{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-bead75b0f9233e05", "name": "No API endpoints detected", "shortDescription": {"text": "No API endpoints detected"}, "fullDescription": {"text": "The scanner did not find FastAPI/Flask/Express/NestJS/GraphQL/gRPC routes. If this repo exposes APIs, the framework may be unsupported."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "info", "confidence": 1.0}}, {"id": "scanner-fbae31a70732ce8b", "name": "Stray `console.log` in TS/JS \u2014 server/src/main/resources/static/admin/highlight.min.js:107", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 server/src/main/resources/static/admin/highlight.min.js:107"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c014a82ce5da8e0b", "name": "Privileged port 10 in use", "shortDescription": {"text": "Privileged port 10 in use"}, "fullDescription": {"text": "Port 10 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1e227ba3f3cb6577", "name": "Privileged port 20 in use", "shortDescription": {"text": "Privileged port 20 in use"}, "fullDescription": {"text": "Port 20 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-47636e33caef255d", "name": "Dockerfile runs as root: docker/Dockerfile", "shortDescription": {"text": "Dockerfile runs as root: docker/Dockerfile"}, "fullDescription": {"text": "No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b52125c457675095", "name": "Docker base image is tag-pinned but not digest-pinned: eclipse-temurin:17-jdk-resolute", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: eclipse-temurin:17-jdk-resolute"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-adf6c0c7e3923ba7", "name": "Dockerfile pipes a remote installer into a shell", "shortDescription": {"text": "Dockerfile pipes a remote installer into a shell"}, "fullDescription": {"text": "Executing downloaded code during image build gives the remote endpoint build-time code execution. Prefer pinned packages or verify downloaded installers by checksum/signature."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "high", "confidence": 1.0}}, {"id": "scanner-e7171c7a713bf488", "name": "Dockerfile runs as root: docker/postgres-mecab/Dockerfile", "shortDescription": {"text": "Dockerfile runs as root: docker/postgres-mecab/Dockerfile"}, "fullDescription": {"text": "No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-cf4497993e21bf18", "name": "Docker base image is tag-pinned but not digest-pinned: postgres:17", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: postgres:17"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9710c8d059e53154", "name": "No frontend routes/components detected", "shortDescription": {"text": "No frontend routes/components detected"}, "fullDescription": {"text": "No React/Vue/Next routes were found. This is fine for backend-only repos."}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-999099765ad2f768", "name": "Insecure pattern 'weak_hash' in README.md:263", "shortDescription": {"text": "Insecure pattern 'weak_hash' in README.md:263"}, "fullDescription": {"text": "Found a known-risky pattern (weak_hash). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8497df34e491f0bb", "name": "Insecure pattern 'direct_innerhtml_assignment' in server/src/main/resources/static/admin/highlight.min.js:271", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in server/src/main/resources/static/admin/highlight.min.js:271"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-cc7be1b48e8e8df6", "name": "Insecure pattern 'direct_innerhtml_assignment' in server/src/main/resources/static/admin/project-tabs.js:453", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in server/src/main/resources/static/admin/project-tabs.js:453"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-949755f46239e73b", "name": "Insecure pattern 'direct_innerhtml_assignment' in server/src/main/resources/static/admin/keyboard.js:55", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in server/src/main/resources/static/admin/keyboard.js:55"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4601e3ad3bb28677", "name": "No CI/CD pipelines detected", "shortDescription": {"text": "No CI/CD pipelines detected"}, "fullDescription": {"text": "No GitHub Actions, GitLab CI, or CircleCI configs found. Without CI you can't gate deploys on tests/lints."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-284a7b065666e967", "name": "Very large file: server/src/main/resources/static/admin/highlight.min.js (1231 lines)", "shortDescription": {"text": "Very large file: server/src/main/resources/static/admin/highlight.min.js (1231 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6893a6c8b0861585", "name": "Very low test-to-source ratio", "shortDescription": {"text": "Very low test-to-source ratio"}, "fullDescription": {"text": "0 test file(s) for 12 source file(s) (ratio 0.00). Consider adding integration or unit tests for critical paths."