{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-efefc407f89ec713", "name": "`truncate` class without `title=` for hover reveal \u2014 docs/src/LandingPage.tsx:283", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 docs/src/LandingPage.tsx:283"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-0f7d313208142e45", "name": "`truncate` class without `title=` for hover reveal \u2014 packages/plugin-graphql/src/components/SchemaSearch.tsx:61", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 packages/plugin-graphql/src/components/SchemaSearch.tsx:61"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-9be4e1110af9b240", "name": "`truncate` class without `title=` for hover reveal \u2014 packages/plugin-graphql/src/components/GraphQLWorkbench.tsx:333", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 packages/plugin-graphql/src/components/GraphQLWorkbench.tsx:333"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-94199dc6f9880037", "name": "`truncate` class without `title=` for hover reveal \u2014 packages/plugin-graphql/src/pages/TypeDetailPage.tsx:348", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 packages/plugin-graphql/src/pages/TypeDetailPage.tsx:348"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-56bfb19d0ea808b9", "name": "Stray `console.log` in TS/JS \u2014 packages/create-zudoku/create-app.ts:133", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 packages/create-zudoku/create-app.ts:133"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-93a595433f42feba", "name": "Stray `console.log` in TS/JS \u2014 packages/create-zudoku/index.ts:132", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 packages/create-zudoku/index.ts:132"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-84f982f385c5e6fd", "name": "Stray `console.log` in TS/JS \u2014 packages/create-zudoku/templates/index.ts:41", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 packages/create-zudoku/templates/index.ts:41"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-199c4ed5ad99935a", "name": "Stray `console.log` in TS/JS \u2014 packages/create-zudoku/helpers/is-folder-empty.ts:38", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 packages/create-zudoku/helpers/is-folder-empty.ts:38"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-653a53ebac8ab637", "name": "Stray `console.log` in TS/JS \u2014 packages/create-zudoku/helpers/install.ts:19", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 packages/create-zudoku/helpers/install.ts:19"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e4600a3754e14b14", "name": "Stray `console.log` in TS/JS \u2014 packages/zudoku/scripts/generate-publish-exports.ts:71", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 packages/zudoku/scripts/generate-publish-exports.ts:71"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-611fb8283ceb90a4", "name": "Stray `console.log` in TS/JS \u2014 packages/zudoku/scripts/generate-graphiql-sri.ts:38", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 packages/zudoku/scripts/generate-graphiql-sri.ts:38"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fb8cd32b69f6f186", "name": "TODO/FIXME marker in shipping code \u2014 packages/zudoku/src/zuplo/enrich-with-zuplo-mcp.ts:54", "shortDescription": {"text": "TODO/FIXME marker in shipping code \u2014 packages/zudoku/src/zuplo/enrich-with-zuplo-mcp.ts:54"}, "fullDescription": {"text": "Track in /reviews or /issues, not as a code comment that rots.\n\nWhy: Drift control \u2014 shouldn't be the same as Quality TODO scanner.\nRule id: fq.todo-marker"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-7bf105473e3f6070", "name": "Stray `console.log` in TS/JS \u2014 packages/zudoku/src/config/validators/ZudokuConfig.ts:814", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 packages/zudoku/src/config/validators/ZudokuConfig.ts:814"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-75d1d66ffb805f1b", "name": "Stray `console.log` in TS/JS \u2014 packages/zudoku/src/cli/common/output.ts:30", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 packages/zudoku/src/cli/common/output.ts:30"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3e7c79964ae82435", "name": "Stray `console.log` in TS/JS \u2014 packages/zudoku/src/cli/common/utils/box.ts:39", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 packages/zudoku/src/cli/common/utils/box.ts:39"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-64d82cc4800324d6", "name": "Stray `console.log` in TS/JS \u2014 packages/zudoku/src/cli/dev/handler.ts:65", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 packages/zudoku/src/cli/dev/handler.ts:65"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8615cb556fd44d1a", "name": "TODO/FIXME marker in shipping code \u2014 packages/zudoku/src/vite/plugin-auth.ts:22", "shortDescription": {"text": "TODO/FIXME marker in shipping code \u2014 packages/zudoku/src/vite/plugin-auth.ts:22"}, "fullDescription": {"text": "Track in /reviews or /issues, not as a code comment that rots.\n\nWhy: Drift control \u2014 shouldn't be the same as Quality TODO scanner.\nRule id: fq.todo-marker"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-8cddbc07dbdfc402", "name": "Stray `console.log` in TS/JS \u2014 packages/zudoku/src/vite/output.ts:225", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 packages/zudoku/src/vite/output.ts:225"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c5ea3f4e11140126", "name": "Stray `console.log` in TS/JS \u2014 packages/zudoku/src/vite/plugin-api.ts:95", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 packages/zudoku/src/vite/plugin-api.ts:95"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7792b5966d11c049", "name": "Stray `console.log` in TS/JS \u2014 packages/zudoku/src/vite/llms.ts:64", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 packages/zudoku/src/vite/llms.ts:64"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-24911e6e837eef35", "name": "Stray `console.log` in TS/JS \u2014 packages/zudoku/src/app/entry.client.tsx:50", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 packages/zudoku/src/app/entry.client.tsx:50"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-58d99547184793ef", "name": "TODO/FIXME marker in shipping code \u2014 packages/zudoku/src/lib/authentication/hook.ts:99", "shortDescription": {"text": "TODO/FIXME marker in shipping code \u2014 packages/zudoku/src/lib/authentication/hook.ts:99"}, "fullDescription": {"text": "Track in /reviews or /issues, not as a code comment that rots.\n\nWhy: Drift control \u2014 shouldn't be the same as Quality TODO scanner.\nRule id: fq.todo-marker"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-7718e762d5bd6493", "name": "`truncate` class without `title=` for hover reveal \u2014 packages/zudoku/src/lib/ui/Value.tsx:25", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 packages/zudoku/src/lib/ui/Value.tsx:25"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-4859e98700a2e468", "name": "`truncate` class without `title=` for hover reveal \u2014 packages/zudoku/src/lib/components/Pagination.tsx:30", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 packages/zudoku/src/lib/components/Pagination.tsx:30"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-93f715fbf45ddf23", "name": "`truncate` class without `title=` for hover reveal \u2014 packages/zudoku/src/lib/components/IdentitySelector.tsx:64", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 packages/zudoku/src/lib/components/IdentitySelector.tsx:64"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-03b3bb381b8ee976", "name": "`truncate` class without `title=` for hover reveal \u2014 packages/zudoku/src/lib/components/BrowserWindow.tsx:70", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 packages/zudoku/src/lib/components/BrowserWindow.tsx:70"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-7cc71cd07cbf8acf", "name": "`truncate` class without `title=` for hover reveal \u2014 packages/zudoku/src/lib/components/MultiSelect.tsx:42", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 packages/zudoku/src/lib/components/MultiSelect.tsx:42"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-62d9ac0c0799817c", "name": "`dangerouslySetInnerHTML` used in a React component \u2014 packages/zudoku/src/lib/components/Mermaid.tsx:67", "shortDescription": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 packages/zudoku/src/lib/components/Mermaid.tsx:67"}, "fullDescription": {"text": "Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library.\n\nWhy: OWASP basics. Already partially flagged by the security analyzer.\nRule id: fq.dangerous-html"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-05734be2b00ce00e", "name": "`truncate` class without `title=` for hover reveal \u2014 packages/zudoku/src/lib/components/navigation/NavigationFrames.tsx:", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 packages/zudoku/src/lib/components/navigation/NavigationFrames.tsx:87"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-1cf6e434181fd817", "name": "`truncate` class without `title=` for hover reveal \u2014 packages/zudoku/src/lib/components/navigation/NavigationCategory.ts", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 packages/zudoku/src/lib/components/navigation/NavigationCategory.tsx:139"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-b3ad1bfcab31086c", "name": "`truncate` class without `title=` for hover reveal \u2014 packages/zudoku/src/lib/components/navigation/StackRows.tsx:26", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 packages/zudoku/src/lib/components/navigation/StackRows.tsx:26"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-e607c84efd57628f", "name": "TODO/FIXME marker in shipping code \u2014 packages/zudoku/src/lib/plugins/api-keys/ProtectedRoute.tsx:9", "shortDescription": {"text": "TODO/FIXME marker in shipping code \u2014 packages/zudoku/src/lib/plugins/api-keys/ProtectedRoute.tsx:9"}, "fullDescription": {"text": "Track in /reviews or /issues, not as a code comment that rots.\n\nWhy: Drift control \u2014 shouldn't be the same as Quality TODO scanner.\nRule id: fq.todo-marker"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-bc04480f074ac0b6", "name": "`truncate` class without `title=` for hover reveal \u2014 packages/zudoku/src/lib/plugins/markdown/MdxPage.tsx:92", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 packages/zudoku/src/lib/plugins/markdown/MdxPage.tsx:92"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-f94a4b71d580ff89", "name": "`truncate` class without `title=` for hover reveal \u2014 packages/zudoku/src/lib/plugins/search-pagefind/IndexingDialog.tsx:", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 packages/zudoku/src/lib/plugins/search-pagefind/IndexingDialog.tsx:126"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-33e3bc498513b470", "name": "`dangerouslySetInnerHTML` used in a React component \u2014 packages/zudoku/src/lib/plugins/search-pagefind/ResultList.tsx:108", "shortDescription": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 packages/zudoku/src/lib/plugins/search-pagefind/ResultList.tsx:108"}, "fullDescription": {"text": "Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library.\n\nWhy: OWASP basics. Already partially flagged by the security analyzer.\nRule id: fq.dangerous-html"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8a8a4b2446d78ce0", "name": "`truncate` class without `title=` for hover reveal \u2014 packages/zudoku/src/lib/plugins/openapi/SchemaInfo.tsx:140", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 packages/zudoku/src/lib/plugins/openapi/SchemaInfo.tsx:140"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-05e51a51892b4f87", "name": "`truncate` class without `title=` for hover reveal \u2014 packages/zudoku/src/lib/plugins/openapi/Endpoint.tsx:63", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 packages/zudoku/src/lib/plugins/openapi/Endpoint.tsx:63"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-fe6e772a495ff01e", "name": "`truncate` class without `title=` for hover reveal \u2014 packages/zudoku/src/lib/plugins/openapi/OperationListItem.tsx:73", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 packages/zudoku/src/lib/plugins/openapi/OperationListItem.tsx:73"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-e6e2cd0ff24c62f5", "name": "`truncate` class without `title=` for hover reveal \u2014 packages/zudoku/src/lib/plugins/openapi/SidecarExamples.tsx:95", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 packages/zudoku/src/lib/plugins/openapi/SidecarExamples.tsx:95"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-8abd89c3b4f00df2", "name": "`truncate` class without `title=` for hover reveal \u2014 packages/zudoku/src/lib/plugins/openapi/Sidecar.tsx:376", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 packages/zudoku/src/lib/plugins/openapi/Sidecar.tsx:376"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-32f7864254eaf2b7", "name": "Stray `console.log` in TS/JS \u2014 packages/zudoku/src/lib/plugins/openapi/client/createServer.ts:33", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 packages/zudoku/src/lib/plugins/openapi/client/createServer.ts:33"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2ea5580fd2cb6259", "name": "TODO/FIXME marker in shipping code \u2014 examples/many-apis/download.js:13", "shortDescription": {"text": "TODO/FIXME marker in shipping code \u2014 examples/many-apis/download.js:13"}, "fullDescription": {"text": "Track in /reviews or /issues, not as a code comment that rots.