{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-e136515d952f12d9", "name": "Possibly dead Python function: add_task_endpoint", "shortDescription": {"text": "Possibly dead Python function: add_task_endpoint"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7e978c193a4d96ba", "name": "Possibly dead Python function: setup_cors", "shortDescription": {"text": "Possibly dead Python function: setup_cors"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b5a6c0defd88e91b", "name": "Possibly dead Python function: send_to_client", "shortDescription": {"text": "Possibly dead Python function: send_to_client"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d9eddc992e054eea", "name": "Possibly dead Python function: broadcast_event", "shortDescription": {"text": "Possibly dead Python function: broadcast_event"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c613da22936f49ce", "name": "Possibly dead Python function: send_event_to_topic", "shortDescription": {"text": "Possibly dead Python function: send_event_to_topic"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-14363f14160af096", "name": "Possibly dead Python function: send_mqtt_message", "shortDescription": {"text": "Possibly dead Python function: send_mqtt_message"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1687fb7477d7d875", "name": "Possibly dead Python function: load_specific_secret", "shortDescription": {"text": "Possibly dead Python function: load_specific_secret"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c60ea6ec1b794410", "name": "Possibly dead Python function: create_secret_environment_map", "shortDescription": {"text": "Possibly dead Python function: create_secret_environment_map"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ec332b2dcf7bff7c", "name": "Possibly dead Python function: validate_required_secrets", "shortDescription": {"text": "Possibly dead Python function: validate_required_secrets"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-daa59ffb8b922db6", "name": "Possibly dead Python function: load_and_inject_realtime_secrets", "shortDescription": {"text": "Possibly dead Python function: load_and_inject_realtime_secrets"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-069c25f8c745009a", "name": "Possibly dead Python function: validate_webservice_realtime_integration", "shortDescription": {"text": "Possibly dead Python function: validate_webservice_realtime_integration"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a2c79bd7fb77884b", "name": "Possibly dead Python function: generate_webservice_secret_configuration", "shortDescription": {"text": "Possibly dead Python function: generate_webservice_secret_configuration"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6609e3fd8a701857", "name": "Possibly dead Python function: add_task_endpoint", "shortDescription": {"text": "Possibly dead Python function: add_task_endpoint"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-88d24c26521119bb", "name": "Possibly dead Python function: setup_cors", "shortDescription": {"text": "Possibly dead Python function: setup_cors"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-943c52f31541bb0c", "name": "Possibly dead Python function: handle_agent_request", "shortDescription": {"text": "Possibly dead Python function: handle_agent_request"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-13606e79bf61b9ff", "name": "Possibly dead Python function: send_to_client", "shortDescription": {"text": "Possibly dead Python function: send_to_client"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5c848bf1c55ae913", "name": "Stray `console.log` in TS/JS \u2014 factory/substrate/crossplane/graphql/schema-discovery/merge-schemas.js:49", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 factory/substrate/crossplane/graphql/schema-discovery/merge-schemas.js:49"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-396e1f24b13a9a7c", "name": "Privileged port 8 in use", "shortDescription": {"text": "Privileged port 8 in use"}, "fullDescription": {"text": "Port 8 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-59426bbd09647e11", "name": "Privileged port 18 in use", "shortDescription": {"text": "Privileged port 18 in use"}, "fullDescription": {"text": "Port 18 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-655878fd60864ab6", "name": "Privileged port 43 in use", "shortDescription": {"text": "Privileged port 43 in use"}, "fullDescription": {"text": "Port 43 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-71ed4106a6eeae41", "name": "Privileged port 9 in use", "shortDescription": {"text": "Privileged port 9 in use"}, "fullDescription": {"text": "Port 9 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a89cd0cf91588edf", "name": "Privileged port 13 in use", "shortDescription": {"text": "Privileged port 13 in use"}, "fullDescription": {"text": "Port 13 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-698c997baf91238b", "name": "Privileged port 16 in use", "shortDescription": {"text": "Privileged port 16 in use"}, "fullDescription": {"text": "Port 16 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-48277233bee6c2f2", "name": "Privileged port 29 in use", "shortDescription": {"text": "Privileged port 29 in use"}, "fullDescription": {"text": "Port 29 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-464e28390435b2d9", "name": "Privileged port 48 in use", "shortDescription": {"text": "Privileged port 48 in use"}, "fullDescription": {"text": "Port 48 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-18828e6cda1a481e", "name": "Privileged port 23 in use", "shortDescription": {"text": "Privileged port 23 in use"}, "fullDescription": {"text": "Port 23 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7e1346b8f9b0aed5", "name": "Privileged port 30 in use", "shortDescription": {"text": "Privileged port 30 in use"}, "fullDescription": {"text": "Port 30 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-80cb82304b5eb10f", "name": "Privileged port 37 in use", "shortDescription": {"text": "Privileged port 37 in use"}, "fullDescription": {"text": "Port 37 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-89d7b5b1b471cb5a", "name": "Privileged port 26 in use", "shortDescription": {"text": "Privileged port 26 in use"}, "fullDescription": {"text": "Port 26 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a9041e730c11a82b", "name": "Privileged port 39 in use", "shortDescription": {"text": "Privileged port 39 in use"}, "fullDescription": {"text": "Port 39 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-33ba9f2ad3b1355a", "name": "Privileged port 1000 in use", "shortDescription": {"text": "Privileged port 1000 in use"}, "fullDescription": {"text": "Port 1000 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0751be323ff76a80", "name": "Privileged port 1001 in use", "shortDescription": {"text": "Privileged port 1001 in use"}, "fullDescription": {"text": "Port 1001 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-31919749d8bc26e5", "name": "Dockerfile runs as root: microservices/accountant-deterministic/Dockerfile", "shortDescription": {"text": "Dockerfile runs as root: microservices/accountant-deterministic/Dockerfile"}, "fullDescription": {"text": "No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-236e1367a50a4947", "name": "Docker base image is tag-pinned but not digest-pinned: python:3.11-slim", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: python:3.11-slim"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6330b9253d197726", "name": "Dockerfile runs as root: microservices/project-manager-anthropic/Dockerfile", "shortDescription": {"text": "Dockerfile runs as root: microservices/project-manager-anthropic/Dockerfile"}, "fullDescription": {"text": "No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c8956ebeea4cc37c", "name": "Docker base image is tag-pinned but not digest-pinned: python:3.11-slim", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: python:3.11-slim"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c30202c582b406cf", "name": "Dockerfile runs as root: microservices/infrastructure-architect-deterministic/Dockerfile", "shortDescription": {"text": "Dockerfile runs as root: microservices/infrastructure-architect-deterministic/Dockerfile"}, "fullDescription": {"text": "No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-feacc33d6a9d93ce", "name": "Docker base image is tag-pinned but not digest-pinned: python:3.11-slim", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: python:3.11-slim"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f869e2c51adfb0af", "name": "Dockerfile runs as root: microservices/project-manager-deterministic/Dockerfile", "shortDescription": {"text": "Dockerfile runs as root: microservices/project-manager-deterministic/Dockerfile"}, "fullDescription": {"text": "No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ecd9e1b8cf8cc9f6", "name": "Docker base image is tag-pinned but not digest-pinned: python:3.11-slim", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: python:3.11-slim"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2086af0264f29c56", "name": "Dockerfile runs as root: microservices/application-architect-anthropic/Dockerfile", "shortDescription": {"text": "Dockerfile runs as root: microservices/application-architect-anthropic/Dockerfile"}, "fullDescription": {"text": "No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7e153e775cb0ee53", "name": "Docker base image is tag-pinned but not digest-pinned: python:3.11-slim", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: python:3.11-slim"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d0792696217b995b", "name": "Dockerfile runs as root: microservices/business-analyst-anthropic/Dockerfile", "shortDescription": {"text": "Dockerfile runs as root: microservices/business-analyst-anthropic/Dockerfile"}, "fullDescription": {"text": "No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-91636c54f780ba1b", "name": "Docker base image is tag-pinned but not digest-pinned: python:3.11-slim", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: python:3.11-slim"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f1126a06123ac04e", "name": "Dockerfile runs as root: microservices/developer-anthropic/Dockerfile", "shortDescription": {"text": "Dockerfile runs as root: microservices/developer-anthropic/Dockerfile"}, "fullDescription": {"text": "No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ddab7feea6f0b457", "name": "Docker base image is tag-pinned but not digest-pinned: python:3.11-slim", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: python:3.11-slim"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-244f87b86648d115", "name": "Docker base image is tag-pinned but not digest-pinned: python:3.11-slim", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: python:3.11-slim"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d9b065afba5ac91c", "name": "Dockerfile runs as root: microservices/infrastructure-architect-anthropic/Dockerfile", "shortDescription": {"text": "Dockerfile runs as root: microservices/infrastructure-architect-anthropic/Dockerfile"}, "fullDescription": {"text": "No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9fa402b1db8b662f", "name": "Docker base image is tag-pinned but not digest-pinned: python:3.11-slim", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: python:3.11-slim"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e826b8bbb4dcf7e9", "name": "Dockerfile runs as root: microservices/business-analyst-deterministic/Dockerfile", "shortDescription": {"text": "Dockerfile runs as root: microservices/business-analyst-deterministic/Dockerfile"}, "fullDescription": {"text": "No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-448893bde7929822", "name": "Docker base image is tag-pinned but not digest-pinned: python:3.11-slim", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: python:3.11-slim"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4c6ec27749e7271a", "name": "Dockerfile runs as root: microservices/business-architect-anthropic/Dockerfile", "shortDescription": {"text": "Dockerfile runs as root: microservices/business-architect-anthropic/Dockerfile"}, "fullDescription": {"text": "No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-cc74a037512b08d4", "name": "Docker base image is tag-pinned but not digest-pinned: python:3.11-slim", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: python:3.11-slim"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-39d53459a36631f2", "name": "Dockerfile runs as root: microservices/application-architect-deterministic/Dockerfile", "shortDescription": {"text": "Dockerfile runs as root: microservices/application-architect-deterministic/Dockerfile"}, "fullDescription": {"text": "No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d33946eaf7053a4c", "name": "Docker base image is tag-pinned but not digest-pinned: python:3.11-slim", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: python:3.11-slim"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4f8ac08c21edd211", "name": "Dockerfile runs as root: microservices/solution-architect-deterministic/Dockerfile", "shortDescription": {"text": "Dockerfile runs as root: microservices/solution-architect-deterministic/Dockerfile"}, "fullDescription": {"text": "No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-5e8b0e0525090a12", "name": "Docker base image is tag-pinned but not digest-pinned: python:3.11-slim", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: python:3.11-slim"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-443a642b45074b60", "name": "Dockerfile runs as root: microservices/developer-deterministic/Dockerfile", "shortDescription": {"text": "Dockerfile runs as root: microservices/developer-deterministic/Dockerfile"}, "fullDescription": {"text": "No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c9961293d1c0d0cc", "name": "Docker base image is tag-pinned but not digest-pinned: python:3.11-slim", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: python:3.11-slim"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7093d2baf2316962", "name": "Dockerfile runs as root: microservices/solution-architect-anthropic/Dockerfile", "shortDescription": {"text": "Dockerfile runs as root: microservices/solution-architect-anthropic/Dockerfile"}, "fullDescription": {"text": "No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d92265827096c7ff", "name": "Docker base image is tag-pinned but not digest-pinned: python:3.11-slim", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: python:3.11-slim"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b0ae894946359aa3", "name": "Dockerfile runs as root: microservices/accountant-anthropic/Dockerfile", "shortDescription": {"text": "Dockerfile runs as root: microservices/accountant-anthropic/Dockerfile"}, "fullDescription": {"text": "No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7680deabf3443fc7", "name": "Docker base image is tag-pinned but not digest-pinned: python:3.11-slim", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: python:3.11-slim"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cb928a2bf0df05c6", "name": "Dockerfile runs as root: microservices/streamlit-frontend/Dockerfile", "shortDescription": {"text": "Dockerfile runs as root: microservices/streamlit-frontend/Dockerfile"}, "fullDescription": {"text": "No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-cee5df4866f58891", "name": "Docker base image is tag-pinned but not digest-pinned: python:3.11-slim", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: python:3.11-slim"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7f8ea8d0cfe9ca3c", "name": "Dockerfile runs as root: microservices/orchestration-service/Dockerfile", "shortDescription": {"text": "Dockerfile runs as root: microservices/orchestration-service/Dockerfile"}, "fullDescription": {"text": "No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-42af1622bd8ec3af", "name": "Docker base image is tag-pinned but not digest-pinned: python:3.11-slim", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: python:3.11-slim"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d08dc38b9f79d30b", "name": "Dockerfile runs as root: microservices/business-architect-deterministic/Dockerfile", "shortDescription": {"text": "Dockerfile runs as root: microservices/business-architect-deterministic/Dockerfile"}, "fullDescription": {"text": "No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ec9949ca8624f5c3", "name": "Docker base image is tag-pinned but not digest-pinned: python:3.11-slim", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: python:3.11-slim"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-05ed87712d371821", "name": "Docker base image is tag-pinned but not digest-pinned: python:3.11-slim", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: python:3.11-slim"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b0c52a797e030920", "name": "Docker base image is tag-pinned but not digest-pinned: python:3.11-slim", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: python:3.11-slim"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5a236a655bd95afb", "name": "Docker base image is tag-pinned but not digest-pinned: python:3.11-slim", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: python:3.11-slim"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-daafe42db9c6ed86", "name": "Docker base image is tag-pinned but not digest-pinned: python:3.11-slim", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: python:3.11-slim"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5ff24f8df9c71423", "name": "Docker base image is tag-pinned but not digest-pinned: python:3.11-slim", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: python:3.11-slim"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-241b49e62a13e757", "name": "Docker base image is tag-pinned but not digest-pinned: node:22-bookworm-slim", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: node:22-bookworm-slim"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ea6f10b251e57df8", "name": "Dockerfile ADD downloads remote content without checksum", "shortDescription": {"text": "Dockerfile ADD downloads remote content without checksum"}, "fullDescription": {"text": "Remote build inputs can change or be replaced upstream. Use Dockerfile ADD --checksum or download with an explicit digest/signature verification step."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d3fc8f54df7bcd1f", "name": "Dockerfile runs as root: factory/production-lines/traditional-cloud/adapters/mscv-image/Dockerfile", "shortDescription": {"text": "Dockerfile runs as root: factory/production-lines/traditional-cloud/adapters/mscv-image/Dockerfile"}, "fullDescription": {"text": "No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-381352b404671270", "name": "Docker base image is tag-pinned but not digest-pinned: alpine:3.18", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: alpine:3.18"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cd9b4b321fab1867", "name": "Docker base image is tag-pinned but not digest-pinned: python:3.10-slim", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: python:3.10-slim"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e4d5f2a730b0095d", "name": "Dockerfile runs as root: factory/substrate/crossplane/graphql/schema-discovery/Dockerfile", "shortDescription": {"text": "Dockerfile runs as root: factory/substrate/crossplane/graphql/schema-discovery/Dockerfile"}, "fullDescription": {"text": "No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-96559511b489fbf7", "name": "Docker base image is tag-pinned but not digest-pinned: alpine:3.18", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: alpine:3.18"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f47643768776601a", "name": "Docker base image is tag-pinned but not digest-pinned: python:3.11-slim", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: python:3.11-slim"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-62cc53e511557efb", "name": "Dockerfile runs as root: factory/substrate/images/realtime-kafka-connect/Dockerfile", "shortDescription": {"text": "Dockerfile runs as root: factory/substrate/images/realtime-kafka-connect/Dockerfile"}, "fullDescription": {"text": "No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b5042218ab5d4a25", "name": "Dockerfile runs as root: factory/utilities/identity-template-generator/Dockerfile", "shortDescription": {"text": "Dockerfile runs as root: factory/utilities/identity-template-generator/Dockerfile"}, "fullDescription": {"text": "No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-16f5f9c823775f8d", "name": "Docker base image is tag-pinned but not digest-pinned: ubuntu:22.04", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: ubuntu:22.04"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9710c8d059e53154", "name": "No frontend routes/components detected", "shortDescription": {"text": "No frontend routes/components detected"}, "fullDescription": {"text": "No React/Vue/Next routes were found. This is fine for backend-only repos."}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-b650a607e4e5eea3", "name": "Possible secret in archive/neon-credentials-secret.yaml", "shortDescription": {"text": "Possible secret in archive/neon-credentials-secret.yaml"}, "fullDescription": {"text": "Detected pattern matching password_literal. Rotate the credential and move to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-0b0a527016b5857f", "name": "Possible secret in archive/requirements/definitions/parking-platform-oam.yaml", "shortDescription": {"text": "Possible secret in archive/requirements/definitions/parking-platform-oam.yaml"}, "fullDescription": {"text": "Detected pattern matching password_literal. Rotate the credential and move to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-d96382af11109fc1", "name": "Insecure pattern 'cors_wildcard' in archive/cluster-snapshots/2026-05-30-2232/compositions.yaml:8303", "shortDescription": {"text": "Insecure pattern 'cors_wildcard' in archive/cluster-snapshots/2026-05-30-2232/compositions.yaml:8303"}, "fullDescription": {"text": "Found a known-risky pattern (cors_wildcard). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-07d133a8926ee49c", "name": "Possible secret in microservices/business-analyst-anthropic/README.md", "shortDescription": {"text": "Possible secret in microservices/business-analyst-anthropic/README.md"}, "fullDescription": {"text": "Detected pattern matching generic_api_key. Rotate the credential and move to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-487ae4ede189ad21", "name": "Insecure pattern 'cors_wildcard' in microservices/business-analyst-anthropic/shared-libs/agent-common/src/agent_common/f", "shortDescription": {"text": "Insecure pattern 'cors_wildcard' in microservices/business-analyst-anthropic/shared-libs/agent-common/src/agent_common/fastapi_utils.py:180"}, "fullDescription": {"text": "Found a known-risky pattern (cors_wildcard). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-5a9b127fb8df0d21", "name": "Insecure pattern 'cors_wildcard' in microservices/shared-libs/agent-common/src/agent_common/fastapi_utils.py:180", "shortDescription": {"text": "Insecure pattern 'cors_wildcard' in microservices/shared-libs/agent-common/src/agent_common/fastapi_utils.py:180"}, "fullDescription": {"text": "Found a known-risky pattern (cors_wildcard). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4340e3caa8fd1945", "name": "Insecure pattern 'cors_wildcard' in microservices/shared-libs/agent-common/src/agent_common/realtime_fastapi.py:409", "shortDescription": {"text": "Insecure pattern 'cors_wildcard' in microservices/shared-libs/agent-common/src/agent_common/realtime_fastapi.py:409"}, "fullDescription": {"text": "Found a known-risky pattern (cors_wildcard). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f1a75d4ede092841", "name": "Insecure pattern 'direct_innerhtml_assignment' in graphify-out/graph.html:135", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in graphify-out/graph.html:135"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-db31e76ebebffa51", "name": "Insecure pattern 'tls_verify_false' in factory/adapters/intake-slack/src/infrastructure/argo_client.py:181", "shortDescription": {"text": "Insecure pattern 'tls_verify_false' in factory/adapters/intake-slack/src/infrastructure/argo_client.py:181"}, "fullDescription": {"text": "Found a known-risky pattern (tls_verify_false). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-5d79b4b544afa9de", "name": "Insecure pattern 'tls_verify_false' in factory/shared-libs/capability-mcp-core/src/infrastructure/argo_client.py:69", "shortDescription": {"text": "Insecure pattern 'tls_verify_false' in factory/shared-libs/capability-mcp-core/src/infrastructure/argo_client.py:69"}, "fullDescription": {"text": "Found a known-risky pattern (tls_verify_false). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-fc3aa9f76df31208", "name": "Insecure pattern 'cors_wildcard' in factory/substrate/crossplane/graphql-platform-claim-composition.yaml:88", "shortDescription": {"text": "Insecure pattern 'cors_wildcard' in factory/substrate/crossplane/graphql-platform-claim-composition.yaml:88"}, "fullDescription": {"text": "Found a known-risky pattern (cors_wildcard). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-799f5ba25caec73b", "name": "Possible secret in factory/substrate/crossplane/realtime-platform/06-lenses-hq-deployment.yaml", "shortDescription": {"text": "Possible secret in factory/substrate/crossplane/realtime-platform/06-lenses-hq-deployment.yaml"}, "fullDescription": {"text": "Detected pattern matching password_literal. Rotate the credential and move to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-3d80db577ec961d1", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b3c5f76155980dad", "name": "GitHub Action tracks a moving branch", "shortDescription": {"text": "GitHub Action tracks a moving branch"}, "fullDescription": {"text": "aquasecurity/trivy-action@master can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "high", "confidence": 1.0}}, {"id": "scanner-d1ac377d04f17482", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-cb0a2d0542bd11d8", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "aws-actions/configure-aws-credentials@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8cd6f464d9060021", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ecb9cc9f0623db25", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8ed8742047bbb5d1", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a3c329ba0df2dea7", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-aad98400d0637d92", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a04111879b3623a7", "name": "GitHub Action tracks a moving branch", "shortDescription": {"text": "GitHub Action tracks a moving branch"}, "fullDescription": {"text": "aquasecurity/trivy-action@master can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "high", "confidence": 1.0}}, {"id": "scanner-eaae909e91a73591", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-af4edc89fc3936af", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1572d1550687267d", "name": "GitHub Action tracks a moving branch", "shortDescription": {"text": "GitHub Action tracks a moving branch"}, "fullDescription": {"text": "aquasecurity/trivy-action@master can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "high", "confidence": 1.0}}, {"id": "scanner-5077973d69724c6c", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0d18038d2a97566d", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4489c9a16e43757b", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-79981f58b1f3ab05", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "aws-actions/configure-aws-credentials@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3605e3a40c34452c", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-5684ea51c61781b0", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a79cacd9914c8e54", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-877b3e77bb6efb33", "name": "GitHub Action tracks a moving branch", "shortDescription": {"text": "GitHub Action tracks a moving branch"}, "fullDescription": {"text": "aquasecurity/trivy-action@master can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "high", "confidence": 1.0}}, {"id": "scanner-efab3fc4fa53608d", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e7ea165212a5f9f2", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "docker/setup-buildx-action@v3 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-bad9cb5068aef2d8", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-db84861fc9b28a95", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "docker/setup-buildx-action@v3 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3e4d506f53fd8678", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-afcdb78e5d1b24a6", "name": "Very large file: microservices/project-manager-anthropic/src/project_manager_anthropic.py (1437 lines)", "shortDescription": {"text": "Very large file: microservices/project-manager-anthropic/src/project_manager_anthropic.py (1437 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e519cad30d184166", "name": "Very large file: microservices/solution-architect-anthropic/src/solution_architect.py (1423 lines)", "shortDescription": {"text": "Very large file: microservices/solution-architect-anthropic/src/solution_architect.py (1423 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-831812ce8b281b05", "name": "Very large file: microservices/accountant-anthropic/src/accountant.py (1251 lines)", "shortDescription": {"text": "Very large file: microservices/accountant-anthropic/src/accountant.py (1251 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-dfb22f1f70b6455f", "name": "Very large file: microservices/streamlit-frontend/components/archimate_visualization.py (1529 lines)", "shortDescription": {"text": "Very large file: microservices/streamlit-frontend/components/archimate_visualization.py (1529 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-141b30a41e03817b", "name": "No license file detected", "shortDescription": {"text": "No license file detected"}, "fullDescription": {"text": "No LICENSE/COPYING/NOTICE file was found. Generated repositories often omit licensing, which blocks reuse and automated intake."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 85 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-72b2a6250083a784", "name": "Placeholder or mock-heavy implementation detected", "shortDescription": {"text": "Placeholder or mock-heavy implementation detected"}, "fullDescription": {"text": "Found 30 placeholder/mock markers across 10 source files. This often means the repo looks complete while core flows still use generated scaffolding or fake data."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-749d4bc1bd66df5f", "name": "Agent instructions exist but release-hardening basics are missing", "shortDescription": {"text": "Agent instructions exist but release-hardening basics are missing"}, "fullDescription": {"text": "AI-coder instruction files were found, but the repo is missing license. Treat this as a contract gap: the agent is guided, but the generated output is not yet guarded by the controls that make it repeatable."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-cc55229a7a3c078d", "name": "Agent authority lacks a verifier contract: .mcp.json", "shortDescription": {"text": "Agent authority lacks a verifier contract: .mcp.json"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-17d866d91a7c451e", "name": "Agent instruction/config may expose a secret: CLAUDE.md", "shortDescription": {"text": "Agent instruction/config may expose a secret: CLAUDE.md"}, "fullDescription": {"text": "Agent-facing files are routinely pasted into LLM/tool contexts. Move literal tokens, keys, and passwords into a secret manager or document them as placeholders only."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-be8ba7bc0215315a", "name": "Legacy-named symbol `test_sink_normalizes_engine_api_without_api_v1` in microservices/shared-libs/realtime-transport/tes", "shortDescription": {"text": "Legacy-named symbol `test_sink_normalizes_engine_api_without_api_v1` in microservices/shared-libs/realtime-transport/tests/test_webhook_role.py:142"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-858be2f68a328ef3", "name": "Commented-code block (8 lines) in microservices/shared-libs/agent-common/src/agent_common/realtime_fastapi.py:57", "shortDescription": {"text": "Commented-code block (8 lines) in microservices/shared-libs/agent-common/src/agent_common/realtime_fastapi.py:57"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-4aad728af92c241b", "name": "Stub function `execute` (body is just `pass`/`return`) \u2014 microservices/fintech-realtime-manual/src/application/use_cases", "shortDescription": {"text": "Stub function `execute` (body is just `pass`/`return`) \u2014 microservices/fintech-realtime-manual/src/application/use_cases.py:11"}, "fullDescription": {"text": "Likely an AI scaffold that was never filled in. Remove or implement."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b74c6ee020ee124e", "name": "Legacy-named symbol `create_backup` in microservices/streamlit-frontend/utils/state_persistence.py:148", "shortDescription": {"text": "Legacy-named symbol `create_backup` in microservices/streamlit-frontend/utils/state_persistence.py:148"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6e0a0df48122c6c3", "name": "Legacy-named symbol `state_backup` in microservices/streamlit-frontend/components/views.py:390", "shortDescription": {"text": "Legacy-named symbol `state_backup` in microservices/streamlit-frontend/components/views.py:390"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7df4ab1019c71dd3", "name": "Legacy-named symbol `expected_backup` in factory/adapters/intake-slack/test_parsing.py:117", "shortDescription": {"text": "Legacy-named symbol `expected_backup` in factory/adapters/intake-slack/test_parsing.py:117"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7aba1c00d02d4602", "name": "Legacy-named symbol `expected_backup` in factory/adapters/intake-slack/test_server.py:25", "shortDescription": {"text": "Legacy-named symbol `expected_backup` in factory/adapters/intake-slack/test_server.py:25"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-32f0a6e9acc02811", "name": "Commented-code block (6 lines) in factory/adapters/intake-slack/src/interface/controllers.py:29", "shortDescription": {"text": "Commented-code block (6 lines) in factory/adapters/intake-slack/src/interface/controllers.py:29"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-896f6b6f27652fff", "name": "Commented-code block (6 lines) in factory/adapters/intake-slack/src/domain/strategies/pattern2_compositional.py:16", "shortDescription": {"text": "Commented-code block (6 lines) in factory/adapters/intake-slack/src/domain/strategies/pattern2_compositional.py:16"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-e539f7790e981393", "name": "Commented-code block (7 lines) in factory/shared-libs/capability-mcp-core/src/application/analytics_platform_recipe.py:1", "shortDescription": {"text": "Commented-code block (7 lines) in factory/shared-libs/capability-mcp-core/src/application/analytics_platform_recipe.py:199"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-61def3ef2d7584d6", "name": "Commented-code block (5 lines) in factory/shared-libs/capability-mcp-core/src/application/submit_use_case.py:93", "shortDescription": {"text": "Commented-code block (5 lines) in factory/shared-libs/capability-mcp-core/src/application/submit_use_case.py:93"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-1ec5b2fe34f39b74", "name": "Commented-code block (6 lines) in factory/substrate/contract-tests/runner.py:296", "shortDescription": {"text": "Commented-code block (6 lines) in factory/substrate/contract-tests/runner.py:296"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-72e43e35213f9ff1", "name": "Network/subprocess call without timeout or try/except \u2014 factory/utilities/foundry_responses.py:47", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 factory/utilities/foundry_responses.py:47"}, "fullDescription": {"text": "`subprocess.check_output(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0f2d921ecc4b3313", "name": "111 env vars used in code but missing from .env.example", "shortDescription": {"text": "111 env vars used in code but missing from .env.example"}, "fullDescription": {"text": "Drift between code and config docs. The first few: `AGENT_TYPE`, `ALLOWED_HOSTS`, `ALLOWED_OIDS`, `ANTHROPIC_API_KEY`, `AOAI_API_VERSION`, `AOAI_BASE_URL`, `AOAI_DEPLOYMENT`, `APIM_AUDIENCE` + 103 more. Add them (with a placeholder/comment) to .env.example so onboarding doesn't break."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-959dc775c4241ad4", "name": "Near-duplicate function bodies in 18 places", "shortDescription": {"text": "Near-duplicate function bodies in 18 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nmicroservices/accountant-deterministic/src/business_analyst.py:initialize, microservices/accountant-deterministic/src/business_analyst.py:initialize, microservices/infrastructure-architect-deterministic/src/business_analyst.py:initialize, microservices/infrastructure-architect-deterministic/src/business_analyst.py:initialize\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-46969939caf8120b", "name": "Near-duplicate function bodies in 9 places", "shortDescription": {"text": "Near-duplicate function bodies in 9 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nmicroservices/accountant-deterministic/src/business_analyst.py:process_text, microservices/infrastructure-architect-deterministic/src/business_analyst.py:process_text, microservices/project-manager-deterministic/src/business_analyst.py:process_text, microservices/business-analyst-anthropic/src/business_analyst.py:process_text\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c54c6fb8e364daaa", "name": "Near-duplicate function bodies in 16 places", "shortDescription": {"text": "Near-duplicate function bodies in 16 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nmicroservices/accountant-deterministic/src/main.py:get_agent, microservices/infrastructure-architect-deterministic/src/main.py:get_agent, microservices/project-manager-deterministic/src/main.py:get_agent, microservices/business-analyst-anthropic/shared-libs/agent-common/src/agent_common/fastapi_base.py:get_agent\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2c04133e54348533", "name": "Near-duplicate function bodies in 2 places", "shortDescription": {"text": "Near-duplicate function bodies in 2 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nmicroservices/business-analyst-anthropic/shared-libs/agent-common/src/agent_common/fastapi_base.py:create_agent_app, microservices/shared-libs/agent-common/src/agent_common/fastapi_base.py:create_agent_app\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-49c98f7cedd9c977", "name": "Near-duplicate function bodies in 4 places", "shortDescription": {"text": "Near-duplicate function bodies in 4 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nmicroservices/business-analyst-anthropic/shared-libs/agent-common/src/agent_common/fastapi_base.py:lifespan, microservices/business-analyst-anthropic/shared-libs/agent-common/src/agent_common/shared_agent_factory.py:lifespan, microservices/shared-libs/agent-common/src/agent_common/fastapi_base.py:lifespan, microservices/shared-libs/agent-common/src/agent_common/shared_agent_factory.py:lifespan\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d262964587208a30", "name": "FastAPI POST `analyze_requirements` without auth dependency \u2014 microservices/accountant-deterministic/src/main.py:73", "shortDescription": {"text": "FastAPI POST `analyze_requirements` without auth dependency \u2014 microservices/accountant-deterministic/src/main.py:73"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-987367a8abd24db6", "name": "FastAPI POST `extract_entities` without auth dependency \u2014 microservices/accountant-deterministic/src/main.py:123", "shortDescription": {"text": "FastAPI POST `extract_entities` without auth dependency \u2014 microservices/accountant-deterministic/src/main.py:123"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-06454ed3fe8a14b3", "name": "FastAPI POST `generate_user_stories` without auth dependency \u2014 microservices/accountant-deterministic/src/main.py:165", "shortDescription": {"text": "FastAPI POST `generate_user_stories` without auth dependency \u2014 microservices/accountant-deterministic/src/main.py:165"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-5281800e5c067c61", "name": "FastAPI POST `assess_complexity` without auth dependency \u2014 microservices/accountant-deterministic/src/main.py:212", "shortDescription": {"text": "FastAPI POST `assess_complexity` without auth dependency \u2014 microservices/accountant-deterministic/src/main.py:212"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-65777dce4cd58498", "name": "FastAPI POST `validate_requirements` without auth dependency \u2014 microservices/accountant-deterministic/src/main.py:259", "shortDescription": {"text": "FastAPI POST `validate_requirements` without auth dependency \u2014 microservices/accountant-deterministic/src/main.py:259"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-e86dbd7ae0e7337c", "name": "FastAPI POST `analyze_requirements` without auth dependency \u2014 microservices/infrastructure-architect-deterministic/src/m", "shortDescription": {"text": "FastAPI POST `analyze_requirements` without auth dependency \u2014 microservices/infrastructure-architect-deterministic/src/main.py:73"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-a998cefba212fc1b", "name": "FastAPI POST `extract_entities` without auth dependency \u2014 microservices/infrastructure-architect-deterministic/src/main.", "shortDescription": {"text": "FastAPI POST `extract_entities` without auth dependency \u2014 microservices/infrastructure-architect-deterministic/src/main.py:123"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-d23a29c230e82d5f", "name": "FastAPI POST `generate_user_stories` without auth dependency \u2014 microservices/infrastructure-architect-deterministic/src/", "shortDescription": {"text": "FastAPI POST `generate_user_stories` without auth dependency \u2014 microservices/infrastructure-architect-deterministic/src/main.py:165"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-37c0b056d19b9d2a", "name": "FastAPI POST `assess_complexity` without auth dependency \u2014 microservices/infrastructure-architect-deterministic/src/main", "shortDescription": {"text": "FastAPI POST `assess_complexity` without auth dependency \u2014 microservices/infrastructure-architect-deterministic/src/main.py:212"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-d24c0d9cb0227ddf", "name": "FastAPI POST `validate_requirements` without auth dependency \u2014 microservices/infrastructure-architect-deterministic/src/", "shortDescription": {"text": "FastAPI POST `validate_requirements` without auth dependency \u2014 microservices/infrastructure-architect-deterministic/src/main.py:259"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-82253ea7f22c424d", "name": "FastAPI POST `analyze_requirements` without auth dependency \u2014 microservices/project-manager-deterministic/src/main.py:73", "shortDescription": {"text": "FastAPI POST `analyze_requirements` without auth dependency \u2014 microservices/project-manager-deterministic/src/main.py:73"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-194d8b03dc5570bb", "name": "FastAPI POST `extract_entities` without auth dependency \u2014 microservices/project-manager-deterministic/src/main.py:123", "shortDescription": {"text": "FastAPI POST `extract_entities` without auth dependency \u2014 microservices/project-manager-deterministic/src/main.py:123"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-01fe4d0c7a6f46f9", "name": "FastAPI POST `generate_user_stories` without auth dependency \u2014 microservices/project-manager-deterministic/src/main.py:1", "shortDescription": {"text": "FastAPI POST `generate_user_stories` without auth dependency \u2014 microservices/project-manager-deterministic/src/main.py:165"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-5714ebed8a0f1d12", "name": "FastAPI POST `assess_complexity` without auth dependency \u2014 microservices/project-manager-deterministic/src/main.py:212", "shortDescription": {"text": "FastAPI POST `assess_complexity` without auth dependency \u2014 microservices/project-manager-deterministic/src/main.py:212"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-88ee02e0770b27e6", "name": "FastAPI POST `validate_requirements` without auth dependency \u2014 microservices/project-manager-deterministic/src/main.py:2", "shortDescription": {"text": "FastAPI POST `validate_requirements` without auth dependency \u2014 microservices/project-manager-deterministic/src/main.py:259"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-d06478df0f84efed", "name": "FastAPI POST `process_task_endpoint` without auth dependency \u2014 microservices/business-analyst-anthropic/shared-libs/agen", "shortDescription": {"text": "FastAPI POST `process_task_endpoint` without auth dependency \u2014 microservices/business-analyst-anthropic/shared-libs/agent-common/src/agent_common/fastapi_utils.py:126"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-5fa93a1b8b1c2c71", "name": "FastAPI POST `ingest` without auth dependency \u2014 microservices/shared-libs/realtime-transport/src/realtime_transport/real", "shortDescription": {"text": "FastAPI POST `ingest` without auth dependency \u2014 microservices/shared-libs/realtime-transport/src/realtime_transport/realtime_fastapi.py:273"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-96b048697f271562", "name": "FastAPI POST `process_task_endpoint` without auth dependency \u2014 microservices/shared-libs/agent-common/src/agent_common/f", "shortDescription": {"text": "FastAPI POST `process_task_endpoint` without auth dependency \u2014 microservices/shared-libs/agent-common/src/agent_common/fastapi_utils.py:126"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-88ada5a7a9175478", "name": "FastAPI POST `broadcast_message` without auth dependency \u2014 microservices/shared-libs/agent-common/src/agent_common/realt", "shortDescription": {"text": "FastAPI POST `broadcast_message` without auth dependency \u2014 microservices/shared-libs/agent-common/src/agent_common/realtime_fastapi.py:452"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-eb04f67c1584d226", "name": "FastAPI POST `send_to_topic` without auth dependency \u2014 microservices/shared-libs/agent-common/src/agent_common/realtime_", "shortDescription": {"text": "FastAPI POST `send_to_topic` without auth dependency \u2014 microservices/shared-libs/agent-common/src/agent_common/realtime_fastapi.py:465"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-38986450f0b22f20", "name": "FastAPI POST `analyze_requirements` without auth dependency \u2014 microservices/business-analyst-deterministic/src/main.py:7", "shortDescription": {"text": "FastAPI POST `analyze_requirements` without auth dependency \u2014 microservices/business-analyst-deterministic/src/main.py:73"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-718c40797dd42361", "name": "FastAPI POST `extract_entities` without auth dependency \u2014 microservices/business-analyst-deterministic/src/main.py:123", "shortDescription": {"text": "FastAPI POST `extract_entities` without auth dependency \u2014 microservices/business-analyst-deterministic/src/main.py:123"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-d23a36e2f45c3602", "name": "FastAPI POST `generate_user_stories` without auth dependency \u2014 microservices/business-analyst-deterministic/src/main.py:", "shortDescription": {"text": "FastAPI POST `generate_user_stories` without auth dependency \u2014 microservices/business-analyst-deterministic/src/main.py:165"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-2707820751d74f86", "name": "FastAPI POST `assess_complexity` without auth dependency \u2014 microservices/business-analyst-deterministic/src/main.py:212", "shortDescription": {"text": "FastAPI POST `assess_complexity` without auth dependency \u2014 microservices/business-analyst-deterministic/src/main.py:212"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-c8406367c327dced", "name": "FastAPI POST `validate_requirements` without auth dependency \u2014 microservices/business-analyst-deterministic/src/main.py:", "shortDescription": {"text": "FastAPI POST `validate_requirements` without auth dependency \u2014 microservices/business-analyst-deterministic/src/main.py:259"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-caef4b2679b27c05", "name": "FastAPI POST `analyze_business_impact` without auth dependency \u2014 microservices/business-architect-anthropic/src/main.py:", "shortDescription": {"text": "FastAPI POST `analyze_business_impact` without auth dependency \u2014 microservices/business-architect-anthropic/src/main.py:73"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-e08708edb9b8ff6d", "name": "FastAPI POST `generate_capability_map` without auth dependency \u2014 microservices/business-architect-anthropic/src/main.py:", "shortDescription": {"text": "FastAPI POST `generate_capability_map` without auth dependency \u2014 microservices/business-architect-anthropic/src/main.py:130"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-cba070a79145706b", "name": "FastAPI POST `design_business_architecture` without auth dependency \u2014 microservices/business-architect-anthropic/src/mai", "shortDescription": {"text": "FastAPI POST `design_business_architecture` without auth dependency \u2014 microservices/business-architect-anthropic/src/main.py:176"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-484a966bfa62f307", "name": "FastAPI POST `generate_archimate_model` without auth dependency \u2014 microservices/business-architect-anthropic/src/main.py", "shortDescription": {"text": "FastAPI POST `generate_archimate_model` without auth dependency \u2014 microservices/business-architect-anthropic/src/main.py:228"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-6ff463758dcad2fd", "name": "FastAPI POST `analyze_requirements` without auth dependency \u2014 microservices/application-architect-deterministic/src/main", "shortDescription": {"text": "FastAPI POST `analyze_requirements` without auth dependency \u2014 microservices/application-architect-deterministic/src/main.py:73"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-08ed02786293335b", "name": "FastAPI POST `extract_entities` without auth dependency \u2014 microservices/application-architect-deterministic/src/main.py:", "shortDescription": {"text": "FastAPI POST `extract_entities` without auth dependency \u2014 microservices/application-architect-deterministic/src/main.py:123"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-65afbc5653749d97", "name": "FastAPI POST `generate_user_stories` without auth dependency \u2014 microservices/application-architect-deterministic/src/mai", "shortDescription": {"text": "FastAPI POST `generate_user_stories` without auth dependency \u2014 microservices/application-architect-deterministic/src/main.py:165"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-2228c0b9d0c53576", "name": "FastAPI POST `assess_complexity` without auth dependency \u2014 microservices/application-architect-deterministic/src/main.py", "shortDescription": {"text": "FastAPI POST `assess_complexity` without auth dependency \u2014 microservices/application-architect-deterministic/src/main.py:212"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-492333702a4b340a", "name": "FastAPI POST `validate_requirements` without auth dependency \u2014 microservices/application-architect-deterministic/src/mai", "shortDescription": {"text": "FastAPI POST `validate_requirements` without auth dependency \u2014 microservices/application-architect-deterministic/src/main.py:259"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-f6d546353060ae62", "name": "FastAPI POST `analyze_requirements` without auth dependency \u2014 microservices/solution-architect-deterministic/src/main.py", "shortDescription": {"text": "FastAPI POST `analyze_requirements` without auth dependency \u2014 microservices/solution-architect-deterministic/src/main.py:73"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-2223d5636ad22859", "name": "FastAPI POST `extract_entities` without auth dependency \u2014 microservices/solution-architect-deterministic/src/main.py:123", "shortDescription": {"text": "FastAPI POST `extract_entities` without auth dependency \u2014 microservices/solution-architect-deterministic/src/main.py:123"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-ea5e7414cb3686f6", "name": "FastAPI POST `generate_user_stories` without auth dependency \u2014 microservices/solution-architect-deterministic/src/main.p", "shortDescription": {"text": "FastAPI POST `generate_user_stories` without auth dependency \u2014 microservices/solution-architect-deterministic/src/main.py:165"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-9f3c1929941e2249", "name": "FastAPI POST `assess_complexity` without auth dependency \u2014 microservices/solution-architect-deterministic/src/main.py:21", "shortDescription": {"text": "FastAPI POST `assess_complexity` without auth dependency \u2014 microservices/solution-architect-deterministic/src/main.py:212"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-ba80677663258dd2", "name": "FastAPI POST `validate_requirements` without auth dependency \u2014 microservices/solution-architect-deterministic/src/main.p", "shortDescription": {"text": "FastAPI POST `validate_requirements` without auth dependency \u2014 microservices/solution-architect-deterministic/src/main.py:259"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-adde8b735b753e64", "name": "FastAPI POST `analyze_requirements` without auth dependency \u2014 microservices/developer-deterministic/src/main.py:73", "shortDescription": {"text": "FastAPI POST `analyze_requirements` without auth dependency \u2014 microservices/developer-deterministic/src/main.py:73"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-d1d93e8e4d18a271", "name": "FastAPI POST `extract_entities` without auth dependency \u2014 microservices/developer-deterministic/src/main.py:123", "shortDescription": {"text": "FastAPI POST `extract_entities` without auth dependency \u2014 microservices/developer-deterministic/src/main.py:123"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-ac2997dfedf3010d", "name": "FastAPI POST `generate_user_stories` without auth dependency \u2014 microservices/developer-deterministic/src/main.py:165", "shortDescription": {"text": "FastAPI POST `generate_user_stories` without auth dependency \u2014 microservices/developer-deterministic/src/main.py:165"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-741eba5697f92ff9", "name": "FastAPI POST `assess_complexity` without auth dependency \u2014 microservices/developer-deterministic/src/main.py:212", "shortDescription": {"text": "FastAPI POST `assess_complexity` without auth dependency \u2014 microservices/developer-deterministic/src/main.py:212"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-cf6894c5165cf7bf", "name": "FastAPI POST `validate_requirements` without auth dependency \u2014 microservices/developer-deterministic/src/main.py:259", "shortDescription": {"text": "FastAPI POST `validate_requirements` without auth dependency \u2014 microservices/developer-deterministic/src/main.py:259"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-483eb24053cab764", "name": "FastAPI POST `create_workflow` without auth dependency \u2014 microservices/orchestration-service/src/main.py:76", "shortDescription": {"text": "FastAPI POST `create_workflow` without auth dependency \u2014 microservices/orchestration-service/src/main.py:76"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-7e560fadd2c79e97", "name": "FastAPI POST `cancel_workflow` without auth dependency \u2014 microservices/orchestration-service/src/main.py:149", "shortDescription": {"text": "FastAPI POST `cancel_workflow` without auth dependency \u2014 microservices/orchestration-service/src/main.py:149"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-fc0d786afb03257e", "name": "FastAPI POST `execute_agent_task` without auth dependency \u2014 microservices/orchestration-service/src/main.py:205", "shortDescription": {"text": "FastAPI POST `execute_agent_task` without auth dependency \u2014 microservices/orchestration-service/src/main.py:205"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-f08f560ac0922d00", "name": "FastAPI POST `analyze_requirements` without auth dependency \u2014 microservices/business-architect-deterministic/src/main.py", "shortDescription": {"text": "FastAPI POST `analyze_requirements` without auth dependency \u2014 microservices/business-architect-deterministic/src/main.py:73"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-056c516fe747a449", "name": "FastAPI POST `extract_entities` without auth dependency \u2014 microservices/business-architect-deterministic/src/main.py:123", "shortDescription": {"text": "FastAPI POST `extract_entities` without auth dependency \u2014 microservices/business-architect-deterministic/src/main.py:123"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-bd62cd8450a7ccad", "name": "FastAPI POST `generate_user_stories` without auth dependency \u2014 microservices/business-architect-deterministic/src/main.p", "shortDescription": {"text": "FastAPI POST `generate_user_stories` without auth dependency \u2014 microservices/business-architect-deterministic/src/main.py:165"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-d13d5d3bda223bf5", "name": "FastAPI POST `assess_complexity` without auth dependency \u2014 microservices/business-architect-deterministic/src/main.py:21", "shortDescription": {"text": "FastAPI POST `assess_complexity` without auth dependency \u2014 microservices/business-architect-deterministic/src/main.py:212"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-1aeeac3ef409a42c", "name": "FastAPI POST `validate_requirements` without auth dependency \u2014 microservices/business-architect-deterministic/src/main.p", "shortDescription": {"text": "FastAPI POST `validate_requirements` without auth dependency \u2014 microservices/business-architect-deterministic/src/main.py:259"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-9c1104d1df31291c", "name": "Flask mutation route `handle_slack_command` without `@login_required` \u2014 factory/adapters/intake-slack/app.py:426", "shortDescription": {"text": "Flask mutation route `handle_slack_command` without `@login_required` \u2014 factory/adapters/intake-slack/app.py:426"}, "fullDescription": {"text": "Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-1d3aa09655b46063", "name": "Flask mutation route `handle_slack_events` without `@login_required` \u2014 factory/adapters/intake-slack/app.py:535", "shortDescription": {"text": "Flask mutation route `handle_slack_events` without `@login_required` \u2014 factory/adapters/intake-slack/app.py:535"}, "fullDescription": {"text": "Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-0ff4453dceab4c36", "name": "Unused endpoint: POST /analyze-requirements", "shortDescription": {"text": "Unused endpoint: POST /analyze-requirements"}, "fullDescription": {"text": "`microservices/accountant-deterministic/src/main.py` declares `POST /analyze-requirements` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-33b331738800d515", "name": "Unused endpoint: POST /extract-entities", "shortDescription": {"text": "Unused endpoint: POST /extract-entities"}, "fullDescription": {"text": "`microservices/accountant-deterministic/src/main.py` declares `POST /extract-entities` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e814bb13d243d018", "name": "Unused endpoint: POST /generate-user-stories", "shortDescription": {"text": "Unused endpoint: POST /generate-user-stories"}, "fullDescription": {"text": "`microservices/accountant-deterministic/src/main.py` declares `POST /generate-user-stories` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5c1e8d100d6950ef", "name": "Unused endpoint: POST /assess-complexity", "shortDescription": {"text": "Unused endpoint: POST /assess-complexity"}, "fullDescription": {"text": "`microservices/accountant-deterministic/src/main.py` declares `POST /assess-complexity` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-74c5598c1cf2785c", "name": "Unused endpoint: POST /validate-requirements", "shortDescription": {"text": "Unused endpoint: POST /validate-requirements"}, "fullDescription": {"text": "`microservices/accountant-deterministic/src/main.py` declares `POST /validate-requirements` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5baa8971ebe192a1", "name": "Unused endpoint: GET /", "shortDescription": {"text": "Unused endpoint: GET /"}, "fullDescription": {"text": "`microservices/business-analyst-anthropic/shared-libs/agent-common/src/agent_common/fastapi_base.py` declares `GET /` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d10e5c556d4bcff6", "name": "Unused endpoint: GET /capabilities", "shortDescription": {"text": "Unused endpoint: GET /capabilities"}, "fullDescription": {"text": "`microservices/business-analyst-anthropic/shared-libs/agent-common/src/agent_common/fastapi_utils.py` declares `GET /capabilities` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-65a667bcc38fb792", "name": "Unused endpoint: POST /ingest", "shortDescription": {"text": "Unused endpoint: POST /ingest"}, "fullDescription": {"text": "`microservices/shared-libs/realtime-transport/src/realtime_transport/realtime_fastapi.py` declares `POST /ingest` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-79c0c3da7d163a64", "name": "Unused endpoint: GET /realtime/status", "shortDescription": {"text": "Unused endpoint: GET /realtime/status"}, "fullDescription": {"text": "`microservices/shared-libs/agent-common/src/agent_common/realtime_fastapi.py` declares `GET /realtime/status` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cc94efd2debf5d63", "name": "Unused endpoint: GET /realtime/connections", "shortDescription": {"text": "Unused endpoint: GET /realtime/connections"}, "fullDescription": {"text": "`microservices/shared-libs/agent-common/src/agent_common/realtime_fastapi.py` declares `GET /realtime/connections` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5d89d0ab7316c5c0", "name": "Unused endpoint: GET /stream/events", "shortDescription": {"text": "Unused endpoint: GET /stream/events"}, "fullDescription": {"text": "`microservices/shared-libs/agent-common/src/agent_common/realtime_fastapi.py` declares `GET /stream/events` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-eee9738ce0d750af", "name": "Unused endpoint: POST /realtime/broadcast", "shortDescription": {"text": "Unused endpoint: POST /realtime/broadcast"}, "fullDescription": {"text": "`microservices/shared-libs/agent-common/src/agent_common/realtime_fastapi.py` declares `POST /realtime/broadcast` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-94d54e32654a8017", "name": "Unused endpoint: POST /realtime/topic/{topic}", "shortDescription": {"text": "Unused endpoint: POST /realtime/topic/{topic}"}, "fullDescription": {"text": "`microservices/shared-libs/agent-common/src/agent_common/realtime_fastapi.py` declares `POST /realtime/topic/{topic}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8c236625afb6a8cb", "name": "Unused endpoint: GET /ready", "shortDescription": {"text": "Unused endpoint: GET /ready"}, "fullDescription": {"text": "`microservices/fintech-realtime-manual/src/interface/api.py` declares `GET /ready` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-380002dd161c0130", "name": "Unused endpoint: POST /analyze-business-impact", "shortDescription": {"text": "Unused endpoint: POST /analyze-business-impact"}, "fullDescription": {"text": "`microservices/business-architect-anthropic/src/main.py` declares `POST /analyze-business-impact` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-bdef05ca37a4ab91", "name": "Unused endpoint: POST /generate-capability-map", "shortDescription": {"text": "Unused endpoint: POST /generate-capability-map"}, "fullDescription": {"text": "`microservices/business-architect-anthropic/src/main.py` declares `POST /generate-capability-map` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6f02c9e79df50d28", "name": "Unused endpoint: POST /design-business-architecture", "shortDescription": {"text": "Unused endpoint: POST /design-business-architecture"}, "fullDescription": {"text": "`microservices/business-architect-anthropic/src/main.py` declares `POST /design-business-architecture` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e9e12d41b23ab06b", "name": "Unused endpoint: POST /generate-archimate-model", "shortDescription": {"text": "Unused endpoint: POST /generate-archimate-model"}, "fullDescription": {"text": "`microservices/business-architect-anthropic/src/main.py` declares `POST /generate-archimate-model` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3f52adc774e06155", "name": "Unused endpoint: POST /workflows", "shortDescription": {"text": "Unused endpoint: POST /workflows"}, "fullDescription": {"text": "`microservices/orchestration-service/src/main.py` declares `POST /workflows` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d1111f1707af4f83", "name": "Unused endpoint: GET /workflows/{execution_id}", "shortDescription": {"text": "Unused endpoint: GET /workflows/{execution_id}"}, "fullDescription": {"text": "`microservices/orchestration-service/src/main.py` declares `GET /workflows/{execution_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3e32822faa4fa544", "name": "Unused endpoint: POST /workflows/{execution_id}/cancel", "shortDescription": {"text": "Unused endpoint: POST /workflows/{execution_id}/cancel"}, "fullDescription": {"text": "`microservices/orchestration-service/src/main.py` declares `POST /workflows/{execution_id}/cancel` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3140e61d7cac5091", "name": "Unused endpoint: GET /agents", "shortDescription": {"text": "Unused endpoint: GET /agents"}, "fullDescription": {"text": "`microservices/orchestration-service/src/main.py` declares `GET /agents` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9a7794f60b112f4c", "name": "Unused endpoint: POST /agents/{agent_type}/execute", "shortDescription": {"text": "Unused endpoint: POST /agents/{agent_type}/execute"}, "fullDescription": {"text": "`microservices/orchestration-service/src/main.py` declares `POST /agents/{agent_type}/execute` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9754fc8a805eb320", "name": "Unused endpoint: GET /workflows/definitions", "shortDescription": {"text": "Unused endpoint: GET /workflows/definitions"}, "fullDescription": {"text": "`microservices/orchestration-service/src/main.py` declares `GET /workflows/definitions` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8e8105a3544a4a0a", "name": "Unused endpoint: ANY /slack/commands", "shortDescription": {"text": "Unused endpoint: ANY /slack/commands"}, "fullDescription": {"text": "`factory/adapters/intake-slack/app.py` declares `ANY /slack/commands` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-042c83903d0a6b68", "name": "Unused endpoint: ANY /slack/events", "shortDescription": {"text": "Unused endpoint: ANY /slack/events"}, "fullDescription": {"text": "`factory/adapters/intake-slack/app.py` declares `ANY /slack/events` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/19528"}, "properties": {"repository": "shlapolosa/health-service-idp", "repoUrl": "https://github.com/shlapolosa/health-service-idp", "branch": "main"}, "results": [{"ruleId": "scanner-e136515d952f12d9", "level": "note", "message": {"text": "Possibly dead Python function: add_task_endpoint"}, "properties": {"repobilityId": "6ec03837de207384", "scanner": "scanner-primary", "fingerprint": "e136515d952f12d9", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "microservices/business-analyst-anthropic/shared-libs/agent-common/src/agent_common/fastapi_utils.py:118"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-7e978c193a4d96ba", "level": "note", "message": {"text": "Possibly dead Python function: setup_cors"}, "properties": {"repobilityId": "bfad0aa3a5d40d06", "scanner": "scanner-primary", "fingerprint": "7e978c193a4d96ba", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "microservices/business-analyst-anthropic/shared-libs/agent-common/src/agent_common/fastapi_utils.py:174"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b5a6c0defd88e91b", "level": "note", "message": {"text": "Possibly dead Python function: send_to_client"}, "properties": {"repobilityId": "fec5df7abef42b6f", "scanner": "scanner-primary", "fingerprint": "b5a6c0defd88e91b", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "microservices/shared-libs/realtime-transport/src/realtime_transport/websocket_manager.py:134"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d9eddc992e054eea", "level": "note", "message": {"text": "Possibly dead Python function: broadcast_event"}, "properties": {"repobilityId": "bf2600e0b507ffdc", "scanner": "scanner-primary", "fingerprint": "d9eddc992e054eea", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "microservices/shared-libs/realtime-transport/src/realtime_transport/websocket_manager.py:289"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c613da22936f49ce", "level": "note", "message": {"text": "Possibly dead Python function: send_event_to_topic"}, "properties": {"repobilityId": "1abe0777fea771ef", "scanner": "scanner-primary", "fingerprint": "c613da22936f49ce", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "microservices/shared-libs/realtime-transport/src/realtime_transport/websocket_manager.py:303"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-14363f14160af096", "level": "note", "message": {"text": "Possibly dead Python function: send_mqtt_message"}, "properties": {"repobilityId": "b84dfcfaf07dceb7", "scanner": "scanner-primary", "fingerprint": "14363f14160af096", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "microservices/shared-libs/realtime-transport/src/realtime_transport/realtime_agent.py:329"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-1687fb7477d7d875", "level": "note", "message": {"text": "Possibly dead Python function: load_specific_secret"}, "properties": {"repobilityId": "f085b7d0bb218058", "scanner": "scanner-primary", "fingerprint": "1687fb7477d7d875", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "microservices/shared-libs/agent-common/src/agent_common/secret_loader.py:271"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c60ea6ec1b794410", "level": "note", "message": {"text": "Possibly dead Python function: create_secret_environment_map"}, "properties": {"repobilityId": "c0dd1a3c013521eb", "scanner": "scanner-primary", "fingerprint": "c60ea6ec1b794410", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "microservices/shared-libs/agent-common/src/agent_common/secret_loader.py:325"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ec332b2dcf7bff7c", "level": "note", "message": {"text": "Possibly dead Python function: validate_required_secrets"}, "properties": {"repobilityId": "d0a3a907557c867b", "scanner": "scanner-primary", "fingerprint": "ec332b2dcf7bff7c", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "microservices/shared-libs/agent-common/src/agent_common/secret_loader.py:351"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-daa59ffb8b922db6", "level": "note", "message": {"text": "Possibly dead Python function: load_and_inject_realtime_secrets"}, "properties": {"repobilityId": "ae613b96b359e2e0", "scanner": "scanner-primary", "fingerprint": "daa59ffb8b922db6", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "microservices/shared-libs/agent-common/src/agent_common/secret_loader.py:486"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-069c25f8c745009a", "level": "note", "message": {"text": "Possibly dead Python function: validate_webservice_realtime_integration"}, "properties": {"repobilityId": "ad8580823ea96502", "scanner": "scanner-primary", "fingerprint": "069c25f8c745009a", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "microservices/shared-libs/agent-common/src/agent_common/secret_loader.py:530"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a2c79bd7fb77884b", "level": "note", "message": {"text": "Possibly dead Python function: generate_webservice_secret_configuration"}, "properties": {"repobilityId": "a5d192488f1fdba4", "scanner": "scanner-primary", "fingerprint": "a2c79bd7fb77884b", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "microservices/shared-libs/agent-common/src/agent_common/secret_loader.py:586"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6609e3fd8a701857", "level": "note", "message": {"text": "Possibly dead Python function: add_task_endpoint"}, "properties": {"repobilityId": "6ec03837de207384", "scanner": "scanner-primary", "fingerprint": "6609e3fd8a701857", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "microservices/shared-libs/agent-common/src/agent_common/fastapi_utils.py:118"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-88d24c26521119bb", "level": "note", "message": {"text": "Possibly dead Python function: setup_cors"}, "properties": {"repobilityId": "bfad0aa3a5d40d06", "scanner": "scanner-primary", "fingerprint": "88d24c26521119bb", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "microservices/shared-libs/agent-common/src/agent_common/fastapi_utils.py:174"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-943c52f31541bb0c", "level": "note", "message": {"text": "Possibly dead Python function: handle_agent_request"}, "properties": {"repobilityId": "8bca60a4cd75c45b", "scanner": "scanner-primary", "fingerprint": "943c52f31541bb0c", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "microservices/shared-libs/agent-common/src/agent_common/realtime_fastapi.py:502"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-13606e79bf61b9ff", "level": "note", "message": {"text": "Possibly dead Python function: send_to_client"}, "properties": {"repobilityId": "fec5df7abef42b6f", "scanner": "scanner-primary", "fingerprint": "13606e79bf61b9ff", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "microservices/shared-libs/agent-common/src/agent_common/websocket_manager.py:134"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-5c848bf1c55ae913", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 factory/substrate/crossplane/graphql/schema-discovery/merge-schemas.js:49"}, "properties": {"repobilityId": "bffe4c99662c1def", "scanner": "scanner-primary", "fingerprint": "5c848bf1c55ae913", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-396e1f24b13a9a7c", "level": "warning", "message": {"text": "Privileged port 8 in use"}, "properties": {"repobilityId": "8e03f5632e703751", "scanner": "scanner-primary", "fingerprint": "396e1f24b13a9a7c", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "archive/requirements/definitions/smart-parking-minimal-oam.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-59426bbd09647e11", "level": "warning", "message": {"text": "Privileged port 18 in use"}, "properties": {"repobilityId": "2d7b5e7d9c158e43", "scanner": "scanner-primary", "fingerprint": "59426bbd09647e11", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "archive/requirements/definitions/smart-parking-minimal-oam.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-655878fd60864ab6", "level": "warning", "message": {"text": "Privileged port 43 in use"}, "properties": {"repobilityId": "af1bc8881542418e", "scanner": "scanner-primary", "fingerprint": "655878fd60864ab6", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "archive/cluster-snapshots/2026-05-30-2232/policydefinitions.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-71ed4106a6eeae41", "level": "warning", "message": {"text": "Privileged port 9 in use"}, "properties": {"repobilityId": "31590a6ba3409390", "scanner": "scanner-primary", "fingerprint": "71ed4106a6eeae41", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "archive/cluster-snapshots/2026-05-30-2232/policydefinitions.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a89cd0cf91588edf", "level": "warning", "message": {"text": "Privileged port 13 in use"}, "properties": {"repobilityId": "79d721e4d6f64798", "scanner": "scanner-primary", "fingerprint": "a89cd0cf91588edf", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "archive/cluster-snapshots/2026-05-30-2232/policydefinitions.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-698c997baf91238b", "level": "warning", "message": {"text": "Privileged port 16 in use"}, "properties": {"repobilityId": "d31009168c502ace", "scanner": "scanner-primary", "fingerprint": "698c997baf91238b", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "archive/cluster-snapshots/2026-05-30-2232/policydefinitions.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-48277233bee6c2f2", "level": "warning", "message": {"text": "Privileged port 29 in use"}, "properties": {"repobilityId": "f09242400239b5a3", "scanner": "scanner-primary", "fingerprint": "48277233bee6c2f2", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "archive/cluster-snapshots/2026-05-30-2232/policydefinitions.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-464e28390435b2d9", "level": "warning", "message": {"text": "Privileged port 48 in use"}, "properties": {"repobilityId": "6a483602fa277896", "scanner": "scanner-primary", "fingerprint": "464e28390435b2d9", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "archive/cluster-snapshots/2026-05-30-2232/traitdefinitions.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-18828e6cda1a481e", "level": "warning", "message": {"text": "Privileged port 23 in use"}, "properties": {"repobilityId": "a1230e3dfc4becfa", "scanner": "scanner-primary", "fingerprint": "18828e6cda1a481e", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "archive/cluster-snapshots/2026-05-30-2232/traitdefinitions.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-7e1346b8f9b0aed5", "level": "warning", "message": {"text": "Privileged port 30 in use"}, "properties": {"repobilityId": "54f172e7d16fc662", "scanner": "scanner-primary", "fingerprint": "7e1346b8f9b0aed5", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "archive/cluster-snapshots/2026-05-30-2232/traitdefinitions.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-80cb82304b5eb10f", "level": "warning", "message": {"text": "Privileged port 37 in use"}, "properties": {"repobilityId": "3bc0728a81a76695", "scanner": "scanner-primary", "fingerprint": "80cb82304b5eb10f", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "archive/cluster-snapshots/2026-05-30-2232/ksvc.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-89d7b5b1b471cb5a", "level": "warning", "message": {"text": "Privileged port 26 in use"}, "properties": {"repobilityId": "9c5e4d9c5edd9bd2", "scanner": "scanner-primary", "fingerprint": "89d7b5b1b471cb5a", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "archive/cluster-snapshots/2026-05-30-2232/ksvc.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a9041e730c11a82b", "level": "warning", "message": {"text": "Privileged port 39 in use"}, "properties": {"repobilityId": "9b982a253b897533", "scanner": "scanner-primary", "fingerprint": "a9041e730c11a82b", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "archive/cluster-snapshots/2026-05-30-2232/ksvc.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-33ba9f2ad3b1355a", "level": "warning", "message": {"text": "Privileged port 1000 in use"}, "properties": {"repobilityId": "5ac9fc9372cfe169", "scanner": "scanner-primary", "fingerprint": "33ba9f2ad3b1355a", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "factory/production-lines/traditional-cloud/adapters/dev-agent/Dockerfile"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-0751be323ff76a80", "level": "warning", "message": {"text": "Privileged port 1001 in use"}, "properties": {"repobilityId": "eb126d41479634e4", "scanner": "scanner-primary", "fingerprint": "0751be323ff76a80", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "factory/production-lines/traditional-cloud/adapters/mscv-image/scripts/lib/camunda.sh"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-31919749d8bc26e5", "level": "warning", "message": {"text": "Dockerfile runs as root: microservices/accountant-deterministic/Dockerfile"}, "properties": {"repobilityId": "5674240bd6e21e60", "scanner": "scanner-primary", "fingerprint": "31919749d8bc26e5", "layer": "hardware", "severity": "medium", "confidence": 1.0, "tags": ["security", "container"]}}, {"ruleId": "scanner-236e1367a50a4947", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: python:3.11-slim"}, "properties": {"repobilityId": "b9f95a5f82da4f48", "scanner": "scanner-primary", "fingerprint": "236e1367a50a4947", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "microservices/accountant-deterministic/Dockerfile"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6330b9253d197726", "level": "warning", "message": {"text": "Dockerfile runs as root: microservices/project-manager-anthropic/Dockerfile"}, "properties": {"repobilityId": "df915a4efd5de2d9", "scanner": "scanner-primary", "fingerprint": "6330b9253d197726", "layer": "hardware", "severity": "medium", "confidence": 1.0, "tags": ["security", "container"]}}, {"ruleId": "scanner-c8956ebeea4cc37c", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: python:3.11-slim"}, "properties": {"repobilityId": "f1a45a280627690b", "scanner": "scanner-primary", "fingerprint": "c8956ebeea4cc37c", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "microservices/project-manager-anthropic/Dockerfile"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c30202c582b406cf", "level": "warning", "message": {"text": "Dockerfile runs as root: microservices/infrastructure-architect-deterministic/Dockerfile"}, "properties": {"repobilityId": "54bba11db2d5095e", "scanner": "scanner-primary", "fingerprint": "c30202c582b406cf", "layer": "hardware", "severity": "medium", "confidence": 1.0, "tags": ["security", "container"]}}, {"ruleId": "scanner-feacc33d6a9d93ce", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: python:3.11-slim"}, "properties": {"repobilityId": "5ddf3a885c7c55fb", "scanner": "scanner-primary", "fingerprint": "feacc33d6a9d93ce", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "microservices/infrastructure-architect-deterministic/Dockerfile"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f869e2c51adfb0af", "level": "warning", "message": {"text": "Dockerfile runs as root: microservices/project-manager-deterministic/Dockerfile"}, "properties": {"repobilityId": "f63ec29191d894c0", "scanner": "scanner-primary", "fingerprint": "f869e2c51adfb0af", "layer": "hardware", "severity": "medium", "confidence": 1.0, "tags": ["security", "container"]}}, {"ruleId": "scanner-ecd9e1b8cf8cc9f6", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: python:3.11-slim"}, "properties": {"repobilityId": "bc57b3248a79e5ac", "scanner": "scanner-primary", "fingerprint": "ecd9e1b8cf8cc9f6", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "microservices/project-manager-deterministic/Dockerfile"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-2086af0264f29c56", "level": "warning", "message": {"text": "Dockerfile runs as root: microservices/application-architect-anthropic/Dockerfile"}, "properties": {"repobilityId": "3d236614a10fbb67", "scanner": "scanner-primary", "fingerprint": "2086af0264f29c56", "layer": "hardware", "severity": "medium", "confidence": 1.0, "tags": ["security", "container"]}}, {"ruleId": "scanner-7e153e775cb0ee53", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: python:3.11-slim"}, "properties": {"repobilityId": "15d9f46fe543997a", "scanner": "scanner-primary", "fingerprint": "7e153e775cb0ee53", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "microservices/application-architect-anthropic/Dockerfile"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d0792696217b995b", "level": "warning", "message": {"text": "Dockerfile runs as root: microservices/business-analyst-anthropic/Dockerfile"}, "properties": {"repobilityId": "ba56cdfa2c91ea39", "scanner": "scanner-primary", "fingerprint": "d0792696217b995b", "layer": "hardware", "severity": "medium", "confidence": 1.0, "tags": ["security", "container"]}}, {"ruleId": "scanner-91636c54f780ba1b", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: python:3.11-slim"}, "properties": {"repobilityId": "16c330936494ba8c", "scanner": "scanner-primary", "fingerprint": "91636c54f780ba1b", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "microservices/business-analyst-anthropic/Dockerfile"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f1126a06123ac04e", "level": "warning", "message": {"text": "Dockerfile runs as root: microservices/developer-anthropic/Dockerfile"}, "properties": {"repobilityId": "b545eb5328f2e19a", "scanner": "scanner-primary", "fingerprint": "f1126a06123ac04e", "layer": "hardware", "severity": "medium", "confidence": 1.0, "tags": ["security", "container"]}}, {"ruleId": "scanner-ddab7feea6f0b457", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: python:3.11-slim"}, "properties": {"repobilityId": "e2de8c356e4c378f", "scanner": "scanner-primary", "fingerprint": "ddab7feea6f0b457", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "microservices/developer-anthropic/Dockerfile"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-244f87b86648d115", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: python:3.11-slim"}, "properties": {"repobilityId": "e5dec49fcc0e2622", "scanner": "scanner-primary", "fingerprint": "244f87b86648d115", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "microservices/fintech-realtime-manual/Dockerfile"}, "region": {"startLine": 2}}}]}, {"ruleId": "scanner-244f87b86648d115", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: python:3.11-slim"}, "properties": {"repobilityId": "6f884878d33b8325", "scanner": "scanner-primary", "fingerprint": "244f87b86648d115", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "microservices/fintech-realtime-manual/Dockerfile"}, "region": {"startLine": 18}}}]}, {"ruleId": "scanner-d9b065afba5ac91c", "level": "warning", "message": {"text": "Dockerfile runs as root: microservices/infrastructure-architect-anthropic/Dockerfile"}, "properties": {"repobilityId": "def1be3b0575b17b", "scanner": "scanner-primary", "fingerprint": "d9b065afba5ac91c", "layer": "hardware", "severity": "medium", "confidence": 1.0, "tags": ["security", "container"]}}, {"ruleId": "scanner-9fa402b1db8b662f", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: python:3.11-slim"}, "properties": {"repobilityId": "4f7dc0181c4f56f9", "scanner": "scanner-primary", "fingerprint": "9fa402b1db8b662f", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "microservices/infrastructure-architect-anthropic/Dockerfile"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e826b8bbb4dcf7e9", "level": "warning", "message": {"text": "Dockerfile runs as root: microservices/business-analyst-deterministic/Dockerfile"}, "properties": {"repobilityId": "ae4abf5de5b0dd80", "scanner": "scanner-primary", "fingerprint": "e826b8bbb4dcf7e9", "layer": "hardware", "severity": "medium", "confidence": 1.0, "tags": ["security", "container"]}}, {"ruleId": "scanner-448893bde7929822", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: python:3.11-slim"}, "properties": {"repobilityId": "96138c606f9b5bc2", "scanner": "scanner-primary", "fingerprint": "448893bde7929822", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "microservices/business-analyst-deterministic/Dockerfile"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-4c6ec27749e7271a", "level": "warning", "message": {"text": "Dockerfile runs as root: microservices/business-architect-anthropic/Dockerfile"}, "properties": {"repobilityId": "56c235cb07e0dac3", "scanner": "scanner-primary", "fingerprint": "4c6ec27749e7271a", "layer": "hardware", "severity": "medium", "confidence": 1.0, "tags": ["security", "container"]}}, {"ruleId": "scanner-cc74a037512b08d4", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: python:3.11-slim"}, "properties": {"repobilityId": "d87a2f32f358ec46", "scanner": "scanner-primary", "fingerprint": "cc74a037512b08d4", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "microservices/business-architect-anthropic/Dockerfile"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-39d53459a36631f2", "level": "warning", "message": {"text": "Dockerfile runs as root: microservices/application-architect-deterministic/Dockerfile"}, "properties": {"repobilityId": "5d6be83413f83c6c", "scanner": "scanner-primary", "fingerprint": "39d53459a36631f2", "layer": "hardware", "severity": "medium", "confidence": 1.0, "tags": ["security", "container"]}}, {"ruleId": "scanner-d33946eaf7053a4c", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: python:3.11-slim"}, "properties": {"repobilityId": "0be7e301227b058f", "scanner": "scanner-primary", "fingerprint": "d33946eaf7053a4c", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "microservices/application-architect-deterministic/Dockerfile"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-4f8ac08c21edd211", "level": "warning", "message": {"text": "Dockerfile runs as root: microservices/solution-architect-deterministic/Dockerfile"}, "properties": {"repobilityId": "2b25733fadf99d83", "scanner": "scanner-primary", "fingerprint": "4f8ac08c21edd211", "layer": "hardware", "severity": "medium", "confidence": 1.0, "tags": ["security", "container"]}}, {"ruleId": "scanner-5e8b0e0525090a12", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: python:3.11-slim"}, "properties": {"repobilityId": "6cd87c2013b3fabd", "scanner": "scanner-primary", "fingerprint": "5e8b0e0525090a12", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "microservices/solution-architect-deterministic/Dockerfile"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-443a642b45074b60", "level": "warning", "message": {"text": "Dockerfile runs as root: microservices/developer-deterministic/Dockerfile"}, "properties": {"repobilityId": "2d2308b246165bdb", "scanner": "scanner-primary", "fingerprint": "443a642b45074b60", "layer": "hardware", "severity": "medium", "confidence": 1.0, "tags": ["security", "container"]}}, {"ruleId": "scanner-c9961293d1c0d0cc", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: python:3.11-slim"}, "properties": {"repobilityId": "bc91b12db150b335", "scanner": "scanner-primary", "fingerprint": "c9961293d1c0d0cc", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "microservices/developer-deterministic/Dockerfile"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-7093d2baf2316962", "level": "warning", "message": {"text": "Dockerfile runs as root: microservices/solution-architect-anthropic/Dockerfile"}, "properties": {"repobilityId": "3e87dbb8fe3226a9", "scanner": "scanner-primary", "fingerprint": "7093d2baf2316962", "layer": "hardware", "severity": "medium", "confidence": 1.0, "tags": ["security", "container"]}}, {"ruleId": "scanner-d92265827096c7ff", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: python:3.11-slim"}, "properties": {"repobilityId": "4645b51a7862fb3f", "scanner": "scanner-primary", "fingerprint": "d92265827096c7ff", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "microservices/solution-architect-anthropic/Dockerfile"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b0ae894946359aa3", "level": "warning", "message": {"text": "Dockerfile runs as root: microservices/accountant-anthropic/Dockerfile"}, "properties": {"repobilityId": "2f35159142964819", "scanner": "scanner-primary", "fingerprint": "b0ae894946359aa3", "layer": "hardware", "severity": "medium", "confidence": 1.0, "tags": ["security", "container"]}}, {"ruleId": "scanner-7680deabf3443fc7", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: python:3.11-slim"}, "properties": {"repobilityId": "fc680cfb69aaa835", "scanner": "scanner-primary", "fingerprint": "7680deabf3443fc7", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "microservices/accountant-anthropic/Dockerfile"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-cb928a2bf0df05c6", "level": "warning", "message": {"text": "Dockerfile runs as root: microservices/streamlit-frontend/Dockerfile"}, "properties": {"repobilityId": "15178bfbf086d63a", "scanner": "scanner-primary", "fingerprint": "cb928a2bf0df05c6", "layer": "hardware", "severity": "medium", "confidence": 1.0, "tags": ["security", "container"]}}, {"ruleId": "scanner-cee5df4866f58891", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: python:3.11-slim"}, "properties": {"repobilityId": "3ed16214177ac8cf", "scanner": "scanner-primary", "fingerprint": "cee5df4866f58891", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "microservices/streamlit-frontend/Dockerfile"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-7f8ea8d0cfe9ca3c", "level": "warning", "message": {"text": "Dockerfile runs as root: microservices/orchestration-service/Dockerfile"}, "properties": {"repobilityId": "067e4c123b1d8218", "scanner": "scanner-primary", "fingerprint": "7f8ea8d0cfe9ca3c", "layer": "hardware", "severity": "medium", "confidence": 1.0, "tags": ["security", "container"]}}, {"ruleId": "scanner-42af1622bd8ec3af", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: python:3.11-slim"}, "properties": {"repobilityId": "531e701745c35ada", "scanner": "scanner-primary", "fingerprint": "42af1622bd8ec3af", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "microservices/orchestration-service/Dockerfile"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d08dc38b9f79d30b", "level": "warning", "message": {"text": "Dockerfile runs as root: microservices/business-architect-deterministic/Dockerfile"}, "properties": {"repobilityId": "cf8d7bba466f4ccc", "scanner": "scanner-primary", "fingerprint": "d08dc38b9f79d30b", "layer": "hardware", "severity": "medium", "confidence": 1.0, "tags": ["security", "container"]}}, {"ruleId": "scanner-ec9949ca8624f5c3", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: python:3.11-slim"}, "properties": {"repobilityId": "8649432ea52dcc5b", "scanner": "scanner-primary", "fingerprint": "ec9949ca8624f5c3", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "microservices/business-architect-deterministic/Dockerfile"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-05ed87712d371821", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: python:3.11-slim"}, "properties": {"repobilityId": "25221a90a6503d29", "scanner": "scanner-primary", "fingerprint": "05ed87712d371821", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "factory/adapters/mcp-web-gateway/Dockerfile"}, "region": {"startLine": 3}}}]}, {"ruleId": "scanner-b0c52a797e030920", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: python:3.11-slim"}, "properties": {"repobilityId": "db329ca9aed95ac6", "scanner": "scanner-primary", "fingerprint": "b0c52a797e030920", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "factory/adapters/intake-slack/Dockerfile"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-5a236a655bd95afb", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: python:3.11-slim"}, "properties": {"repobilityId": "b569dea5e386a460", "scanner": "scanner-primary", "fingerprint": "5a236a655bd95afb", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "factory/adapters/mcp-read-gateway/Dockerfile"}, "region": {"startLine": 9}}}]}, {"ruleId": "scanner-daafe42db9c6ed86", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: python:3.11-slim"}, "properties": {"repobilityId": "a55cb3a5cf1420d9", "scanner": "scanner-primary", "fingerprint": "daafe42db9c6ed86", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "factory/adapters/mcp-write-gateway/Dockerfile"}, "region": {"startLine": 3}}}]}, {"ruleId": "scanner-5ff24f8df9c71423", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: python:3.11-slim"}, "properties": {"repobilityId": "a11bc65cc99b9739", "scanner": "scanner-primary", "fingerprint": "5ff24f8df9c71423", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "factory/production-lines/traditional-cloud/adapters/compose-mcp/Dockerfile"}, "region": {"startLine": 4}}}]}, {"ruleId": "scanner-241b49e62a13e757", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: node:22-bookworm-slim"}, "properties": {"repobilityId": "ed24f6e78313b815", "scanner": "scanner-primary", "fingerprint": "241b49e62a13e757", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "factory/production-lines/traditional-cloud/adapters/dev-agent/Dockerfile"}, "region": {"startLine": 19}}}]}, {"ruleId": "scanner-ea6f10b251e57df8", "level": "warning", "message": {"text": "Dockerfile ADD downloads remote content without checksum"}, "properties": {"repobilityId": "568ca87e6234f928", "scanner": "scanner-primary", "fingerprint": "ea6f10b251e57df8", "layer": "hardware", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "docker", "checksum"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "factory/production-lines/traditional-cloud/adapters/dev-agent/Dockerfile"}, "region": {"startLine": 31}}}]}, {"ruleId": "scanner-d3fc8f54df7bcd1f", "level": "warning", "message": {"text": "Dockerfile runs as root: factory/production-lines/traditional-cloud/adapters/mscv-image/Dockerfile"}, "properties": {"repobilityId": "f57dc4a118397a94", "scanner": "scanner-primary", "fingerprint": "d3fc8f54df7bcd1f", "layer": "hardware", "severity": "medium", "confidence": 1.0, "tags": ["security", "container"]}}, {"ruleId": "scanner-381352b404671270", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: alpine:3.18"}, "properties": {"repobilityId": "1692176be94b3607", "scanner": "scanner-primary", "fingerprint": "381352b404671270", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "factory/production-lines/traditional-cloud/adapters/mscv-image/Dockerfile"}, "region": {"startLine": 9}}}]}, {"ruleId": "scanner-cd9b4b321fab1867", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: python:3.10-slim"}, "properties": {"repobilityId": "09027bcd03fc982c", "scanner": "scanner-primary", "fingerprint": "cd9b4b321fab1867", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "factory/production-lines/traditional-cloud/adapters/rasa-base-image/Dockerfile"}, "region": {"startLine": 32}}}]}, {"ruleId": "scanner-e4d5f2a730b0095d", "level": "warning", "message": {"text": "Dockerfile runs as root: factory/substrate/crossplane/graphql/schema-discovery/Dockerfile"}, "properties": {"repobilityId": "b2c2a6d36b280626", "scanner": "scanner-primary", "fingerprint": "e4d5f2a730b0095d", "layer": "hardware", "severity": "medium", "confidence": 1.0, "tags": ["security", "container"]}}, {"ruleId": "scanner-96559511b489fbf7", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: alpine:3.18"}, "properties": {"repobilityId": "696068e94c3454d2", "scanner": "scanner-primary", "fingerprint": "96559511b489fbf7", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "factory/substrate/crossplane/graphql/schema-discovery/Dockerfile"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f47643768776601a", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: python:3.11-slim"}, "properties": {"repobilityId": "d2c60cd0d8c4453c", "scanner": "scanner-primary", "fingerprint": "f47643768776601a", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "factory/substrate/contract-tests/Dockerfile"}, "region": {"startLine": 8}}}]}, {"ruleId": "scanner-62cc53e511557efb", "level": "warning", "message": {"text": "Dockerfile runs as root: factory/substrate/images/realtime-kafka-connect/Dockerfile"}, "properties": {"repobilityId": "4ab7cd3b5d9091c5", "scanner": "scanner-primary", "fingerprint": "62cc53e511557efb", "layer": "hardware", "severity": "medium", "confidence": 1.0, "tags": ["security", "container"]}}, {"ruleId": "scanner-b5042218ab5d4a25", "level": "warning", "message": {"text": "Dockerfile runs as root: factory/utilities/identity-template-generator/Dockerfile"}, "properties": {"repobilityId": "4a98f47bc2fa0988", "scanner": "scanner-primary", "fingerprint": "b5042218ab5d4a25", "layer": "hardware", "severity": "medium", "confidence": 1.0, "tags": ["security", "container"]}}, {"ruleId": "scanner-16f5f9c823775f8d", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: ubuntu:22.04"}, "properties": {"repobilityId": "2e27656debbeb3de", "scanner": "scanner-primary", "fingerprint": "16f5f9c823775f8d", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "factory/utilities/identity-template-generator/Dockerfile"}, "region": {"startLine": 3}}}]}, {"ruleId": "scanner-9710c8d059e53154", "level": "none", "message": {"text": "No frontend routes/components detected"}, "properties": {"repobilityId": "44ca61485762e494", "scanner": "scanner-primary", "fingerprint": "9710c8d059e53154", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-b650a607e4e5eea3", "level": "error", "message": {"text": "Possible secret in archive/neon-credentials-secret.yaml"}, "properties": {"repobilityId": "efe40320a6a8b675", "scanner": "scanner-primary", "fingerprint": "b650a607e4e5eea3", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "archive/neon-credentials-secret.yaml"}, "region": {"startLine": 10}}}]}, {"ruleId": "scanner-0b0a527016b5857f", "level": "error", "message": {"text": "Possible secret in archive/requirements/definitions/parking-platform-oam.yaml"}, "properties": {"repobilityId": "abf8bba7a3668f27", "scanner": "scanner-primary", "fingerprint": "0b0a527016b5857f", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "archive/requirements/definitions/parking-platform-oam.yaml"}, "region": {"startLine": 57}}}]}, {"ruleId": "scanner-0b0a527016b5857f", "level": "error", "message": {"text": "Possible secret in archive/requirements/definitions/parking-platform-oam.yaml"}, "properties": {"repobilityId": "abf8bba7a3668f27", "scanner": "scanner-primary", "fingerprint": "0b0a527016b5857f", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "archive/requirements/definitions/parking-platform-oam.yaml"}, "region": {"startLine": 59}}}]}, {"ruleId": "scanner-0b0a527016b5857f", "level": "error", "message": {"text": "Possible secret in archive/requirements/definitions/parking-platform-oam.yaml"}, "properties": {"repobilityId": "abf8bba7a3668f27", "scanner": "scanner-primary", "fingerprint": "0b0a527016b5857f", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "archive/requirements/definitions/parking-platform-oam.yaml"}, "region": {"startLine": 506}}}]}, {"ruleId": "scanner-0b0a527016b5857f", "level": "error", "message": {"text": "Possible secret in archive/requirements/definitions/parking-platform-oam.yaml"}, "properties": {"repobilityId": "abf8bba7a3668f27", "scanner": "scanner-primary", "fingerprint": "0b0a527016b5857f", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "archive/requirements/definitions/parking-platform-oam.yaml"}, "region": {"startLine": 508}}}]}, {"ruleId": "scanner-0b0a527016b5857f", "level": "error", "message": {"text": "Possible secret in archive/requirements/definitions/parking-platform-oam.yaml"}, "properties": {"repobilityId": "abf8bba7a3668f27", "scanner": "scanner-primary", "fingerprint": "0b0a527016b5857f", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "archive/requirements/definitions/parking-platform-oam.yaml"}, "region": {"startLine": 524}}}]}, {"ruleId": "scanner-0b0a527016b5857f", "level": "error", "message": {"text": "Possible secret in archive/requirements/definitions/parking-platform-oam.yaml"}, "properties": {"repobilityId": "abf8bba7a3668f27", "scanner": "scanner-primary", "fingerprint": "0b0a527016b5857f", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "archive/requirements/definitions/parking-platform-oam.yaml"}, "region": {"startLine": 548}}}]}, {"ruleId": "scanner-d96382af11109fc1", "level": "warning", "message": {"text": "Insecure pattern 'cors_wildcard' in archive/cluster-snapshots/2026-05-30-2232/compositions.yaml:8303"}, "properties": {"repobilityId": "7f64b52e2e216a0d", "scanner": "scanner-primary", "fingerprint": "d96382af11109fc1", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "cors_wildcard"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "archive/cluster-snapshots/2026-05-30-2232/compositions.yaml"}, "region": {"startLine": 8303}}}]}, {"ruleId": "scanner-07d133a8926ee49c", "level": "error", "message": {"text": "Possible secret in microservices/business-analyst-anthropic/README.md"}, "properties": {"repobilityId": "fc9a2aecf17fdbe2", "scanner": "scanner-primary", "fingerprint": "07d133a8926ee49c", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "microservices/business-analyst-anthropic/README.md"}, "region": {"startLine": 115}}}]}, {"ruleId": "scanner-487ae4ede189ad21", "level": "warning", "message": {"text": "Insecure pattern 'cors_wildcard' in microservices/business-analyst-anthropic/shared-libs/agent-common/src/agent_common/fastapi_utils.py:180"}, "properties": {"repobilityId": "8ed818f19672a942", "scanner": "scanner-primary", "fingerprint": "487ae4ede189ad21", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "cors_wildcard"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "microservices/business-analyst-anthropic/shared-libs/agent-common/src/agent_common/fastapi_utils.py"}, "region": {"startLine": 180}}}]}, {"ruleId": "scanner-5a9b127fb8df0d21", "level": "warning", "message": {"text": "Insecure pattern 'cors_wildcard' in microservices/shared-libs/agent-common/src/agent_common/fastapi_utils.py:180"}, "properties": {"repobilityId": "b3b021bb5c778f1e", "scanner": "scanner-primary", "fingerprint": "5a9b127fb8df0d21", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "cors_wildcard"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "microservices/shared-libs/agent-common/src/agent_common/fastapi_utils.py"}, "region": {"startLine": 180}}}]}, {"ruleId": "scanner-4340e3caa8fd1945", "level": "warning", "message": {"text": "Insecure pattern 'cors_wildcard' in microservices/shared-libs/agent-common/src/agent_common/realtime_fastapi.py:409"}, "properties": {"repobilityId": "c22269babb0a37c6", "scanner": "scanner-primary", "fingerprint": "4340e3caa8fd1945", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "cors_wildcard"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "microservices/shared-libs/agent-common/src/agent_common/realtime_fastapi.py"}, "region": {"startLine": 409}}}]}, {"ruleId": "scanner-f1a75d4ede092841", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in graphify-out/graph.html:135"}, "properties": {"repobilityId": "351fcd8a0cdaa114", "scanner": "scanner-primary", "fingerprint": "f1a75d4ede092841", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "graphify-out/graph.html"}, "region": {"startLine": 135}}}]}, {"ruleId": "scanner-db31e76ebebffa51", "level": "error", "message": {"text": "Insecure pattern 'tls_verify_false' in factory/adapters/intake-slack/src/infrastructure/argo_client.py:181"}, "properties": {"repobilityId": "79272653ebca83bb", "scanner": "scanner-primary", "fingerprint": "db31e76ebebffa51", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "tls_verify_false"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "factory/adapters/intake-slack/src/infrastructure/argo_client.py"}, "region": {"startLine": 181}}}]}, {"ruleId": "scanner-5d79b4b544afa9de", "level": "error", "message": {"text": "Insecure pattern 'tls_verify_false' in factory/shared-libs/capability-mcp-core/src/infrastructure/argo_client.py:69"}, "properties": {"repobilityId": "06efb9bf1d9bc43a", "scanner": "scanner-primary", "fingerprint": "5d79b4b544afa9de", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "tls_verify_false"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "factory/shared-libs/capability-mcp-core/src/infrastructure/argo_client.py"}, "region": {"startLine": 69}}}]}, {"ruleId": "scanner-fc3aa9f76df31208", "level": "warning", "message": {"text": "Insecure pattern 'cors_wildcard' in factory/substrate/crossplane/graphql-platform-claim-composition.yaml:88"}, "properties": {"repobilityId": "d761a4df12c709b4", "scanner": "scanner-primary", "fingerprint": "fc3aa9f76df31208", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "cors_wildcard"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "factory/substrate/crossplane/graphql-platform-claim-composition.yaml"}, "region": {"startLine": 88}}}]}, {"ruleId": "scanner-799f5ba25caec73b", "level": "error", "message": {"text": "Possible secret in factory/substrate/crossplane/realtime-platform/06-lenses-hq-deployment.yaml"}, "properties": {"repobilityId": "d1964c61cf1aade6", "scanner": "scanner-primary", "fingerprint": "799f5ba25caec73b", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "factory/substrate/crossplane/realtime-platform/06-lenses-hq-deployment.yaml"}, "region": {"startLine": 