{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "JRN010", "name": "Critical user action appears to be handled by a no-op or placeholder", "shortDescription": {"text": "Critical user action appears to be handled by a no-op or placeholder"}, "fullDescription": {"text": "Human reports repeatedly found generated dashboards where buttons existed but only alerted, logged, threw not-implemented errors, or promised coming-soon behavior. This makes the UI look complete while the user journey cannot complete a real action."}, "properties": {"scanner": "repobility-journey-contract", "category": "quality", "severity": "medium", "confidence": 0.74, "cwe": "", "owasp": ""}}, {"id": "GHSA-hcf7-66rw-9f5r", "name": "turbo: GHSA-hcf7-66rw-9f5r", "shortDescription": {"text": "turbo: GHSA-hcf7-66rw-9f5r"}, "fullDescription": {"text": "Trubo: Login callback CSRF/session fixation"}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "medium", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "GHSA-qx2v-qp2m-jg93", "name": "postcss: GHSA-qx2v-qp2m-jg93", "shortDescription": {"text": "postcss: GHSA-qx2v-qp2m-jg93"}, "fullDescription": {"text": "PostCSS has XSS via Unescaped in its CSS Stringify Output"}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "medium", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "SEC045", "name": "[SEC045] eval()/exec() on stored or user-supplied data: eval() and exec() on data \u2014 even admin-stored data \u2014 is a latera", "shortDescription": {"text": "[SEC045] eval()/exec() on stored or user-supplied data: eval() and exec() on data \u2014 even admin-stored data \u2014 is a lateral-movement vector after any one credential compromise. Sandboxes (__builtins__ cleared) are escapable: attackers use obj"}, "fullDescription": {"text": "For literal data structures: use ast.literal_eval(text) \u2014 only parses literals, raises on code.\nFor formula evaluation: use asteval or simpleeval (purpose-built sandboxes with allow-lists).\nFor Odoo: use odoo.tools.safe_eval(expr, locals_dict, mode='exec').\nIf you genuinely need to execute admin-stored code: require explicit super-admin permission AND log every execution with a stack trace."}, "properties": {"scanner": "repobility-threat-engine", "category": "injection", "severity": "medium", "confidence": 1.0, "cwe": "", "owasp": ""}}, {"id": "MINED115", "name": "Action `oven-sh/setup-bun` pinned to mutable ref `@v2`", "shortDescription": {"text": "Action `oven-sh/setup-bun` pinned to mutable ref `@v2`"}, "fullDescription": {"text": "`uses: oven-sh/setup-bun@v2` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-actions/changed-files compromise (2025) instantly affect many repos. Treat official first-party action tags as lower risk, but pin security-sensitive third-party actions to a 40-char commit SHA + lock with Dependabot or renovate."}, "properties": {"scanner": "repobility-supply-chain", "category": "dependency", "severity": "medium", "confidence": 0.9, "cwe": "", "owasp": ""}}, {"id": "GHSA-3qcw-2rhx-2726", "name": "turbo: GHSA-3qcw-2rhx-2726", "shortDescription": {"text": "turbo: GHSA-3qcw-2rhx-2726"}, "fullDescription": {"text": "Turbo: Unexpected local code execution during Yarn Berry detection"}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "low", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "DEPCUR-NPM", "name": "npm package `yaml` is minor version(s) behind (^2.7.1 -> 2.9.0)", "shortDescription": {"text": "npm package `yaml` is minor version(s) behind (^2.7.1 -> 2.9.0)"}, "fullDescription": {"text": "`yaml` is pinned/resolved at ^2.7.1 but the latest stable release on the npm registry is 2.9.0 (minor version(s) behind). Outdated dependencies accumulate unpatched bugs and make future security upgrades harder. This is the version-currency signal Dependabot version-update PRs raise."}, "properties": {"scanner": "repobility-dependency-currency", "category": "dependency", "severity": "low", "confidence": 0.9, "cwe": "", "owasp": ""}}, {"id": "MINED054", "name": "[MINED054] Ts As Any: Casting to any (as any) bypasses type checking entirely.", "shortDescription": {"text": "[MINED054] Ts As Any: Casting to any (as any) bypasses type checking entirely."}, "fullDescription": {"text": "Review and fix per the pattern semantics. See CWE-704 / for context."