{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-811348297c1feb88", "name": "Stray `console.log` in TS/JS \u2014 resources/js/Pages/RequestForm/Components/AddForm.jsx:18", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 resources/js/Pages/RequestForm/Components/AddForm.jsx:18"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7b78d66ae9d3b8fb", "name": "`dangerouslySetInnerHTML` used in a React component \u2014 resources/js/Pages/Consultation/Show.jsx:263", "shortDescription": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 resources/js/Pages/Consultation/Show.jsx:263"}, "fullDescription": {"text": "Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library.\n\nWhy: OWASP basics. Already partially flagged by the security analyzer.\nRule id: fq.dangerous-html"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c6fb136a70311940", "name": "Stray `console.log` in TS/JS \u2014 resources/js/Pages/Patient/Add.jsx:36", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 resources/js/Pages/Patient/Add.jsx:36"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-93a997e811816375", "name": "Stray `console.log` in TS/JS \u2014 resources/js/Pages/Acceptance/Components/ConsultationForm.jsx:88", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 resources/js/Pages/Acceptance/Components/ConsultationForm.jsx:88"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7f47680ef8dfd2bc", "name": "`dangerouslySetInnerHTML` used in a React component \u2014 resources/js/Pages/Report/Show.jsx:368", "shortDescription": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 resources/js/Pages/Report/Show.jsx:368"}, "fullDescription": {"text": "Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library.\n\nWhy: OWASP basics. Already partially flagged by the security analyzer.\nRule id: fq.dangerous-html"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e40f01665c94013d", "name": "`dangerouslySetInnerHTML` used in a React component \u2014 resources/js/Pages/Report/Components/History.jsx:212", "shortDescription": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 resources/js/Pages/Report/Components/History.jsx:212"}, "fullDescription": {"text": "Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library.\n\nWhy: OWASP basics. Already partially flagged by the security analyzer.\nRule id: fq.dangerous-html"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-cb51d9428fa748ff", "name": "`dangerouslySetInnerHTML` used in a React component \u2014 resources/js/Pages/Setting/Index.jsx:73", "shortDescription": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 resources/js/Pages/Setting/Index.jsx:73"}, "fullDescription": {"text": "Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library.\n\nWhy: OWASP basics. Already partially flagged by the security analyzer.\nRule id: fq.dangerous-html"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-865a965854a4b1d8", "name": "Stray `console.log` in TS/JS \u2014 resources/js/Pages/ReferrerOrder/Index.jsx:143", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 resources/js/Pages/ReferrerOrder/Index.jsx:143"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9d5b2105cbad3b6c", "name": "Stray `console.log` in TS/JS \u2014 resources/js/Pages/ReferrerOrder/Components/Form.jsx:39", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 resources/js/Pages/ReferrerOrder/Components/Form.jsx:39"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3b8e32b393d147d3", "name": "Stray `console.log` in TS/JS \u2014 resources/js/Pages/Referrer/Components/ReferrerTestsTab.jsx:231", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 resources/js/Pages/Referrer/Components/ReferrerTestsTab.jsx:231"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1f0b4607df288c9f", "name": "Stray `console.log` in TS/JS \u2014 resources/js/Pages/Materials/Components/Filter.jsx:20", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 resources/js/Pages/Materials/Components/Filter.jsx:20"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0e2894d5ffd579ab", "name": "Stray `console.log` in TS/JS \u2014 resources/js/Components/Upload.jsx:340", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 resources/js/Components/Upload.jsx:340"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-018ed9e7bb7e55d4", "name": "React Flow <MiniMap> without dark background \u2014 resources/js/Components/Drawing.jsx:1990", "shortDescription": {"text": "React Flow <MiniMap> without dark background \u2014 resources/js/Components/Drawing.jsx:1990"}, "fullDescription": {"text": "A bare <MiniMap> renders with the vendor's white default in dark themes. Wrap the canvas in a class that overrides `.react-flow__minimap` background, or pass an explicit `style`/`maskColor`/`bgColor`.