{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-fb464266575069f3", "name": "Stray `console.log` in TS/JS \u2014 api/scripts/test-pay.js:35", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 api/scripts/test-pay.js:35"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-afb4ea23e530d9a9", "name": "Stray `console.log` in TS/JS \u2014 api/src/index.js:201", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 api/src/index.js:201"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f436cb03edfc4f34", "name": "Stray `console.log` in TS/JS \u2014 indexer/scripts/scan-wallet.js:28", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 indexer/scripts/scan-wallet.js:28"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2d2a2604f08f458a", "name": "Stray `console.log` in TS/JS \u2014 indexer/src/index.js:29", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 indexer/src/index.js:29"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c9f929111ea26d2a", "name": "Stray `console.log` in TS/JS \u2014 contracts/scripts/test-register.js:33", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 contracts/scripts/test-register.js:33"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-731d16a42441376e", "name": "Stray `console.log` in TS/JS \u2014 contracts/scripts/register-bot.js:60", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 contracts/scripts/register-bot.js:60"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-bfc38ab3c91f5975", "name": "Stray `console.log` in TS/JS \u2014 contracts/scripts/deploy.js:36", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 contracts/scripts/deploy.js:36"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9bb22953e57ce80d", "name": "Stray `console.log` in TS/JS \u2014 contracts/scripts/send-to-deployer.js:31", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 contracts/scripts/send-to-deployer.js:31"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fbc6a946214599c4", "name": "Stray `console.log` in TS/JS \u2014 contracts/scripts/gen-deployer.js:41", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 contracts/scripts/gen-deployer.js:41"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a1da9a2a35f4ac2e", "name": "Dockerfile runs as root: api/Dockerfile", "shortDescription": {"text": "Dockerfile runs as root: api/Dockerfile"}, "fullDescription": {"text": "No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-efd5a820a6ce56e9", "name": "Docker base image is tag-pinned but not digest-pinned: node:24-alpine", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: node:24-alpine"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3016824c25bdac9f", "name": "Docker base image is tag-pinned but not digest-pinned: node:24-alpine", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: node:24-alpine"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-aa5acaa49eb8315b", "name": "Containers defined but no K8s/orchestration manifest found", "shortDescription": {"text": "Containers defined but no K8s/orchestration manifest found"}, "fullDescription": {"text": "Repo has Dockerfiles/compose but no Kubernetes/Nomad manifests. If the target deployment is K8s, the manifests may live in a separate ops repo."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6e2d79ac187d7a8a", "name": "Insecure pattern 'node_child_process' in scripts/x-publish/publish.mjs:18", "shortDescription": {"text": "Insecure pattern 'node_child_process' in scripts/x-publish/publish.mjs:18"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f0e06c8f7210502b", "name": "Insecure pattern 'node_child_process' in scripts/x-publish/set-profile.mjs:10", "shortDescription": {"text": "Insecure pattern 'node_child_process' in scripts/x-publish/set-profile.mjs:10"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea3b5e389d8c9c0f", "name": "Low test-to-source ratio", "shortDescription": {"text": "Low test-to-source ratio"}, "fullDescription": {"text": "4 tests / 35 src (ratio 0.11)."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-141b30a41e03817b", "name": "No license file detected", "shortDescription": {"text": "No license file detected"}, "fullDescription": {"text": "No LICENSE/COPYING/NOTICE file was found. Generated repositories often omit licensing, which blocks reuse and automated intake."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 203 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-749d4bc1bd66df5f", "name": "Agent instructions exist but release-hardening basics are missing", "shortDescription": {"text": "Agent instructions exist but release-hardening basics are missing"}, "fullDescription": {"text": "AI-coder instruction files were found, but the repo is missing license. Treat this as a contract gap: the agent is guided, but the generated output is not yet guarded by the controls that make it repeatable."