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6cae36fdd2f62664", "name": "Node manifest has dependencies but no lockfile: vscode-extension/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: vscode-extension/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b9088664ace7f748", "name": "Composite production-readiness gap", "shortDescription": {"text": "Composite production-readiness gap"}, "fullDescription": {"text": "Multiple low-cost hardening controls are missing together: ci, tests, lockfile. Opus verification showed these co-occurring gaps are a better readiness signal than reading each flag in isolation."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-ba5ca14ce56040bf", "name": "Commented-code block (6 lines) in server/src/main/resources/static/admin/voice-input.js:57", "shortDescription": {"text": "Commented-code block (6 lines) in server/src/main/resources/static/admin/voice-input.js:57"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-b7af970f4f41911c", "name": "Commented-code block (6 lines) in server/src/main/resources/static/admin/console-render.js:371", "shortDescription": {"text": "Commented-code block (6 lines) in server/src/main/resources/static/admin/console-render.js:371"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-2c56ac614d5412e3", "name": "Commented-code block (6 lines) in server/src/main/resources/static/admin/prompt-templates.js:140", "shortDescription": {"text": "Commented-code block (6 lines) in server/src/main/resources/static/admin/prompt-templates.js:140"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-813242223b0d5832", "name": "Commented-code block (5 lines) in server/src/main/resources/static/admin/sw.js:1", "shortDescription": {"text": "Commented-code block (5 lines) in server/src/main/resources/static/admin/sw.js:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-549939d9a4ff721e", "name": "`fetch()` without try/.catch or AbortSignal \u2014 server/src/main/resources/static/admin/sw.js:69", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 server/src/main/resources/static/admin/sw.js:69"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-951c61d155e66386", "name": "Commented-code block (5 lines) in server/src/main/resources/static/admin/file-tree-select.js:12", "shortDescription": {"text": "Commented-code block (5 lines) in server/src/main/resources/static/admin/file-tree-select.js:12"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-b0acf79be761be61", "name": "Commented-code block (9 lines) in server/src/main/resources/static/admin/project-tabs.js:7", "shortDescription": {"text": "Commented-code block (9 lines) in server/src/main/resources/static/admin/project-tabs.js:7"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-faef5995fe9d2b45", "name": "`fetch()` without try/.catch or AbortSignal \u2014 server/src/main/resources/static/admin/project-tabs.js:421", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 server/src/main/resources/static/admin/project-tabs.js:421"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-49107320e007be5a", "name": "Commented-code block (8 lines) in server/src/main/resources/static/admin/keyboard.js:3", "shortDescription": {"text": "Commented-code block (8 lines) in server/src/main/resources/static/admin/keyboard.js:3"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-853cd3de274268e2", "name": "Commented-code block (8 lines) in vscode-extension/src/extension.ts:3", "shortDescription": {"text": "Commented-code block (8 lines) in vscode-extension/src/extension.ts:3"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/19603"}, "properties": {"repository": "siamakerlab/vibe-coder-server", "repoUrl": "https://github.com/siamakerlab/vibe-coder-server", "branch": "main"}, "results": [{"ruleId": "scanner-bead75b0f9233e05", "level": "none", "message": {"text": "No API endpoints detected"}, "properties": {"repobilityId": "0f8bb852027c38f8", "scanner": "scanner-primary", "fingerprint": "bead75b0f9233e05", "layer": "api", "severity": "info", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-fbae31a70732ce8b", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 server/src/main/resources/static/admin/highlight.min.js:107"}, "properties": {"repobilityId": "10bedafab281f79e", "scanner": "scanner-primary", "fingerprint": "fbae31a70732ce8b", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-c014a82ce5da8e0b", "level": "warning", "message": {"text": "Privileged port 10 in use"}, "properties": {"repobilityId": "735372d6b5594915", "scanner": "scanner-primary", "fingerprint": "c014a82ce5da8e0b", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docker/compose.