\n\nWhy: P1 in CHECKLIST.md \u2014 vendor defaults bleed light through.\nRule id: fq.minimap.no-bg"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0b67ccc8dcb9ec3e", "name": "React Flow <Controls> without dark theming \u2014 resources/js/Components/Drawing.jsx:1989", "shortDescription": {"text": "React Flow <Controls> without dark theming \u2014 resources/js/Components/Drawing.jsx:1989"}, "fullDescription": {"text": "`<Controls>` ships with white buttons. Override `.react-flow__controls` and `.react-flow__controls-button` in your stylesheet or pass a styled wrapper.\n\nWhy: P1 in CHECKLIST.md \u2014 vendor defaults bleed light through.\nRule id: fq.controls.no-bg"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-13664153d7a98f1e", "name": "`dangerouslySetInnerHTML` used in a React component \u2014 resources/js/Components/DOCXViewer.jsx:159", "shortDescription": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 resources/js/Components/DOCXViewer.jsx:159"}, "fullDescription": {"text": "Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library.\n\nWhy: OWASP basics. Already partially flagged by the security analyzer.\nRule id: fq.dangerous-html"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a335b6be64f84dda", "name": "Docker base image is tag-pinned but not digest-pinned: php:8.4-fpm-alpine", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: php:8.4-fpm-alpine"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d9f53d3a148e45b0", "name": "Docker base image is tag-pinned but not digest-pinned: php:8.4-alpine", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: php:8.4-alpine"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ab8be21e118d7027", "name": "Insecure pattern 'dangerous_innerhtml' in resources/js/Pages/Consultation/Show.jsx:263", "shortDescription": {"text": "Insecure pattern 'dangerous_innerhtml' in resources/js/Pages/Consultation/Show.jsx:263"}, "fullDescription": {"text": "Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3a119062acbfa486", "name": "Insecure pattern 'direct_innerhtml_assignment' in resources/js/Pages/Acceptance/Barcodes.jsx:302", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in resources/js/Pages/Acceptance/Barcodes.jsx:302"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-bf2a795653d152ed", "name": "Insecure pattern 'new_function_used' in resources/js/Pages/Test/Components/PricingConfig.jsx:94", "shortDescription": {"text": "Insecure pattern 'new_function_used' in resources/js/Pages/Test/Components/PricingConfig.jsx:94"}, "fullDescription": {"text": "Found a known-risky pattern (new_function_used). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-62b235873be24024", "name": "Possible secret in resources/js/Pages/User/Add.jsx", "shortDescription": {"text": "Possible secret in resources/js/Pages/User/Add.jsx"}, "fullDescription": {"text": "Detected pattern matching password_literal. Rotate the credential and move to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-8cdf7c35c6637daa", "name": "Insecure pattern 'dangerous_innerhtml' in resources/js/Pages/Report/Show.jsx:368", "shortDescription": {"text": "Insecure pattern 'dangerous_innerhtml' in resources/js/Pages/Report/Show.jsx:368"}, "fullDescription": {"text": "Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b718de13fe9e6a42", "name": "Insecure pattern 'dangerous_innerhtml' in resources/js/Pages/Report/Components/History.jsx:212", "shortDescription": {"text": "Insecure pattern 'dangerous_innerhtml' in resources/js/Pages/Report/Components/History.jsx:212"}, "fullDescription": {"text": "Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a41ef76fc4566569", "name": "Insecure pattern 