}, "properties": {"scanner": "repobility-threat-engine", "category": "quality", "severity": "info", "confidence": 1.0, "cwe": "", "owasp": ""}}, {"id": "MINED045", "name": "[MINED045] Ts Non Null Assertion: x! asserts not null - bypasses null checks - TypeError if wrong.", "shortDescription": {"text": "[MINED045] Ts Non Null Assertion: x! asserts not null - bypasses null checks - TypeError if wrong."}, "fullDescription": {"text": "Review and fix per the pattern semantics. See CWE-476 / for context."}, "properties": {"scanner": "repobility-threat-engine", "category": "quality", "severity": "info", "confidence": 1.0, "cwe": "", "owasp": ""}}, {"id": "MINED052", "name": "[MINED052] Ts Any Typed: : any used as type annotation. Defeats TypeScript type safety.", "shortDescription": {"text": "[MINED052] Ts Any Typed: : any used as type annotation. Defeats TypeScript type safety."}, "fullDescription": {"text": "Review and fix per the pattern semantics. See CWE-704 / for context."}, "properties": {"scanner": "repobility-threat-engine", "category": "quality", "severity": "info", "confidence": 1.0, "cwe": "", "owasp": ""}}, {"id": "MINED044", "name": "[MINED044] Js Console Log Prod (and 3 more): Same pattern found in 3 additional files. Review if needed.", "shortDescription": {"text": "[MINED044] Js Console Log Prod (and 3 more): Same pattern found in 3 additional files. Review if needed."}, "fullDescription": {"text": "Review and fix per the pattern semantics. See CWE-532 / for context."}, "properties": {"scanner": "repobility-threat-engine", "category": "quality", "severity": "info", "confidence": 0.2, "cwe": "", "owasp": ""}}, {"id": "SEC040", "name": "[SEC040] innerHTML XSS \u2014 template literal with server-supplied data: Setting .innerHTML with a template literal that int", "shortDescription": {"text": "[SEC040] innerHTML XSS \u2014 template literal with server-supplied data: Setting .innerHTML with a template literal that interpolates server-supplied or user-supplied data is the canonical stored/reflected XSS vector. The browser parses the HTM"}, "fullDescription": {"text": "For plain text: use el.textContent = data.value (auto-escapes).\nFor HTML you need to render: el.innerHTML = DOMPurify.sanitize(html).\nFor React/Vue/Svelte: stop using innerHTML; use the framework's binding.\nWhen data comes from CV/PDF parsers, sanitize at the parser boundary too."}, "properties": {"scanner": "repobility-threat-engine", "category": "xss", "severity": "high", "confidence": 1.0, "cwe": "", "owasp": ""}}, {"id": "SEC085", "name": "[SEC085] JS: child_process.exec with non-literal: child_process.exec with user-derived input enables command injection. ", "shortDescription": {"text": "[SEC085] JS: child_process.exec with non-literal: child_process.exec with user-derived input enables command injection. Ported from eslint-plugin-security detect-child-process (Apache-2.0)."}, "fullDescription": {"text": "Use execFile / spawn with separate args array; never pass shell strings."}, "properties": {"scanner": "repobility-threat-engine", "category": "quality", "severity": "high", "confidence": 1.0, "cwe": "", "owasp": ""}}, {"id": "MINED035", "name": "[MINED035] Js New Function: new Function(...) compiles strings to functions.", "shortDescription": {"text": "[MINED035] Js New Function: new Function(...) compiles strings to functions."}, "fullDescription": {"text": "Review and fix per the pattern semantics. See CWE-95 / for context."}, "properties": {"scanner": "repobility-threat-engine", "category": "quality", "severity": "critical", "confidence": 1.0, "cwe": "", "owasp": ""}}, {"id": "scanner-a9c2a675a90ea227", "name": "Stray `console.log` in TS/JS \u2014 packages/cli/scripts/check-package.ts:40", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 packages/cli/scripts/check-package.ts:40"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d56b770cdb24cf7f", "name": "Stray `console.log` in TS/JS \u2014 packages/cli/src/commands/export.ts:65", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 packages/cli/src/commands/export.ts:65"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f7226cbd87867f68", "name": "Stray `console.log` in TS/JS \u2014 packages/cli/src/commands/diff.ts:72", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 