanner": "scanner-primary", "fingerprint": "1f525c328184e1a2", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "assets/predictive-search.js"}, "region": {"startLine": 234}}}]}, {"ruleId": "scanner-83c68164b2ff59a0", "level": "warning", "message": {"text": "Insecure pattern 'domparser_html_parse' in assets/predictive-search.js:192"}, "properties": {"repobilityId": "ee789e6be0c85e2d", "scanner": "scanner-primary", "fingerprint": "83c68164b2ff59a0", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "domparser_html_parse"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "assets/predictive-search.js"}, "region": {"startLine": 192}}}]}, {"ruleId": "scanner-c02d16bdd534f3e6", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in assets/cart-notification.js:41"}, "properties": {"repobilityId": "49a039358a1f5ffc", "scanner": "scanner-primary", "fingerprint": "c02d16bdd534f3e6", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "assets/cart-notification.js"}, "region": {"startLine": 41}}}]}, {"ruleId": "scanner-78ab133c06bcf02c", "level": "warning", "message": {"text": "Insecure pattern 'domparser_html_parse' in assets/cart-notification.js:64"}, "properties": {"repobilityId": "d7d7f8e6898641c9", "scanner": "scanner-primary", "fingerprint": "78ab133c06bcf02c", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "domparser_html_parse"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "assets/cart-notification.js"}, "region": {"startLine": 64}}}]}, {"ruleId": "scanner-7644abe43ef45b40", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in assets/cart.js:78"}, "properties": {"repobilityId": "d7188ba648f1ce24", "scanner": "scanner-primary", "fingerprint": "7644abe43ef45b40", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "assets/cart.js"}, "region": {"startLine": 78}}}]}, {"ruleId": "scanner-415d047cf36b3d21", "level": "warning", "message": {"text": "Insecure pattern 'domparser_html_parse' in assets/cart.js:59"}, "properties": {"repobilityId": "033768e3beb3f5f3", "scanner": "scanner-primary", "fingerprint": "415d047cf36b3d21", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "domparser_html_parse"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "assets/cart.js"}, "region": {"startLine": 59}}}]}, {"ruleId": "scanner-ce1dde3ed68c841b", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in assets/price-per-item.js:78"}, "properties": {"repobilityId": "1cca1a4b83008331", "scanner": "scanner-primary", "fingerprint": "ce1dde3ed68c841b", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "assets/price-per-item.js"}, "region": {"startLine": 78}}}]}, {"ruleId": "scanner-c01bce42faff7857", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in assets/media-gallery.js:84"}, "properties": {"repobilityId": "72686857d685aca8", "scanner": "scanner-primary", "fingerprint": "c01bce42faff7857", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "assets/media-gallery.js"}, "region": {"startLine": 84}}}]}, {"ruleId": "scanner-7ef275a7352c03da", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in assets/facets.js:83"}, "properties": {"repobilityId": "34c68932f40ef47a", "scanner": "scanner-primary", "fingerprint": "7ef275a7352c03da", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "assets/facets.js"}, "region": {"startLine": 83}}}]}, {"ruleId": "scanner-c8dd3c902fb8d742", "level": "warning", "message": {"text": "Insecure pattern 'direct_outerhtml_assignment' in assets/facets.js:203"}, "properties": {"repobilityId": "72f2d88fc675f386", "scanner": "scanner-primary", "fingerprint": "c8dd3c902fb8d742", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_outerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "assets/facets.js"}, "region": {"startLine": 203}}}]}, {"ruleId": "scanner-b2160d654e9d5c38", "level": "warning", "message": {"text": "Insecure pattern 'domparser_html_parse' in assets/facets.js:83"}, "properties": {"repobilityId": "361cc643ae7afa44", "scanner": "scanner-primary", "fingerprint": "b2160d654e9d5c38", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "domparser_html_parse"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "assets/facets.js"}, "region": {"startLine": 83}}}]}, {"ruleId": "scanner-2fb65fbff07d934f", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in assets/quick-add.js:13"}, "properties": {"repobilityId": "713da56173431fbc", "scanner": "scanner-primary", "fingerprint": "2fb65fbff07d934f", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "assets/quick-add.js"}, "region": {"startLine": 13}}}]}, {"ruleId": "scanner-2c6da10222d549d4", "level": "warning", "message": {"text": "Insecure pattern 'domparser_html_parse' in assets/quick-add.js:27"}, "properties": {"repobilityId": "88f876198b854c07", "scanner": "scanner-primary", "fingerprint": "2c6da10222d549d4", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "domparser_html_parse"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "assets/quick-add.js"}, "region": {"startLine": 27}}}]}, {"ruleId": "scanner-3faee74e4c2dd688", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in assets/product-info.js:93"}, "properties": {"repobilityId": "e4d605613744bb91", "scanner": "scanner-primary", "fingerprint": "3faee74e4c2dd688", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "assets/product-info.js"}, "region": {"startLine": 93}}}]}, {"ruleId": "scanner-478deac5fcb5834a", "level": "warning", "message": {"text": "Insecure pattern 'domparser_html_parse' in