'dangerous_innerhtml' in resources/js/Pages/Setting/Index.jsx:73", "shortDescription": {"text": "Insecure pattern 'dangerous_innerhtml' in resources/js/Pages/Setting/Index.jsx:73"}, "fullDescription": {"text": "Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-21bd1b4cee256cc4", "name": "Insecure pattern 'direct_innerhtml_assignment' in resources/js/Pages/Materials/Barcodes.jsx:279", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in resources/js/Pages/Materials/Barcodes.jsx:279"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-07ce1a7fb1914e7f", "name": "Insecure pattern 'dangerous_innerhtml' in resources/js/Components/DOCXViewer.jsx:159", "shortDescription": {"text": "Insecure pattern 'dangerous_innerhtml' in resources/js/Components/DOCXViewer.jsx:159"}, "fullDescription": {"text": "Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d56a6ac1bccf08c7", "name": "Insecure pattern 'new_function_used' in resources/js/Components/FormulaTester.jsx:133", "shortDescription": {"text": "Insecure pattern 'new_function_used' in resources/js/Components/FormulaTester.jsx:133"}, "fullDescription": {"text": "Found a known-risky pattern (new_function_used). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-fc8ff9de1a637988", "name": "Very large file: resources/js/Pages/Patient/Components/PatientForm.jsx (942 lines)", "shortDescription": {"text": "Very large file: resources/js/Pages/Patient/Components/PatientForm.jsx (942 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-804e4fc6e42dbc56", "name": "Very large file: resources/js/Pages/Acceptance/Components/AddTestOrPanel.jsx (1125 lines)", "shortDescription": {"text": "Very large file: resources/js/Pages/Acceptance/Components/AddTestOrPanel.jsx (1125 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ca49223494798360", "name": "Very large file: resources/js/Pages/Inventory/PurchaseRequests/Show.jsx (901 lines)", "shortDescription": {"text": "Very large file: resources/js/Pages/Inventory/PurchaseRequests/Show.jsx (901 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-088ba11ec1c10c7d", "name": "Very large file: resources/js/Pages/Import/Create.jsx (1356 lines)", "shortDescription": {"text": "Very large file: resources/js/Pages/Import/Create.jsx (1356 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ab6ec408a7652600", "name": "Very large file: resources/js/Pages/ReferrerOrder/Show.jsx (1231 lines)", "shortDescription": {"text": "Very large file: resources/js/Pages/ReferrerOrder/Show.jsx (1231 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-158f096daf0a1dcd", "name": "Very large file: resources/js/Components/Drawing.jsx (2046 lines)", "shortDescription": {"text": "Very large file: resources/js/Components/Drawing.jsx (2046 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6893a6c8b0861585", "name": "Very low test-to-source ratio", "shortDescription": {"text": "Very low test-to-source ratio"}, "fullDescription": {"text": "27 test file(s) for 342 source file(s) (ratio 0.08). Consider adding integration or unit tests for critical paths."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-141b30a41e03817b", "name": "No license file detected", "shortDescription": {"text": "No license file detected"}, "fullDescription": {"text": "No LICENSE/COPYING/NOTICE file was found. Generated repositories often omit licensing, which blocks reuse and automated intake."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 9 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-72b2a6250083a784", "name": "Placeholder or mock-heavy implementation detected", "shortDescription": {"text": "Placeholder or mock-heavy implementation detected"}, "fullDescription": {"text": "Found 154 placeholder/mock markers across 74 source files. This often means the repo looks complete while core flows still use generated scaffolding or fake data."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b9088664ace7f748", "name": "Composite production-readiness gap", "shortDescription": {"text": "Composite production-readiness gap"}, "fullDescription": {"text": "Multiple low-cost hardening controls are missing together: license, ci. Opus verification showed these co-occurring gaps are a better readiness signal than reading each flag in isolation."