\n\nWhy: Drift control \u2014 shouldn't be the same as Quality TODO scanner.\nRule id: fq.todo-marker"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-e14f6705d1d692b0", "name": "Insecure pattern 'node_child_process' in packages/create-zudoku/helpers/git.ts:1", "shortDescription": {"text": "Insecure pattern 'node_child_process' in packages/create-zudoku/helpers/git.ts:1"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-af80618028042e1e", "name": "Insecure pattern 'node_child_process' in packages/create-zudoku/helpers/is-online.ts:1", "shortDescription": {"text": "Insecure pattern 'node_child_process' in packages/create-zudoku/helpers/is-online.ts:1"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c444a219b88986d7", "name": "Insecure pattern 'node_child_process' in packages/zudoku/src/cli/common/machine-id/lib.ts:8", "shortDescription": {"text": "Insecure pattern 'node_child_process' in packages/zudoku/src/cli/common/machine-id/lib.ts:8"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-61b9ebf2883c2417", "name": "Insecure pattern 'node_child_process' in packages/zudoku/src/vite/mdx/remark-last-modified.ts:2", "shortDescription": {"text": "Insecure pattern 'node_child_process' in packages/zudoku/src/vite/mdx/remark-last-modified.ts:2"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2346cc3c961b8c3b", "name": "Insecure pattern 'direct_innerhtml_assignment' in packages/zudoku/src/lib/authentication/providers/clerk.test.tsx:10", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in packages/zudoku/src/lib/authentication/providers/clerk.test.tsx:10"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c87d7c49a2dcaf87", "name": "Insecure pattern 'local_storage_auth_token' in packages/zudoku/src/lib/authentication/providers/openid.test.ts:79", "shortDescription": {"text": "Insecure pattern 'local_storage_auth_token' in packages/zudoku/src/lib/authentication/providers/openid.test.ts:79"}, "fullDescription": {"text": "Found a known-risky pattern (local_storage_auth_token). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f7b48b2004e394a3", "name": "Insecure pattern 'dangerous_innerhtml' in packages/zudoku/src/lib/components/Mermaid.tsx:67", "shortDescription": {"text": "Insecure pattern 'dangerous_innerhtml' in packages/zudoku/src/lib/components/Mermaid.tsx:67"}, "fullDescription": {"text": "Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4554e4bf6f2e4056", "name": "Insecure pattern 'dangerous_innerhtml' in packages/zudoku/src/lib/plugins/search-pagefind/ResultList.tsx:108", "shortDescription": {"text": "Insecure pattern 'dangerous_innerhtml' in packages/zudoku/src/lib/plugins/search-pagefind/ResultList.tsx:108"}, "fullDescription": {"text": "Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b4c1620aecd8a426", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/setup-node@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-caab7a0e021ba38e", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9214c6df1cb2ff85", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/setup-node@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5c59bc92e4c8b327", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-83cfa31a4858f727", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/setup-node@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7b7b2ff13d8a34f0", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-cb639d9a10a47b23", "name": "package.json defines install-time lifecycle scripts", "shortDescription": {"text": "package.json defines install-time lifecycle scripts"}, "fullDescription": {"text": "preinstall/install/postinstall/prepare scripts execute during dependency installation. Review them carefully for network calls, obfuscation, shell execution, or credential access."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ea3b5e389d8c9c0f", "name": "Low test-to-source ratio", "shortDescription": {"text": "Low test-to-source ratio"}, "fullDescription": {"text": "134 tests / 705 src (ratio 0.19)."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b8fae141f052f3ab", "name": "Node manifest has dependencies but no lockfile: docs/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: docs/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c5a4ca9d846b65d0", "name": "Node manifest has dependencies but no lockfile: packages/plugin-search-algolia/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: packages/plugin-search-algolia/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-758032065bca55eb", "name": "Node manifest has dependencies but no lockfile: packages/plugin-graphql/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: packages/plugin-graphql/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-bd91d0f22430fc8b", "name": "Node manifest has dependencies but no lockfile: packages/create-zudoku/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: packages/create-zudoku/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-250137f599e48ce3", "name": "Node manifest has dependencies but no lockfile: packages/zudoku/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: packages/zudoku/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-12372603316f7790", "name": "Node manifest has dependencies but no lockfile: packages/plugin-zuplo-monetization/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: packages/plugin-zuplo-monetization/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1e043d0a33b613be", "name": "Node manifest has dependencies but no lockfile: examples/many-apis/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: examples/many-apis/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4161803148a2673d", "name": "Node manifest has dependencies but no lockfile: examples/search-algolia/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: examples/search-algolia/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2cf8e3bed898eb38", "name": "Node manifest has dependencies but no lockfile: examples/aws-lambda-ssr/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: examples/aws-lambda-ssr/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-57af807dee62400d", "name": "Node manifest has dependencies but no lockfile: examples/auth-supabase/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: examples/auth-supabase/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3394693e27b2da8b", "name": "Node manifest has dependencies but no lockfile: examples/api-identity-plugin/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: examples/api-identity-plugin/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3a2184771e970d74", "name": "Node manifest has dependencies but no lockfile: examples/with-openapi-json/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: examples/with-openapi-json/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-550a6628543245a3", "name": "Node manifest has dependencies but no lockfile: examples/graphql/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: examples/graphql/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6e1519dac884105d", "name": "Node manifest has dependencies but no lockfile: examples/mermaid/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: examples/mermaid/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c368f83e2758c3ee", "name": "Node manifest has dependencies but no lockfile: examples/with-auth0/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: examples/with-auth0/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-302cb9a8176c267e", "name": "Node manifest has dependencies but no lockfile: examples/zuplo-monetization/docs/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: examples/zuplo-monetization/docs/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-bac0c980cc314486", "name": "Node manifest has dependencies but no lockfile: examples/cloudflare-ssr/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: examples/cloudflare-ssr/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-eb6e4aa56df3a2af", "name": "Node manifest has dependencies but no lockfile: examples/with-vite-config/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: examples/with-vite-config/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-976ad13b055350ff", "name": "Node manifest has dependencies but no lockfile: examples/cosmo-cargo/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: examples/cosmo-cargo/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e3b121fd77357ca3", "name": "Node manifest has dependencies but no lockfile: examples/with-openapi-yaml/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: examples/with-openapi-yaml/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3d65eb8410dafb3a", "name": "Node manifest has dependencies but no lockfile: examples/with-base-path/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: examples/with-base-path/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-42c2f2957afd850e", "name": "Node manifest has dependencies but no lockfile: examples/auth-firebase/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: examples/auth-firebase/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-15f6e5b367f8d806", "name": "Node manifest has dependencies but no lockfile: examples/with-zuplo/docs/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: examples/with-zuplo/docs/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9b7d5360b0ba3e01", "name": "Node manifest has dependencies but no lockfile: examples/with-config/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: examples/with-config/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6b97fadb6719941b", "name": "Node manifest has dependencies but no lockfile: examples/api-key-service/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: examples/api-key-service/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 80 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-72b2a6250083a784", "name": "Placeholder or mock-heavy implementation detected", "shortDescription": {"text": "Placeholder or mock-heavy implementation detected"}, "fullDescription": {"text": "Found 62 placeholder/mock markers across 35 source files. This often means the repo looks complete while core flows still use generated scaffolding or fake data."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9d79c4077342a7d0", "name": "Runtime service client appears to use placeholder configuration", "shortDescription": {"text": "Runtime service client appears to use placeholder configuration"}, "fullDescription": {"text": "A runtime source file appears to wire Supabase/Firebase/AI/payment-style clients to placeholder URLs, keys, or fallback values. In the Fable corpus this often means the UI/API shape is present while the backend service is not actually configured."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-749d4bc1bd66df5f", "name": "Agent instructions exist but release-hardening basics are missing", "shortDescription": {"text": "Agent instructions exist but release-hardening basics are missing"}, "fullDescription": {"text": "AI-coder instruction files were found, but the repo is missing lockfile. Treat this as a contract gap: the agent is guided, but the generated output is not yet guarded by the controls that make it repeatable."