assets/product-info.js:67"}, "properties": {"repobilityId": "28b62cccb024c6b6", "scanner": "scanner-primary", "fingerprint": "478deac5fcb5834a", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "domparser_html_parse"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "assets/product-info.js"}, "region": {"startLine": 67}}}]}, {"ruleId": "scanner-8ec357daf876dfc1", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in assets/selling-plans-integration.js:204"}, "properties": {"repobilityId": "2fc7b9d160f813d7", "scanner": "scanner-primary", "fingerprint": "8ec357daf876dfc1", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "assets/selling-plans-integration.js"}, "region": {"startLine": 204}}}]}, {"ruleId": "scanner-44b4d71fffb0fa7b", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in assets/global.js:323"}, "properties": {"repobilityId": "a39b6df1377013f0", "scanner": "scanner-primary", "fingerprint": "44b4d71fffb0fa7b", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "assets/global.js"}, "region": {"startLine": 323}}}]}, {"ruleId": "scanner-aae59b97024c34fc", "level": "warning", "message": {"text": "Insecure pattern 'domparser_html_parse' in assets/global.js:1128"}, "properties": {"repobilityId": "8842da31305d3bbb", "scanner": "scanner-primary", "fingerprint": "aae59b97024c34fc", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "domparser_html_parse"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "assets/global.js"}, "region": {"startLine": 1128}}}]}, {"ruleId": "scanner-68b62290186dbc2b", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in assets/pickup-availability.js:42"}, "properties": {"repobilityId": "f89e8b2f62f3af02", "scanner": "scanner-primary", "fingerprint": "68b62290186dbc2b", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "assets/pickup-availability.js"}, "region": {"startLine": 42}}}]}, {"ruleId": "scanner-7386aab1b58b2946", "level": "warning", "message": {"text": "Insecure pattern 'domparser_html_parse' in assets/pickup-availability.js:25"}, "properties": {"repobilityId": "7e89f0845ac26694", "scanner": "scanner-primary", "fingerprint": "7386aab1b58b2946", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "domparser_html_parse"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "assets/pickup-availability.js"}, "region": {"startLine": 25}}}]}, {"ruleId": "scanner-b9da75961c39323a", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in assets/box-builder.js:590"}, "properties": {"repobilityId": "b7ddda3cfe8b9d63", "scanner": "scanner-primary", "fingerprint": "b9da75961c39323a", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "assets/box-builder.js"}, "region": {"startLine": 590}}}]}, {"ruleId": "scanner-92335600b4937335", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in assets/box-builder-facets.js:83"}, "properties": {"repobilityId": "a7d4ea7f3510426b", "scanner": "scanner-primary", "fingerprint": "92335600b4937335", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "assets/box-builder-facets.js"}, "region": {"startLine": 83}}}]}, {"ruleId": "scanner-0b92064f950092a6", "level": "warning", "message": {"text": "Insecure pattern 'direct_outerhtml_assignment' in assets/box-builder-facets.js:225"}, "properties": {"repobilityId": "ac2153718bbf2c16", "scanner": "scanner-primary", "fingerprint": "0b92064f950092a6", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_outerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "assets/box-builder-facets.js"}, "region": {"startLine": 225}}}]}, {"ruleId": "scanner-4af860779aca7564", "level": "warning", "message": {"text": "Insecure pattern 'domparser_html_parse' in assets/box-builder-facets.js:83"}, "properties": {"repobilityId": "15ca814c9495ea73", "scanner": "scanner-primary", "fingerprint": "4af860779aca7564", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "domparser_html_parse"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "assets/box-builder-facets.js"}, "region": {"startLine": 83}}}]}, {"ruleId": "scanner-1f9f15f365fc495c", "level": "note", "message": {"text": "Very large file: assets/box-builder.js (1473 lines)"}, "properties": {"repobilityId": "496bb6467a6790fb", "scanner": "scanner-primary", "fingerprint": "1f9f15f365fc495c", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-6893a6c8b0861585", "level": "warning", "message": {"text": "Very low test-to-source ratio"}, "properties": {"repobilityId": "54a7de3f06314bf0", "scanner": "scanner-primary", "fingerprint": "6893a6c8b0861585", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["tests", "coverage"]}}, {"ruleId": "scanner-141b30a41e03817b", "level": "note", "message": {"text": "No license file detected"}, "properties": {"repobilityId": "1f91df7981a3e77e", "scanner": "scanner-primary", "fingerprint": "141b30a41e03817b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["license", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "7ef1303b4af4660b", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-b9088664ace7f748", "level": "note", "message": {"text": "Composite production-readiness gap"}, "properties": {"repobilityId": "3f965cd3f0a8a579", "scanner": "scanner-primary", "fingerprint": "b9088664ace7f748", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["production-readiness", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-749d4bc1bd66df5f", "level": "warning", "message": {"text": "Agent instructions exist but release-hardening basics are missing"}, "properties": {"repobilityId": "c89a7c66e15893f4", "scanner": "scanner-primary", "fingerprint": "749d4bc1bd66df5f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-bea357a6497a2d5d", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: CLAUDE.md"}, "properties": {"repobilityId": "aae72df3934829ac", "scanner": "scanner-primary", "fingerprint": "bea357a6497a2d5d", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "CLAUDE.