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c2a5a021758cb717", "name": "Commented-code block (5 lines) in resources/js/app.jsx:41", "shortDescription": {"text": "Commented-code block (5 lines) in resources/js/app.jsx:41"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-2d0f8442781d489d", "name": "`fetch()` without try/.catch or AbortSignal \u2014 resources/js/Pages/Monitoring/Nodes/Show.jsx:234", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 resources/js/Pages/Monitoring/Nodes/Show.jsx:234"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e31f29141be112ad", "name": "`fetch()` without try/.catch or AbortSignal \u2014 resources/js/Pages/Notification/Index.jsx:37", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 resources/js/Pages/Notification/Index.jsx:37"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-84a766a4dc7a46d8", "name": "`fetch()` without try/.catch or AbortSignal \u2014 resources/js/Layouts/Components/Notification.jsx:18", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 resources/js/Layouts/Components/Notification.jsx:18"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2eafc3188c36bb02", "name": "3 env vars used in code but missing from .env.example", "shortDescription": {"text": "3 env vars used in code but missing from .env.example"}, "fullDescription": {"text": "Drift between code and config docs. The first few: `NODE_ENV`, `VITE_HMR_CLIENT_PORT`, `VITE_HMR_HOST`. Add them (with a placeholder/comment) to .env.example so onboarding doesn't break."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/24340"}, "properties": {"repository": "arvni/lis", "repoUrl": "https://github.com/arvni/lis", "branch": "main"}, "results": [{"ruleId": "scanner-811348297c1feb88", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 resources/js/Pages/RequestForm/Components/AddForm.jsx:18"}, "properties": {"repobilityId": "21e253fe4f4eb3d3", "scanner": "scanner-primary", "fingerprint": "811348297c1feb88", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-7b78d66ae9d3b8fb", "level": "warning", "message": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 resources/js/Pages/Consultation/Show.jsx:263"}, "properties": {"repobilityId": "3333d55c2d7f495d", "scanner": "scanner-primary", "fingerprint": "7b78d66ae9d3b8fb", "layer": "frontend", "severity": "medium", "confidence": 1.0, "tags": ["frontend-quality", "fq.dangerous-html"]}}, {"ruleId": "scanner-c6fb136a70311940", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 resources/js/Pages/Patient/Add.jsx:36"}, "properties": {"repobilityId": "bcd7c93fd4356cfa", "scanner": "scanner-primary", "fingerprint": "c6fb136a70311940", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-93a997e811816375", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 resources/js/Pages/Acceptance/Components/ConsultationForm.jsx:88"}, "properties": {"repobilityId": "9034953399930739", "scanner": "scanner-primary", "fingerprint": "93a997e811816375", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-7f47680ef8dfd2bc", "level": "warning", "message": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 resources/js/Pages/Report/Show.jsx:368"}, "properties": {"repobilityId": "3a3c0680b470ef5a", "scanner": "scanner-primary", "fingerprint": "7f47680ef8dfd2bc", "layer": "frontend", "severity": "medium", "confidence": 1.0, "tags": ["frontend-quality", "fq.dangerous-html"]}}, {"ruleId": "scanner-e40f01665c94013d", "level": "warning", "message": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 resources/js/Pages/Report/Components/History.jsx:212"}, "properties": {"repobilityId": "e408163f76df874e", "scanner": "scanner-primary", "fingerprint": "e40f01665c94013d", "layer": "frontend", "severity": "medium", "confidence": 1.0, "tags": ["frontend-quality", "fq.dangerous-html"]}}, {"ruleId": "scanner-cb51d9428fa748ff", "level": "warning", "message": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 resources/js/Pages/Setting/Index.jsx:73"}, "properties": {"repobilityId": "3340d4116a8f6846", "scanner": "scanner-primary", "fingerprint": "cb51d9428fa748ff", "layer": "frontend", "severity": "medium", "confidence": 