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-0e31a11190c73fef", "name": "Commented-code block (7 lines) in docs/sidebar.ts:17", "shortDescription": {"text": "Commented-code block (7 lines) in docs/sidebar.ts:17"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-15410d8197b4b006", "name": "Legacy-named symbol `showDeprecated` in packages/plugin-graphql/src/interfaces.ts:4", "shortDescription": {"text": "Legacy-named symbol `showDeprecated` in packages/plugin-graphql/src/interfaces.ts:4"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1ff8ad5972bbca97", "name": "Legacy-named symbol `isDeprecated` in packages/plugin-graphql/src/util/generateOperation.ts:168", "shortDescription": {"text": "Legacy-named symbol `isDeprecated` in packages/plugin-graphql/src/util/generateOperation.ts:168"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f834bc88b81052aa", "name": "Legacy-named symbol `isDeprecated` in packages/plugin-graphql/src/components/FieldList.tsx:103", "shortDescription": {"text": "Legacy-named symbol `isDeprecated` in packages/plugin-graphql/src/components/FieldList.tsx:103"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4faa157332ba2b4f", "name": "Legacy-named symbol `isDeprecated` in packages/plugin-graphql/src/components/EnumValueList.tsx:24", "shortDescription": {"text": "Legacy-named symbol `isDeprecated` in packages/plugin-graphql/src/components/EnumValueList.tsx:24"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-58068c96b03fcab3", "name": "Legacy-named symbol `isDeprecated` in packages/plugin-graphql/src/components/ArgumentList.tsx:29", "shortDescription": {"text": "Legacy-named symbol `isDeprecated` in packages/plugin-graphql/src/components/ArgumentList.tsx:29"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6c7704cfcfcc96a0", "name": "Legacy-named symbol `isDeprecated` in packages/plugin-graphql/src/components/DetailPageHeader.tsx:11", "shortDescription": {"text": "Legacy-named symbol `isDeprecated` in packages/plugin-graphql/src/components/DetailPageHeader.tsx:11"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-03ff8d8e90801ae8", "name": "`fetch()` without try/.catch or AbortSignal \u2014 packages/plugin-graphql/src/components/GraphQLPlayground.tsx:77", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 packages/plugin-graphql/src/components/GraphQLPlayground.tsx:77"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9f03a6e65baa3f95", "name": "Legacy-named symbol `isDeprecated` in packages/plugin-graphql/src/pages/OperationPage.tsx:66", "shortDescription": {"text": "Legacy-named symbol `isDeprecated` in packages/plugin-graphql/src/pages/OperationPage.tsx:66"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d157d4fd58654b3a", "name": "Commented-code block (6 lines) in packages/create-zudoku/templates/zuplo/zudoku.config.tsx:1", "shortDescription": {"text": "Commented-code block (6 lines) in packages/create-zudoku/templates/zuplo/zudoku.config.tsx:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-72e925aff5bbf323", "name": "`fetch()` without try/.catch or AbortSignal \u2014 packages/create-zudoku/helpers/examples.ts:95", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 packages/create-zudoku/helpers/examples.ts:95"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0f689651821db968", "name": "`fetch()` without try/.catch or AbortSignal \u2014 packages/zudoku/scripts/generate-graphiql-sri.ts:15", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 packages/zudoku/scripts/generate-graphiql-sri.ts:15"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6b60e29c93ff1f8e", "name": "Commented-code block (5 lines) in packages/zudoku/src/config/loader.ts:247", "shortDescription": {"text": "Commented-code block (5 lines) in packages/zudoku/src/config/loader.ts:247"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-0c0194b4cd0b2b83", "name": "`fetch()` without try/.catch or AbortSignal \u2014 packages/zudoku/src/cli/common/outdated.ts:49", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 packages/zudoku/src/cli/common/outdated.ts:49"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-eb8f5720795ab690", "name": "Commented-code block (7 lines) in packages/zudoku/src/cli/common/analytics/lib.ts:39", "shortDescription": {"text": "Commented-code block (7 lines) in packages/zudoku/src/cli/common/analytics/lib.ts:39"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-b495a8a800d6dfd7", "name": "`fetch()` without try/.catch or AbortSignal \u2014 packages/zudoku/src/vite/shadcn-registry.ts:38", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 packages/zudoku/src/vite/shadcn-registry.ts:38"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f292f806fc2a5c0e", "name": "`fetch()` without try/.catch or AbortSignal \u2014 packages/zudoku/src/vite/dev-server.ts:180", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 packages/zudoku/src/vite/dev-server.ts:180"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-62baf5725863ec2b", "name": "Commented-code block (5 lines) in packages/zudoku/src/vite/mdx/remark-link-rewrite.ts:8", "shortDescription": {"text": "Commented-code block (5 lines) in packages/zudoku/src/vite/mdx/remark-link-rewrite.ts:8"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-b198aea3ca804bd0", "name": "`fetch()` without try/.catch or AbortSignal \u2014 packages/zudoku/src/app/adapters/cloudflare.ts:15", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 packages/zudoku/src/app/adapters/cloudflare.ts:15"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c75492ab0405cbc8", "name": "`fetch()` without try/.catch or AbortSignal \u2014 packages/zudoku/src/lib/authentication/session-handler.test.ts:52", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 packages/zudoku/src/lib/authentication/session-handler.test.ts:52"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1d52202a00069cfa", "name": "`fetch()` without try/.catch or AbortSignal \u2014 packages/zudoku/src/lib/authentication/cookie-sync.ts:40", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 packages/zudoku/src/lib/authentication/cookie-sync.ts:40"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-355f45d9b6f0843c", "name": "`fetch()` without try/.catch or AbortSignal \u2014 packages/zudoku/src/lib/authentication/providers/azureb2c.tsx:201", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 packages/zudoku/src/lib/authentication/providers/azureb2c.tsx:201"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-cf68ac07983306e4", "name": "Commented-code block (8 lines) in packages/zudoku/src/lib/util/joinUrl.test.ts:36", "shortDescription": {"text": "Commented-code block (8 lines) in packages/zudoku/src/lib/util/joinUrl.test.ts:36"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-80be0c7d4c152b03", "name": "`fetch()` without try/.catch or AbortSignal \u2014 packages/zudoku/src/lib/oas/graphql/security.test.ts:27", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 packages/zudoku/src/lib/oas/graphql/security.test.ts:27"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-fa585a8e60a73fd9", "name": "Commented-code block (5 lines) in packages/zudoku/src/lib/components/Markdown.tsx:16", "shortDescription": {"text": "Commented-code block (5 lines) in packages/zudoku/src/lib/components/Markdown.tsx:16"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-f26fefbaecd6cac7", "name": "Commented-code block (5 lines) in packages/zudoku/src/lib/components/navigation/NavigationFilterContext.tsx:18", "shortDescription": {"text": "Commented-code block (5 lines) in packages/zudoku/src/lib/components/navigation/NavigationFilterContext.tsx:18"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-3f98d9985881eb03", "name": "`fetch()` without try/.catch or AbortSignal \u2014 packages/zudoku/src/lib/hooks/useApiIdentitySelection.ts:41", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 packages/zudoku/src/lib/hooks/useApiIdentitySelection.ts:41"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-82f22f18a6fa7243", "name": "`fetch()` without try/.catch or AbortSignal \u2014 packages/zudoku/src/lib/plugins/api-keys/index.tsx:96", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 packages/zudoku/src/lib/plugins/api-keys/index.tsx:96"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2ddb19109719c25a", "name": "`fetch()` without try/.catch or AbortSignal \u2014 packages/zudoku/src/lib/plugins/markdown/MdxPage.tsx:216", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 packages/zudoku/src/lib/plugins/markdown/MdxPage.tsx:216"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2b3eb4480561fe63", "name": "`fetch()` without try/.catch or AbortSignal \u2014 packages/zudoku/src/lib/plugins/openapi/DownloadSchemaButton.tsx:77", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 packages/zudoku/src/lib/plugins/openapi/DownloadSchemaButton.tsx:77"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-83d61f75063660e2", "name": "`fetch()` without try/.catch or AbortSignal \u2014 packages/zudoku/src/lib/plugins/openapi/playground/GraphiQL.tsx:97", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 packages/zudoku/src/lib/plugins/openapi/playground/GraphiQL.tsx:97"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7227d469380c66c2", "name": "`fetch()` without try/.catch or AbortSignal \u2014 packages/zudoku/src/lib/plugins/openapi/client/useCreateQuery.ts:21", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 packages/zudoku/src/lib/plugins/openapi/client/useCreateQuery.ts:21"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-814c46fe585b5137", "name": "`fetch()` without try/.catch or AbortSignal \u2014 packages/zudoku/src/lib/plugins/openapi/client/GraphQLClient.tsx:45", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 packages/zudoku/src/lib/plugins/openapi/client/GraphQLClient.tsx:45"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0fd5ec87f91545e7", "name": "Legacy-named symbol `isDeprecated` in packages/zudoku/src/lib/plugins/openapi/schema/SchemaPropertyItem.tsx:45", "shortDescription": {"text": "Legacy-named symbol `isDeprecated` in packages/zudoku/src/lib/plugins/openapi/schema/SchemaPropertyItem.tsx:45"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8406a0b1e6b79f02", "name": "Legacy-named symbol `showDeprecated` in packages/zudoku/src/lib/plugins/openapi/schema/SchemaView.tsx:90", "shortDescription": {"text": "Legacy-named symbol `showDeprecated` in packages/zudoku/src/lib/plugins/openapi/schema/SchemaView.tsx:90"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3e2a70662f0ac65b", "name": "`fetch()` without try/.catch or AbortSignal \u2014 packages/plugin-zuplo-monetization/src/ZuploMonetizationWrapper.tsx:62", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 packages/plugin-zuplo-monetization/src/ZuploMonetizationWrapper.tsx:62"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d5947c2a46c8bf80", "name": "Commented-code block (6 lines) in packages/plugin-zuplo-monetization/src/utils/subscriptionEntitlements.test.ts:287", "shortDescription": {"text": "Commented-code block (6 lines) in packages/plugin-zuplo-monetization/src/utils/subscriptionEntitlements.test.ts:287"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-16ceaa877cb4f107", "name": "Commented-code block (5 lines) in packages/plugin-zuplo-monetization/src/utils/categorizeRateCards.ts:26", "shortDescription": {"text": "Commented-code block (5 lines) in packages/plugin-zuplo-monetization/src/utils/categorizeRateCards.ts:26"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-41cf7e4119303975", "name": "Commented-code block (8 lines) in packages/plugin-zuplo-monetization/src/utils/subscriptionEntitlements.ts:73", "shortDescription": {"text": "Commented-code block (8 lines) in packages/plugin-zuplo-monetization/src/utils/subscriptionEntitlements.ts:73"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-87dd61c76a72e004", "name": "Commented-code block (7 lines) in packages/plugin-zuplo-monetization/src/pages/components/PlanChangeCard.tsx:164", "shortDescription": {"text": "Commented-code block (7 lines) in packages/plugin-zuplo-monetization/src/pages/components/PlanChangeCard.tsx:164"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-781d4bd8e7460cb3", "name": "Commented-code block (5 lines) in packages/plugin-zuplo-monetization/src/pages/subscriptions/deriveUsageView.test.ts:5", "shortDescription": {"text": "Commented-code block (5 lines) in packages/plugin-zuplo-monetization/src/pages/subscriptions/deriveUsageView.test.ts:5"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-8893d8e38c15f76e", "name": "Commented-code block (21 lines) in packages/plugin-zuplo-monetization/src/pricing-ui/index.ts:4", "shortDescription": {"text": "Commented-code block (21 lines) in packages/plugin-zuplo-monetization/src/pricing-ui/index.ts:4"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-c125f31aac432be0", "name": "`fetch()` without try/.catch or AbortSignal \u2014 examples/many-apis/download.js:52", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 examples/many-apis/download.js:52"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-64bc033a45ab26f1", "name": "34 env vars used in code but missing from .env.example", "shortDescription": {"text": "34 env vars used in code but missing from .env.example"}, "fullDescription": {"text": "Drift between code and config docs. The first few: `BASE_URL`, `CI`, `COLUMNS`, `DEV`, `GITHUB_ACTIONS`, `HEADED`, `IS_ZUPLO`, `MODE` + 26 more. Add them (with a placeholder/comment) to .env.example so onboarding doesn't break."