{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-bead75b0f9233e05", "name": "No API endpoints detected", "shortDescription": {"text": "No API endpoints detected"}, "fullDescription": {"text": "The scanner did not find FastAPI/Flask/Express/NestJS/GraphQL/gRPC routes. If this repo exposes APIs, the framework may be unsupported."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "info", "confidence": 1.0}}, {"id": "scanner-bf2dcbefb7bbf8e8", "name": "Stray `console.log` in TS/JS \u2014 scripts/server.js:44", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 scripts/server.js:44"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5fbd3591a6202367", "name": "Stray `console.log` in TS/JS \u2014 src/lib/explorer/pair-client.ts:109", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 src/lib/explorer/pair-client.ts:109"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-37b075ffabb87382", "name": "Stray `console.log` in TS/JS \u2014 src/lib/components/SourceCode.svelte:10", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 src/lib/components/SourceCode.svelte:10"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cb64091a89ddce82", "name": "Stray `console.log` in TS/JS \u2014 src/lib/components/Button.svelte:19", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 src/lib/components/Button.svelte:19"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d3026e614dec909e", "name": "TODO/FIXME marker in shipping code \u2014 src/lib/trade-executor/helpers/benchmark.svelte.ts:68", "shortDescription": {"text": "TODO/FIXME marker in shipping code \u2014 src/lib/trade-executor/helpers/benchmark.svelte.ts:68"}, "fullDescription": {"text": "Track in /reviews or /issues, not as a code comment that rots.\n\nWhy: Drift control \u2014 shouldn't be the same as Quality TODO scanner.\nRule id: fq.todo-marker"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-8857f425b392ad85", "name": "TODO/FIXME marker in shipping code \u2014 src/lib/trade-executor/vaults/enzyme/index.ts:285", "shortDescription": {"text": "TODO/FIXME marker in shipping code \u2014 src/lib/trade-executor/vaults/enzyme/index.ts:285"}, "fullDescription": {"text": "Track in /reviews or /issues, not as a code comment that rots.\n\nWhy: Drift control \u2014 shouldn't be the same as Quality TODO scanner.\nRule id: fq.todo-marker"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-78f2e5ec491f0c2e", "name": "TODO/FIXME marker in shipping code \u2014 src/lib/trade-executor/vaults/velvet/index.ts:31", "shortDescription": {"text": "TODO/FIXME marker in shipping code \u2014 src/lib/trade-executor/vaults/velvet/index.ts:31"}, "fullDescription": {"text": "Track in /reviews or /issues, not as a code comment that rots.\n\nWhy: Drift control \u2014 shouldn't be the same as Quality TODO scanner.\nRule id: fq.todo-marker"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-e1f7e9ab3ce8ddd1", "name": "Stray `console.log` in TS/JS \u2014 src/routes/trading-view/api/+page.svelte:35", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 src/routes/trading-view/api/+page.svelte:35"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-71a2f085061eceb5", "name": "TODO/FIXME marker in shipping code \u2014 src/routes/trading-view/[chain=slug]/[exchange]/[pair]/InfoSummary.svelte:17", "shortDescription": {"text": "TODO/FIXME marker in shipping code \u2014 src/routes/trading-view/[chain=slug]/[exchange]/[pair]/InfoSummary.svelte:17"}, "fullDescription": {"text": "Track in /reviews or /issues, not as a code comment that rots.\n\nWhy: Drift control \u2014 shouldn't be the same as Quality TODO scanner.\nRule id: fq.todo-marker"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-401eb6cf130a22f3", "name": "TODO/FIXME marker in shipping code \u2014 src/routes/strategies/[strategy=apiStrategy]/(wizard)/deposit/tos/+page.svelte:44", "shortDescription": {"text": "TODO/FIXME marker in shipping code \u2014 src/routes/strategies/[strategy=apiStrategy]/(wizard)/deposit/tos/+page.svelte:44"}, "fullDescription": {"text": "Track in /reviews or /issues, not as a code comment that rots.\n\nWhy: Drift control \u2014 shouldn't be the same as Quality TODO scanner.\nRule id: fq.todo-marker"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-be15e6f68283299a", "name": "TODO/FIXME marker in shipping code \u2014 src/routes/strategies/tvl/+server.ts:70", "shortDescription": {"text": "TODO/FIXME marker in shipping code \u2014 src/routes/strategies/tvl/+server.ts:70"}, "fullDescription": {"text": "Track in /reviews or /issues, not as a code comment that rots.\n\nWhy: Drift control \u2014 shouldn't be the same as Quality TODO scanner.