packages/cli/src/commands/diff.ts:72"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c58cf3a341d1f7ff", "name": "Stray `console.log` in TS/JS \u2014 packages/cli/src/commands/lint.ts:45", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 packages/cli/src/commands/lint.ts:45"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-dfac166729a44da8", "name": "Stray `console.log` in TS/JS \u2014 packages/cli/src/commands/spec.ts:62", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 packages/cli/src/commands/spec.ts:62"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-20f9fd6caeb26d15", "name": "Stray `console.log` in TS/JS \u2014 packages/cli/src/linter/spec-gen/generate.ts:69", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 packages/cli/src/linter/spec-gen/generate.ts:69"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-da1f9b6e46ec5714", "name": "Stray `console.log` in TS/JS \u2014 packages/cli/src/linter/dtcg/conformance.test.ts:116", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 packages/cli/src/linter/dtcg/conformance.test.ts:116"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-206365f9e3e73d89", "name": "detect child process \u2014 packages/cli/scripts/check-package.ts:65", "shortDescription": {"text": "detect child process \u2014 packages/cli/scripts/check-package.ts:65"}, "fullDescription": {"text": "Detected calls to child_process from a function argument `cmd`. This could lead to a command injection if the input is user controllable. Try to avoid calls to child_process, and if it is needed ensure user input is correctly sanitized or sandboxed.\n\nRule: javascript.lang.security.detect-child-process.detect-child-process\nSeverity: ERROR\nOWASP: A01:2017 - Injection, A03:2021 - Injection, A05:2025 - Injection\nCWE: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')\nCategory: security"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-b405b003cc80bd4f", "name": "Insecure pattern 'node_child_process' in packages/cli/scripts/check-package.ts:27", "shortDescription": {"text": "Insecure pattern 'node_child_process' in packages/cli/scripts/check-package.ts:27"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b128da0ae20f9c72", "name": "Insecure pattern 'new_function_used' in packages/cli/src/linter/spec-gen/compiler.ts:32", "shortDescription": {"text": "Insecure pattern 'new_function_used' in packages/cli/src/linter/spec-gen/compiler.ts:32"}, "fullDescription": {"text": "Found a known-risky pattern (new_function_used). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-6c7266aef2adf711", "name": "Insecure pattern 'node_child_process' in packages/cli/src/linter/dtcg/conformance.test.ts:19", "shortDescription": {"text": "Insecure pattern 'node_child_process' in packages/cli/src/linter/dtcg/conformance.test.ts:19"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6372cebde0220094", "name": "No auth library detected", "shortDescription": {"text": "No auth library detected"}, "fullDescription": {"text": "The scanner did not find any standard auth library (JWT, OAuth, NextAuth, Auth0, etc.). The repo has auth/admin/session surface indicators, so auth may live in custom code, in a separate service, or be missing."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8c2e3196a4ef0cdd", "name": "Node manifest has dependencies but no lockfile: packages/cli/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: packages/cli/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 18 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-94a687093cfa4d22", "name": "Commented-code block (6 lines) in packages/cli/scripts/check-package.ts:112", "shortDescription": {"text": "Commented-code block (6 lines) in packages/cli/scripts/check-package.ts:112"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-bc587679bd5d9e06", "name": "Commented-code block (5 lines) in packages/cli/src/linter/linter/rules/orphaned-tokens.test.ts:38", "shortDescription": {"text": "Commented-code block (5 lines) in packages/cli/src/linter/linter/rules/orphaned-tokens.test.ts:38"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-29baf6bf1ccea6c1", "name": "Commented-code block (5 lines) in packages/cli/src/linter/model/handler.ts:186", "shortDescription": {"text": "Commented-code block (5 lines) in