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1aa1fc38c830b8af", "name": "Dangling fetch: GET https://registry.npmjs.org/${packageName}/latest (packages/create-zudoku/helpers/get-latest-version.", "shortDescription": {"text": "Dangling fetch: GET https://registry.npmjs.org/${packageName}/latest (packages/create-zudoku/helpers/get-latest-version.ts:15)"}, "fullDescription": {"text": "`packages/create-zudoku/helpers/get-latest-version.ts:15` calls `GET https://registry.npmjs.org/${packageName}/latest` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/https:/registry.npmjs.org/<p>/latest`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-f49802c75a660244", "name": "Dangling fetch: GET /_protected/chunk.js (packages/zudoku/src/app/protectChunks.test.ts:20)", "shortDescription": {"text": "Dangling fetch: GET /_protected/chunk.js (packages/zudoku/src/app/protectChunks.test.ts:20)"}, "fullDescription": {"text": "`packages/zudoku/src/app/protectChunks.test.ts:20` calls `GET /_protected/chunk.js` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: helper:request\nNormalized path used for matching: `/_protected/chunk.js`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-737caa4d5a42f337", "name": "Dangling fetch: GET /_protected/chunk.js (packages/zudoku/src/app/protectChunks.test.ts:25)", "shortDescription": {"text": "Dangling fetch: GET /_protected/chunk.js (packages/zudoku/src/app/protectChunks.test.ts:25)"}, "fullDescription": {"text": "`packages/zudoku/src/app/protectChunks.test.ts:25` calls `GET /_protected/chunk.js` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: helper:request\nNormalized path used for matching: `/_protected/chunk.js`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-3b5305c29efd9c9f", "name": "Dangling fetch: GET /assets/foo.js (packages/zudoku/src/app/protectChunks.test.ts:33)", "shortDescription": {"text": "Dangling fetch: GET /assets/foo.js (packages/zudoku/src/app/protectChunks.test.ts:33)"}, "fullDescription": {"text": "`packages/zudoku/src/app/protectChunks.test.ts:33` calls `GET /assets/foo.js` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: helper:request\nNormalized path used for matching: `/assets/foo.js`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-1cc3654b5d4c6b4e", "name": "Dangling fetch: GET /docs/_protected/chunk.js (packages/zudoku/src/app/protectChunks.test.ts:41)", "shortDescription": {"text": "Dangling fetch: GET /docs/_protected/chunk.js (packages/zudoku/src/app/protectChunks.test.ts:41)"}, "fullDescription": {"text": "`packages/zudoku/src/app/protectChunks.test.ts:41` calls `GET /docs/_protected/chunk.js` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: helper:request\nNormalized path used for matching: `/docs/_protected/chunk.js`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-74d2d91bdf28ff5b", "name": "Dangling fetch: GET /docs/_protected/chunk.js (packages/zudoku/src/app/protectChunks.test.ts:44)", "shortDescription": {"text": "Dangling fetch: GET /docs/_protected/chunk.js (packages/zudoku/src/app/protectChunks.test.ts:44)"}, "fullDescription": {"text": "`packages/zudoku/src/app/protectChunks.test.ts:44` calls `GET /docs/_protected/chunk.js` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: helper:request\nNormalized path used for matching: `/docs/_protected/chunk.js`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-f1bc8c47081d32c2", "name": "Dangling fetch: GET /_protected/chunk.js (packages/zudoku/src/app/protectChunks.test.ts:50)", "shortDescription": {"text": "Dangling fetch: GET /_protected/chunk.js (packages/zudoku/src/app/protectChunks.test.ts:50)"}, "fullDescription": {"text": "`packages/zudoku/src/app/protectChunks.test.ts:50` calls `GET /_protected/chunk.js` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: helper:request\nNormalized path used for matching: `/_protected/chunk.js`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-e599dc78b1b3df78", "name": "Dangling fetch: GET /_protected/chunk.js (packages/zudoku/src/app/protectChunks.test.ts:55)", "shortDescription": {"text": "Dangling fetch: GET /_protected/chunk.js (packages/zudoku/src/app/protectChunks.test.ts:55)"}, "fullDescription": {"text": "`packages/zudoku/src/app/protectChunks.test.ts:55` calls `GET /_protected/chunk.js` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: helper:request\nNormalized path used for matching: `/_protected/chunk.js`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-fc3dbc7cfc6c1567", "name": "Dangling fetch: GET /_protected/chunk.js (packages/zudoku/src/app/protectChunks.test.ts:62)", "shortDescription": {"text": "Dangling fetch: GET /_protected/chunk.js (packages/zudoku/src/app/protectChunks.test.ts:62)"}, "fullDescription": {"text": "`packages/zudoku/src/app/protectChunks.test.ts:62` calls `GET /_protected/chunk.js` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: helper:request\nNormalized path used for matching: `/_protected/chunk.js`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-e9671f6fdd521e0b", "name": "Dangling fetch: GET /_protected (packages/zudoku/src/app/protectChunks.test.ts:69)", "shortDescription": {"text": "Dangling fetch: GET /_protected (packages/zudoku/src/app/protectChunks.test.ts:69)"}, "fullDescription": {"text": "`packages/zudoku/src/app/protectChunks.test.ts:69` calls `GET /_protected` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: helper:request\nNormalized path used for matching: `/_protected`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-1b24cfaf6db225ab", "name": "Dangling fetch: GET /_PROTECTED/chunk.js (packages/zudoku/src/app/protectChunks.test.ts:74)", "shortDescription": {"text": "Dangling fetch: GET /_PROTECTED/chunk.js (packages/zudoku/src/app/protectChunks.test.ts:74)"}, "fullDescription": {"text": "`packages/zudoku/src/app/protectChunks.test.ts:74` calls `GET /_PROTECTED/chunk.js` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: helper:request\nNormalized path used for matching: `/_protected/chunk.js`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-11d33070afea1e22", "name": "Dangling fetch: GET /_protected-public/chunk.js (packages/zudoku/src/app/protectChunks.test.ts:79)", "shortDescription": {"text": "Dangling fetch: GET /_protected-public/chunk.js (packages/zudoku/src/app/protectChunks.test.ts:79)"}, "fullDescription": {"text": "`packages/zudoku/src/app/protectChunks.test.ts:79` calls `GET /_protected-public/chunk.js` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: helper:request\nNormalized path used for matching: `/_protected-public/chunk.js`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-f0ed286cd2c710ef", "name": "Dangling fetch: GET /_protected/chunk.js (packages/zudoku/src/app/protectChunks.test.ts:84)", "shortDescription": {"text": "Dangling fetch: GET /_protected/chunk.js (packages/zudoku/src/app/protectChunks.test.ts:84)"}, "fullDescription": {"text": "`packages/zudoku/src/app/protectChunks.test.ts:84` calls `GET /_protected/chunk.js` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: helper:request\nNormalized path used for matching: `/_protected/chunk.js`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-de5d44db73b77794", "name": "Dangling fetch: GET /_protected/chunk.js (packages/zudoku/src/app/protectChunks.test.ts:91)", "shortDescription": {"text": "Dangling fetch: GET /_protected/chunk.js (packages/zudoku/src/app/protectChunks.test.ts:91)"}, "fullDescription": {"text": "`packages/zudoku/src/app/protectChunks.test.ts:91` calls `GET /_protected/chunk.js` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: helper:request\nNormalized path used for matching: `/_protected/chunk.js`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-ff3197b6d30c7796", "name": "Dangling fetch: GET /_protected/chunk.js (packages/zudoku/src/app/protectChunks.test.ts:96)", "shortDescription": {"text": "Dangling fetch: GET /_protected/chunk.js (packages/zudoku/src/app/protectChunks.test.ts:96)"}, "fullDescription": {"text": "`packages/zudoku/src/app/protectChunks.test.ts:96` calls `GET /_protected/chunk.js` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: helper:request\nNormalized path used for matching: `/_protected/chunk.js`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-65690546f51f7a19", "name": "Dangling fetch: GET /_protected/chunk.js (packages/zudoku/src/app/protectChunks.test.ts:119)", "shortDescription": {"text": "Dangling fetch: GET /_protected/chunk.js (packages/zudoku/src/app/protectChunks.test.ts:119)"}, "fullDescription": {"text": "`packages/zudoku/src/app/protectChunks.test.ts:119` calls `GET /_protected/chunk.js` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: helper:request\nNormalized path used for matching: `/_protected/chunk.js`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-bea9a857b6b2f99c", "name": "Dangling fetch: GET /_protected/chunk.js (packages/zudoku/src/app/protectChunks.test.ts:127)", "shortDescription": {"text": "Dangling fetch: GET /_protected/chunk.js (packages/zudoku/src/app/protectChunks.test.ts:127)"}, "fullDescription": {"text": "`packages/zudoku/src/app/protectChunks.test.ts:127` calls `GET /_protected/chunk.js` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: helper:request\nNormalized path used for matching: `/_protected/chunk.js`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-98356ca04b0acfdd", "name": "Dangling fetch: GET /_protected/chunk.js (packages/zudoku/src/app/protectChunks.test.ts:137)", "shortDescription": {"text": "Dangling fetch: GET /_protected/chunk.js (packages/zudoku/src/app/protectChunks.test.ts:137)"}, "fullDescription": {"text": "`packages/zudoku/src/app/protectChunks.test.ts:137` calls `GET /_protected/chunk.js` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: helper:request\nNormalized path used for matching: `/_protected/chunk.js`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-25b5af50c5cf169e", "name": "Dangling fetch: GET /_protected/chunk.js (packages/zudoku/src/app/protectChunks.test.ts:146)", "shortDescription": {"text": "Dangling fetch: GET /_protected/chunk.js (packages/zudoku/src/app/protectChunks.test.ts:146)"}, "fullDescription": {"text": "`packages/zudoku/src/app/protectChunks.test.ts:146` calls `GET /_protected/chunk.js` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: helper:request\nNormalized path used for matching: `/_protected/chunk.js`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-e63e8f6012dc774c", "name": "Unused endpoint: USE /__z/pagefind-reindex", "shortDescription": {"text": "Unused endpoint: USE /__z/pagefind-reindex"}, "fullDescription": {"text": "`packages/zudoku/src/vite/dev-server.ts` declares `USE /__z/pagefind-reindex` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-dba9320254e60b4e", "name": "Unused endpoint: ALL /server/*", "shortDescription": {"text": "Unused endpoint: ALL /server/*"}, "fullDescription": {"text": "`packages/zudoku/src/app/adapters/lambda.ts` declares `ALL /server/*` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/23735"}, "properties": {"repository": "zuplo/zudoku", "repoUrl": "https://github.com/zuplo/zudoku", "branch": "main"}, "results": [{"ruleId": "scanner-efefc407f89ec713", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 docs/src/LandingPage.tsx:283"}, "properties": {"repobilityId": "0e0969e4fcde21ac", "scanner": "scanner-primary", "fingerprint": "efefc407f89ec713", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-0f7d313208142e45", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 packages/plugin-graphql/src/components/SchemaSearch.tsx:61"}, "properties": {"repobilityId": "b0ab738a839aec3e", "scanner": "scanner-primary", "fingerprint": "0f7d313208142e45", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-9be4e1110af9b240", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 packages/plugin-graphql/src/components/GraphQLWorkbench.tsx:333"}, "properties": {"repobilityId": "06412145fc2f5e7c", "scanner": "scanner-primary", "fingerprint": "9be4e1110af9b240", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-94199dc6f9880037", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 packages/plugin-graphql/src/pages/TypeDetailPage.tsx:348"}, "properties": {"repobilityId": "d6cd8d52eafcc4a7", "scanner": "scanner-primary", "fingerprint": "94199dc6f9880037", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-56bfb19d0ea808b9", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 packages/create-zudoku/create-app.ts:133"}, "properties": {"repobilityId": "402b85d0a2de9312", "scanner": "scanner-primary", "fingerprint": "56bfb19d0ea808b9", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-93a595433f42feba", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 packages/create-zudoku/index.ts:132"}, "properties": {"repobilityId": "819f88b9db991c4d", "scanner": "scanner-primary", "fingerprint": "93a595433f42feba", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-84f982f385c5e6fd", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 