1.0, "tags": ["frontend-quality", "fq.dangerous-html"]}}, {"ruleId": "scanner-865a965854a4b1d8", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 resources/js/Pages/ReferrerOrder/Index.jsx:143"}, "properties": {"repobilityId": "deaef5e5637195aa", "scanner": "scanner-primary", "fingerprint": "865a965854a4b1d8", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-9d5b2105cbad3b6c", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 resources/js/Pages/ReferrerOrder/Components/Form.jsx:39"}, "properties": {"repobilityId": "57bea117244882fb", "scanner": "scanner-primary", "fingerprint": "9d5b2105cbad3b6c", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-3b8e32b393d147d3", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 resources/js/Pages/Referrer/Components/ReferrerTestsTab.jsx:231"}, "properties": {"repobilityId": "d2ce9d901026b2e7", "scanner": "scanner-primary", "fingerprint": "3b8e32b393d147d3", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-1f0b4607df288c9f", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 resources/js/Pages/Materials/Components/Filter.jsx:20"}, "properties": {"repobilityId": "eff51cbb6561b3c4", "scanner": "scanner-primary", "fingerprint": "1f0b4607df288c9f", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-0e2894d5ffd579ab", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 resources/js/Components/Upload.jsx:340"}, "properties": {"repobilityId": "47b822fd29e9594f", "scanner": "scanner-primary", "fingerprint": "0e2894d5ffd579ab", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-018ed9e7bb7e55d4", "level": "note", "message": {"text": "React Flow <MiniMap> without dark background \u2014 resources/js/Components/Drawing.jsx:1990"}, "properties": {"repobilityId": "1f0489edba193f62", "scanner": "scanner-primary", "fingerprint": "018ed9e7bb7e55d4", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.minimap.no-bg"]}}, {"ruleId": "scanner-0b67ccc8dcb9ec3e", "level": "note", "message": {"text": "React Flow <Controls> without dark theming \u2014 resources/js/Components/Drawing.jsx:1989"}, "properties": {"repobilityId": "61d974b8b6acbe5f", "scanner": "scanner-primary", "fingerprint": "0b67ccc8dcb9ec3e", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.controls.no-bg"]}}, {"ruleId": "scanner-13664153d7a98f1e", "level": "warning", "message": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 resources/js/Components/DOCXViewer.jsx:159"}, "properties": {"repobilityId": "ac56c28427e983d5", "scanner": "scanner-primary", "fingerprint": "13664153d7a98f1e", "layer": "frontend", "severity": "medium", "confidence": 1.0, "tags": ["frontend-quality", "fq.dangerous-html"]}}, {"ruleId": "scanner-a335b6be64f84dda", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: php:8.4-fpm-alpine"}, "properties": {"repobilityId": "334f8d3104a9ccba", "scanner": "scanner-primary", "fingerprint": "a335b6be64f84dda", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Dockerfile"}, "region": {"startLine": 4}}}]}, {"ruleId": "scanner-d9f53d3a148e45b0", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: php:8.4-alpine"}, "properties": {"repobilityId": "54df670c5ddd2309", "scanner": "scanner-primary", "fingerprint": "d9f53d3a148e45b0", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Dockerfile"}, "region": {"startLine": 73}}}]}, {"ruleId": "scanner-ab8be21e118d7027", "level": "warning", "message": {"text": "Insecure pattern 'dangerous_innerhtml' in resources/js/Pages/Consultation/Show.jsx:263"}, "properties": {"repobilityId": "4368e0a055f2e485", "scanner": "scanner-primary", "fingerprint": "ab8be21e118d7027", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "dangerous_innerhtml"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "resources/js/Pages/Consultation/Show.jsx"}, "region": {"startLine": 263}}}]}, {"ruleId": "scanner-3a119062acbfa486", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in resources/js/Pages/Acceptance/Barcodes.jsx:302"}, "properties": {"repobilityId": "eeedd7f704f6be50", "scanner": "scanner-primary", "fingerprint": "3a119062acbfa486", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "resources/js/Pages/Acceptance/Barcodes.jsx"}, "region": {"startLine": 302}}}]}, {"ruleId": "scanner-bf2a795653d152ed", "level": "error", "message": {"text": "Insecure