packages/cli/src/linter/model/handler.ts:186"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/30736"}, "properties": {"repository": "google-labs-code/design.md", "repoUrl": "https://github.com/google-labs-code/design.md.git", "branch": "main"}, "results": [{"ruleId": "JRN010", "level": "warning", "message": {"text": "Critical user action appears to be handled by a no-op or placeholder"}, "properties": {"repobilityId": 469780, "scanner": "repobility-journey-contract", "fingerprint": "a5bd9fb8d7a6231e574bf14ca1b6fc0d2589b1f1d79387dde91de02b851c9671", "category": "quality", "severity": "medium", "confidence": 0.74, "triageState": "open", "verdict": "likely", "isResolved": false, "reason": "Action wording appears near alert/console/not-implemented placeholder behavior without a nearby backend call.", "evidence": {"rule_id": "JRN010", "scanner": "repobility-journey-contract", "references": ["https://repobility.com/library/authorization/"], "correlation_key": "fp|a5bd9fb8d7a6231e574bf14ca1b6fc0d2589b1f1d79387dde91de02b851c9671"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/cli/scripts/check-package.ts"}, "region": {"startLine": 264}}}]}, {"ruleId": "JRN010", "level": "warning", "message": {"text": "Critical user action appears to be handled by a no-op or placeholder"}, "properties": {"repobilityId": 469779, "scanner": "repobility-journey-contract", "fingerprint": "483f838711be3ded2c3c9c3528745e2b6ff3bb75b0a351ac5ef6cd49cffb2d85", "category": "quality", "severity": "medium", "confidence": 0.74, "triageState": "open", "verdict": "likely", "isResolved": false, "reason": "Action wording appears near alert/console/not-implemented placeholder behavior without a nearby backend call.", "evidence": {"rule_id": "JRN010", "scanner": "repobility-journey-contract", "references": ["https://repobility.com/library/authorization/"], "correlation_key": "fp|483f838711be3ded2c3c9c3528745e2b6ff3bb75b0a351ac5ef6cd49cffb2d85"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/cli/scripts/check-package.ts"}, "region": {"startLine": 40}}}]}, {"ruleId": "GHSA-hcf7-66rw-9f5r", "level": "warning", "message": {"text": "turbo: GHSA-hcf7-66rw-9f5r"}, "properties": {"repobilityId": 469778, "scanner": "osv-scanner", "fingerprint": "2ffe150111b45121beb933245c88b3f5d0b49d7e138adf82688a7d89b41db70b", "category": "dependency", "severity": "medium", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["CVE-2026-45773"], "package": "turbo", "rule_id": "GHSA-hcf7-66rw-9f5r", "scanner": "osv-scanner", "correlation_key": "vuln|turbo|CVE-2026-45773|bun.lock"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "bun.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "GHSA-qx2v-qp2m-jg93", "level": "warning", "message": {"text": "postcss: GHSA-qx2v-qp2m-jg93"}, "properties": {"repobilityId": 469776, "scanner": "osv-scanner", "fingerprint": "304a3861bef956bd9546420c180c80c92e6c95a5065fe8ff3ad958143320f046", "category": "dependency", "severity": "medium", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["CVE-2026-41305"], "package": "postcss", "rule_id": "GHSA-qx2v-qp2m-jg93", "scanner": "osv-scanner", "correlation_key": "vuln|postcss|CVE-2026-41305|bun.lock"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "bun.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "SEC045", "level": "warning", "message": {"text": "[SEC045] eval()/exec() on stored or user-supplied data: eval() and exec() on data \u2014 even admin-stored data \u2014 is a lateral-movement vector after any one credential compromise. Sandboxes (__builtins__ cleared) are escapable: attackers use object introspection (().__class__.__mro__[-1].__subclasses__()) to reach os.system. CWE-95 (eval injection)."}, "properties": {"repobilityId": 469769, "scanner": "repobility-threat-engine", "fingerprint": "5ee6a8c057c0261835dd9aa251040fa8cc2190086b524933ebb6dc98b607bb94", "category": "injection", "severity": "medium", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": "new Function(", "reason": "Pattern matched with no mitigating context found", "rule_id": "SEC045", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "code|injection|token|32|sec045"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/cli/src/linter/spec-gen/compiler.ts"}, "region": {"startLine": 32}}}]}, {"ruleId": "SEC045", "level": "warning", "message": {"text": "[SEC045] eval()/exec() on stored or user-supplied data: eval() and exec() on data \u2014 even admin-stored data \u2014 is a lateral-movement vector after any one credential compromise. Sandboxes (__builtins__ cleared) are escapable: attackers use object introspection (().