packages/create-zudoku/templates/index.ts:41"}, "properties": {"repobilityId": "64c48f2c6c002a85", "scanner": "scanner-primary", "fingerprint": "84f982f385c5e6fd", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-199c4ed5ad99935a", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 packages/create-zudoku/helpers/is-folder-empty.ts:38"}, "properties": {"repobilityId": "278280b9d7048b3c", "scanner": "scanner-primary", "fingerprint": "199c4ed5ad99935a", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-653a53ebac8ab637", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 packages/create-zudoku/helpers/install.ts:19"}, "properties": {"repobilityId": "2b9301e550a37569", "scanner": "scanner-primary", "fingerprint": "653a53ebac8ab637", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-e4600a3754e14b14", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 packages/zudoku/scripts/generate-publish-exports.ts:71"}, "properties": {"repobilityId": "cc9a36b66fad69d2", "scanner": "scanner-primary", "fingerprint": "e4600a3754e14b14", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-611fb8283ceb90a4", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 packages/zudoku/scripts/generate-graphiql-sri.ts:38"}, "properties": {"repobilityId": "32a7867d6136c584", "scanner": "scanner-primary", "fingerprint": "611fb8283ceb90a4", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-fb8cd32b69f6f186", "level": "none", "message": {"text": "TODO/FIXME marker in shipping code \u2014 packages/zudoku/src/zuplo/enrich-with-zuplo-mcp.ts:54"}, "properties": {"repobilityId": "fdbe770cb4653283", "scanner": "scanner-primary", "fingerprint": "fb8cd32b69f6f186", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.todo-marker"]}}, {"ruleId": "scanner-7bf105473e3f6070", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 packages/zudoku/src/config/validators/ZudokuConfig.ts:814"}, "properties": {"repobilityId": "7f0ada2ce896f0ee", "scanner": "scanner-primary", "fingerprint": "7bf105473e3f6070", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-75d1d66ffb805f1b", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 packages/zudoku/src/cli/common/output.ts:30"}, "properties": {"repobilityId": "4a753f45d0c0330c", "scanner": "scanner-primary", "fingerprint": "75d1d66ffb805f1b", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-3e7c79964ae82435", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 packages/zudoku/src/cli/common/utils/box.ts:39"}, "properties": {"repobilityId": "e17f6df143fc1399", "scanner": "scanner-primary", "fingerprint": "3e7c79964ae82435", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-64d82cc4800324d6", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 packages/zudoku/src/cli/dev/handler.ts:65"}, "properties": {"repobilityId": "230461bbeb10dedb", "scanner": "scanner-primary", "fingerprint": "64d82cc4800324d6", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-8615cb556fd44d1a", "level": "none", "message": {"text": "TODO/FIXME marker in shipping code \u2014 packages/zudoku/src/vite/plugin-auth.ts:22"}, "properties": {"repobilityId": "ba6484db096aba0e", "scanner": "scanner-primary", "fingerprint": "8615cb556fd44d1a", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.todo-marker"]}}, {"ruleId": "scanner-8cddbc07dbdfc402", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 packages/zudoku/src/vite/output.ts:225"}, "properties": {"repobilityId": "e47db3eb069c4baf", "scanner": "scanner-primary", "fingerprint": "8cddbc07dbdfc402", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-c5ea3f4e11140126", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 packages/zudoku/src/vite/plugin-api.ts:95"}, "properties": {"repobilityId": "249ad2dfa27d5788", "scanner": "scanner-primary", "fingerprint": "c5ea3f4e11140126", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-7792b5966d11c049", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 packages/zudoku/src/vite/llms.ts:64"}, "properties": {"repobilityId": "53e2d70f873ebf49", "scanner": "scanner-primary", "fingerprint": "7792b5966d11c049", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-24911e6e837eef35", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 packages/zudoku/src/app/entry.client.tsx:50"}, "properties": {"repobilityId": "f326f6aa41dfa143", "scanner": "scanner-primary", "fingerprint": "24911e6e837eef35", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-58d99547184793ef", "level": "none", "message": {"text": "TODO/FIXME marker in shipping code \u2014 packages/zudoku/src/lib/authentication/hook.ts:99"}, "properties": {"repobilityId": "1bc898db319a085a", "scanner": "scanner-primary", "fingerprint": "58d99547184793ef", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.todo-marker"]}}, {"ruleId": "scanner-7718e762d5bd6493", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 packages/zudoku/src/lib/ui/Value.tsx:25"}, "properties": {"repobilityId": "e31a04aee3367307", "scanner": "scanner-primary", "fingerprint": "7718e762d5bd6493", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-4859e98700a2e468", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 packages/zudoku/src/lib/components/Pagination.tsx:30"}, "properties": {"repobilityId": "51e0762a23daddc6", "scanner": "scanner-primary", "fingerprint": "4859e98700a2e468", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-93f715fbf45ddf23", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 packages/zudoku/src/lib/components/IdentitySelector.tsx:64"}, "properties": {"repobilityId": "26879e10ed4c0cf9", "scanner": "scanner-primary", "fingerprint": "93f715fbf45ddf23", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-03b3bb381b8ee976", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 packages/zudoku/src/lib/components/BrowserWindow.tsx:70"}, "properties": {"repobilityId": "0dd5624c7d98bf24", "scanner": "scanner-primary", "fingerprint": "03b3bb381b8ee976", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-7cc71cd07cbf8acf", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 packages/zudoku/src/lib/components/MultiSelect.tsx:42"}, "properties": {"repobilityId": "92e181fdac80400b", "scanner": "scanner-primary", "fingerprint": "7cc71cd07cbf8acf", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-62d9ac0c0799817c", "level": "warning", "message": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 packages/zudoku/src/lib/components/Mermaid.tsx:67"}, "properties": {"repobilityId": "cc955edc4ebb5166", "scanner": "scanner-primary", "fingerprint": "62d9ac0c0799817c", "layer": "frontend", "severity": "medium", "confidence": 1.0, "tags": ["frontend-quality", "fq.dangerous-html"]}}, {"ruleId": "scanner-05734be2b00ce00e", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 packages/zudoku/src/lib/components/navigation/NavigationFrames.tsx:87"}, "properties": {"repobilityId": "27339ebb495e41aa", "scanner": "scanner-primary", "fingerprint": "05734be2b00ce00e", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-1cf6e434181fd817", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 packages/zudoku/src/lib/components/navigation/NavigationCategory.tsx:139"}, "properties": {"repobilityId": "b50d1e09f6db1b78", "scanner": "scanner-primary", "fingerprint": "1cf6e434181fd817", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-b3ad1bfcab31086c", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 packages/zudoku/src/lib/components/navigation/StackRows.tsx:26"}, "properties": {"repobilityId": "c1c60d1ac2802ffe", "scanner": "scanner-primary", "fingerprint": "b3ad1bfcab31086c", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-e607c84efd57628f", "level": "none", "message": {"text": "TODO/FIXME marker in shipping code \u2014 packages/zudoku/src/lib/plugins/api-keys/ProtectedRoute.tsx:9"}, "properties": {"repobilityId": "1957b5d5ce5f7856", "scanner": "scanner-primary", "fingerprint": "e607c84efd57628f", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.todo-marker"]}}, {"ruleId": "scanner-bc04480f074ac0b6", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 packages/zudoku/src/lib/plugins/markdown/MdxPage.tsx:92"}, "properties": {"repobilityId": "34ffc3f3d0b754cb", "scanner": "scanner-primary", "fingerprint": "bc04480f074ac0b6", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-f94a4b71d580ff89", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 packages/zudoku/src/lib/plugins/search-pagefind/IndexingDialog.tsx:126"}, "properties": {"repobilityId": "29f28b54be9197f5", "scanner": "scanner-primary", "fingerprint": "f94a4b71d580ff89", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-33e3bc498513b470", "level": "warning", "message": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 packages/zudoku/src/lib/plugins/search-pagefind/ResultList.tsx:108"}, "properties": {"repobilityId": "e4b4c4708bca40f0", "scanner": "scanner-primary", "fingerprint": "33e3bc498513b470", "layer": "frontend", "severity": "medium", "confidence": 1.0, "tags": ["frontend-quality", "fq.dangerous-html"]}}, {"ruleId": "scanner-8a8a4b2446d78ce0", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 packages/zudoku/src/lib/plugins/openapi/SchemaInfo.tsx:140"}, "properties": {"repobilityId": "aba737d42bfb6349", "scanner": "scanner-primary", "fingerprint": "8a8a4b2446d78ce0", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-05e51a51892b4f87", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 packages/zudoku/src/lib/plugins/openapi/Endpoint.tsx:63"}, "properties": {"repobilityId": "69ce87ac8a553eb0", "scanner": "scanner-primary", "fingerprint": "05e51a51892b4f87", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-fe6e772a495ff01e", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 packages/zudoku/src/lib/plugins/openapi/OperationListItem.tsx:73"}, "properties": {"repobilityId": "92a65d8241936226", "scanner": "scanner-primary", "fingerprint": "fe6e772a495ff01e", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-e6e2cd0ff24c62f5", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 packages/zudoku/src/lib/plugins/openapi/SidecarExamples.tsx:95"}, "properties": {"repobilityId": "ad3243b7e9b6698d", "scanner": "scanner-primary", "fingerprint": "e6e2cd0ff24c62f5", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-8abd89c3b4f00df2", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 packages/zudoku/src/lib/plugins/openapi/Sidecar.tsx:376"}, "properties": {"repobilityId": "9a16d63ea2ba33ca", "scanner": "scanner-primary", "fingerprint": "8abd89c3b4f00df2", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-32f7864254eaf2b7", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 packages/zudoku/src/lib/plugins/openapi/client/createServer.ts:33"}, "properties": {"repobilityId": "0b3ae03524b9ee37", "scanner": "scanner-primary", "fingerprint": "32f7864254eaf2b7", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-2ea5580fd2cb6259", "level": "none", "message": {"text": "TODO/FIXME marker in shipping code \u2014 examples/many-apis/download.js:13"}, "properties": {"repobilityId": "f56ac418465e3348", "scanner": "scanner-primary", "fingerprint": "2ea5580fd2cb6259", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.todo-marker"]}}, {"ruleId": "scanner-e14f6705d1d692b0", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in packages/create-zudoku/helpers/git.ts:1"}, "properties": {"repobilityId": "4f6a3aaa1bef7199", "scanner": "scanner-primary", "fingerprint": "e14f6705d1d692b0", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/create-zudoku/helpers/git.ts"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-af80618028042e1e", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in packages/create-zudoku/helpers/is-online.ts:1"}, "properties": {"repobilityId": "ea7830ab20e9ffa9", "scanner": "scanner-primary", "fingerprint": "af80618028042e1e", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/create-zudoku/helpers/is-online.ts"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c444a219b88986d7", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in packages/zudoku/src/cli/common/machine-id/lib.ts:8"}, "properties": {"repobilityId": "5f1302f928faba56", "scanner": "scanner-primary", "fingerprint": "c444a219b88986d7", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/zudoku/src/cli/common/machine-id/lib.ts"}, "region": {"startLine": 8}}}]}, {"ruleId": "scanner-61b9ebf2883c2417", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in packages/zudoku/src/vite/mdx/remark-last-modified.ts:2"}, "properties": {"repobilityId": "4807404ceb87beb5", "scanner": "scanner-primary", "fingerprint": "61b9ebf2883c2417", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/zudoku/src/vite/mdx/remark-last-modified.ts"}, "region": {"startLine": 2}}}]}, {"ruleId": "scanner-2346cc3c961b8c3b", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in