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-ce89fad7a77fac0b", "name": "Agent authority lacks a verifier contract: web/.claude/launch.json", "shortDescription": {"text": "Agent authority lacks a verifier contract: web/.claude/launch.json"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3a486928dd38e3f4", "name": "Commented-code block (6 lines) in scripts/x-publish/publish.mjs:4", "shortDescription": {"text": "Commented-code block (6 lines) in scripts/x-publish/publish.mjs:4"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-085d4ed684c3581e", "name": "`fetch()` without try/.catch or AbortSignal \u2014 scripts/x-publish/weekly-stats.mjs:27", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 scripts/x-publish/weekly-stats.mjs:27"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a30d493d706229a9", "name": "Commented-code block (9 lines) in cli/stakedbots.mjs:13", "shortDescription": {"text": "Commented-code block (9 lines) in cli/stakedbots.mjs:13"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-b8494300067942b6", "name": "`fetch()` without try/.catch or AbortSignal \u2014 web/lib/api.ts:46", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 web/lib/api.ts:46"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4041451c98229236", "name": "Legacy-named symbol `base_sepolia_registry_v1` in indexer/src/config.js:10", "shortDescription": {"text": "Legacy-named symbol `base_sepolia_registry_v1` in indexer/src/config.js:10"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cdf2aaa51b46e920", "name": "Legacy-named symbol `_registry_v1` in indexer/src/transfers.js:86", "shortDescription": {"text": "Legacy-named symbol `_registry_v1` in indexer/src/transfers.js:86"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8d66422b1b65723d", "name": "Commented-code block (7 lines) in contracts/scripts/register-bot.js:12", "shortDescription": {"text": "Commented-code block (7 lines) in contracts/scripts/register-bot.js:12"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-d785c17821858dcb", "name": "22 env vars used in code but missing from .env.example", "shortDescription": {"text": "22 env vars used in code but missing from .env.example"}, "fullDescription": {"text": "Drift between code and config docs. The first few: `AMOUNT_ETH`, `ATTEST`, `ATTEST_EPOCH`, `BASE_SEPOLIA_RPC`, `BOT_ID`, `BOT_WALLET`, `CDP_API_KEY_ID`, `CDP_API_KEY_SECRET` + 14 more. Add them (with a placeholder/comment) to .env.example so onboarding doesn't break."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5baa8971ebe192a1", "name": "Unused endpoint: GET /", "shortDescription": {"text": "Unused endpoint: GET /"}, "fullDescription": {"text": "`api/src/index.js` declares `GET /` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-968d4311ce08cfe9", "name": "Unused endpoint: GET /openapi.json", "shortDescription": {"text": "Unused endpoint: GET /openapi.json"}, "fullDescription": {"text": "`api/src/index.js` declares `GET /openapi.json` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4526733ac363578e", "name": "Unused endpoint: GET /bots", "shortDescription": {"text": "Unused endpoint: GET /bots"}, "fullDescription": {"text": "`api/src/index.js` declares `GET /bots` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2bcc24953f898ce8", "name": "Unused endpoint: GET /bots/:id", "shortDescription": {"text": "Unused endpoint: GET /bots/:id"}, "fullDescription": {"text": "`api/src/index.js` declares `GET /bots/:id` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4b852bf93fed2f7f", "name": "Unused endpoint: GET /bots/:id/detail", "shortDescription": {"text": "Unused endpoint: GET /bots/:id/detail"}, "fullDescription": {"text": "`api/src/index.js` declares `GET /bots/:id/detail` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6f43089f530485de", "name": "Unused endpoint: GET /bots/:id/events", "shortDescription": {"text": "Unused endpoint: GET /bots/:id/events"}, "fullDescription": {"text": "`api/src/index.js` declares `GET /bots/:id/events` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/20226"}, "properties": {"repository": "stakedbots/bot-registry", "repoUrl": "https://github.com/stakedbots/bot-registry", "branch": "main"}, "results": [{"ruleId": "scanner-fb464266575069f3", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 api/scripts/test-pay.js:35"}, "properties": {"repobilityId": "88e8406d99cbd1f0", "scanner": "scanner-primary", "fingerprint": "fb464266575069f3", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-afb4ea23e530d9a9", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 api/src/index.js:201"}, "properties": {"repobilityId": "d970175708f231f0", "scanner": "scanner-primary", "fingerprint": "afb4ea23e530d9a9", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-f436cb03edfc4f34", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 