__class__.__mro__[-1].__subclasses__()) to reach os.system. CWE-95 (eval injection)."}, "properties": {"repobilityId": 469768, "scanner": "repobility-threat-engine", "fingerprint": "76da85c31ea95f80e5d0237a9fd4294ecd8bec5f3ca83a53063dedd080ceb3e2", "category": "injection", "severity": "medium", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": ".exec(", "reason": "Pattern matched with no mitigating context found", "rule_id": "SEC045", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "code|injection|token|129|sec045"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/cli/src/linter/lint.ts"}, "region": {"startLine": 129}}}]}, {"ruleId": "MINED115", "level": "warning", "message": {"text": "Action `oven-sh/setup-bun` pinned to mutable ref `@v2`"}, "properties": {"repobilityId": 469759, "scanner": "repobility-supply-chain", "fingerprint": "b0c02190795c359c96b59fd34574b52cff701479ab2f8907480c53c73807c3a4", "category": "dependency", "severity": "medium", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "gha-mutable-ref", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|b0c02190795c359c96b59fd34574b52cff701479ab2f8907480c53c73807c3a4"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/test.yml"}, "region": {"startLine": 29}}}]}, {"ruleId": "GHSA-3qcw-2rhx-2726", "level": "note", "message": {"text": "turbo: GHSA-3qcw-2rhx-2726"}, "properties": {"repobilityId": 469777, "scanner": "osv-scanner", "fingerprint": "ac81882cc88ddc2930b5c6424756bf686072ec99041af16c160e2a9b714459d8", "category": "dependency", "severity": "low", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["CVE-2026-45772"], "package": "turbo", "rule_id": "GHSA-3qcw-2rhx-2726", "scanner": "osv-scanner", "correlation_key": "vuln|turbo|CVE-2026-45772|bun.lock"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "bun.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "DEPCUR-NPM", "level": "note", "message": {"text": "npm package `yaml` is minor version(s) behind (^2.7.1 -> 2.9.0)"}, "properties": {"repobilityId": 469762, "scanner": "repobility-dependency-currency", "fingerprint": "e878f7648cda927430d8fd5d5a5b5c5e26f1131711d7edc61907f10d827fecc3", "category": "dependency", "severity": "low", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"gap": "minor version(s) behind", "signal": "currency", "cwe_ids": [], "package": "yaml", "scanner": "repobility-dependency-currency", "ecosystem": "npm", "languages": ["javascript"], "latest_version": "2.9.0", "correlation_key": "fp|e878f7648cda927430d8fd5d5a5b5c5e26f1131711d7edc61907f10d827fecc3", "current_version": "^2.7.1"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/cli/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "DEPCUR-NPM", "level": "note", "message": {"text": "npm package `citty` is minor version(s) behind (^0.1.6 -> 0.2.2)"}, "properties": {"repobilityId": 469761, "scanner": "repobility-dependency-currency", "fingerprint": "e797c4675fd575f6befa60e1e2a121fc57de196817a0e4203dc7ac932db5d371", "category": "dependency", "severity": "low", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"gap": "minor version(s) behind", "signal": "currency", "cwe_ids": [], "package": "citty", "scanner": "repobility-dependency-currency", "ecosystem": "npm", "languages": ["javascript"], "latest_version": "0.2.2", "correlation_key": "fp|e797c4675fd575f6befa60e1e2a121fc57de196817a0e4203dc7ac932db5d371", "current_version": "^0.1.6"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/cli/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "MINED115", "level": "note", "message": {"text": "Action `actions/setup-node` pinned to mutable ref `@v4`"}, "properties": {"repobilityId": 469760, "scanner": "repobility-supply-chain", "fingerprint": "668ecaa51c25fa2345b57347e7e8579e146c01c1238e2f463b3f70f0169f2762", "category": "dependency", "severity": "low", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "gha-mutable-ref", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|668ecaa51c25fa2345b57347e7e8579e146c01c1238e2f463b3f70f0169f2762"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/test.yml"}, "region": {"startLine": 