\nRule id: fq.todo-marker"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-d63da3583b14afc0", "name": "Dockerfile runs as root: Dockerfile", "shortDescription": {"text": "Dockerfile runs as root: Dockerfile"}, "fullDescription": {"text": "No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-903f4f5484f5cca6", "name": "Docker base image is tag-pinned but not digest-pinned: node:20.19", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: node:20.19"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d8b7c66dffa1d24e", "name": "Docker base image is tag-pinned but not digest-pinned: node:20.19-slim", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: node:20.19-slim"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-aa5acaa49eb8315b", "name": "Containers defined but no K8s/orchestration manifest found", "shortDescription": {"text": "Containers defined but no K8s/orchestration manifest found"}, "fullDescription": {"text": "Repo has Dockerfiles/compose but no Kubernetes/Nomad manifests. If the target deployment is K8s, the manifests may live in a separate ops repo."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8cc38920b5cbb65e", "name": "Runtime dotenv file present in repo: .env.development", "shortDescription": {"text": "Runtime dotenv file present in repo: .env.development"}, "fullDescription": {"text": "`.env.development` looks like a runtime dotenv file. It contains secret-looking assignments for TS_PRIVATE_ADMIN_PW, TS_PUBLIC_TURNSTILE_SITE_KEY, TS_PRIVATE_TURNSTILE_SECRET_KEY. Move real values to a secret manager and keep only `.env.example` style templates in source control."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-5b43d4a583792c5d", "name": "Runtime dotenv file present in repo: .env.dev", "shortDescription": {"text": "Runtime dotenv file present in repo: .env.dev"}, "fullDescription": {"text": "`.env.dev` looks like a runtime dotenv file. It contains secret-looking assignments for TS_PRIVATE_ADMIN_PW. Move real values to a secret manager and keep only `.env.example` style templates in source control."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-7176e5d95d18d844", "name": "Runtime dotenv file present in repo: .env", "shortDescription": {"text": "Runtime dotenv file present in repo: .env"}, "fullDescription": {"text": "`.env` looks like a runtime dotenv file. It contains secret-looking assignments for TS_PUBLIC_GHOST_CONTENT_API_KEY, TS_PUBLIC_TYPESENSE_API_KEY. Move real values to a secret manager and keep only `.env.example` style templates in source control."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-f2d830d7ae5c1641", "name": "Runtime dotenv file present in repo: .env.test", "shortDescription": {"text": "Runtime dotenv file present in repo: .env.test"}, "fullDescription": {"text": "`.env.test` looks like a runtime dotenv file. No high-confidence secret value was matched, but runtime dotenv files often drift into live credentials. Move real values to a secret manager and keep only `.env.example` style templates in source control."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-6372cebde0220094", "name": "No auth library detected", "shortDescription": {"text": "No auth library detected"}, "fullDescription": {"text": "The scanner did not find any standard auth library (JWT, OAuth, NextAuth, Auth0, etc.). The repo has auth/admin/session surface indicators, so auth may live in custom code, in a separate service, or be missing."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a780aa133722421d", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "pnpm/action-setup@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-941f814795305240", "name": "Lockfile references known compromised npm package: axios@1.14.1", "shortDescription": {"text": "Lockfile references known compromised npm package: axios@1.14.1"}, "fullDescription": {"text": "axios@1.14.1 is tied to a documented npm supply-chain compromise. Treat this as an incident until confirmed clean, and rotate credentials exposed during install."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-959fdfccd399f7c8", "name": "Lockfile references known compromised npm package: axios@0.30.4", "shortDescription": {"text": "Lockfile references known compromised npm package: axios@0.30.4"}, "fullDescription": {"text": "axios@0.30.4 is tied to a documented npm supply-chain compromise. Treat this as an incident until confirmed clean, and rotate credentials exposed during install."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-cb639d9a10a47b23", "name": "package.json defines install-time lifecycle scripts", "shortDescription": {"text": "package.json defines install-time lifecycle scripts"}, "fullDescription": {"text": "preinstall/install/postinstall/prepare scripts execute during dependency installation. Review them carefully for network calls, obfuscation, shell execution, or credential access."