packages/zudoku/src/lib/authentication/providers/clerk.test.tsx:10"}, "properties": {"repobilityId": "151eabcec038a490", "scanner": "scanner-primary", "fingerprint": "2346cc3c961b8c3b", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/zudoku/src/lib/authentication/providers/clerk.test.tsx"}, "region": {"startLine": 10}}}]}, {"ruleId": "scanner-c87d7c49a2dcaf87", "level": "warning", "message": {"text": "Insecure pattern 'local_storage_auth_token' in packages/zudoku/src/lib/authentication/providers/openid.test.ts:79"}, "properties": {"repobilityId": "f0231403cb3e024a", "scanner": "scanner-primary", "fingerprint": "c87d7c49a2dcaf87", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "local_storage_auth_token"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/zudoku/src/lib/authentication/providers/openid.test.ts"}, "region": {"startLine": 79}}}]}, {"ruleId": "scanner-f7b48b2004e394a3", "level": "warning", "message": {"text": "Insecure pattern 'dangerous_innerhtml' in packages/zudoku/src/lib/components/Mermaid.tsx:67"}, "properties": {"repobilityId": "2c892313d52e9626", "scanner": "scanner-primary", "fingerprint": "f7b48b2004e394a3", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "dangerous_innerhtml"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/zudoku/src/lib/components/Mermaid.tsx"}, "region": {"startLine": 67}}}]}, {"ruleId": "scanner-4554e4bf6f2e4056", "level": "warning", "message": {"text": "Insecure pattern 'dangerous_innerhtml' in packages/zudoku/src/lib/plugins/search-pagefind/ResultList.tsx:108"}, "properties": {"repobilityId": "ce8cf38333c75415", "scanner": "scanner-primary", "fingerprint": "4554e4bf6f2e4056", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "dangerous_innerhtml"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/zudoku/src/lib/plugins/search-pagefind/ResultList.tsx"}, "region": {"startLine": 108}}}]}, {"ruleId": "scanner-b4c1620aecd8a426", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "7810b1fdb0a2a6ed", "scanner": "scanner-primary", "fingerprint": "b4c1620aecd8a426", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/main.yaml"}, "region": {"startLine": 60}}}]}, {"ruleId": "scanner-b4c1620aecd8a426", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "1b3c5df606b305ae", "scanner": "scanner-primary", "fingerprint": "b4c1620aecd8a426", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/main.yaml"}, "region": {"startLine": 111}}}]}, {"ruleId": "scanner-b4c1620aecd8a426", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "1b3c5df606b305ae", "scanner": "scanner-primary", "fingerprint": "b4c1620aecd8a426", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/main.yaml"}, "region": {"startLine": 220}}}]}, {"ruleId": "scanner-caab7a0e021ba38e", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "e9fb4378e2018e7c", "scanner": "scanner-primary", "fingerprint": "caab7a0e021ba38e", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/main.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-9214c6df1cb2ff85", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "9fa6a4b062b960cd", "scanner": "scanner-primary", "fingerprint": "9214c6df1cb2ff85", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release-monetization.yaml"}, "region": {"startLine": 43}}}]}, {"ruleId": "scanner-9214c6df1cb2ff85", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "0850ec0f5cf19d5e", "scanner": "scanner-primary", "fingerprint": "9214c6df1cb2ff85", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release-monetization.yaml"}, "region": {"startLine": 81}}}]}, {"ruleId": "scanner-9214c6df1cb2ff85", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "0850ec0f5cf19d5e", "scanner": "scanner-primary", "fingerprint": "9214c6df1cb2ff85", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release-monetization.yaml"}, "region": {"startLine": 118}}}]}, {"ruleId": "scanner-5c59bc92e4c8b327", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "6e847876b5fe5c16", "scanner": "scanner-primary", "fingerprint": "5c59bc92e4c8b327", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release-monetization.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-83cfa31a4858f727", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "d817c882b31e25bb", "scanner": "scanner-primary", "fingerprint": "83cfa31a4858f727", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/build.yaml"}, "region": {"startLine": 32}}}]}, {"ruleId": "scanner-83cfa31a4858f727", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "57772614cdf9c6c0", "scanner": "scanner-primary", "fingerprint": "83cfa31a4858f727", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/build.yaml"}, "region": {"startLine": 66}}}]}, {"ruleId": "scanner-83cfa31a4858f727", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "e8b7634935551c07", "scanner": "scanner-primary", "fingerprint": "83cfa31a4858f727", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/build.yaml"}, "region": {"startLine": 74}}}]}, {"ruleId": "scanner-83cfa31a4858f727", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "6bcfce374f2f4da3", "scanner": "scanner-primary", "fingerprint": "83cfa31a4858f727", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/build.yaml"}, "region": {"startLine": 86}}}]}, {"ruleId": "scanner-83cfa31a4858f727", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "d817c882b31e25bb", "scanner": "scanner-primary", "fingerprint": "83cfa31a4858f727", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/build.yaml"}, "region": {"startLine": 161}}}]}, {"ruleId": "scanner-83cfa31a4858f727", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "e8b7634935551c07", "scanner": "scanner-primary", "fingerprint": "83cfa31a4858f727", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/build.yaml"}, "region": {"startLine": 176}}}]}, {"ruleId": "scanner-83cfa31a4858f727", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "6bcfce374f2f4da3", "scanner": "scanner-primary", "fingerprint": "83cfa31a4858f727", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/build.yaml"}, "region": {"startLine": 196}}}]}, {"ruleId": "scanner-7b7b2ff13d8a34f0", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "0a5c67d756567c47", "scanner": "scanner-primary", "fingerprint": "7b7b2ff13d8a34f0", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/build.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-cb639d9a10a47b23", "level": "note", "message": {"text": "package.json defines install-time lifecycle scripts"}, "properties": {"repobilityId": "b86179956da3a4a8", "scanner": "scanner-primary", "fingerprint": "cb639d9a10a47b23", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "npm", "install-scripts"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ea3b5e389d8c9c0f", "level": "note", "message": {"text": "Low test-to-source ratio"}, "properties": {"repobilityId": "ef7b2552cc00a375", "scanner": "scanner-primary", "fingerprint": "ea3b5e389d8c9c0f", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["tests"]}}, {"ruleId": "scanner-b8fae141f052f3ab", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: docs/package.json"}, "properties": {"repobilityId": "e77ce50b08d152bb", "scanner": "scanner-primary", "fingerprint": "b8fae141f052f3ab", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docs/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c5a4ca9d846b65d0", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: packages/plugin-search-algolia/package.json"}, "properties": {"repobilityId": "b437058b1b5a816e", "scanner": "scanner-primary", "fingerprint": "c5a4ca9d846b65d0", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/plugin-search-algolia/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-758032065bca55eb", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: packages/plugin-graphql/package.json"}, "properties": {"repobilityId": "8b8a19bfcc6de884", "scanner": "scanner-primary", "fingerprint": "758032065bca55eb", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/plugin-graphql/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-bd91d0f22430fc8b", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: packages/create-zudoku/package.json"}, "properties": {"repobilityId": "3b1653730383e07a", "scanner": "scanner-primary", "fingerprint": "bd91d0f22430fc8b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/create-zudoku/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-250137f599e48ce3", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: packages/zudoku/package.json"}, "properties": {"repobilityId": "b999854f92d0922e", "scanner": "scanner-primary", "fingerprint": "250137f599e48ce3", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/zudoku/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-12372603316f7790", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: packages/plugin-zuplo-monetization/package.json"}, "properties": {"repobilityId": "6ed386066fa9c207", "scanner": "scanner-primary", "fingerprint": "12372603316f7790", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/plugin-zuplo-monetization/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-1e043d0a33b613be", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: examples/many-apis/package.json"}, "properties": {"repobilityId": "a22faedb358a8cab", "scanner": "scanner-primary", "fingerprint": "1e043d0a33b613be", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "examples/many-apis/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-4161803148a2673d", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: examples/search-algolia/package.json"}, "properties": {"repobilityId": "67acd0bd87d9c4e8", "scanner": "scanner-primary", "fingerprint": "4161803148a2673d", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "examples/search-algolia/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-2cf8e3bed898eb38", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: examples/aws-lambda-ssr/package.json"}, "properties": {"repobilityId": "425c35530de584bb", "scanner": "scanner-primary", "fingerprint": "2cf8e3bed898eb38", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "examples/aws-lambda-ssr/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-57af807dee62400d", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: examples/auth-supabase/package.json"}, "properties": {"repobilityId": "d86a8d2e9a8690d8", "scanner": "scanner-primary", "fingerprint": "57af807dee62400d", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "examples/auth-supabase/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3394693e27b2da8b", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: examples/api-identity-plugin/package.json"}, "properties": {"repobilityId": "f8924db8854448a1", "scanner": "scanner-primary", "fingerprint": "3394693e27b2da8b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "examples/api-identity-plugin/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3a2184771e970d74", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: examples/with-openapi-json/package.json"}, "properties": {"repobilityId": "6ffd96ce6266e13d", "scanner": "scanner-primary", "fingerprint": "3a2184771e970d74", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "examples/with-openapi-json/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-550a6628543245a3", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: examples/graphql/package.json"}, "properties": {"repobilityId": "be578e012cccd871", "scanner": "scanner-primary", "fingerprint": "550a6628543245a3", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "examples/graphql/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6e1519dac884105d", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: examples/mermaid/package.json"}, "properties": {"repobilityId": "2d41a4a2594d6ce5", "scanner": "scanner-primary", "fingerprint": "6e1519dac884105d", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "examples/mermaid/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c368f83e2758c3ee", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: examples/with-auth0/package.json"}, "properties": {"repobilityId": "8fee5e0891937ac6", "scanner": "scanner-primary", "fingerprint": "c368f83e2758c3ee", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "examples/with-auth0/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-302cb9a8176c267e", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: examples/zuplo-monetization/docs/package.json"}, "properties": {"repobilityId": "c0cab5ac4715623c", "scanner": "scanner-primary", "fingerprint": "302cb9a8176c267e", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "examples/zuplo-monetization/docs/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-bac0c980cc314486", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: examples/cloudflare-ssr/package.json"}, "properties": {"repobilityId": "6af777debbfefdbc", "scanner": "scanner-primary", "fingerprint": "bac0c980cc314486", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "examples/cloudflare-ssr/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-eb6e4aa56df3a2af", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: examples/with-vite-config/package.json"}, "properties": {"repobilityId": "2d44018cea3eb22c", "scanner": "scanner-primary", "fingerprint": "eb6e4aa56df3a2af", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "examples/with-vite-config/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-976ad13b055350ff", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: examples/cosmo-cargo/package.json"}, "properties": {"repobilityId": "45f8d0bf716863ad", "scanner": "scanner-primary", "fingerprint": "976ad13b055350ff", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "examples/cosmo-cargo/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e3b121fd77357ca3", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: examples/with-openapi-yaml/package.json"}, "properties": {"repobilityId": "071d6702f3d31cf3", "scanner": "scanner-primary", "fingerprint": "e3b121fd77357ca3", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "examples/with-openapi-yaml/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3d65eb8410dafb3a", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: examples/with-base-path/package.json"}, "properties": {"repobilityId": "d7f84ee7c5cdf355", "scanner": "scanner-primary", "fingerprint": "3d65eb8410dafb3a", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "examples/with-base-path/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-42c2f2957afd850e", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: examples/auth-firebase/package.json"}, "properties": {"repobilityId": "8c6b4fe171f3c347", "scanner": "scanner-primary", "fingerprint": "42c2f2957afd850e", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "examples/auth-firebase/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-15f6e5b367f8d806", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: examples/with-zuplo/docs/package.json"}, "properties": {"repobilityId": "120073d0c60bbe5a", "scanner": "scanner-primary", "fingerprint": "15f6e5b367f8d806", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "examples/with-zuplo/docs/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-9b7d5360b0ba3e01", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: examples/with-config/package.json"}, "properties": {"repobilityId": "49bdd5fb09d8dc7f", "scanner": "scanner-primary", "fingerprint": "9b7d5360b0ba3e01", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "examples/with-config/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6b97fadb6719941b", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: examples/api-key-service/package.json"}, "properties": {"repobilityId": "a0d1230734d09dab", "scanner": "scanner-primary", "fingerprint": "6b97fadb6719941b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "examples/api-key-service/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "563bdc960fa228b3", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-72b2a6250083a784", "level": "warning", "message": {"text": "Placeholder or mock-heavy implementation detected"}, "properties": {"repobilityId": "3ace3e579a4eed55", "scanner": "scanner-primary", "fingerprint": "72b2a6250083a784", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "incomplete", "generated-repo-pattern"]}}, {"ruleId": "scanner-9d79c4077342a7d0", "level": "warning", "message": {"text": "Runtime service client appears to use placeholder configuration"}, "properties": {"repobilityId": "04000006501eaa2d", "scanner": "scanner-primary", "fingerprint": "9d79c4077342a7d0", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "runtime-config", "service-client", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "46097a0d6a3ab946", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-749d4bc1bd66df5f", "level": "warning", "message": {"text": "Agent instructions exist but release-hardening basics are missing"}, "properties": {"repobilityId": "d7c81febb0e8b0df", "scanner": "scanner-primary", "fingerprint": "749d4bc1bd66df5f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "21a476802b303170", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "b6bf0f563a9af752", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-0e31a11190c73fef", "level": "none", "message": {"text": "Commented-code block (7 lines) in docs/sidebar.ts:17"}, "properties": {"repobilityId": "d304e7aa732a7876", "scanner": "scanner-primary", "fingerprint": "0e31a11190c73fef", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-15410d8197b4b006", "level": "note", "message": {"text": "Legacy-named symbol `showDeprecated` in packages/plugin-graphql/src/interfaces.ts:4"}, "properties": {"repobilityId": "812baad0d950a464", "scanner": "scanner-primary", "fingerprint": "15410d8197b4b006", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-1ff8ad5972bbca97", "level": "note", "message": {"text": "Legacy-named symbol `isDeprecated` in packages/plugin-graphql/src/util/generateOperation.ts:168"}, "properties": {"repobilityId": "408127d75838a2c1", "scanner": "scanner-primary", "fingerprint": "1ff8ad5972bbca97", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-f834bc88b81052aa", "level": "note", "message": {"text": "Legacy-named symbol `isDeprecated` in packages/plugin-graphql/src/components/FieldList.tsx:103"}, "properties": {"repobilityId": "9091de5c5521b177", "scanner": "scanner-primary", "fingerprint": "f834bc88b81052aa", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-4faa157332ba2b4f", "level": "note", "message": {"text": "Legacy-named symbol `isDeprecated` in packages/plugin-graphql/src/components/EnumValueList.tsx:24"}, "properties": {"repobilityId": "12eeb490ad69b8a7", "scanner": "scanner-primary", "fingerprint": "4faa157332ba2b4f", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-58068c96b03fcab3", "level": "note", "message": {"text": "Legacy-named symbol `isDeprecated` in packages/plugin-graphql/src/components/ArgumentList.tsx:29"}, "properties": {"repobilityId": "b94b5f4281e66056", "scanner": "scanner-primary", "fingerprint": "58068c96b03fcab3", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-6c7704cfcfcc96a0", "level": "note", "message": {"text": "Legacy-named symbol `isDeprecated` in packages/plugin-graphql/src/components/DetailPageHeader.tsx:11"}, "properties": {"repobilityId": "1183ff59bf9a0b7d", "scanner": "scanner-primary", "fingerprint": "6c7704cfcfcc96a0", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-03ff8d8e90801ae8", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 packages/plugin-graphql/src/components/GraphQLPlayground.tsx:77"}, "properties": {"repobilityId": "36ebb93266cca4dc", "scanner": "scanner-primary", "fingerprint": "03ff8d8e90801ae8", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-9f03a6e65baa3f95", "level": "note", "message": {"text": "Legacy-named symbol `isDeprecated` in packages/plugin-graphql/src/pages/OperationPage.tsx:66"}, "properties": {"repobilityId": "b01e5a0e9654ea45", "scanner": "scanner-primary", "fingerprint": "9f03a6e65baa3f95", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-d157d4fd58654b3a", "level": "none", "message": {"text": "Commented-code block (6 lines) in packages/create-zudoku/templates/zuplo/zudoku.config.tsx:1"}, "properties": {"repobilityId": "3b4e3894e0ae2296", "scanner": "scanner-primary", "fingerprint": "d157d4fd58654b3a", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-72e925aff5bbf323", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 packages/create-zudoku/helpers/examples.ts:95"}, "properties": {"repobilityId": "55000c939ce96617", "scanner": "scanner-primary", "fingerprint": "72e925aff5bbf323", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-0f689651821db968", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 packages/zudoku/scripts/generate-graphiql-sri.ts:15"}, "properties": {"repobilityId": "63a35ab78cc28a79", "scanner": "scanner-primary", "fingerprint": "0f689651821db968", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-6b60e29c93ff1f8e", "level": "none", "message": {"text": "Commented-code block (5 lines) in packages/zudoku/src/config/loader.ts:247"}, "properties": {"repobilityId": "94f2cbfbb82681fb", "scanner": "scanner-primary", "fingerprint": "6b60e29c93ff1f8e", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-0c0194b4cd0b2b83", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 packages/zudoku/src/cli/common/outdated.ts:49"}, "properties": {"repobilityId": "40173df6402a5932", "scanner": "scanner-primary", "fingerprint": "0c0194b4cd0b2b83", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-eb8f5720795ab690", "level": "none", "message": {"text": "Commented-code block (7 lines) in packages/zudoku/src/cli/common/analytics/lib.ts:39"}, "properties": {"repobilityId": "49125632a168cc27", "scanner": "scanner-primary", "fingerprint": "eb8f5720795ab690", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-b495a8a800d6dfd7", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 packages/zudoku/src/vite/shadcn-registry.ts:38"}, "properties": {"repobilityId": "08d4777af625e902", "scanner": "scanner-primary", "fingerprint": "b495a8a800d6dfd7", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-f292f806fc2a5c0e", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 packages/zudoku/src/vite/dev-server.ts:180"}, "properties": {"repobilityId": "5f8d755b52bd9772", "scanner": "scanner-primary", "fingerprint": "f292f806fc2a5c0e", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-62baf5725863ec2b", "level": "none", "message": {"text": "Commented-code block (5 lines) in packages/zudoku/src/vite/mdx/remark-link-rewrite.ts:8"}, "properties": {"repobilityId": "9adf338ee5959dd1", "scanner": "scanner-primary", "fingerprint": "62baf5725863ec2b", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-b198aea3ca804bd0", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 packages/zudoku/src/app/adapters/cloudflare.ts:15"}, "properties": {"repobilityId": "0cd20434544415f0", "scanner": "scanner-primary", "fingerprint": "b198aea3ca804bd0", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-c75492ab0405cbc8", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 packages/zudoku/src/lib/authentication/session-handler.test.ts:52"}, "properties": {"repobilityId": "e093a452f64addf4", "scanner": "scanner-primary", "fingerprint": "c75492ab0405cbc8", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-1d52202a00069cfa", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 packages/zudoku/src/lib/authentication/cookie-sync.ts:40"}, "properties": {"repobilityId": "107d41c406cfff76", "scanner": "scanner-primary", "fingerprint": "1d52202a00069cfa", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-355f45d9b6f0843c", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 packages/zudoku/src/lib/authentication/providers/azureb2c.tsx:201"}, "properties": {"repobilityId": "9bc0b7dd48202ee6", "scanner": "scanner-primary", "fingerprint": "355f45d9b6f0843c", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-cf68ac07983306e4", "level": "none", "message": {"text": "Commented-code block (8 lines) in packages/zudoku/src/lib/util/joinUrl.test.ts:36"}, "properties": {"repobilityId": "f5246b6d69166478", "scanner": "scanner-primary", "fingerprint": "cf68ac07983306e4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-80be0c7d4c152b03", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 packages/zudoku/src/lib/oas/graphql/security.test.ts:27"}, "properties": {"repobilityId": "92332ea82d50af4a", "scanner": "scanner-primary", "fingerprint": "80be0c7d4c152b03", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-fa585a8e60a73fd9", "level": "none", "message": {"text": "Commented-code block (5 lines) in packages/zudoku/src/lib/components/Markdown.tsx:16"}, "properties": {"repobilityId": "240025cf2b189bae", "scanner": "scanner-primary", "fingerprint": "fa585a8e60a73fd9", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-f26fefbaecd6cac7", "level": "none", "message": {"text": "Commented-code block (5 lines) in packages/zudoku/src/lib/components/navigation/NavigationFilterContext.tsx:18"}, "properties": {"repobilityId": "b78b4a1d327f372f", "scanner": "scanner-primary", "fingerprint": "f26fefbaecd6cac7", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-3f98d9985881eb03", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 packages/zudoku/src/lib/hooks/useApiIdentitySelection.ts:41"}, "properties": {"repobilityId": "53233fa60d18aa8e", "scanner": "scanner-primary", "fingerprint": "3f98d9985881eb03", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-82f22f18a6fa7243", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 