61}}}]}, {"ruleId": "MINED115", "level": "note", "message": {"text": "Action `actions/checkout` pinned to mutable ref `@v6`"}, "properties": {"repobilityId": 469758, "scanner": "repobility-supply-chain", "fingerprint": "80e4dd0509a6a3a153cc0d8e49365d12d3c7f3608cbb576028b37bb6384c5c47", "category": "dependency", "severity": "low", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "gha-mutable-ref", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|80e4dd0509a6a3a153cc0d8e49365d12d3c7f3608cbb576028b37bb6384c5c47"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/test.yml"}, "region": {"startLine": 27}}}]}, {"ruleId": "MINED054", "level": "none", "message": {"text": "[MINED054] Ts As Any: Casting to any (as any) bypasses type checking entirely."}, "properties": {"repobilityId": 469774, "scanner": "repobility-threat-engine", "fingerprint": "8f8eb74090f9a24b2d01e3f12ef4151c9f6d27163c664bdceaa44f7217ecb928", "category": "quality", "severity": "info", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "ts-as-any", "owasp": null, "cwe_ids": ["CWE-704"], "languages": ["typescript", "tsx"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.348028+00:00", "triaged_in_corpus": 12, "observations_count": 341218, "ai_coder_pattern_id": 98}, "scanner": "repobility-threat-engine", "correlation_key": "fp|8f8eb74090f9a24b2d01e3f12ef4151c9f6d27163c664bdceaa44f7217ecb928"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/cli/src/linter/spec-gen/compiler.ts"}, "region": {"startLine": 31}}}]}, {"ruleId": "MINED045", "level": "none", "message": {"text": "[MINED045] Ts Non Null Assertion: x! asserts not null - bypasses null checks - TypeError if wrong."}, "properties": {"repobilityId": 469772, "scanner": "repobility-threat-engine", "fingerprint": "0c27fdc1768ea2e70249cd7cd52fb7d76aaf9dd413b51e5a541f9c8c2fbba254", "category": "quality", "severity": "info", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "ts-non-null-assertion", "owasp": null, "cwe_ids": ["CWE-476"], "languages": ["typescript", "tsx"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.348005+00:00", "triaged_in_corpus": 12, "observations_count": 1810954, "ai_coder_pattern_id": 105}, "scanner": "repobility-threat-engine", "correlation_key": "fp|0c27fdc1768ea2e70249cd7cd52fb7d76aaf9dd413b51e5a541f9c8c2fbba254"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/cli/src/linter/linter/rules/levenshtein.ts"}, "region": {"startLine": 24}}}]}, {"ruleId": "MINED045", "level": "none", "message": {"text": "[MINED045] Ts Non Null Assertion: x! asserts not null - bypasses null checks - TypeError if wrong."}, "properties": {"repobilityId": 469771, "scanner": "repobility-threat-engine", "fingerprint": "6047a45d4120fe1947103230ee47a080ecfb9aa7efeb80c695dc1546ef0f853e", "category": "quality", "severity": "info", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "ts-non-null-assertion", "owasp": null, "cwe_ids": ["CWE-476"], "languages": ["typescript", "tsx"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.348005+00:00", "triaged_in_corpus": 12, "observations_count": 1810954, "ai_coder_pattern_id": 105}, "scanner": "repobility-threat-engine", "correlation_key": "fp|6047a45d4120fe1947103230ee47a080ecfb9aa7efeb80c695dc1546ef0f853e"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/cli/src/linter/linter/rules/broken-ref.ts"}, "region": {"startLine": 35}}}]}, {"ruleId": "MINED052", "level": "none", "message": {"text": "[MINED052] Ts Any Typed: : any used as type annotation. Defeats TypeScript type safety."}, "properties": {"repobilityId": 469767, "scanner": "repobility-threat-engine", "fingerprint": "d13aad099f82505f1ec4ff9d30141eeabe8f7f418adc873773a0e3596312e8da", "category": "quality", "severity": "info", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "ts-any-typed", "owasp": null, "cwe_ids": ["CWE-704"], "languages": ["typescript", "tsx"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.348022+00:00", "triaged_in_corpus": 12, "observations_count": 496002, "ai_coder_pattern_id": 97}, "scanner": "repobility-threat-engine", "correlation_key": "fp|d13aad099f82505f1ec4ff9d30141eeabe8f7f418adc873773a0e3596312e8da"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/cli/src/commands/spec.ts"}, "region": {"startLine": 43}}}]}, {"ruleId": "MINED044", "level": "none", "message": {"text": "[MINED044] Js Console Log Prod (and 3 more): Same pattern found in 3 additional files. Review if needed."