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-141b30a41e03817b", "name": "No license file detected", "shortDescription": {"text": "No license file detected"}, "fullDescription": {"text": "No LICENSE/COPYING/NOTICE file was found. Generated repositories often omit licensing, which blocks reuse and automated intake."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 28 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-749d4bc1bd66df5f", "name": "Agent instructions exist but release-hardening basics are missing", "shortDescription": {"text": "Agent instructions exist but release-hardening basics are missing"}, "fullDescription": {"text": "AI-coder instruction files were found, but the repo is missing license. Treat this as a contract gap: the agent is guided, but the generated output is not yet guarded by the controls that make it repeatable."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-cebc44e5953a3f8c", "name": "Agent authority lacks a verifier contract: .claude/skills/create-issue/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/skills/create-issue/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-359ee6e600069f11", "name": "`fetch()` without try/.catch or AbortSignal \u2014 scripts/benchmark-historical-tvl-chain.mjs:316", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 scripts/benchmark-historical-tvl-chain.mjs:316"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1a83e4a42b7a4c9a", "name": "`fetch()` without try/.catch or AbortSignal \u2014 src/hooks.server.ts:22", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/hooks.server.ts:22"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1a3f7849d9cdade4", "name": "`fetch()` without try/.catch or AbortSignal \u2014 src/lib/blog/client.ts:22", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/lib/blog/client.ts:22"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1a51af69de0e7f19", "name": "Commented-code block (5 lines) in src/lib/components/Tooltip.test.ts:5", "shortDescription": {"text": "Commented-code block (5 lines) in src/lib/components/Tooltip.test.ts:5"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-7237721f773c25f3", "name": "Legacy-named symbol `uniswap_v2` in src/lib/helpers/exchange.ts:34", "shortDescription": {"text": "Legacy-named symbol `uniswap_v2` in src/lib/helpers/exchange.ts:34"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d578d0c180a13888", "name": "`fetch()` without try/.catch or AbortSignal \u2014 src/lib/top-vaults/server-config.ts:49", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/lib/top-vaults/server-config.ts:49"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b2ef4a76ec4f9e7f", "name": "`fetch()` without try/.catch or AbortSignal \u2014 src/lib/top-vaults/client-cache.ts:22", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/lib/top-vaults/client-cache.ts:22"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3745115843a4ff51", "name": "`fetch()` without try/.catch or AbortSignal \u2014 src/lib/newsletter/client.ts:49", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/lib/newsletter/client.ts:49"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-82c684d2f1ff03d5", "name": "`fetch()` without try/.catch or AbortSignal \u2014 src/routes/trading-view/vaults/datasets/download/[datasetId]/+server.ts:30", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/routes/trading-view/vaults/datasets/download/[datasetId]/+server.ts:30"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d5a4f52e43429fb8", "name": "`fetch()` without try/.catch or AbortSignal \u2014 src/routes/blog/image/[...file]/+server.ts:49", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/routes/blog/image/[...file]/+server.ts:49"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9e2006a6e0c49692", "name": "`fetch()` without try/.catch or AbortSignal \u2014 src/routes/glossary/glossary.ts:82", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/routes/glossary/glossary.ts:82"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1434fdfd3aa81dae", "name": "Legacy-named symbol `uniswap_v2` in src/routes/strategies/[strategy=apiStrategy]/[status=positionStatus]-positions/[posi", "shortDescription": {"text": "Legacy-named symbol `uniswap_v2` in src/routes/strategies/[strategy=apiStrategy]/[status=positionStatus]-positions/[position=integer]/snapshot/+page.ts:57"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-43f6d989c4aa98e8", "name": "`fetch()` without try/.catch or AbortSignal \u2014 src/routes/strategies/[strategy=apiStrategy]/tech-details/logs/+page.ts:12", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/routes/strategies/[strategy=apiStrategy]/tech-details/logs/+page.ts:12"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-eb96f2bc15912b76", "name": "`fetch()` without try/.catch or AbortSignal \u2014 