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-1e227ba3f3cb6577", "level": "warning", "message": {"text": "Privileged port 20 in use"}, "properties": {"repobilityId": "a59f3e53d617e0f8", "scanner": "scanner-primary", "fingerprint": "1e227ba3f3cb6577", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docker/compose.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-47636e33caef255d", "level": "warning", "message": {"text": "Dockerfile runs as root: docker/Dockerfile"}, "properties": {"repobilityId": "8a345ba4198453bd", "scanner": "scanner-primary", "fingerprint": "47636e33caef255d", "layer": "hardware", "severity": "medium", "confidence": 1.0, "tags": ["security", "container"]}}, {"ruleId": "scanner-b52125c457675095", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: eclipse-temurin:17-jdk-resolute"}, "properties": {"repobilityId": "55f67ebe6f85013a", "scanner": "scanner-primary", "fingerprint": "b52125c457675095", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docker/Dockerfile"}, "region": {"startLine": 25}}}]}, {"ruleId": "scanner-b52125c457675095", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: eclipse-temurin:17-jdk-resolute"}, "properties": {"repobilityId": "af83327e7e742929", "scanner": "scanner-primary", "fingerprint": "b52125c457675095", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docker/Dockerfile"}, "region": {"startLine": 55}}}]}, {"ruleId": "scanner-adf6c0c7e3923ba7", "level": "error", "message": {"text": "Dockerfile pipes a remote installer into a shell"}, "properties": {"repobilityId": "c4c7f74af41ccb96", "scanner": "scanner-primary", "fingerprint": "adf6c0c7e3923ba7", "layer": "hardware", "severity": "high", "confidence": 1.0, "tags": ["supply-chain", "docker", "remote-installer"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docker/Dockerfile"}, "region": {"startLine": 144}}}]}, {"ruleId": "scanner-e7171c7a713bf488", "level": "warning", "message": {"text": "Dockerfile runs as root: docker/postgres-mecab/Dockerfile"}, "properties": {"repobilityId": "7dced22d1c5a3243", "scanner": "scanner-primary", "fingerprint": "e7171c7a713bf488", "layer": "hardware", "severity": "medium", "confidence": 1.0, "tags": ["security", "container"]}}, {"ruleId": "scanner-cf4497993e21bf18", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: postgres:17"}, "properties": {"repobilityId": "339f1dfd6d0edffa", "scanner": "scanner-primary", "fingerprint": "cf4497993e21bf18", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docker/postgres-mecab/Dockerfile"}, "region": {"startLine": 29}}}]}, {"ruleId": "scanner-9710c8d059e53154", "level": "none", "message": {"text": "No frontend routes/components detected"}, "properties": {"repobilityId": "44ca61485762e494", "scanner": "scanner-primary", "fingerprint": "9710c8d059e53154", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-999099765ad2f768", "level": "warning", "message": {"text": "Insecure pattern 'weak_hash' in README.md:263"}, "properties": {"repobilityId": "5388562008acceec", "scanner": "scanner-primary", "fingerprint": "999099765ad2f768", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "weak_hash"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "README.md"}, "region": {"startLine": 263}}}]}, {"ruleId": "scanner-8497df34e491f0bb", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in server/src/main/resources/static/admin/highlight.min.js:271"}, "properties": {"repobilityId": "d5fe3d8419c40216", "scanner": "scanner-primary", "fingerprint": "8497df34e491f0bb", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server/src/main/resources/static/admin/highlight.min.js"}, "region": {"startLine": 271}}}]}, {"ruleId": "scanner-cc7be1b48e8e8df6", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in server/src/main/resources/static/admin/project-tabs.js:453"}, "properties": {"repobilityId": "eee85a3afa5fe3df", "scanner": "scanner-primary", "fingerprint": "cc7be1b48e8e8df6", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server/src/main/resources/static/admin/project-tabs.js"}, "region": {"startLine": 453}}}]}, {"ruleId": "scanner-949755f46239e73b", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in server/src/main/resources/static/admin/keyboard.js:55"}, "properties": {"repobilityId": "952118f171e9433c", "scanner": "scanner-primary", "fingerprint": "949755f46239e73b", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server/src/main/resources/static/admin/keyboard.js"}, "region": {"startLine": 55}}}]}, {"ruleId": "scanner-4601e3ad3bb28677", "level": "warning", "message": {"text": "No CI/CD pipelines