indexer/scripts/scan-wallet.js:28"}, "properties": {"repobilityId": "ff32c5f2ede96fb9", "scanner": "scanner-primary", "fingerprint": "f436cb03edfc4f34", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-2d2a2604f08f458a", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 indexer/src/index.js:29"}, "properties": {"repobilityId": "8e6f8bcf4c7c47c9", "scanner": "scanner-primary", "fingerprint": "2d2a2604f08f458a", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-c9f929111ea26d2a", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 contracts/scripts/test-register.js:33"}, "properties": {"repobilityId": "d33e44776938ab2c", "scanner": "scanner-primary", "fingerprint": "c9f929111ea26d2a", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-731d16a42441376e", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 contracts/scripts/register-bot.js:60"}, "properties": {"repobilityId": "56e606e44791da31", "scanner": "scanner-primary", "fingerprint": "731d16a42441376e", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-bfc38ab3c91f5975", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 contracts/scripts/deploy.js:36"}, "properties": {"repobilityId": "d4bf4ec2c07658e7", "scanner": "scanner-primary", "fingerprint": "bfc38ab3c91f5975", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-9bb22953e57ce80d", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 contracts/scripts/send-to-deployer.js:31"}, "properties": {"repobilityId": "4d57999a132cfcce", "scanner": "scanner-primary", "fingerprint": "9bb22953e57ce80d", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-fbc6a946214599c4", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 contracts/scripts/gen-deployer.js:41"}, "properties": {"repobilityId": "3053353e83077426", "scanner": "scanner-primary", "fingerprint": "fbc6a946214599c4", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-a1da9a2a35f4ac2e", "level": "warning", "message": {"text": "Dockerfile runs as root: api/Dockerfile"}, "properties": {"repobilityId": "d158f2064abae541", "scanner": "scanner-primary", "fingerprint": "a1da9a2a35f4ac2e", "layer": "hardware", "severity": "medium", "confidence": 1.0, "tags": ["security", "container"]}}, {"ruleId": "scanner-efd5a820a6ce56e9", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: node:24-alpine"}, "properties": {"repobilityId": "f89ece124b3b5e3a", "scanner": "scanner-primary", "fingerprint": "efd5a820a6ce56e9", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "api/Dockerfile"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3016824c25bdac9f", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: node:24-alpine"}, "properties": {"repobilityId": "b0ccde341043d804", "scanner": "scanner-primary", "fingerprint": "3016824c25bdac9f", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "web/Dockerfile"}, "region": {"startLine": 3}}}]}, {"ruleId": "scanner-3016824c25bdac9f", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: node:24-alpine"}, "properties": {"repobilityId": "fd04dc9ba1da6e01", "scanner": "scanner-primary", "fingerprint": "3016824c25bdac9f", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "web/Dockerfile"}, "region": {"startLine": 8}}}]}, {"ruleId": "scanner-3016824c25bdac9f", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: node:24-alpine"}, "properties": {"repobilityId": "49c20533005759a6", "scanner": "scanner-primary", "fingerprint": "3016824c25bdac9f", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "web/Dockerfile"}, "region": {"startLine": 17}}}]}, {"ruleId": "scanner-aa5acaa49eb8315b", "level": "note", "message": {"text": "Containers defined but no K8s/orchestration manifest found"}, "properties": {"repobilityId": "b230ea9b68736081", "scanner": "scanner-primary", "fingerprint": "aa5acaa49eb8315b", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["coverage", "deployment"]}}, {"ruleId": "scanner-6e2d79ac187d7a8a", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in scripts/x-publish/publish.mjs:18"}, "properties": {"repobilityId": "49dc1520c64361c7", "scanner": "scanner-primary", "fingerprint": "6e2d79ac187d7a8a", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/x-publish/publish.mjs"}, "region": {"startLine": 18}}}]}, {"ruleId": "scanner-f0e06c8f7210502b", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in scripts/x-publish/set-profile.mjs:10"}, "properties": {"repobilityId": "6ff4654ff3fab658", "scanner": "scanner-primary", "fingerprint": "f0e06c8f7210502b", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/x-publish/set-profile.mjs"}, "region": {"startLine": 10}}}]}, {"ruleId": "scanner-ea3b5e389d8c9c0f", "level": "note", "message": {"text": "Low test-to-source ratio"}, "properties": {"repobilityId": "ef7b2552cc00a375", "scanner": "scanner-primary", "fingerprint": "ea3b5e389d8c9c0f", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["tests"]}}, {"ruleId": "scanner-141b30a41e03817b", "level": "note", "message": {"text": "No license file