src/routes/strategies/[strategy=apiStrategy]/tech-details/analysis/+page.t", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/routes/strategies/[strategy=apiStrategy]/tech-details/analysis/+page.ts:25"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-cdf4a462dc5d3bde", "name": "`fetch()` without try/.catch or AbortSignal \u2014 src/routes/strategies/[strategy=apiStrategy].ipynb/+server.ts:9", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/routes/strategies/[strategy=apiStrategy].ipynb/+server.ts:9"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-537f2a6ba686721e", "name": "`fetch()` without try/.catch or AbortSignal \u2014 src/routes/newsletter/+page.server.ts:16", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/routes/newsletter/+page.server.ts:16"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/21604"}, "properties": {"repository": "tradingstrategy-ai/frontend", "repoUrl": "https://github.com/tradingstrategy-ai/frontend", "branch": "main"}, "results": [{"ruleId": "scanner-bead75b0f9233e05", "level": "none", "message": {"text": "No API endpoints detected"}, "properties": {"repobilityId": "0f8bb852027c38f8", "scanner": "scanner-primary", "fingerprint": "bead75b0f9233e05", "layer": "api", "severity": "info", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-bf2dcbefb7bbf8e8", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 scripts/server.js:44"}, "properties": {"repobilityId": "9270a3deccd2c32e", "scanner": "scanner-primary", "fingerprint": "bf2dcbefb7bbf8e8", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-5fbd3591a6202367", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 src/lib/explorer/pair-client.ts:109"}, "properties": {"repobilityId": "c5a798a146126bfa", "scanner": "scanner-primary", "fingerprint": "5fbd3591a6202367", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-37b075ffabb87382", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 src/lib/components/SourceCode.svelte:10"}, "properties": {"repobilityId": "a2d15ab48f0e845b", "scanner": "scanner-primary", "fingerprint": "37b075ffabb87382", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-cb64091a89ddce82", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 src/lib/components/Button.svelte:19"}, "properties": {"repobilityId": "53db66af1abc2f12", "scanner": "scanner-primary", "fingerprint": "cb64091a89ddce82", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-d3026e614dec909e", "level": "none", "message": {"text": "TODO/FIXME marker in shipping code \u2014 src/lib/trade-executor/helpers/benchmark.svelte.ts:68"}, "properties": {"repobilityId": "80acc7d063fcc9e0", "scanner": "scanner-primary", "fingerprint": "d3026e614dec909e", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.todo-marker"]}}, {"ruleId": "scanner-8857f425b392ad85", "level": "none", "message": {"text": "TODO/FIXME marker in shipping code \u2014 src/lib/trade-executor/vaults/enzyme/index.ts:285"}, "properties": {"repobilityId": "947accb24a7ff6e1", "scanner": "scanner-primary", "fingerprint": "8857f425b392ad85", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.todo-marker"]}}, {"ruleId": "scanner-78f2e5ec491f0c2e", "level": "none", "message": {"text": "TODO/FIXME marker in shipping code \u2014 src/lib/trade-executor/vaults/velvet/index.ts:31"}, "properties": {"repobilityId": "2feff5c7dadb0057", "scanner": "scanner-primary", "fingerprint": "78f2e5ec491f0c2e", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.todo-marker"]}}, {"ruleId": "scanner-e1f7e9ab3ce8ddd1", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 src/routes/trading-view/api/+page.svelte:35"}, "properties": {"repobilityId": "f528fd201a24891f", "scanner": "scanner-primary", "fingerprint": "e1f7e9ab3ce8ddd1", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-71a2f085061eceb5", "level": "none", "message": {"text": "TODO/FIXME marker in shipping code \u2014 src/routes/trading-view/[chain=slug]/[exchange]/[pair]/InfoSummary.svelte:17"}, "properties": {"repobilityId": "9e01722296957811", "scanner": "scanner-primary", "fingerprint": "71a2f085061eceb5", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.todo-marker"]}}, {"ruleId": "scanner-401eb6cf130a22f3", "level": "none", "message": {"text": "TODO/FIXME marker in shipping code \u2014 src/routes/strategies/[strategy=apiStrategy]/(wizard)/deposit/tos/+page.svelte:44"}, "properties": {"repobilityId": "74607cd04900daa4", "scanner": "scanner-primary", "fingerprint": "401eb6cf130a22f3", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.todo-marker"]}}, {"ruleId": "scanner-be15e6f68283299a", "level": "none", "message": {"text": "TODO/FIXME marker in shipping code \u2014 src/routes/strategies/tvl/+server.ts:70"}, "properties": {"repobilityId": "8f3760a1118a38ff", "scanner": "scanner-primary", "fingerprint": "be15e6f68283299a", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.todo-marker"]}}, {"ruleId": "scanner-d63da3583b14afc0", "level": "warning", "message": {"text": "Dockerfile