{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-86a70ca421a114d0", "name": "Stray `console.log` in TS/JS \u2014 tests/performance.spec.js:21", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 tests/performance.spec.js:21"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ee5c8b0cc375bda1", "name": "Stray `console.log` in TS/JS \u2014 tests/grid.spec.js:12", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 tests/grid.spec.js:12"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1f30b6ca95e11db4", "name": "Stray `console.log` in TS/JS \u2014 tests/runtime.spec.js:28", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 tests/runtime.spec.js:28"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-891436e8131c17b2", "name": "Stray `console.log` in TS/JS \u2014 tests/benchmark.spec.js:23", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 tests/benchmark.spec.js:23"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c97d08ccbd32492f", "name": "Stray `console.log` in TS/JS \u2014 tests/export.spec.js:53", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 tests/export.spec.js:53"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7930a82bf253283d", "name": "Stray `console.log` in TS/JS \u2014 scripts/update-presets.js:28", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 scripts/update-presets.js:28"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5109302ba251702f", "name": "Icon-only button without accessible name \u2014 src/App.jsx:655", "shortDescription": {"text": "Icon-only button without accessible name \u2014 src/App.jsx:655"}, "fullDescription": {"text": "A `<button>` whose only child is a single glyph or symbol needs `title=` or `aria-label=` so screen readers (and tooltips on hover) work.\n\nWhy: P3 in CHECKLIST.md \u2014 icon-only buttons skipped a title.\nRule id: fq.button.no-label"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-69b0b47dcdabe036", "name": "Icon-only button without accessible name \u2014 src/components/Sidebar.jsx:1037", "shortDescription": {"text": "Icon-only button without accessible name \u2014 src/components/Sidebar.jsx:1037"}, "fullDescription": {"text": "A `<button>` whose only child is a single glyph or symbol needs `title=` or `aria-label=` so screen readers (and tooltips on hover) work.\n\nWhy: P3 in CHECKLIST.md \u2014 icon-only buttons skipped a title.\nRule id: fq.button.no-label"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f3226c91194b28e8", "name": "Stray `console.log` in TS/JS \u2014 src/components/SurfaceMesh.jsx:324", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 src/components/SurfaceMesh.jsx:324"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3b0e5cfe351e6b4d", "name": "Icon-only button without accessible name \u2014 src/components/ElevationProfile.jsx:43", "shortDescription": {"text": "Icon-only button without accessible name \u2014 src/components/ElevationProfile.jsx:43"}, "fullDescription": {"text": "A `<button>` whose only child is a single glyph or symbol needs `title=` or `aria-label=` so screen readers (and tooltips on hover) work.\n\nWhy: P3 in CHECKLIST.md \u2014 icon-only buttons skipped a title.\nRule id: fq.button.no-label"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6637e3553cfc56d5", "name": "React Flow <Controls> without dark theming \u2014 src/components/Scene.jsx:324", "shortDescription": {"text": "React Flow <Controls> without dark theming \u2014 src/components/Scene.jsx:324"}, "fullDescription": {"text": "`<Controls>` ships with white buttons. Override `.react-flow__controls` and `.react-flow__controls-button` in your stylesheet or pass a styled wrapper.\n\nWhy: P1 in CHECKLIST.md \u2014 vendor defaults bleed light through.\nRule id: fq.controls.no-bg"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-09a8e4282025addd", "name": "Stray `console.log` in TS/JS \u2014 src/hooks/useTerrainGeometry.js:45", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 src/hooks/useTerrainGeometry.js:45"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-826f081ae8ca2d20", "name": "Stray `console.log` in TS/JS \u2014 src/hooks/useHeightmap.js:329", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 src/hooks/useHeightmap.js:329"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6372cebde0220094", "name": "No auth library detected", "shortDescription": {"text": "No auth library detected"}, "fullDescription": {"text": "The scanner did not find any standard auth library (JWT, OAuth, NextAuth, Auth0, etc.). The repo has auth/admin/session surface indicators, so auth may live in custom code, in a separate service, or be missing."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-28c4a04bd807da0c", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ad6701f0a8405e22", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-99b2cff57e7b6a82", "name": "Very large file: src/utils/geometryBuilders.js (1497 lines)", "shortDescription": {"text": "Very large file: src/utils/geometryBuilders.js (1497 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d500cbae330d2edb", "name": "Very large file: src/components/Sidebar.jsx (1214 lines)", "shortDescription": {"text": "Very large file: src/components/Sidebar.jsx (1214 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ea3b5e389d8c9c0f", "name": "Low test-to-source ratio", "shortDescription": {"text": "Low test-to-source ratio"}, "fullDescription": {"text": "6 tests / 33 src (ratio 0.18)."