33}}}]}, {"ruleId": "scanner-3d80db577ec961d1", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "88a06ad5f5baa9cf", "scanner": "scanner-primary", "fingerprint": "3d80db577ec961d1", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "factory/adapters/intake-slack/.github/workflows/slack-api-server-ci.yml"}, "region": {"startLine": 48}}}]}, {"ruleId": "scanner-b3c5f76155980dad", "level": "error", "message": {"text": "GitHub Action tracks a moving branch"}, "properties": {"repobilityId": "6bfd6b8bbfee52c4", "scanner": "scanner-primary", "fingerprint": "b3c5f76155980dad", "layer": "cicd", "severity": "high", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "factory/adapters/intake-slack/.github/workflows/slack-api-server-ci.yml"}, "region": {"startLine": 51}}}]}, {"ruleId": "scanner-3d80db577ec961d1", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "99f6886b86e6c5da", "scanner": "scanner-primary", "fingerprint": "3d80db577ec961d1", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "factory/adapters/intake-slack/.github/workflows/slack-api-server-ci.yml"}, "region": {"startLine": 59}}}]}, {"ruleId": "scanner-3d80db577ec961d1", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "88a06ad5f5baa9cf", "scanner": "scanner-primary", "fingerprint": "3d80db577ec961d1", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "factory/adapters/intake-slack/.github/workflows/slack-api-server-ci.yml"}, "region": {"startLine": 69}}}]}, {"ruleId": "scanner-3d80db577ec961d1", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "845a700bd1225797", "scanner": "scanner-primary", "fingerprint": "3d80db577ec961d1", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "factory/adapters/intake-slack/.github/workflows/slack-api-server-ci.yml"}, "region": {"startLine": 72}}}]}, {"ruleId": "scanner-3d80db577ec961d1", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "88a06ad5f5baa9cf", "scanner": "scanner-primary", "fingerprint": "3d80db577ec961d1", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "factory/adapters/intake-slack/.github/workflows/slack-api-server-ci.yml"}, "region": {"startLine": 102}}}]}, {"ruleId": "scanner-3d80db577ec961d1", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "8c64e6b809464819", "scanner": "scanner-primary", "fingerprint": "3d80db577ec961d1", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "factory/adapters/intake-slack/.github/workflows/slack-api-server-ci.yml"}, "region": {"startLine": 116}}}]}, {"ruleId": "scanner-3d80db577ec961d1", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "2b9039b0cf8a8647", "scanner": "scanner-primary", "fingerprint": "3d80db577ec961d1", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "factory/adapters/intake-slack/.github/workflows/slack-api-server-ci.yml"}, "region": {"startLine": 119}}}]}, {"ruleId": "scanner-3d80db577ec961d1", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "7969669ef4f4401a", "scanner": "scanner-primary", "fingerprint": "3d80db577ec961d1", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "factory/adapters/intake-slack/.github/workflows/slack-api-server-ci.yml"}, "region": {"startLine": 126}}}]}, {"ruleId": "scanner-3d80db577ec961d1", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "88a06ad5f5baa9cf", "scanner": "scanner-primary", "fingerprint": "3d80db577ec961d1", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "factory/adapters/intake-slack/.github/workflows/slack-api-server-ci.yml"}, "region": {"startLine": 144}}}]}, {"ruleId": "scanner-3d80db577ec961d1", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "5b41b0611d5c3e78", "scanner": "scanner-primary", "fingerprint": "3d80db577ec961d1", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "factory/adapters/intake-slack/.github/workflows/slack-api-server-ci.yml"}, "region": {"startLine": 147}}}]}, {"ruleId": "scanner-3d80db577ec961d1", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "88a06ad5f5baa9cf", "scanner": "scanner-primary", "fingerprint": "3d80db577ec961d1", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "factory/adapters/intake-slack/.github/workflows/slack-api-server-ci.yml"}, "region": {"startLine": 213}}}]}, {"ruleId": "scanner-3d80db577ec961d1", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "5b41b0611d5c3e78", "scanner": "scanner-primary", "fingerprint": "3d80db577ec961d1", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "factory/adapters/intake-slack/.github/workflows/slack-api-server-ci.yml"}, "region": {"startLine": 224}}}]}, {"ruleId": "scanner-d1ac377d04f17482", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "205e07cffe172b49", "scanner": "scanner-primary", "fingerprint": "d1ac377d04f17482", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "factory/adapters/intake-slack/.github/workflows/slack-api-server-ci.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-cb0a2d0542bd11d8", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "b8164429bfbc32e3", "scanner": "scanner-primary", "fingerprint": "cb0a2d0542bd11d8", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/debug-auth.yml"}, "region": {"startLine": 26}}}]}, {"ruleId": "scanner-8cd6f464d9060021", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "2209ddaceed4138f", "scanner": "scanner-primary", "fingerprint": "8cd6f464d9060021", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/debug-auth.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ecb9cc9f0623db25", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "0b6d764de847247d", "scanner": "scanner-primary", "fingerprint": "ecb9cc9f0623db25", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/create-vcluster.yml"}, "region": {"startLine": 21}}}]}, {"ruleId": "scanner-ecb9cc9f0623db25", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "32c7d9f817c035af", "scanner": "scanner-primary", "fingerprint": "ecb9cc9f0623db25", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/create-vcluster.yml"}, "region": {"startLine": 140}}}]}, {"ruleId": "scanner-ecb9cc9f0623db25", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "5e62a70ca149c0c2", "scanner": "scanner-primary", "fingerprint": "ecb9cc9f0623db25", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/create-vcluster.yml"}, "region": {"startLine": 148}}}]}, {"ruleId": "scanner-8ed8742047bbb5d1", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "8235386f1a1bdd42", "scanner": "scanner-primary", "fingerprint": "8ed8742047bbb5d1", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/create-vcluster.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a3c329ba0df2dea7", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "150cee5ef90d532a", "scanner": "scanner-primary", "fingerprint": "a3c329ba0df2dea7", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/argocd-sync.yml"}, "region": {"startLine": 25}}}]}, {"ruleId": "scanner-a3c329ba0df2dea7", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "45c12741100be475", "scanner": "scanner-primary", "fingerprint": "a3c329ba0df2dea7", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/argocd-sync.yml"}, "region": {"startLine": 40}}}]}, {"ruleId": "scanner-aad98400d0637d92", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "9b8f040af577d149", "scanner": "scanner-primary", "fingerprint": "aad98400d0637d92", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/slack-api-server-ci.yml"}, "region": {"startLine": 48}}}]}, {"ruleId": "scanner-a04111879b3623a7", "level": "error", "message": {"text": "GitHub Action tracks a moving branch"}, "properties": {"repobilityId": "9be0107283a8ccfc", "scanner": "scanner-primary", "fingerprint": "a04111879b3623a7", "layer": "cicd", "severity": "high", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/slack-api-server-ci.yml"}, "region": {"startLine": 51}}}]}, {"ruleId": "scanner-aad98400d0637d92", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "1defc18e315f250b", "scanner": "scanner-primary", "fingerprint": "aad98400d0637d92", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/slack-api-server-ci.yml"}, "region": {"startLine": 59}}}]}, {"ruleId": "scanner-aad98400d0637d92", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "9b8f040af577d149", "scanner": "scanner-primary", "fingerprint": "aad98400d0637d92", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/slack-api-server-ci.yml"}, "region": {"startLine": 69}}}]}, {"ruleId": "scanner-aad98400d0637d92", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "4aa6cc5843f29f14", "scanner": "scanner-primary", "fingerprint": "aad98400d0637d92", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/slack-api-server-ci.yml"}, "region": {"startLine": 72}}}]}, {"ruleId": "scanner-aad98400d0637d92", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "9b8f040af577d149", "scanner": "scanner-primary", "fingerprint": "aad98400d0637d92", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/slack-api-server-ci.yml"}, "region": {"startLine": 111}}}]}, {"ruleId": "scanner-aad98400d0637d92", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "7b76727b74fe9fee", "scanner": "scanner-primary", "fingerprint": "aad98400d0637d92", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/slack-api-server-ci.yml"}, "region": {"startLine": 125}}}]}, {"ruleId": "scanner-aad98400d0637d92", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "53dd14a3bb7355c3", "scanner": "scanner-primary", "fingerprint": "aad98400d0637d92", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/slack-api-server-ci.yml"}, "region": {"startLine": 128}}}]}, {"ruleId": "scanner-aad98400d0637d92", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "d091e693bba555bf", "scanner": "scanner-primary", "fingerprint": "aad98400d0637d92", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/slack-api-server-ci.yml"}, "region": {"startLine": 135}}}]}, {"ruleId": "scanner-aad98400d0637d92", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "9b8f040af577d149", "scanner": "scanner-primary", "fingerprint": "aad98400d0637d92", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/slack-api-server-ci.yml"}, "region": {"startLine": 199}}}]}, {"ruleId": "scanner-aad98400d0637d92", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "3627b36c85123bfe", "scanner": "scanner-primary", "fingerprint": "aad98400d0637d92", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/slack-api-server-ci.yml"}, "region": {"startLine": 210}}}]}, {"ruleId": "scanner-eaae909e91a73591", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "e79cf3a7eae4bfd5", "scanner": "scanner-primary", "fingerprint": "eaae909e91a73591", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/slack-api-server-ci.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-af4edc89fc3936af", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "b80c961b106acf7b", "scanner": "scanner-primary", "fingerprint": "af4edc89fc3936af", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/chat-gitops.yml"}, "region": {"startLine": 48}}}]}, {"ruleId": "scanner-af4edc89fc3936af", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "b80c961b106acf7b", "scanner": "scanner-primary", "fingerprint": "af4edc89fc3936af", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/chat-gitops.yml"}, "region": {"startLine": 127}}}]}, {"ruleId": "scanner-1572d1550687267d", "level": "error", "message": {"text": "GitHub Action tracks a moving branch"}, "properties": {"repobilityId": "516dd395a7be6a42", "scanner": "scanner-primary", "fingerprint": "1572d1550687267d", "layer": "cicd", "severity": "high", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/chat-gitops.yml"}, "region": {"startLine": 153}}}]}, {"ruleId": "scanner-1572d1550687267d", "level": "error", "message": {"text": "GitHub Action tracks a moving branch"}, "properties": {"repobilityId": "516dd395a7be6a42", "scanner": "scanner-primary", "fingerprint": "1572d1550687267d", "layer": "cicd", "severity": "high", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/chat-gitops.yml"}, "region": {"startLine": 161}}}]}, {"ruleId": "scanner-1572d1550687267d", "level": "error", "message": {"text": "GitHub Action tracks a moving branch"}, "properties": {"repobilityId": "516dd395a7be6a42", "scanner": "scanner-primary", "fingerprint": "1572d1550687267d", "layer": "cicd", "severity": "high", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/chat-gitops.yml"}, "region": {"startLine": 169}}}]}, {"ruleId": "scanner-af4edc89fc3936af", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "d336c64aa1d6aaa3", "scanner": "scanner-primary", "fingerprint": "af4edc89fc3936af", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/chat-gitops.yml"}, "region": {"startLine": 177}}}]}, {"ruleId": "scanner-af4edc89fc3936af", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "d336c64aa1d6aaa3", "scanner": "scanner-primary", "fingerprint": "af4edc89fc3936af", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/chat-gitops.yml"}, "region": {"startLine": 185}}}]}, {"ruleId": "scanner-af4edc89fc3936af", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "d336c64aa1d6aaa3", "scanner": "scanner-primary", "fingerprint": "af4edc89fc3936af", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/chat-gitops.yml"}, "region": {"startLine": 193}}}]}, {"ruleId": "scanner-af4edc89fc3936af", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "b80c961b106acf7b", "scanner": "scanner-primary", "fingerprint": "af4edc89fc3936af", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/chat-gitops.yml"}, "region": {"startLine": 209}}}]}, {"ruleId": "scanner-af4edc89fc3936af", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "1be6fafdfbd7f281", "scanner": "scanner-primary", "fingerprint": "af4edc89fc3936af", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/chat-gitops.yml"}, "region": {"startLine": 214}}}]}, {"ruleId": "scanner-af4edc89fc3936af", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "6da380cdd8657d1c", "scanner": "scanner-primary", "fingerprint": "af4edc89fc3936af", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/chat-gitops.yml"}, "region": {"startLine": 217}}}]}, {"ruleId": "scanner-5077973d69724c6c", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "03dd2e2313ab7538", "scanner": "scanner-primary", "fingerprint": "5077973d69724c6c", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/chat-gitops.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-0d18038d2a97566d", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "ded6121c9e9bd4c2", "scanner": "scanner-primary", "fingerprint": "0d18038d2a97566d", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/architect-evals.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-4489c9a16e43757b", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "851819d42b788f37", "scanner": "scanner-primary", "fingerprint": "4489c9a16e43757b", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/realtime-transport-publish.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-79981f58b1f3ab05", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "255de1d42c100325", "scanner": "scanner-primary", "fingerprint": "79981f58b1f3ab05", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/debug-secret.yml"}, "region": {"startLine": 26}}}]}, {"ruleId": "scanner-3605e3a40c34452c", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "0ff63cff68fa7122", "scanner": "scanner-primary", "fingerprint": "3605e3a40c34452c", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/debug-secret.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-5684ea51c61781b0", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "0cfa3bb0f6f6593b", "scanner": "scanner-primary", "fingerprint": "5684ea51c61781b0", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/pr-validation.yml"}, "region": {"startLine": 21}}}]}, {"ruleId": "scanner-5684ea51c61781b0", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "0cfa3bb0f6f6593b", "scanner": "scanner-primary", "fingerprint": "5684ea51c61781b0", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/pr-validation.yml"}, "region": {"startLine": 97}}}]}, {"ruleId": "scanner-5684ea51c61781b0", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "a537050e01faea75", "scanner": "scanner-primary", "fingerprint": "5684ea51c61781b0", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/pr-validation.yml"}, "region": {"startLine": 102}}}]}, {"ruleId": "scanner-a79cacd9914c8e54", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "87ff0f09c5d003fc", "scanner": "scanner-primary", "fingerprint": "a79cacd9914c8e54", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/comprehensive-gitops.yml"}, "region": {"startLine": 40}}}]}, {"ruleId": "scanner-a79cacd9914c8e54", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "87ff0f09c5d003fc", "scanner": "scanner-primary", "fingerprint": "a79cacd9914c8e54", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/comprehensive-gitops.yml"}, "region": {"startLine": 122}}}]}, {"ruleId": "scanner-877b3e77bb6efb33", "level": "error", "message": {"text": "GitHub Action tracks a moving branch"}, "properties": {"repobilityId": "9a593e2860fdca9f", "scanner": "scanner-primary", "fingerprint": "877b3e77bb6efb33", "layer": "cicd", "severity": "high", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/comprehensive-gitops.yml"}, "region": {"startLine": 140}}}]}, {"ruleId": "scanner-a79cacd9914c8e54", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "05b92ab015048ec0", "scanner": "scanner-primary", "fingerprint": "a79cacd9914c8e54", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/comprehensive-gitops.yml"}, "region": {"startLine": 148}}}]}, {"ruleId": "scanner-877b3e77bb6efb33", "level": "error", "message": {"text": "GitHub Action tracks a moving branch"}, "properties": {"repobilityId": "9a593e2860fdca9f", "scanner": "scanner-primary", "fingerprint": "877b3e77bb6efb33", "layer": "cicd", "severity": "high", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/comprehensive-gitops.yml"}, "region": {"startLine": 156}}}]}, {"ruleId": "scanner-a79cacd9914c8e54", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "87ff0f09c5d003fc", "scanner": "scanner-primary", "fingerprint": "a79cacd9914c8e54", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/comprehensive-gitops.yml"}, "region": {"startLine": 166}}}]}, {"ruleId": "scanner-a79cacd9914c8e54", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "d7dd27b9d2c72b2d", "scanner": "scanner-primary", "fingerprint": "a79cacd9914c8e54", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/comprehensive-gitops.yml"}, "region": {"startLine": 169}}}]}, {"ruleId": "scanner-a79cacd9914c8e54", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "87ff0f09c5d003fc", "scanner": "scanner-primary", "fingerprint": "a79cacd9914c8e54", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/comprehensive-gitops.yml"}, "region": {"startLine": 197}}}]}, {"ruleId": "scanner-a79cacd9914c8e54", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "26142eb1d9df18d7", "scanner": "scanner-primary", "fingerprint": "a79cacd9914c8e54", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/comprehensive-gitops.yml"}, "region": {"startLine": 229}}}]}, {"ruleId": "scanner-a79cacd9914c8e54", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "6e683a986021e27b", "scanner": "scanner-primary", "fingerprint": "a79cacd9914c8e54", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/comprehensive-gitops.yml"}, "region": {"startLine": 232}}}]}, {"ruleId": "scanner-efab3fc4fa53608d", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "ace799c8b411b284", "scanner": "scanner-primary", "fingerprint": "efab3fc4fa53608d", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/comprehensive-gitops.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e7ea165212a5f9f2", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "3d9ec572c07a35b5", "scanner": "scanner-primary", "fingerprint": "e7ea165212a5f9f2", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/contract-test-runner-ci.yml"}, "region": {"startLine": 71}}}]}, {"ruleId": "scanner-e7ea165212a5f9f2", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "a759cfcb45ec4d2b", "scanner": "scanner-primary", "fingerprint": "e7ea165212a5f9f2", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/contract-test-runner-ci.yml"}, "region": {"startLine": 74}}}]}, {"ruleId": "scanner-bad9cb5068aef2d8", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "6bf32c5a22835261", "scanner": "scanner-primary", "fingerprint": "bad9cb5068aef2d8", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/contract-test-runner-ci.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-db84861fc9b28a95", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "3182fd5117c4a8ef", "scanner": "scanner-primary", "fingerprint": "db84861fc9b28a95", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/mscv-image.yml"}, "region": {"startLine": 47}}}]}, {"ruleId": "scanner-db84861fc9b28a95", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "b04271b1023e1456", "scanner": "scanner-primary", "fingerprint": "db84861fc9b28a95", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/mscv-image.yml"}, "region": {"startLine": 60}}}]}, {"ruleId": "scanner-3e4d506f53fd8678", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "b3bc4c0fc4ab1e85", "scanner": "scanner-primary", "fingerprint": "3e4d506f53fd8678", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/mscv-image.