}, "properties": {"repobilityId": 469766, "scanner": "repobility-threat-engine", "fingerprint": "4b3d1f5da7bc76208217d4630f94b5c604a37c1b24cbe552082771023e8fad2d", "category": "quality", "severity": "info", "confidence": 0.2, "triageState": "false_positive", "verdict": "likely_fp", "isResolved": true, "reason": "Deduplicated summary only: 3 additional occurrences found. The top occurrences remain visible as actionable findings.", "evidence": {"mined": true, "mining": {"slug": "js-console-log-prod", "owasp": null, "cwe_ids": ["CWE-532"], "languages": ["javascript", "typescript", "tsx", "jsx"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.348003+00:00", "triaged_in_corpus": 10, "observations_count": 1940833, "ai_coder_pattern_id": 102}, "scanner": "repobility-threat-engine", "aggregated": true, "correlation_key": "fp|4b3d1f5da7bc76208217d4630f94b5c604a37c1b24cbe552082771023e8fad2d", "aggregated_count": 3}}}, {"ruleId": "MINED044", "level": "none", "message": {"text": "[MINED044] Js Console Log Prod: console.log left in code. Should be replaced with logger or removed."}, "properties": {"repobilityId": 469765, "scanner": "repobility-threat-engine", "fingerprint": "72fc636926d91a6881ce16cb2b484a9b0f44d2d979aa1531d163e52fc4d135ab", "category": "quality", "severity": "info", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "js-console-log-prod", "owasp": null, "cwe_ids": ["CWE-532"], "languages": ["javascript", "typescript", "tsx", "jsx"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.348003+00:00", "triaged_in_corpus": 10, "observations_count": 1940833, "ai_coder_pattern_id": 102}, "scanner": "repobility-threat-engine", "correlation_key": "fp|72fc636926d91a6881ce16cb2b484a9b0f44d2d979aa1531d163e52fc4d135ab"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/cli/src/commands/lint.ts"}, "region": {"startLine": 45}}}]}, {"ruleId": "MINED044", "level": "none", "message": {"text": "[MINED044] Js Console Log Prod: console.log left in code. Should be replaced with logger or removed."}, "properties": {"repobilityId": 469764, "scanner": "repobility-threat-engine", "fingerprint": "0bcee84de5e5e8a7c7d6da8a744bf1920f2a8905dbbdd611bf39db8a257fe1f9", "category": "quality", "severity": "info", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "js-console-log-prod", "owasp": null, "cwe_ids": ["CWE-532"], "languages": ["javascript", "typescript", "tsx", "jsx"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.348003+00:00", "triaged_in_corpus": 10, "observations_count": 1940833, "ai_coder_pattern_id": 102}, "scanner": "repobility-threat-engine", "correlation_key": "fp|0bcee84de5e5e8a7c7d6da8a744bf1920f2a8905dbbdd611bf39db8a257fe1f9"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/cli/src/commands/export.ts"}, "region": {"startLine": 45}}}]}, {"ruleId": "MINED044", "level": "none", "message": {"text": "[MINED044] Js Console Log Prod: console.log left in code. Should be replaced with logger or removed."}, "properties": {"repobilityId": 469763, "scanner": "repobility-threat-engine", "fingerprint": "595ff24c1481fd4602fd8d5d6b4e44728f3472fd32e01426259dbd17ce9fdb81", "category": "quality", "severity": "info", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "js-console-log-prod", "owasp": null, "cwe_ids": ["CWE-532"], "languages": ["javascript", "typescript", "tsx", "jsx"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.348003+00:00", "triaged_in_corpus": 10, "observations_count": 1940833, "ai_coder_pattern_id": 102}, "scanner": "repobility-threat-engine", "correlation_key": "fp|595ff24c1481fd4602fd8d5d6b4e44728f3472fd32e01426259dbd17ce9fdb81"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/cli/src/commands/diff.ts"}, "region": {"startLine": 72}}}]}, {"ruleId": "SEC040", "level": "error", "message": {"text": "[SEC040] innerHTML XSS \u2014 template literal with server-supplied data: Setting .innerHTML with a template literal that interpolates server-supplied or user-supplied data is the canonical stored/reflected XSS vector. The browser parses the HTML and executes any