pattern 'new_function_used' in resources/js/Pages/Test/Components/PricingConfig.jsx:94"}, "properties": {"repobilityId": "32a164cfd200a6b4", "scanner": "scanner-primary", "fingerprint": "bf2a795653d152ed", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "new_function_used"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "resources/js/Pages/Test/Components/PricingConfig.jsx"}, "region": {"startLine": 94}}}]}, {"ruleId": "scanner-62b235873be24024", "level": "error", "message": {"text": "Possible secret in resources/js/Pages/User/Add.jsx"}, "properties": {"repobilityId": "0b58b85da9ff29a0", "scanner": "scanner-primary", "fingerprint": "62b235873be24024", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "resources/js/Pages/User/Add.jsx"}, "region": {"startLine": 55}}}]}, {"ruleId": "scanner-8cdf7c35c6637daa", "level": "warning", "message": {"text": "Insecure pattern 'dangerous_innerhtml' in resources/js/Pages/Report/Show.jsx:368"}, "properties": {"repobilityId": "39287eff1b16172e", "scanner": "scanner-primary", "fingerprint": "8cdf7c35c6637daa", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "dangerous_innerhtml"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "resources/js/Pages/Report/Show.jsx"}, "region": {"startLine": 368}}}]}, {"ruleId": "scanner-b718de13fe9e6a42", "level": "warning", "message": {"text": "Insecure pattern 'dangerous_innerhtml' in resources/js/Pages/Report/Components/History.jsx:212"}, "properties": {"repobilityId": "8cc3eb29dcd4cd1e", "scanner": "scanner-primary", "fingerprint": "b718de13fe9e6a42", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "dangerous_innerhtml"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "resources/js/Pages/Report/Components/History.jsx"}, "region": {"startLine": 212}}}]}, {"ruleId": "scanner-a41ef76fc4566569", "level": "warning", "message": {"text": "Insecure pattern 'dangerous_innerhtml' in resources/js/Pages/Setting/Index.jsx:73"}, "properties": {"repobilityId": "d116be2b878f484a", "scanner": "scanner-primary", "fingerprint": "a41ef76fc4566569", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "dangerous_innerhtml"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "resources/js/Pages/Setting/Index.jsx"}, "region": {"startLine": 73}}}]}, {"ruleId": "scanner-21bd1b4cee256cc4", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in resources/js/Pages/Materials/Barcodes.jsx:279"}, "properties": {"repobilityId": "ff4ed327bd9c1a5a", "scanner": "scanner-primary", "fingerprint": "21bd1b4cee256cc4", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "resources/js/Pages/Materials/Barcodes.jsx"}, "region": {"startLine": 279}}}]}, {"ruleId": "scanner-07ce1a7fb1914e7f", "level": "warning", "message": {"text": "Insecure pattern 'dangerous_innerhtml' in resources/js/Components/DOCXViewer.jsx:159"}, "properties": {"repobilityId": "82dd9b089fac0aac", "scanner": "scanner-primary", "fingerprint": "07ce1a7fb1914e7f", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "dangerous_innerhtml"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "resources/js/Components/DOCXViewer.jsx"}, "region": {"startLine": 159}}}]}, {"ruleId": "scanner-d56a6ac1bccf08c7", "level": "error", "message": {"text": "Insecure pattern 'new_function_used' in resources/js/Components/FormulaTester.jsx:133"}, "properties": {"repobilityId": "24f3d1a0e9e89ea5", "scanner": "scanner-primary", "fingerprint": "d56a6ac1bccf08c7", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "new_function_used"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "resources/js/Components/FormulaTester.jsx"}, "region": {"startLine": 133}}}]}, {"ruleId": "scanner-fc8ff9de1a637988", "level": "note", "message": {"text": "Very large file: resources/js/Pages/Patient/Components/PatientForm.jsx (942 lines)"}, "properties": {"repobilityId": "71c357a15e88fe11", "scanner": "scanner-primary", "fingerprint": "fc8ff9de1a637988", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-804e4fc6e42dbc56", "level": "note", "message": {"text": "Very large file: resources/js/Pages/Acceptance/Components/AddTestOrPanel.jsx (1125 