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-af18e8abc4b2dd99", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 cloudflare/agent-discovery/src/worker.js:74"}, "properties": {"repobilityId": "5d3177a4c6472863", "scanner": "scanner-primary", "fingerprint": "af18e8abc4b2dd99", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-1d5e00eaf69c0d0b", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 assets/custom-date-picker.js:210"}, "properties": {"repobilityId": "1d341974de4efa6c", "scanner": "scanner-primary", "fingerprint": "1d5e00eaf69c0d0b", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-92fc85ff99d35225", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 assets/loop_bundle.js:410"}, "properties": {"repobilityId": "88836fa7ab3465c9", "scanner": "scanner-primary", "fingerprint": "92fc85ff99d35225", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-5db3deec98293282", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 assets/quick-order-list.js:238"}, "properties": {"repobilityId": "5ff142b03a821ebc", "scanner": "scanner-primary", "fingerprint": "5db3deec98293282", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-c7aee4c8acfc8225", "level": "none", "message": {"text": "Commented-code block (5 lines) in assets/webmcp.js:1"}, "properties": {"repobilityId": "b542650c6cffbec7", "scanner": "scanner-primary", "fingerprint": "c7aee4c8acfc8225", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-a3517dafb45f5c1b", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 assets/webmcp.js:185"}, "properties": {"repobilityId": "3efc23353e224904", "scanner": "scanner-primary", "fingerprint": "a3517dafb45f5c1b", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-a2f1e3f488c3856a", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 assets/predictive-search.js:179"}, "properties": {"repobilityId": "c8d0612e2473dfef", "scanner": "scanner-primary", "fingerprint": "a2f1e3f488c3856a", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-4ab2081b4f47e989", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 assets/cart.js:56"}, "properties": {"repobilityId": "b31b98abd732fc50", "scanner": "scanner-primary", "fingerprint": "4ab2081b4f47e989", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-d7398e0570ef3a32", "level": "note", "message": {"text": "Legacy-named symbol `button__copy` in assets/share.js:26"}, "properties": {"repobilityId": "db0e89914633b1a2", "scanner": "scanner-primary", "fingerprint": "d7398e0570ef3a32", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-2a52623031d42a0b", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 assets/facets.js:62"}, "properties": {"repobilityId": "f83db23294e3aa58", "scanner": "scanner-primary", "fingerprint": "2a52623031d42a0b", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-1bea0fe1d317a414", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 assets/quick-add.js:24"}, "properties": {"repobilityId": "a9a99eff44e34d1c", "scanner": "scanner-primary", "fingerprint": "1bea0fe1d317a414", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-b33c402d4d8e1377", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 assets/product-info.js:62"}, "properties": {"repobilityId": "f260d5c55288cf18", "scanner": "scanner-primary", "fingerprint": "b33c402d4d8e1377", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-4901a6cefb6241a5", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 assets/global.js:1119"}, "properties": {"repobilityId": "c9a9961d305e89fa", "scanner": "scanner-primary", "fingerprint": "4901a6cefb6241a5", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-9c0664b6b07c3cfc", "level": "none", "message": {"text": "Commented-code block (6 lines) in assets/box-builder.js:747"}, "properties": {"repobilityId": "32bba2e09c0a615f", "scanner": "scanner-primary", "fingerprint": "9c0664b6b07c3cfc", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-3191aa2d4f953c64", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 assets/box-builder.js:912"}, "properties": {"repobilityId": "72adfe2d5e7f369c", "scanner": "scanner-primary", "fingerprint": "3191aa2d4f953c64", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-057486ea44c09d18", "level": "none", "message": {"text": "Commented-code block (16 lines) in assets/upsell-modal.js:21"}, "properties": {"repobilityId": "c39041b629b1100e", "scanner": "scanner-primary", "fingerprint": "057486ea44c09d18", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-9027602a49a848e4", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 assets/box-builder-facets.js:62"}, "properties": {"repobilityId": "8ceee92c02b52383", "scanner": "scanner-primary", "fingerprint": "9027602a49a848e4", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-f4a829f25f19372f", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 assets/product-form.js:44"}, "properties": {"repobilityId": "35bc9b75208dbfdb", "scanner": "scanner-primary", "fingerprint": "f4a829f25f19372f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}]}]}