detected"}, "properties": {"repobilityId": "dfb68647b052cc1f", "scanner": "scanner-primary", "fingerprint": "141b30a41e03817b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["license", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "5bab4228b1291ccd", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-749d4bc1bd66df5f", "level": "warning", "message": {"text": "Agent instructions exist but release-hardening basics are missing"}, "properties": {"repobilityId": "d77ca991e64b8b2b", "scanner": "scanner-primary", "fingerprint": "749d4bc1bd66df5f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "02b775b8b2a93322", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "9d0fb75bc037c549", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-ce89fad7a77fac0b", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: web/.claude/launch.json"}, "properties": {"repobilityId": "21c7b2884e621ce9", "scanner": "scanner-primary", "fingerprint": "ce89fad7a77fac0b", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "web/.claude/launch.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3a486928dd38e3f4", "level": "none", "message": {"text": "Commented-code block (6 lines) in scripts/x-publish/publish.mjs:4"}, "properties": {"repobilityId": "8277de99c08e6aec", "scanner": "scanner-primary", "fingerprint": "3a486928dd38e3f4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-085d4ed684c3581e", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 scripts/x-publish/weekly-stats.mjs:27"}, "properties": {"repobilityId": "fc36abb136e14bfa", "scanner": "scanner-primary", "fingerprint": "085d4ed684c3581e", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-a30d493d706229a9", "level": "none", "message": {"text": "Commented-code block (9 lines) in cli/stakedbots.mjs:13"}, "properties": {"repobilityId": "c19889f61c9ba02d", "scanner": "scanner-primary", "fingerprint": "a30d493d706229a9", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-b8494300067942b6", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 web/lib/api.ts:46"}, "properties": {"repobilityId": "78e45fba0b1d5f70", "scanner": "scanner-primary", "fingerprint": "b8494300067942b6", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-4041451c98229236", "level": "note", "message": {"text": "Legacy-named symbol `base_sepolia_registry_v1` in indexer/src/config.js:10"}, "properties": {"repobilityId": "95673694414d2fdd", "scanner": "scanner-primary", "fingerprint": "4041451c98229236", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-cdf2aaa51b46e920", "level": "note", "message": {"text": "Legacy-named symbol `_registry_v1` in indexer/src/transfers.js:86"}, "properties": {"repobilityId": "e9d07c567b682e99", "scanner": "scanner-primary", "fingerprint": "cdf2aaa51b46e920", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-8d66422b1b65723d", "level": "none", "message": {"text": "Commented-code block (7 lines) in contracts/scripts/register-bot.js:12"}, "properties": {"repobilityId": "ffb6779b5df874ed", "scanner": "scanner-primary", "fingerprint": "8d66422b1b65723d", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-d785c17821858dcb", "level": "note", "message": {"text": "22 env vars used in code but missing from .env.example"}, "properties": {"repobilityId": "f5222babac44ad42", "scanner": "scanner-primary", "fingerprint": "d785c17821858dcb", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "config-drift"]}}, {"ruleId": "scanner-5baa8971ebe192a1", "level": "note", "message": {"text": "Unused endpoint: GET /"}, "properties": {"repobilityId": "53392fd5f435b85b", "scanner": "scanner-primary", "fingerprint": "5baa8971ebe192a1", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-968d4311ce08cfe9", "level": "note", "message": {"text": "Unused endpoint: GET /openapi.json"}, "properties": {"repobilityId": "90350c400b59b46b", "scanner": "scanner-primary", "fingerprint": "968d4311ce08cfe9", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-4526733ac363578e", "level": "note", "message": {"text": "Unused endpoint: GET /bots"}, "properties": {"repobilityId": "1b09a69423d6471d", "scanner": "scanner-primary", "fingerprint": "4526733ac363578e", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-2bcc24953f898ce8", "level": "note", "message": {"text": "Unused endpoint: GET /bots/:id"}, "properties": {"repobilityId": "058cb9ce674bbda8", "scanner": "scanner-primary", "fingerprint": "2bcc24953f898ce8", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-4b852bf93fed2f7f", "level": "note", "message": {"text": "Unused endpoint: GET /bots/:id/detail"}, "properties": {"repobilityId": "3d3fad4c6b538d93", "scanner": "scanner-primary", "fingerprint": "4b852bf93fed2f7f", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-6f43089f530485de", "level": "note", "message": {"text": "Unused endpoint: GET /bots/:id/events"}, "properties": {"repobilityId": "a6877c39ab1e4a52", "scanner": "scanner-primary", "fingerprint": "6f43089f530485de", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}]}]}