detected"}, "properties": {"repobilityId": "c3ee439bce2bc51e", "scanner": "scanner-primary", "fingerprint": "4601e3ad3bb28677", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-284a7b065666e967", "level": "note", "message": {"text": "Very large file: server/src/main/resources/static/admin/highlight.min.js (1231 lines)"}, "properties": {"repobilityId": "c94f0fa43c98e648", "scanner": "scanner-primary", "fingerprint": "284a7b065666e967", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-6893a6c8b0861585", "level": "warning", "message": {"text": "Very low test-to-source ratio"}, "properties": {"repobilityId": "54a7de3f06314bf0", "scanner": "scanner-primary", "fingerprint": "6893a6c8b0861585", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["tests", "coverage"]}}, {"ruleId": "scanner-6cae36fdd2f62664", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: vscode-extension/package.json"}, "properties": {"repobilityId": "029b1252a84047e3", "scanner": "scanner-primary", "fingerprint": "6cae36fdd2f62664", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "vscode-extension/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "595e33bda1d13d10", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-b9088664ace7f748", "level": "warning", "message": {"text": "Composite production-readiness gap"}, "properties": {"repobilityId": "0896cee1003a8450", "scanner": "scanner-primary", "fingerprint": "b9088664ace7f748", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["production-readiness", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "d3fe3b6f4a082a61", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "984ee47bcd6bd56c", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-ba5ca14ce56040bf", "level": "none", "message": {"text": "Commented-code block (6 lines) in server/src/main/resources/static/admin/voice-input.js:57"}, "properties": {"repobilityId": "3351f35f190754b2", "scanner": "scanner-primary", "fingerprint": "ba5ca14ce56040bf", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-b7af970f4f41911c", "level": "none", "message": {"text": "Commented-code block (6 lines) in server/src/main/resources/static/admin/console-render.js:371"}, "properties": {"repobilityId": "1aec548bbecfd7e4", "scanner": "scanner-primary", "fingerprint": "b7af970f4f41911c", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-2c56ac614d5412e3", "level": "none", "message": {"text": "Commented-code block (6 lines) in server/src/main/resources/static/admin/prompt-templates.js:140"}, "properties": {"repobilityId": "8dbf33f2835e479e", "scanner": "scanner-primary", "fingerprint": "2c56ac614d5412e3", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-813242223b0d5832", "level": "none", "message": {"text": "Commented-code block (5 lines) in server/src/main/resources/static/admin/sw.js:1"}, "properties": {"repobilityId": "a3e923f3436b7322", "scanner": "scanner-primary", "fingerprint": "813242223b0d5832", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-549939d9a4ff721e", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 server/src/main/resources/static/admin/sw.js:69"}, "properties": {"repobilityId": "7cd4b681d38bab9f", "scanner": "scanner-primary", "fingerprint": "549939d9a4ff721e", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-951c61d155e66386", "level": "none", "message": {"text": "Commented-code block (5 lines) in server/src/main/resources/static/admin/file-tree-select.js:12"}, "properties": {"repobilityId": "0adcd95eb9e53d87", "scanner": "scanner-primary", "fingerprint": "951c61d155e66386", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-b0acf79be761be61", "level": "none", "message": {"text": "Commented-code block (9 lines) in server/src/main/resources/static/admin/project-tabs.js:7"}, "properties": {"repobilityId": "b5a17e2fd269dc87", "scanner": "scanner-primary", "fingerprint": "b0acf79be761be61", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-faef5995fe9d2b45", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 server/src/main/resources/static/admin/project-tabs.js:421"}, "properties": {"repobilityId": "2b65b48df6140e20", "scanner": "scanner-primary", "fingerprint": "faef5995fe9d2b45", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-49107320e007be5a", "level": "none", "message": {"text": "Commented-code block (8 lines) in server/src/main/resources/static/admin/keyboard.js:3"}, "properties": {"repobilityId": "901a663706e4331c", "scanner": "scanner-primary", "fingerprint": "49107320e007be5a", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-853cd3de274268e2", "level": "none", "message": {"text": "Commented-code block (8 lines) in vscode-extension/src/extension.ts:3"}, "properties": {"repobilityId": "61ac12124c118265", "scanner": "scanner-primary", "fingerprint": "853cd3de274268e2", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}]}]}