packages/zudoku/src/lib/plugins/api-keys/index.tsx:96"}, "properties": {"repobilityId": "45d11c26c8780072", "scanner": "scanner-primary", "fingerprint": "82f22f18a6fa7243", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-2ddb19109719c25a", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 packages/zudoku/src/lib/plugins/markdown/MdxPage.tsx:216"}, "properties": {"repobilityId": "843ce27fd3a349b3", "scanner": "scanner-primary", "fingerprint": "2ddb19109719c25a", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-2b3eb4480561fe63", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 packages/zudoku/src/lib/plugins/openapi/DownloadSchemaButton.tsx:77"}, "properties": {"repobilityId": "dbe5622f61879e90", "scanner": "scanner-primary", "fingerprint": "2b3eb4480561fe63", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-83d61f75063660e2", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 packages/zudoku/src/lib/plugins/openapi/playground/GraphiQL.tsx:97"}, "properties": {"repobilityId": "c7d0a2a57349f0aa", "scanner": "scanner-primary", "fingerprint": "83d61f75063660e2", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-7227d469380c66c2", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 packages/zudoku/src/lib/plugins/openapi/client/useCreateQuery.ts:21"}, "properties": {"repobilityId": "01af64a2c0a81ca2", "scanner": "scanner-primary", "fingerprint": "7227d469380c66c2", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-814c46fe585b5137", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 packages/zudoku/src/lib/plugins/openapi/client/GraphQLClient.tsx:45"}, "properties": {"repobilityId": "7649e2183c2de3a8", "scanner": "scanner-primary", "fingerprint": "814c46fe585b5137", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-0fd5ec87f91545e7", "level": "note", "message": {"text": "Legacy-named symbol `isDeprecated` in packages/zudoku/src/lib/plugins/openapi/schema/SchemaPropertyItem.tsx:45"}, "properties": {"repobilityId": "ba58f59795af9e01", "scanner": "scanner-primary", "fingerprint": "0fd5ec87f91545e7", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-8406a0b1e6b79f02", "level": "note", "message": {"text": "Legacy-named symbol `showDeprecated` in packages/zudoku/src/lib/plugins/openapi/schema/SchemaView.tsx:90"}, "properties": {"repobilityId": "7c348e3f77793dd9", "scanner": "scanner-primary", "fingerprint": "8406a0b1e6b79f02", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-3e2a70662f0ac65b", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 packages/plugin-zuplo-monetization/src/ZuploMonetizationWrapper.tsx:62"}, "properties": {"repobilityId": "b75472d1a276b4fe", "scanner": "scanner-primary", "fingerprint": "3e2a70662f0ac65b", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-d5947c2a46c8bf80", "level": "none", "message": {"text": "Commented-code block (6 lines) in packages/plugin-zuplo-monetization/src/utils/subscriptionEntitlements.test.ts:287"}, "properties": {"repobilityId": "d75df5b09a228156", "scanner": "scanner-primary", "fingerprint": "d5947c2a46c8bf80", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-16ceaa877cb4f107", "level": "none", "message": {"text": "Commented-code block (5 lines) in packages/plugin-zuplo-monetization/src/utils/categorizeRateCards.ts:26"}, "properties": {"repobilityId": "695c78cc6b449a28", "scanner": "scanner-primary", "fingerprint": "16ceaa877cb4f107", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-41cf7e4119303975", "level": "none", "message": {"text": "Commented-code block (8 lines) in packages/plugin-zuplo-monetization/src/utils/subscriptionEntitlements.ts:73"}, "properties": {"repobilityId": "03cccf6d528f497d", "scanner": "scanner-primary", "fingerprint": "41cf7e4119303975", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-87dd61c76a72e004", "level": "none", "message": {"text": "Commented-code block (7 lines) in packages/plugin-zuplo-monetization/src/pages/components/PlanChangeCard.tsx:164"}, "properties": {"repobilityId": "61d1923749944372", "scanner": "scanner-primary", "fingerprint": "87dd61c76a72e004", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-781d4bd8e7460cb3", "level": "none", "message": {"text": "Commented-code block (5 lines) in packages/plugin-zuplo-monetization/src/pages/subscriptions/deriveUsageView.test.ts:5"}, "properties": {"repobilityId": "52f7648d3da78243", "scanner": "scanner-primary", "fingerprint": "781d4bd8e7460cb3", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-8893d8e38c15f76e", "level": "none", "message": {"text": "Commented-code block (21 lines) in packages/plugin-zuplo-monetization/src/pricing-ui/index.ts:4"}, "properties": {"repobilityId": "79e2a3ef5bd692dc", "scanner": "scanner-primary", "fingerprint": "8893d8e38c15f76e", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-c125f31aac432be0", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 examples/many-apis/download.js:52"}, "properties": {"repobilityId": "fa9f6ac7e35362ff", "scanner": "scanner-primary", "fingerprint": "c125f31aac432be0", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-64bc033a45ab26f1", "level": "note", "message": {"text": "34 env vars used in code but missing from .env.example"}, "properties": {"repobilityId": "dab9f6f977f9c414", "scanner": "scanner-primary", "fingerprint": "64bc033a45ab26f1", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "config-drift"]}}, {"ruleId": "scanner-1aa1fc38c830b8af", "level": "error", "message": {"text": "Dangling fetch: GET https://registry.npmjs.org/${packageName}/latest (packages/create-zudoku/helpers/get-latest-version.ts:15)"}, "properties": {"repobilityId": "4c7fbe9ae62463bc", "scanner": "scanner-primary", "fingerprint": "1aa1fc38c830b8af", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-f49802c75a660244", "level": "error", "message": {"text": "Dangling fetch: GET /_protected/chunk.js (packages/zudoku/src/app/protectChunks.test.ts:20)"}, "properties": {"repobilityId": "25681a6a0cad0d9d", "scanner": "scanner-primary", "fingerprint": "f49802c75a660244", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "helper:request"]}}, {"ruleId": "scanner-737caa4d5a42f337", "level": "error", "message": {"text": "Dangling fetch: GET /_protected/chunk.js (packages/zudoku/src/app/protectChunks.test.ts:25)"}, "properties": {"repobilityId": "160a3f9ba0149a9c", "scanner": "scanner-primary", "fingerprint": "737caa4d5a42f337", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "helper:request"]}}, {"ruleId": "scanner-3b5305c29efd9c9f", "level": "error", "message": {"text": "Dangling fetch: GET /assets/foo.js (packages/zudoku/src/app/protectChunks.test.ts:33)"}, "properties": {"repobilityId": "08884b951b9bede0", "scanner": "scanner-primary", "fingerprint": "3b5305c29efd9c9f", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "helper:request"]}}, {"ruleId": "scanner-1cc3654b5d4c6b4e", "level": "error", "message": {"text": "Dangling fetch: GET /docs/_protected/chunk.js (packages/zudoku/src/app/protectChunks.test.ts:41)"}, "properties": {"repobilityId": "942b6e5765740cbd", "scanner": "scanner-primary", "fingerprint": "1cc3654b5d4c6b4e", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "helper:request"]}}, {"ruleId": "scanner-74d2d91bdf28ff5b", "level": "error", "message": {"text": "Dangling fetch: GET /docs/_protected/chunk.js (packages/zudoku/src/app/protectChunks.test.ts:44)"}, "properties": {"repobilityId": "32513d7078e7ec84", "scanner": "scanner-primary", "fingerprint": "74d2d91bdf28ff5b", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "helper:request"]}}, {"ruleId": "scanner-f1bc8c47081d32c2", "level": "error", "message": {"text": "Dangling fetch: GET /_protected/chunk.js (packages/zudoku/src/app/protectChunks.test.ts:50)"}, "properties": {"repobilityId": "c8adcbb13ea4a6c3", "scanner": "scanner-primary", "fingerprint": "f1bc8c47081d32c2", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "helper:request"]}}, {"ruleId": "scanner-e599dc78b1b3df78", "level": "error", "message": {"text": "Dangling fetch: GET /_protected/chunk.js (packages/zudoku/src/app/protectChunks.test.ts:55)"}, "properties": {"repobilityId": "90875f3ec6b349e3", "scanner": "scanner-primary", "fingerprint": "e599dc78b1b3df78", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "helper:request"]}}, {"ruleId": "scanner-fc3dbc7cfc6c1567", "level": "error", "message": {"text": "Dangling fetch: GET /_protected/chunk.js (packages/zudoku/src/app/protectChunks.test.ts:62)"}, "properties": {"repobilityId": "375539da8f9ddae0", "scanner": "scanner-primary", "fingerprint": "fc3dbc7cfc6c1567", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "helper:request"]}}, {"ruleId": "scanner-e9671f6fdd521e0b", "level": "error", "message": {"text": "Dangling fetch: GET /_protected (packages/zudoku/src/app/protectChunks.test.ts:69)"}, "properties": {"repobilityId": "cb7c7593e9e95591", "scanner": "scanner-primary", "fingerprint": "e9671f6fdd521e0b", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "helper:request"]}}, {"ruleId": "scanner-1b24cfaf6db225ab", "level": "error", "message": {"text": "Dangling fetch: GET /_PROTECTED/chunk.js (packages/zudoku/src/app/protectChunks.test.ts:74)"}, "properties": {"repobilityId": "c469ab365caa63d9", "scanner": "scanner-primary", "fingerprint": "1b24cfaf6db225ab", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "helper:request"]}}, {"ruleId": "scanner-11d33070afea1e22", "level": "error", "message": {"text": "Dangling fetch: GET /_protected-public/chunk.js (packages/zudoku/src/app/protectChunks.test.ts:79)"}, "properties": {"repobilityId": "bd121678faa57092", "scanner": "scanner-primary", "fingerprint": "11d33070afea1e22", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "helper:request"]}}, {"ruleId": "scanner-f0ed286cd2c710ef", "level": "error", "message": {"text": "Dangling fetch: GET /_protected/chunk.js (packages/zudoku/src/app/protectChunks.test.ts:84)"}, "properties": {"repobilityId": "561cbf1dc523f74c", "scanner": "scanner-primary", "fingerprint": "f0ed286cd2c710ef", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "helper:request"]}}, {"ruleId": "scanner-de5d44db73b77794", "level": "error", "message": {"text": "Dangling fetch: GET /_protected/chunk.js (packages/zudoku/src/app/protectChunks.test.ts:91)"}, "properties": {"repobilityId": "bd9fbb259c9483e9", "scanner": "scanner-primary", "fingerprint": "de5d44db73b77794", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "helper:request"]}}, {"ruleId": "scanner-ff3197b6d30c7796", "level": "error", "message": {"text": "Dangling fetch: GET /_protected/chunk.js (packages/zudoku/src/app/protectChunks.test.ts:96)"}, "properties": {"repobilityId": "2878f005000c6886", "scanner": "scanner-primary", "fingerprint": "ff3197b6d30c7796", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "helper:request"]}}, {"ruleId": "scanner-65690546f51f7a19", "level": "error", "message": {"text": "Dangling fetch: GET /_protected/chunk.js (packages/zudoku/src/app/protectChunks.test.ts:119)"}, "properties": {"repobilityId": "3a479088225a2d3c", "scanner": "scanner-primary", "fingerprint": "65690546f51f7a19", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "helper:request"]}}, {"ruleId": "scanner-bea9a857b6b2f99c", "level": "error", "message": {"text": "Dangling fetch: GET /_protected/chunk.js (packages/zudoku/src/app/protectChunks.test.ts:127)"}, "properties": {"repobilityId": "57e26ab8142163ba", "scanner": "scanner-primary", "fingerprint": "bea9a857b6b2f99c", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "helper:request"]}}, {"ruleId": "scanner-98356ca04b0acfdd", "level": "error", "message": {"text": "Dangling fetch: GET /_protected/chunk.js (packages/zudoku/src/app/protectChunks.test.ts:137)"}, "properties": {"repobilityId": "e081c5444aab976e", "scanner": "scanner-primary", "fingerprint": "98356ca04b0acfdd", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "helper:request"]}}, {"ruleId": "scanner-25b5af50c5cf169e", "level": "error", "message": {"text": "Dangling fetch: GET /_protected/chunk.js (packages/zudoku/src/app/protectChunks.test.ts:146)"}, "properties": {"repobilityId": "797107a3ec9270fe", "scanner": "scanner-primary", "fingerprint": "25b5af50c5cf169e", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "helper:request"]}}, {"ruleId": "scanner-e63e8f6012dc774c", "level": "note", "message": {"text": "Unused endpoint: USE /__z/pagefind-reindex"}, "properties": {"repobilityId": "9941b439511d749a", "scanner": "scanner-primary", "fingerprint": "e63e8f6012dc774c", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-dba9320254e60b4e", "level": "note", "message": {"text": "Unused endpoint: ALL /server/*"}, "properties": {"repobilityId": "b14f078c09da977f", "scanner": "scanner-primary", "fingerprint": "dba9320254e60b4e", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}]}]}