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-afcdb78e5d1b24a6", "level": "note", "message": {"text": "Very large file: microservices/project-manager-anthropic/src/project_manager_anthropic.py (1437 lines)"}, "properties": {"repobilityId": "882996b82a4f1f93", "scanner": "scanner-primary", "fingerprint": "afcdb78e5d1b24a6", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-e519cad30d184166", "level": "note", "message": {"text": "Very large file: microservices/solution-architect-anthropic/src/solution_architect.py (1423 lines)"}, "properties": {"repobilityId": "377686a635228352", "scanner": "scanner-primary", "fingerprint": "e519cad30d184166", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-831812ce8b281b05", "level": "note", "message": {"text": "Very large file: microservices/accountant-anthropic/src/accountant.py (1251 lines)"}, "properties": {"repobilityId": "8f5678a43f35dc7e", "scanner": "scanner-primary", "fingerprint": "831812ce8b281b05", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-dfb22f1f70b6455f", "level": "note", "message": {"text": "Very large file: microservices/streamlit-frontend/components/archimate_visualization.py (1529 lines)"}, "properties": {"repobilityId": "2d196da90e1594b4", "scanner": "scanner-primary", "fingerprint": "dfb22f1f70b6455f", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-141b30a41e03817b", "level": "note", "message": {"text": "No license file detected"}, "properties": {"repobilityId": "fb4c3b8b74a98d28", "scanner": "scanner-primary", "fingerprint": "141b30a41e03817b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["license", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "c6ebf65578a35d68", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-72b2a6250083a784", "level": "warning", "message": {"text": "Placeholder or mock-heavy implementation detected"}, "properties": {"repobilityId": "3e6af665134705da", "scanner": "scanner-primary", "fingerprint": "72b2a6250083a784", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "incomplete", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "349619c8f325b693", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-749d4bc1bd66df5f", "level": "warning", "message": {"text": "Agent instructions exist but release-hardening basics are missing"}, "properties": {"repobilityId": "98da7510bb1ce84a", "scanner": "scanner-primary", "fingerprint": "749d4bc1bd66df5f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "b7086e0919eb88e7", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "90ae4cfc1eef1781", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-cc55229a7a3c078d", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .mcp.json"}, "properties": {"repobilityId": "51942fb3d5b8b5b4", "scanner": "scanner-primary", "fingerprint": "cc55229a7a3c078d", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "mcp_config"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".mcp.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-17d866d91a7c451e", "level": "error", "message": {"text": "Agent instruction/config may expose a secret: CLAUDE.md"}, "properties": {"repobilityId": "ccce5984e58a48f0", "scanner": "scanner-primary", "fingerprint": "17d866d91a7c451e", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["agent-instructions", "secrets", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "CLAUDE.md"}, "region": {"startLine": 447}}}]}, {"ruleId": "scanner-be8ba7bc0215315a", "level": "note", "message": {"text": "Legacy-named symbol `test_sink_normalizes_engine_api_without_api_v1` in microservices/shared-libs/realtime-transport/tests/test_webhook_role.py:142"}, "properties": {"repobilityId": "c9124107ff59033a", "scanner": "scanner-primary", "fingerprint": "be8ba7bc0215315a", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-858be2f68a328ef3", "level": "none", "message": {"text": "Commented-code block (8 lines) in microservices/shared-libs/agent-common/src/agent_common/realtime_fastapi.py:57"}, "properties": {"repobilityId": "5bbd53973c743d6f", "scanner": "scanner-primary", "fingerprint": "858be2f68a328ef3", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-4aad728af92c241b", "level": "note", "message": {"text": "Stub function `execute` (body is just `pass`/`return`) \u2014 microservices/fintech-realtime-manual/src/application/use_cases.py:11"}, "properties": {"repobilityId": "861c8c68fadd5359", "scanner": "scanner-primary", "fingerprint": "4aad728af92c241b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "empty-handler", "dead-code"]}}, {"ruleId": "scanner-b74c6ee020ee124e", "level": "note", "message": {"text": "Legacy-named symbol `create_backup` in microservices/streamlit-frontend/utils/state_persistence.py:148"}, "properties": {"repobilityId": "c8d053da571aa076", "scanner": "scanner-primary", "fingerprint": "b74c6ee020ee124e", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-6e0a0df48122c6c3", "level": "note", "message": {"text": "Legacy-named symbol `state_backup` in microservices/streamlit-frontend/components/views.py:390"}, "properties": {"repobilityId": "da4f526c46e2dd68", "scanner": "scanner-primary", "fingerprint": "6e0a0df48122c6c3", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-7df4ab1019c71dd3", "level": "note", "message": {"text": "Legacy-named symbol `expected_backup` in factory/adapters/intake-slack/test_parsing.py:117"}, "properties": {"repobilityId": "a13eb24d3e145b60", "scanner": "scanner-primary", "fingerprint": "7df4ab1019c71dd3", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-7aba1c00d02d4602", "level": "note", "message": {"text": "Legacy-named symbol `expected_backup` in factory/adapters/intake-slack/test_server.py:25"}, "properties": {"repobilityId": "8da28d1742e06993", "scanner": "scanner-primary", "fingerprint": "7aba1c00d02d4602", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-32f0a6e9acc02811", "level": "none", "message": {"text": "Commented-code block (6 lines) in factory/adapters/intake-slack/src/interface/controllers.py:29"}, "properties": {"repobilityId": "174e9e65b5163fdb", "scanner": "scanner-primary", "fingerprint": "32f0a6e9acc02811", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-896f6b6f27652fff", "level": "none", "message": {"text": "Commented-code block (6 lines) in factory/adapters/intake-slack/src/domain/strategies/pattern2_compositional.py:16"}, "properties": {"repobilityId": "f6c6768fa55dd549", "scanner": "scanner-primary", "fingerprint": "896f6b6f27652fff", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-e539f7790e981393", "level": "none", "message": {"text": "Commented-code block (7 lines) in factory/shared-libs/capability-mcp-core/src/application/analytics_platform_recipe.py:199"}, "properties": {"repobilityId": "642b0c2be56370b0", "scanner": "scanner-primary", "fingerprint": "e539f7790e981393", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-61def3ef2d7584d6", "level": "none", "message": {"text": "Commented-code block (5 lines) in factory/shared-libs/capability-mcp-core/src/application/submit_use_case.py:93"}, "properties": {"repobilityId": "5ebcb0480f3911b8", "scanner": "scanner-primary", "fingerprint": "61def3ef2d7584d6", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-1ec5b2fe34f39b74", "level": "none", "message": {"text": "Commented-code block (6 lines) in factory/substrate/contract-tests/runner.py:296"}, "properties": {"repobilityId": "9f840723ae8489f1", "scanner": "scanner-primary", "fingerprint": "1ec5b2fe34f39b74", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-72e43e35213f9ff1", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 factory/utilities/foundry_responses.py:47"}, "properties": {"repobilityId": "a627e03ec824f243", "scanner": "scanner-primary", "fingerprint": "72e43e35213f9ff1", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-0f2d921ecc4b3313", "level": "note", "message": {"text": "111 env vars used in code but missing from .env.example"}, "properties": {"repobilityId": "86d178202ea6a64d", "scanner": "scanner-primary", "fingerprint": "0f2d921ecc4b3313", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "config-drift"]}}, {"ruleId": "scanner-959dc775c4241ad4", "level": "note", "message": {"text": "Near-duplicate function bodies in 18 places"}, "properties": {"repobilityId": "a08fe59e715fb97b", "scanner": "scanner-primary", "fingerprint": "959dc775c4241ad4", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-46969939caf8120b", "level": "note", "message": {"text": "Near-duplicate function bodies in 9 places"}, "properties": {"repobilityId": "7b0165516add3ecc", "scanner": "scanner-primary", "fingerprint": "46969939caf8120b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-46969939caf8120b", "level": "note", "message": {"text": "Near-duplicate function bodies in 9 places"}, "properties": {"repobilityId": "0090ba6f9208400a", "scanner": "scanner-primary", "fingerprint": "46969939caf8120b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-46969939caf8120b", "level": "note", "message": {"text": "Near-duplicate function bodies in 9 places"}, "properties": {"repobilityId": "fed1e9da90a8755f", "scanner": "scanner-primary", "fingerprint": "46969939caf8120b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-46969939caf8120b", "level": "note", "message": {"text": "Near-duplicate function bodies in 9 places"}, "properties": {"repobilityId": "8a946a8abf431d3f", "scanner": "scanner-primary", "fingerprint": "46969939caf8120b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-46969939caf8120b", "level": "note", "message": {"text": "Near-duplicate function bodies in 9 places"}, "properties": {"repobilityId": "06fd7e2a81af15b8", "scanner": "scanner-primary", "fingerprint": "46969939caf8120b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-46969939caf8120b", "level": "note", "message": {"text": "Near-duplicate function bodies in 9 places"}, "properties": {"repobilityId": "66a232e5936fc231", "scanner": "scanner-primary", "fingerprint": "46969939caf8120b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-c54c6fb8e364daaa", "level": "note", "message": {"text": "Near-duplicate function bodies in 16 places"}, "properties": {"repobilityId": "33d016954c8140e6", "scanner": "scanner-primary", "fingerprint": "c54c6fb8e364daaa", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "289b45e684e3279c", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-49c98f7cedd9c977", "level": "note", "message": {"text": "Near-duplicate function bodies in 4 places"}, "properties": {"repobilityId": "efafeeed7b13dd7c", "scanner": "scanner-primary", "fingerprint": "49c98f7cedd9c977", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "37e0c26d5e312827", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "25454559f66c27d1", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "73b758d4493c5002", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "213b4a1bb3276819", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "51fe32f3c3813855", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "2724085c243e570c", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "3654980803807398", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "edd93035d7e08ebb", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "30960fa998d8416d", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "394b21f75343396c", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-d262964587208a30", "level": "error", "message": {"text": "FastAPI POST `analyze_requirements` without auth dependency \u2014 microservices/accountant-deterministic/src/main.py:73"}, "properties": {"repobilityId": "b809811cf9d3706f", "scanner": "scanner-primary", "fingerprint": "d262964587208a30", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "microservices/accountant-deterministic/src/main.py"}, "region": {"startLine": 73}}}]}, {"ruleId": "scanner-987367a8abd24db6", "level": "error", "message": {"text": "FastAPI POST `extract_entities` without auth dependency \u2014 microservices/accountant-deterministic/src/main.py:123"}, "properties": {"repobilityId": "49354aa5f5a05f4e", "scanner": "scanner-primary", "fingerprint": "987367a8abd24db6", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "microservices/accountant-deterministic/src/main.py"}, "region": {"startLine": 123}}}]}, {"ruleId": "scanner-06454ed3fe8a14b3", "level": "error", "message": {"text": "FastAPI POST `generate_user_stories` without auth dependency \u2014 microservices/accountant-deterministic/src/main.py:165"}, "properties": {"repobilityId": "16e27705297f4dcf", "scanner": "scanner-primary", "fingerprint": "06454ed3fe8a14b3", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "microservices/accountant-deterministic/src/main.py"}, "region": {"startLine": 165}}}]}, {"ruleId": "scanner-5281800e5c067c61", "level": "error", "message": {"text": "FastAPI POST `assess_complexity` without auth dependency \u2014 microservices/accountant-deterministic/src/main.py:212"}, "properties": {"repobilityId": "4acd46e17ea013e0", "scanner": "scanner-primary", "fingerprint": "5281800e5c067c61", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "microservices/accountant-deterministic/src/main.py"}, "region": {"startLine": 212}}}]}, {"ruleId": "scanner-65777dce4cd58498", "level": "error", "message": {"text": "FastAPI POST `validate_requirements` without auth dependency \u2014 microservices/accountant-deterministic/src/main.py:259"}, "properties": {"repobilityId": "99ddef775d1e770e", "scanner": "scanner-primary", "fingerprint": "65777dce4cd58498", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "microservices/accountant-deterministic/src/main.py"}, "region": {"startLine": 259}}}]}, {"ruleId": "scanner-e86dbd7ae0e7337c", "level": "error", "message": {"text": "FastAPI POST `analyze_requirements` without auth dependency \u2014 microservices/infrastructure-architect-deterministic/src/main.py:73"}, "properties": {"repobilityId": "c2ff6d3d45700d9c", "scanner": "scanner-primary", "fingerprint": "e86dbd7ae0e7337c", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "microservices/infrastructure-architect-deterministic/src/main.py"}, "region": {"startLine": 73}}}]}, {"ruleId": "scanner-a998cefba212fc1b", "level": "error", "message": {"text": "FastAPI POST `extract_entities` without auth dependency \u2014 microservices/infrastructure-architect-deterministic/src/main.py:123"}, "properties": {"repobilityId": "1fb75fdfe05f086b", "scanner": "scanner-primary", "fingerprint": "a998cefba212fc1b", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "microservices/infrastructure-architect-deterministic/src/main.py"}, "region": {"startLine": 123}}}]}, {"ruleId": "scanner-d23a29c230e82d5f", "level": "error", "message": {"text": "FastAPI POST `generate_user_stories` without auth dependency \u2014 microservices/infrastructure-architect-deterministic/src/main.py:165"}, "properties": {"repobilityId": "e452708c912800d6", "scanner": "scanner-primary", "fingerprint": "d23a29c230e82d5f", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "microservices/infrastructure-architect-deterministic/src/main.py"}, "region": {"startLine": 165}}}]}, {"ruleId": "scanner-37c0b056d19b9d2a", "level": "error", "message": {"text": "FastAPI POST `assess_complexity` without auth dependency \u2014 microservices/infrastructure-architect-deterministic/src/main.py:212"}, "properties": {"repobilityId": "8fbef793a11803fc", "scanner": "scanner-primary", "fingerprint": "37c0b056d19b9d2a", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "microservices/infrastructure-architect-deterministic/src/main.py"}, "region": {"startLine": 212}}}]}, {"ruleId": "scanner-d24c0d9cb0227ddf", "level": "error", "message": {"text": "FastAPI POST `validate_requirements` without auth dependency \u2014 microservices/infrastructure-architect-deterministic/src/main.py:259"}, "properties": {"repobilityId": "2cd42e37bd1e4bf7", "scanner": "scanner-primary", "fingerprint": "d24c0d9cb0227ddf", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "microservices/infrastructure-architect-deterministic/src/main.py"}, "region": {"startLine": 259}}}]}, {"ruleId": "scanner-82253ea7f22c424d", "level": "error", "message": {"text": "FastAPI POST `analyze_requirements` without auth dependency \u2014 microservices/project-manager-deterministic/src/main.py:73"}, "properties": {"repobilityId": "1ee85c55c5c195f7", "scanner": "scanner-primary", "fingerprint": "82253ea7f22c424d", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "microservices/project-manager-deterministic/src/main.py"}, "region": {"startLine": 73}}}]}, {"ruleId": "scanner-194d8b03dc5570bb", "level": "error", "message": {"text": "FastAPI POST `extract_entities` without auth dependency \u2014 microservices/project-manager-deterministic/src/main.py:123"}, "properties": {"repobilityId": "42ea9b469d9d5ea8", "scanner": "scanner-primary", "fingerprint": "194d8b03dc5570bb", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "microservices/project-manager-deterministic/src/main.py"}, "region": {"startLine": 123}}}]}, {"ruleId": "scanner-01fe4d0c7a6f46f9", "level": "error", "message": {"text": "FastAPI POST `generate_user_stories` without auth dependency \u2014 microservices/project-manager-deterministic/src/main.py:165"}, "properties": {"repobilityId": "a6d4362c69110cac", "scanner": "scanner-primary", "fingerprint": "01fe4d0c7a6f46f9", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "microservices/project-manager-deterministic/src/main.py"}, "region": {"startLine": 165}}}]}, {"ruleId": "scanner-5714ebed8a0f1d12", "level": "error", "message": {"text": "FastAPI POST `assess_complexity` without auth dependency \u2014 microservices/project-manager-deterministic/src/main.py:212"}, "properties": {"repobilityId": "aa21bb7aba3c5fd4", "scanner": "scanner-primary", "fingerprint": "5714ebed8a0f1d12", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "microservices/project-manager-deterministic/src/main.py"}, "region": {"startLine": 212}}}]}, {"ruleId": "scanner-88ee02e0770b27e6", "level": "error", "message": {"text": "FastAPI POST `validate_requirements` without auth dependency \u2014 microservices/project-manager-deterministic/src/main.py:259"}, "properties": {"repobilityId": "834c24c9ecb87705", "scanner": "scanner-primary", "fingerprint": "88ee02e0770b27e6", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "microservices/project-manager-deterministic/src/main.py"}, "region": {"startLine": 259}}}]}, {"ruleId": "scanner-d06478df0f84efed", "level": "error", "message": {"text": "FastAPI POST `process_task_endpoint` without auth dependency \u2014 microservices/business-analyst-anthropic/shared-libs/agent-common/src/agent_common/fastapi_utils.py:126"}, "properties": {"repobilityId": "6ae63b9031de2dbb", "scanner": "scanner-primary", "fingerprint": "d06478df0f84efed", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "microservices/business-analyst-anthropic/shared-libs/agent-common/src/agent_common/fastapi_utils.py"}, "region": {"startLine": 126}}}]}, {"ruleId": "scanner-5fa93a1b8b1c2c71", "level": "error", "message": {"text": "FastAPI POST `ingest` without auth dependency \u2014 microservices/shared-libs/realtime-transport/src/realtime_transport/realtime_fastapi.py:273"}, "properties": {"repobilityId": "2c4910d5e4fcac2a", "scanner": "scanner-primary", "fingerprint": "5fa93a1b8b1c2c71", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "microservices/shared-libs/realtime-transport/src/realtime_transport/realtime_fastapi.py"}, "region": {"startLine": 273}}}]}, {"ruleId": "scanner-96b048697f271562", "level": "error", "message": {"text": "FastAPI POST `process_task_endpoint` without auth dependency \u2014 microservices/shared-libs/agent-common/src/agent_common/fastapi_utils.py:126"}, "properties": {"repobilityId": "221fa6083a8dc47f", "scanner": "scanner-primary", "fingerprint": "96b048697f271562", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "microservices/shared-libs/agent-common/src/agent_common/fastapi_utils.py"}, "region": {"startLine": 126}}}]}, {"ruleId": "scanner-88ada5a7a9175478", "level": "error", "message": {"text": "FastAPI POST `broadcast_message` without auth dependency \u2014 microservices/shared-libs/agent-common/src/agent_common/realtime_fastapi.py:452"}, "properties": {"repobilityId": "4040ddfcc737400f", "scanner": "scanner-primary", "fingerprint": "88ada5a7a9175478", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "microservices/shared-libs/agent-common/src/agent_common/realtime_fastapi.py"}, "region": {"startLine": 452}}}]}, {"ruleId": "scanner-eb04f67c1584d226", "level": "error", "message": {"text": "FastAPI POST `send_to_topic` without auth dependency \u2014 microservices/shared-libs/agent-common/src/agent_common/realtime_fastapi.py:465"}, "properties": {"repobilityId": "1edc2a5a1292ef84", "scanner": "scanner-primary", "fingerprint": "eb04f67c1584d226", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "microservices/shared-libs/agent-common/src/agent_common/realtime_fastapi.py"}, "region": {"startLine": 465}}}]}, {"ruleId": "scanner-38986450f0b22f20", "level": "error", "message": {"text": "FastAPI POST `analyze_requirements` without auth dependency \u2014 microservices/business-analyst-deterministic/src/main.py:73"}, "properties": {"repobilityId": "16a7deb467968acf", "scanner": "scanner-primary", "fingerprint": "38986450f0b22f20", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "microservices/business-analyst-deterministic/src/main.py"}, "region": {"startLine": 73}}}]}, {"ruleId": "scanner-718c40797dd42361", "level": "error", "message": {"text": "FastAPI POST `extract_entities` without auth dependency \u2014 microservices/business-analyst-deterministic/src/main.py:123"}, "properties": {"repobilityId": "d327a5fee92472ea", "scanner": "scanner-primary", "fingerprint": "718c40797dd42361", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "microservices/business-analyst-deterministic/src/main.py"}, "region": {"startLine": 123}}}]}, {"ruleId": "scanner-d23a36e2f45c3602", "level": "error", "message": {"text": "FastAPI POST `generate_user_stories` without auth dependency \u2014 