runs as root: Dockerfile"}, "properties": {"repobilityId": "a2ed1bd120e507db", "scanner": "scanner-primary", "fingerprint": "d63da3583b14afc0", "layer": "hardware", "severity": "medium", "confidence": 1.0, "tags": ["security", "container"]}}, {"ruleId": "scanner-903f4f5484f5cca6", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: node:20.19"}, "properties": {"repobilityId": "874ba5bd6dcae180", "scanner": "scanner-primary", "fingerprint": "903f4f5484f5cca6", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Dockerfile"}, "region": {"startLine": 4}}}]}, {"ruleId": "scanner-d8b7c66dffa1d24e", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: node:20.19-slim"}, "properties": {"repobilityId": "5f888a48bed92e08", "scanner": "scanner-primary", "fingerprint": "d8b7c66dffa1d24e", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Dockerfile"}, "region": {"startLine": 31}}}]}, {"ruleId": "scanner-aa5acaa49eb8315b", "level": "note", "message": {"text": "Containers defined but no K8s/orchestration manifest found"}, "properties": {"repobilityId": "b230ea9b68736081", "scanner": "scanner-primary", "fingerprint": "aa5acaa49eb8315b", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["coverage", "deployment"]}}, {"ruleId": "scanner-8cc38920b5cbb65e", "level": "error", "message": {"text": "Runtime dotenv file present in repo: .env.development"}, "properties": {"repobilityId": "7d5eb336bd00195c", "scanner": "scanner-primary", "fingerprint": "8cc38920b5cbb65e", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets", "config", "env-file", "runtime-env", "env_file_with_secret"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".env.development"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-5b43d4a583792c5d", "level": "error", "message": {"text": "Runtime dotenv file present in repo: .env.dev"}, "properties": {"repobilityId": "39400adf0f918d08", "scanner": "scanner-primary", "fingerprint": "5b43d4a583792c5d", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets", "config", "env-file", "runtime-env", "env_file_with_secret"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".env.dev"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-7176e5d95d18d844", "level": "error", "message": {"text": "Runtime dotenv file present in repo: .env"}, "properties": {"repobilityId": "4b9c737a445874ba", "scanner": "scanner-primary", "fingerprint": "7176e5d95d18d844", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets", "config", "env-file", "runtime-env", "env_file_with_secret"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".env"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f2d830d7ae5c1641", "level": "error", "message": {"text": "Runtime dotenv file present in repo: .env.test"}, "properties": {"repobilityId": "25baea8a4d77c75a", "scanner": "scanner-primary", "fingerprint": "f2d830d7ae5c1641", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["secrets", "config", "env-file", "runtime-env"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".env.test"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6372cebde0220094", "level": "warning", "message": {"text": "No auth library detected"}, "properties": {"repobilityId": "a5b6035a5bbf8054", "scanner": "scanner-primary", "fingerprint": "6372cebde0220094", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["coverage", "auth"]}}, {"ruleId": "scanner-a780aa133722421d", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "6dc7acf4956d8be4", "scanner": "scanner-primary", "fingerprint": "a780aa133722421d", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/javascript.yml"}, "region": {"startLine": 23}}}]}, {"ruleId": "scanner-a780aa133722421d", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "df9f0a93e6f4b423", "scanner": "scanner-primary", "fingerprint": "a780aa133722421d", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/javascript.yml"}, "region": {"startLine": 39}}}]}, {"ruleId": "scanner-a780aa133722421d", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "6dc7acf4956d8be4", "scanner": "scanner-primary", "fingerprint": "a780aa133722421d", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/javascript.yml"}, "region": {"startLine": 46}}}]}, {"ruleId": "scanner-a780aa133722421d", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "f0be41d4571dff2f", "scanner": "scanner-primary", "fingerprint": "a780aa133722421d", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/javascript.yml"}, "region": {"startLine": 66}}}]}, {"ruleId": "scanner-a780aa133722421d", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "df9f0a93e6f4b423", "scanner": "scanner-primary", "fingerprint": "a780aa133722421d", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/javascript.yml"}, "region": {"startLine": 