lines)"}, "properties": {"repobilityId": "4862e09d4f5b3e7c", "scanner": "scanner-primary", "fingerprint": "804e4fc6e42dbc56", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-ca49223494798360", "level": "note", "message": {"text": "Very large file: resources/js/Pages/Inventory/PurchaseRequests/Show.jsx (901 lines)"}, "properties": {"repobilityId": "b7e1fd3f43db976c", "scanner": "scanner-primary", "fingerprint": "ca49223494798360", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-088ba11ec1c10c7d", "level": "note", "message": {"text": "Very large file: resources/js/Pages/Import/Create.jsx (1356 lines)"}, "properties": {"repobilityId": "3ab8b9ee08506225", "scanner": "scanner-primary", "fingerprint": "088ba11ec1c10c7d", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-ab6ec408a7652600", "level": "note", "message": {"text": "Very large file: resources/js/Pages/ReferrerOrder/Show.jsx (1231 lines)"}, "properties": {"repobilityId": "941e8489cdbb1f7c", "scanner": "scanner-primary", "fingerprint": "ab6ec408a7652600", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-158f096daf0a1dcd", "level": "note", "message": {"text": "Very large file: resources/js/Components/Drawing.jsx (2046 lines)"}, "properties": {"repobilityId": "21c0f324c6c423b2", "scanner": "scanner-primary", "fingerprint": "158f096daf0a1dcd", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-6893a6c8b0861585", "level": "warning", "message": {"text": "Very low test-to-source ratio"}, "properties": {"repobilityId": "54a7de3f06314bf0", "scanner": "scanner-primary", "fingerprint": "6893a6c8b0861585", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["tests", "coverage"]}}, {"ruleId": "scanner-141b30a41e03817b", "level": "note", "message": {"text": "No license file detected"}, "properties": {"repobilityId": "00b1662316bd1b71", "scanner": "scanner-primary", "fingerprint": "141b30a41e03817b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["license", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "9a2b80b09c306060", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-72b2a6250083a784", "level": "warning", "message": {"text": "Placeholder or mock-heavy implementation detected"}, "properties": {"repobilityId": "07e76769ed376e05", "scanner": "scanner-primary", "fingerprint": "72b2a6250083a784", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "incomplete", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "b8e83fcffc223c9f", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-b9088664ace7f748", "level": "note", "message": {"text": "Composite production-readiness gap"}, "properties": {"repobilityId": "4671b73e92573aa5", "scanner": "scanner-primary", "fingerprint": "b9088664ace7f748", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["production-readiness", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-c2a5a021758cb717", "level": "none", "message": {"text": "Commented-code block (5 lines) in resources/js/app.jsx:41"}, "properties": {"repobilityId": "07ac676cdaf3d11f", "scanner": "scanner-primary", "fingerprint": "c2a5a021758cb717", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-2d0f8442781d489d", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 resources/js/Pages/Monitoring/Nodes/Show.jsx:234"}, "properties": {"repobilityId": "8bdf1b231cdb3b44", "scanner": "scanner-primary", "fingerprint": "2d0f8442781d489d", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-e31f29141be112ad", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 resources/js/Pages/Notification/Index.jsx:37"}, "properties": {"repobilityId": "aacc6509f4c299fc", "scanner": "scanner-primary", "fingerprint": "e31f29141be112ad", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-84a766a4dc7a46d8", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 resources/js/Layouts/Components/Notification.jsx:18"}, "properties": {"repobilityId": "b92245fff7c1e942", "scanner": "scanner-primary", "fingerprint": "84a766a4dc7a46d8", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-2eafc3188c36bb02", "level": "none", "message": {"text": "3 env vars used in code but missing from .env.example"}, "properties": {"repobilityId": "bd934ba112b02ffa", "scanner": "scanner-primary", "fingerprint": "2eafc3188c36bb02", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "config-drift"]}}]}]}