microservices/business-analyst-deterministic/src/main.py:165"}, "properties": {"repobilityId": "52a08fc47dcd93fc", "scanner": "scanner-primary", "fingerprint": "d23a36e2f45c3602", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "microservices/business-analyst-deterministic/src/main.py"}, "region": {"startLine": 165}}}]}, {"ruleId": "scanner-2707820751d74f86", "level": "error", "message": {"text": "FastAPI POST `assess_complexity` without auth dependency \u2014 microservices/business-analyst-deterministic/src/main.py:212"}, "properties": {"repobilityId": "65df3e8e8d7da34e", "scanner": "scanner-primary", "fingerprint": "2707820751d74f86", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "microservices/business-analyst-deterministic/src/main.py"}, "region": {"startLine": 212}}}]}, {"ruleId": "scanner-c8406367c327dced", "level": "error", "message": {"text": "FastAPI POST `validate_requirements` without auth dependency \u2014 microservices/business-analyst-deterministic/src/main.py:259"}, "properties": {"repobilityId": "049ca6daa6ea94f8", "scanner": "scanner-primary", "fingerprint": "c8406367c327dced", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "microservices/business-analyst-deterministic/src/main.py"}, "region": {"startLine": 259}}}]}, {"ruleId": "scanner-caef4b2679b27c05", "level": "error", "message": {"text": "FastAPI POST `analyze_business_impact` without auth dependency \u2014 microservices/business-architect-anthropic/src/main.py:73"}, "properties": {"repobilityId": "3ad57ce70324d8ae", "scanner": "scanner-primary", "fingerprint": "caef4b2679b27c05", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "microservices/business-architect-anthropic/src/main.py"}, "region": {"startLine": 73}}}]}, {"ruleId": "scanner-e08708edb9b8ff6d", "level": "error", "message": {"text": "FastAPI POST `generate_capability_map` without auth dependency \u2014 microservices/business-architect-anthropic/src/main.py:130"}, "properties": {"repobilityId": "61a932ba80059795", "scanner": "scanner-primary", "fingerprint": "e08708edb9b8ff6d", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "microservices/business-architect-anthropic/src/main.py"}, "region": {"startLine": 130}}}]}, {"ruleId": "scanner-cba070a79145706b", "level": "error", "message": {"text": "FastAPI POST `design_business_architecture` without auth dependency \u2014 microservices/business-architect-anthropic/src/main.py:176"}, "properties": {"repobilityId": "26489e3b2779c88f", "scanner": "scanner-primary", "fingerprint": "cba070a79145706b", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "microservices/business-architect-anthropic/src/main.py"}, "region": {"startLine": 176}}}]}, {"ruleId": "scanner-484a966bfa62f307", "level": "error", "message": {"text": "FastAPI POST `generate_archimate_model` without auth dependency \u2014 microservices/business-architect-anthropic/src/main.py:228"}, "properties": {"repobilityId": "75cf54411e86c3db", "scanner": "scanner-primary", "fingerprint": "484a966bfa62f307", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "microservices/business-architect-anthropic/src/main.py"}, "region": {"startLine": 228}}}]}, {"ruleId": "scanner-6ff463758dcad2fd", "level": "error", "message": {"text": "FastAPI POST `analyze_requirements` without auth dependency \u2014 microservices/application-architect-deterministic/src/main.py:73"}, "properties": {"repobilityId": "d2241920b8794f77", "scanner": "scanner-primary", "fingerprint": "6ff463758dcad2fd", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "microservices/application-architect-deterministic/src/main.py"}, "region": {"startLine": 73}}}]}, {"ruleId": "scanner-08ed02786293335b", "level": "error", "message": {"text": "FastAPI POST `extract_entities` without auth dependency \u2014 microservices/application-architect-deterministic/src/main.py:123"}, "properties": {"repobilityId": "e03b9de4c0526ac3", "scanner": "scanner-primary", "fingerprint": "08ed02786293335b", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "microservices/application-architect-deterministic/src/main.py"}, "region": {"startLine": 123}}}]}, {"ruleId": "scanner-65afbc5653749d97", "level": "error", "message": {"text": "FastAPI POST `generate_user_stories` without auth dependency \u2014 microservices/application-architect-deterministic/src/main.py:165"}, "properties": {"repobilityId": "d3332ec07f153b58", "scanner": "scanner-primary", "fingerprint": "65afbc5653749d97", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "microservices/application-architect-deterministic/src/main.py"}, "region": {"startLine": 165}}}]}, {"ruleId": "scanner-2228c0b9d0c53576", "level": "error", "message": {"text": "FastAPI POST `assess_complexity` without auth dependency \u2014 microservices/application-architect-deterministic/src/main.py:212"}, "properties": {"repobilityId": "8ae6a323d8b0b522", "scanner": "scanner-primary", "fingerprint": "2228c0b9d0c53576", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "microservices/application-architect-deterministic/src/main.py"}, "region": {"startLine": 212}}}]}, {"ruleId": "scanner-492333702a4b340a", "level": "error", "message": {"text": "FastAPI POST `validate_requirements` without auth dependency \u2014 microservices/application-architect-deterministic/src/main.py:259"}, "properties": {"repobilityId": "1425bd68f45150dd", "scanner": "scanner-primary", "fingerprint": "492333702a4b340a", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "microservices/application-architect-deterministic/src/main.py"}, "region": {"startLine": 259}}}]}, {"ruleId": "scanner-f6d546353060ae62", "level": "error", "message": {"text": "FastAPI POST `analyze_requirements` without auth dependency \u2014 microservices/solution-architect-deterministic/src/main.py:73"}, "properties": {"repobilityId": "6cb46632d91e1e5a", "scanner": "scanner-primary", "fingerprint": "f6d546353060ae62", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "microservices/solution-architect-deterministic/src/main.py"}, "region": {"startLine": 73}}}]}, {"ruleId": "scanner-2223d5636ad22859", "level": "error", "message": {"text": "FastAPI POST `extract_entities` without auth dependency \u2014 microservices/solution-architect-deterministic/src/main.py:123"}, "properties": {"repobilityId": "da9300c6fb87a254", "scanner": "scanner-primary", "fingerprint": "2223d5636ad22859", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "microservices/solution-architect-deterministic/src/main.py"}, "region": {"startLine": 123}}}]}, {"ruleId": "scanner-ea5e7414cb3686f6", "level": "error", "message": {"text": "FastAPI POST `generate_user_stories` without auth dependency \u2014 microservices/solution-architect-deterministic/src/main.py:165"}, "properties": {"repobilityId": "491ff1cc05e79641", "scanner": "scanner-primary", "fingerprint": "ea5e7414cb3686f6", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "microservices/solution-architect-deterministic/src/main.py"}, "region": {"startLine": 165}}}]}, {"ruleId": "scanner-9f3c1929941e2249", "level": "error", "message": {"text": "FastAPI POST `assess_complexity` without auth dependency \u2014 microservices/solution-architect-deterministic/src/main.py:212"}, "properties": {"repobilityId": "52f68f2b9780081a", "scanner": "scanner-primary", "fingerprint": "9f3c1929941e2249", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "microservices/solution-architect-deterministic/src/main.py"}, "region": {"startLine": 212}}}]}, {"ruleId": "scanner-ba80677663258dd2", "level": "error", "message": {"text": "FastAPI POST `validate_requirements` without auth dependency \u2014 microservices/solution-architect-deterministic/src/main.py:259"}, "properties": {"repobilityId": "ab0715bab97a8d0d", "scanner": "scanner-primary", "fingerprint": "ba80677663258dd2", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "microservices/solution-architect-deterministic/src/main.py"}, "region": {"startLine": 259}}}]}, {"ruleId": "scanner-adde8b735b753e64", "level": "error", "message": {"text": "FastAPI POST `analyze_requirements` without auth dependency \u2014 microservices/developer-deterministic/src/main.py:73"}, "properties": {"repobilityId": "9cfd11947543c8cc", "scanner": "scanner-primary", "fingerprint": "adde8b735b753e64", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "microservices/developer-deterministic/src/main.py"}, "region": {"startLine": 73}}}]}, {"ruleId": "scanner-d1d93e8e4d18a271", "level": "error", "message": {"text": "FastAPI POST `extract_entities` without auth dependency \u2014 microservices/developer-deterministic/src/main.py:123"}, "properties": {"repobilityId": "909b396f7fa18785", "scanner": "scanner-primary", "fingerprint": "d1d93e8e4d18a271", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "microservices/developer-deterministic/src/main.py"}, "region": {"startLine": 123}}}]}, {"ruleId": "scanner-ac2997dfedf3010d", "level": "error", "message": {"text": "FastAPI POST `generate_user_stories` without auth dependency \u2014 microservices/developer-deterministic/src/main.py:165"}, "properties": {"repobilityId": "c07a84de3e7983f7", "scanner": "scanner-primary", "fingerprint": "ac2997dfedf3010d", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "microservices/developer-deterministic/src/main.py"}, "region": {"startLine": 165}}}]}, {"ruleId": "scanner-741eba5697f92ff9", "level": "error", "message": {"text": "FastAPI POST `assess_complexity` without auth dependency \u2014 microservices/developer-deterministic/src/main.py:212"}, "properties": {"repobilityId": "6c5504de6d52feea", "scanner": "scanner-primary", "fingerprint": "741eba5697f92ff9", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "microservices/developer-deterministic/src/main.py"}, "region": {"startLine": 212}}}]}, {"ruleId": "scanner-cf6894c5165cf7bf", "level": "error", "message": {"text": "FastAPI POST `validate_requirements` without auth dependency \u2014 microservices/developer-deterministic/src/main.py:259"}, "properties": {"repobilityId": "b97c950fd270a4a4", "scanner": "scanner-primary", "fingerprint": "cf6894c5165cf7bf", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "microservices/developer-deterministic/src/main.py"}, "region": {"startLine": 259}}}]}, {"ruleId": "scanner-483eb24053cab764", "level": "error", "message": {"text": "FastAPI POST `create_workflow` without auth dependency \u2014 microservices/orchestration-service/src/main.py:76"}, "properties": {"repobilityId": "9e2f3b165cf28a19", "scanner": "scanner-primary", "fingerprint": "483eb24053cab764", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "microservices/orchestration-service/src/main.py"}, "region": {"startLine": 76}}}]}, {"ruleId": "scanner-7e560fadd2c79e97", "level": "error", "message": {"text": "FastAPI POST `cancel_workflow` without auth dependency \u2014 microservices/orchestration-service/src/main.py:149"}, "properties": {"repobilityId": "4773f5339fd07bac", "scanner": "scanner-primary", "fingerprint": "7e560fadd2c79e97", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "microservices/orchestration-service/src/main.py"}, "region": {"startLine": 149}}}]}, {"ruleId": "scanner-fc0d786afb03257e", "level": "error", "message": {"text": "FastAPI POST `execute_agent_task` without auth dependency \u2014 microservices/orchestration-service/src/main.py:205"}, "properties": {"repobilityId": "a4832bba4dec1043", "scanner": "scanner-primary", "fingerprint": "fc0d786afb03257e", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "microservices/orchestration-service/src/main.py"}, "region": {"startLine": 205}}}]}, {"ruleId": "scanner-f08f560ac0922d00", "level": "error", "message": {"text": "FastAPI POST `analyze_requirements` without auth dependency \u2014 microservices/business-architect-deterministic/src/main.py:73"}, "properties": {"repobilityId": "36ad2d570c5cb313", "scanner": "scanner-primary", "fingerprint": "f08f560ac0922d00", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "microservices/business-architect-deterministic/src/main.py"}, "region": {"startLine": 73}}}]}, {"ruleId": "scanner-056c516fe747a449", "level": "error", "message": {"text": "FastAPI POST `extract_entities` without auth dependency \u2014 microservices/business-architect-deterministic/src/main.py:123"}, "properties": {"repobilityId": "3a74e28385f50797", "scanner": "scanner-primary", "fingerprint": "056c516fe747a449", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "microservices/business-architect-deterministic/src/main.py"}, "region": {"startLine": 123}}}]}, {"ruleId": "scanner-bd62cd8450a7ccad", "level": "error", "message": {"text": "FastAPI POST `generate_user_stories` without auth dependency \u2014 microservices/business-architect-deterministic/src/main.py:165"}, "properties": {"repobilityId": "b09e33171ab8989c", "scanner": "scanner-primary", "fingerprint": "bd62cd8450a7ccad", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "microservices/business-architect-deterministic/src/main.py"}, "region": {"startLine": 165}}}]}, {"ruleId": "scanner-d13d5d3bda223bf5", "level": "error", "message": {"text": "FastAPI POST `assess_complexity` without auth dependency \u2014 microservices/business-architect-deterministic/src/main.py:212"}, "properties": {"repobilityId": "c3d1b6bae7df8bc2", "scanner": "scanner-primary", "fingerprint": "d13d5d3bda223bf5", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "microservices/business-architect-deterministic/src/main.py"}, "region": {"startLine": 212}}}]}, {"ruleId": "scanner-1aeeac3ef409a42c", "level": "error", "message": {"text": "FastAPI POST `validate_requirements` without auth dependency \u2014 microservices/business-architect-deterministic/src/main.py:259"}, "properties": {"repobilityId": "ea4ca9fd739bd9fd", "scanner": "scanner-primary", "fingerprint": "1aeeac3ef409a42c", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "microservices/business-architect-deterministic/src/main.py"}, "region": {"startLine": 259}}}]}, {"ruleId": "scanner-9c1104d1df31291c", "level": "error", "message": {"text": "Flask mutation route `handle_slack_command` without `@login_required` \u2014 factory/adapters/intake-slack/app.py:426"}, "properties": {"repobilityId": "356905d2a47e84a6", "scanner": "scanner-primary", "fingerprint": "9c1104d1df31291c", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.flask.unauth_route"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "factory/adapters/intake-slack/app.py"}, "region": {"startLine": 426}}}]}, {"ruleId": "scanner-1d3aa09655b46063", "level": "error", "message": {"text": "Flask mutation route `handle_slack_events` without `@login_required` \u2014 factory/adapters/intake-slack/app.py:535"}, "properties": {"repobilityId": "6a2e1e8965aecbb5", "scanner": "scanner-primary", "fingerprint": "1d3aa09655b46063", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.flask.unauth_route"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "factory/adapters/intake-slack/app.py"}, "region": {"startLine": 535}}}]}, {"ruleId": "scanner-0ff4453dceab4c36", "level": "note", "message": {"text": "Unused endpoint: POST /analyze-requirements"}, "properties": {"repobilityId": "59a1c88658dc2ce8", "scanner": "scanner-primary", "fingerprint": "0ff4453dceab4c36", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-33b331738800d515", "level": "note", "message": {"text": "Unused endpoint: POST /extract-entities"}, "properties": {"repobilityId": "cc5b3198ba1425d3", "scanner": "scanner-primary", "fingerprint": "33b331738800d515", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-e814bb13d243d018", "level": "note", "message": {"text": "Unused endpoint: POST /generate-user-stories"}, "properties": {"repobilityId": "11b41ce358d5ddc5", "scanner": "scanner-primary", "fingerprint": "e814bb13d243d018", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-5c1e8d100d6950ef", "level": "note", "message": {"text": "Unused endpoint: POST /assess-complexity"}, "properties": {"repobilityId": "8bade8c836d850d2", "scanner": "scanner-primary", "fingerprint": "5c1e8d100d6950ef", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-74c5598c1cf2785c", "level": "note", "message": {"text": "Unused endpoint: POST /validate-requirements"}, "properties": {"repobilityId": "e83526b2be3e050f", "scanner": "scanner-primary", "fingerprint": "74c5598c1cf2785c", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-5baa8971ebe192a1", "level": "note", "message": {"text": "Unused endpoint: GET /"}, "properties": {"repobilityId": "f0da045fda65f12e", "scanner": "scanner-primary", "fingerprint": "5baa8971ebe192a1", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-d10e5c556d4bcff6", "level": "note", "message": {"text": "Unused endpoint: GET /capabilities"}, "properties": {"repobilityId": "1a594838102c45e7", "scanner": "scanner-primary", "fingerprint": "d10e5c556d4bcff6", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-65a667bcc38fb792", "level": "note", "message": {"text": "Unused endpoint: POST /ingest"}, "properties": {"repobilityId": "519cedc4b808d809", "scanner": "scanner-primary", "fingerprint": "65a667bcc38fb792", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-79c0c3da7d163a64", "level": "note", "message": {"text": "Unused endpoint: GET /realtime/status"}, "properties": {"repobilityId": "52126601aa2fe767", "scanner": "scanner-primary", "fingerprint": "79c0c3da7d163a64", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-cc94efd2debf5d63", "level": "note", "message": {"text": "Unused endpoint: GET /realtime/connections"}, "properties": {"repobilityId": "2f000b71bcb958fb", "scanner": "scanner-primary", "fingerprint": "cc94efd2debf5d63", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-5d89d0ab7316c5c0", "level": "note", "message": {"text": "Unused endpoint: GET /stream/events"}, "properties": {"repobilityId": "caa61539a7a5b595", "scanner": "scanner-primary", "fingerprint": "5d89d0ab7316c5c0", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-eee9738ce0d750af", "level": "note", "message": {"text": "Unused endpoint: POST /realtime/broadcast"}, "properties": {"repobilityId": "c3dedd9875dd6fdd", "scanner": "scanner-primary", "fingerprint": "eee9738ce0d750af", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-94d54e32654a8017", "level": "note", "message": {"text": "Unused endpoint: POST /realtime/topic/{topic}"}, "properties": {"repobilityId": "33941206875f2e6b", "scanner": "scanner-primary", "fingerprint": "94d54e32654a8017", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-8c236625afb6a8cb", "level": "note", "message": {"text": "Unused endpoint: GET /ready"}, "properties": {"repobilityId": "e1adc982bd3f8df3", "scanner": "scanner-primary", "fingerprint": "8c236625afb6a8cb", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-380002dd161c0130", "level": "note", "message": {"text": "Unused endpoint: POST /analyze-business-impact"}, "properties": {"repobilityId": "9608fc49aa071c83", "scanner": "scanner-primary", "fingerprint": "380002dd161c0130", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-bdef05ca37a4ab91", "level": "note", "message": {"text": "Unused endpoint: POST /generate-capability-map"}, "properties": {"repobilityId": "2a47440e21fd85f2", "scanner": "scanner-primary", "fingerprint": "bdef05ca37a4ab91", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-6f02c9e79df50d28", "level": "note", "message": {"text": "Unused endpoint: POST /design-business-architecture"}, "properties": {"repobilityId": "24c2c5a680b77186", "scanner": "scanner-primary", "fingerprint": "6f02c9e79df50d28", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-e9e12d41b23ab06b", "level": "note", "message": {"text": "Unused endpoint: POST /generate-archimate-model"}, "properties": {"repobilityId": "44bc0ca170f7f71e", "scanner": "scanner-primary", "fingerprint": "e9e12d41b23ab06b", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-3f52adc774e06155", "level": "note", "message": {"text": "Unused endpoint: POST /workflows"}, "properties": {"repobilityId": "362d95c6820ea1c5", "scanner": "scanner-primary", "fingerprint": "3f52adc774e06155", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-d1111f1707af4f83", "level": "note", "message": {"text": "Unused endpoint: GET /workflows/{execution_id}"}, "properties": {"repobilityId": "93a8b5efaf5f1c1d", "scanner": "scanner-primary", "fingerprint": "d1111f1707af4f83", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-3e32822faa4fa544", "level": "note", "message": {"text": "Unused endpoint: POST /workflows/{execution_id}/cancel"}, "properties": {"repobilityId": "a84603b0d1d97be7", "scanner": "scanner-primary", "fingerprint": "3e32822faa4fa544", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-3140e61d7cac5091", "level": "note", "message": {"text": "Unused endpoint: GET /agents"}, "properties": {"repobilityId": "a6450fdddce71ffb", "scanner": "scanner-primary", "fingerprint": "3140e61d7cac5091", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-9a7794f60b112f4c", "level": "note", "message": {"text": "Unused endpoint: POST /agents/{agent_type}/execute"}, "properties": {"repobilityId": "63d7d5f9433d05e2", "scanner": "scanner-primary", "fingerprint": "9a7794f60b112f4c", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-9754fc8a805eb320", "level": "note", "message": {"text": "Unused endpoint: GET /workflows/definitions"}, "properties": {"repobilityId": "d0b4d843e70fc899", "scanner": "scanner-primary", "fingerprint": "9754fc8a805eb320", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-8e8105a3544a4a0a", "level": "note", "message": {"text": "Unused endpoint: ANY /slack/commands"}, "properties": {"repobilityId": "b14c0ac7c6b2c5a7", "scanner": "scanner-primary", "fingerprint": "8e8105a3544a4a0a", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-042c83903d0a6b68", "level": "note", "message": {"text": "Unused endpoint: ANY /slack/events"}, "properties": {"repobilityId": "23a9416935ce294b", "scanner": "scanner-primary", "fingerprint": "042c83903d0a6b68", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}]}]}