79}}}]}, {"ruleId": "scanner-a780aa133722421d", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "6dc7acf4956d8be4", "scanner": "scanner-primary", "fingerprint": "a780aa133722421d", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/javascript.yml"}, "region": {"startLine": 86}}}]}, {"ruleId": "scanner-a780aa133722421d", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "f0be41d4571dff2f", "scanner": "scanner-primary", "fingerprint": "a780aa133722421d", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/javascript.yml"}, "region": {"startLine": 109}}}]}, {"ruleId": "scanner-a780aa133722421d", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "df9f0a93e6f4b423", "scanner": "scanner-primary", "fingerprint": "a780aa133722421d", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/javascript.yml"}, "region": {"startLine": 124}}}]}, {"ruleId": "scanner-a780aa133722421d", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "86f498031597afa7", "scanner": "scanner-primary", "fingerprint": "a780aa133722421d", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/javascript.yml"}, "region": {"startLine": 131}}}]}, {"ruleId": "scanner-a780aa133722421d", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "1a3373ddaf4e742d", "scanner": "scanner-primary", "fingerprint": "a780aa133722421d", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/javascript.yml"}, "region": {"startLine": 134}}}]}, {"ruleId": "scanner-a780aa133722421d", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "4e8ee879c3f28280", "scanner": "scanner-primary", "fingerprint": "a780aa133722421d", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/javascript.yml"}, "region": {"startLine": 138}}}]}, {"ruleId": "scanner-a780aa133722421d", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "4f0f8820ac14d100", "scanner": "scanner-primary", "fingerprint": "a780aa133722421d", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/javascript.yml"}, "region": {"startLine": 144}}}]}, {"ruleId": "scanner-a780aa133722421d", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "1a3373ddaf4e742d", "scanner": "scanner-primary", "fingerprint": "a780aa133722421d", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/javascript.yml"}, "region": {"startLine": 161}}}]}, {"ruleId": "scanner-a780aa133722421d", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "4e8ee879c3f28280", "scanner": "scanner-primary", "fingerprint": "a780aa133722421d", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/javascript.yml"}, "region": {"startLine": 166}}}]}, {"ruleId": "scanner-941f814795305240", "level": "error", "message": {"text": "Lockfile references known compromised npm package: axios@1.14.1"}, "properties": {"repobilityId": "ff5364977b0fffef", "scanner": "scanner-primary", "fingerprint": "941f814795305240", "layer": "cicd", "severity": "critical", "confidence": 1.0, "tags": ["supply-chain", "npm", "ioc"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pnpm-lock.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-959fdfccd399f7c8", "level": "error", "message": {"text": "Lockfile references known compromised npm package: axios@0.30.4"}, "properties": {"repobilityId": "9a79f6fa8b456023", "scanner": "scanner-primary", "fingerprint": "959fdfccd399f7c8", "layer": "cicd", "severity": "critical", "confidence": 1.0, "tags": ["supply-chain", "npm", "ioc"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pnpm-lock.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-cb639d9a10a47b23", "level": "note", "message": {"text": "package.json defines install-time lifecycle scripts"}, "properties": {"repobilityId": "b86179956da3a4a8", "scanner": "scanner-primary", "fingerprint": "cb639d9a10a47b23", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "npm", "install-scripts"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-141b30a41e03817b", "level": "note", "message": {"text": "No license file detected"}, "properties": {"repobilityId": "2d7a791dc5e282fa", "scanner": "scanner-primary", "fingerprint": "141b30a41e03817b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["license", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "9b345512d4c9683c", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-749d4bc1bd66df5f", "level": "warning", "message": {"text": "Agent instructions exist but release-hardening basics are missing"}, "properties": {"repobilityId": "19e0b773e70fc89a", "scanner": "scanner-primary", "fingerprint": "749d4bc1bd66df5f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "50a5ebb823dc721d", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "7f35ec7870153d62", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-cebc44e5953a3f8c", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/skills/create-issue/SKILL.md"}, "properties": {"repobilityId": "5f201a726e84bae2", "scanner": "scanner-primary", "fingerprint": "cebc44e5953a3f8c", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/create-issue/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-359ee6e600069f11", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 scripts/benchmark-historical-tvl-chain.mjs:316"}, "properties": {"repobilityId": "fa9ca368e918b23c", "scanner": "scanner-primary", "fingerprint": "359ee6e600069f11", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-1a83e4a42b7a4c9a", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/hooks.server.ts:22"}, "properties": {"repobilityId": "a9379b46a6ba97c6", "scanner": "scanner-primary", "fingerprint": "1a83e4a42b7a4c9a", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-1a3f7849d9cdade4", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/lib/blog/client.ts:22"}, "properties": {"repobilityId": "c2b2a93dbc43e36a", "scanner": "scanner-primary", "fingerprint": "1a3f7849d9cdade4", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-1a51af69de0e7f19", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/lib/components/Tooltip.test.ts:5"}, "properties": {"repobilityId": "5575491913c132b0", "scanner": "scanner-primary", "fingerprint": "1a51af69de0e7f19", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-7237721f773c25f3", "level": "note", "message": {"text": "Legacy-named symbol `uniswap_v2` in src/lib/helpers/exchange.ts:34"}, "properties": {"repobilityId": "0ec3fcaadd15aedb", "scanner": "scanner-primary", "fingerprint": "7237721f773c25f3", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-d578d0c180a13888", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/lib/top-vaults/server-config.ts:49"}, "properties": {"repobilityId": "687cf57a8623c94c", "scanner": "scanner-primary", "fingerprint": "d578d0c180a13888", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-b2ef4a76ec4f9e7f", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/lib/top-vaults/client-cache.ts:22"}, "properties": {"repobilityId": "f4f6436138f06b85", "scanner": "scanner-primary", "fingerprint": "b2ef4a76ec4f9e7f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-3745115843a4ff51", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/lib/newsletter/client.ts:49"}, "properties": {"repobilityId": "eb454b166edd9e05", "scanner": "scanner-primary", "fingerprint": "3745115843a4ff51", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-82c684d2f1ff03d5", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/routes/trading-view/vaults/datasets/download/[datasetId]/+server.ts:30"}, "properties": {"repobilityId": "0bd699a2fd1eaff7", "scanner": "scanner-primary", "fingerprint": "82c684d2f1ff03d5", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-d5a4f52e43429fb8", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/routes/blog/image/[...file]/+server.ts:49"}, "properties": {"repobilityId": "eb35b768b5996010", "scanner": "scanner-primary", "fingerprint": "d5a4f52e43429fb8", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-9e2006a6e0c49692", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/routes/glossary/glossary.ts:82"}, "properties": {"repobilityId": "f426f53bcec07458", "scanner": "scanner-primary", "fingerprint": "9e2006a6e0c49692", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-1434fdfd3aa81dae", "level": "note", "message": {"text": "Legacy-named symbol `uniswap_v2` in src/routes/strategies/[strategy=apiStrategy]/[status=positionStatus]-positions/[position=integer]/snapshot/+page.ts:57"}, "properties": {"repobilityId": "38c8dd198d971cc1", "scanner": "scanner-primary", "fingerprint": "1434fdfd3aa81dae", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-43f6d989c4aa98e8", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/routes/strategies/[strategy=apiStrategy]/tech-details/logs/+page.ts:12"}, "properties": {"repobilityId": "09734a67ab7bb99f", "scanner": "scanner-primary", "fingerprint": "43f6d989c4aa98e8", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-eb96f2bc15912b76", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/routes/strategies/[strategy=apiStrategy]/tech-details/analysis/+page.ts:25"}, "properties": {"repobilityId": "c9867d0cc0750f15", "scanner": "scanner-primary", "fingerprint": "eb96f2bc15912b76", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-cdf4a462dc5d3bde", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/routes/strategies/[strategy=apiStrategy].ipynb/+server.ts:9"}, "properties": {"repobilityId": "d959edad83a85d44", "scanner": "scanner-primary", "fingerprint": "cdf4a462dc5d3bde", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-537f2a6ba686721e", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/routes/newsletter/+page.server.ts:16"}, "properties": {"repobilityId": "fffc972b0923ff6d", "scanner": "scanner-primary", "fingerprint": "537f2a6ba686721e", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}]}]}