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 8 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-3157a8b739714093", "name": "Commented-code block (5 lines) in tests/benchmark.spec.js:174", "shortDescription": {"text": "Commented-code block (5 lines) in tests/benchmark.spec.js:174"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-c8295ee698d81a8d", "name": "`fetch()` without try/.catch or AbortSignal \u2014 src/App.jsx:288", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/App.jsx:288"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-5b311492c07a4b6f", "name": "Commented-code block (7 lines) in src/utils/svgExport.js:167", "shortDescription": {"text": "Commented-code block (7 lines) in src/utils/svgExport.js:167"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-7ac6a88c43178d26", "name": "Commented-code block (5 lines) in src/utils/geometryBuilders.js:166", "shortDescription": {"text": "Commented-code block (5 lines) in src/utils/geometryBuilders.js:166"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-128c15d5b5954656", "name": "Legacy-named symbol `hOld` in src/utils/erosion.js:84", "shortDescription": {"text": "Legacy-named symbol `hOld` in src/utils/erosion.js:84"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-aa77fb1cf26611b4", "name": "Commented-code block (5 lines) in src/components/SurfaceMesh.jsx:545", "shortDescription": {"text": "Commented-code block (5 lines) in src/components/SurfaceMesh.jsx:545"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-72a958460ac04d07", "name": "Commented-code block (8 lines) in src/components/Scene.jsx:75", "shortDescription": {"text": "Commented-code block (8 lines) in src/components/Scene.jsx:75"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-85aabf235da549df", "name": "Commented-code block (5 lines) in src/hooks/useHeightmap.js:255", "shortDescription": {"text": "Commented-code block (5 lines) in src/hooks/useHeightmap.js:255"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/20026"}, "properties": {"repository": "sorny/erzberg", "repoUrl": "https://github.com/sorny/erzberg", "branch": "main"}, "results": [{"ruleId": "scanner-86a70ca421a114d0", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 tests/performance.spec.js:21"}, "properties": {"repobilityId": "96fa02ce486c5997", "scanner": "scanner-primary", "fingerprint": "86a70ca421a114d0", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-ee5c8b0cc375bda1", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 tests/grid.spec.js:12"}, "properties": {"repobilityId": "87bd9e3483ccff6f", "scanner": "scanner-primary", "fingerprint": "ee5c8b0cc375bda1", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-1f30b6ca95e11db4", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 tests/runtime.spec.js:28"}, "properties": {"repobilityId": "2fc5cccfe121c56e", "scanner": "scanner-primary", "fingerprint": "1f30b6ca95e11db4", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-891436e8131c17b2", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 tests/benchmark.spec.js:23"}, "properties": {"repobilityId": "9a192a33c5945523", "scanner": "scanner-primary", "fingerprint": "891436e8131c17b2", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-c97d08ccbd32492f", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 tests/export.spec.js:53"}, "properties": {"repobilityId": "eadcce982695c715", "scanner": "scanner-primary", "fingerprint": "c97d08ccbd32492f", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-7930a82bf253283d", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 scripts/update-presets.js:28"}, "properties": {"repobilityId": "ae74d0f86caf59bf", "scanner": "scanner-primary", "fingerprint": "7930a82bf253283d", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-5109302ba251702f", "level": "note", "message": {"text": "Icon-only button without accessible name \u2014 src/App.jsx:655"}, "properties": {"repobilityId": "9476f60e89fe241e", "scanner": "scanner-primary", "fingerprint": "5109302ba251702f", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.button.no-label"]}}, {"ruleId": "scanner-69b0b47dcdabe036", "level": "note", "message": {"text": "Icon-only button without accessible name \u2014 src/components/Sidebar.jsx:1037"}, "properties": {"repobilityId": "213ee98b60544443", "scanner": "scanner-primary", "fingerprint": "69b0b47dcdabe036", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.button.no-label"]}}, {"ruleId": "scanner-f3226c91194b28e8", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 src/components/SurfaceMesh.jsx:324"}, "properties": {"repobilityId": "7fc766c843e7d1de", "scanner": "scanner-primary", "fingerprint": "f3226c91194b28e8", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-3b0e5cfe351e6b4d", "level": "note", "message": {"text": "Icon-only button without accessible name \u2014 src/components/ElevationProfile.jsx:43"}, "properties": {"repobilityId": "1758f984e2420f60", "scanner": "scanner-primary", "fingerprint": "3b0e5cfe351e6b4d", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.button.no-label"]}}, {"ruleId": "scanner-6637e3553cfc56d5", "level": "note", "message": {"text": "React Flow <Controls> without dark theming \u2014 src/components/Scene.jsx:324"}, "properties": {"repobilityId": "2853460d0f20a798", "scanner": "scanner-primary", "fingerprint": "6637e3553cfc56d5", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.controls.no-bg"]}}, {"ruleId": "scanner-09a8e4282025addd", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 src/hooks/useTerrainGeometry.js:45"}, "properties": {"repobilityId": "890ecb23dcc0abfa", "scanner": "scanner-primary", "fingerprint": "09a8e4282025addd", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-826f081ae8ca2d20", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 src/hooks/useHeightmap.js:329"}, "properties": {"repobilityId": "3be3d03b8930fe46", "scanner": "scanner-primary", "fingerprint": "826f081ae8ca2d20", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-6372cebde0220094", "level": "warning", "message": {"text": "No auth library detected"}, "properties": {"repobilityId": "a5b6035a5bbf8054", "scanner": "scanner-primary", "fingerprint": "6372cebde0220094", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["coverage", "auth"]}}, {"ruleId": "scanner-28c4a04bd807da0c", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "722ab4643920a278", "scanner": "scanner-primary", "fingerprint": "28c4a04bd807da0c", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/deploy.yml"}, "region": {"startLine": 26}}}]}, {"ruleId": "scanner-28c4a04bd807da0c", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "c266bde81c839bdc", "scanner": "scanner-primary", "fingerprint": "28c4a04bd807da0c", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/deploy.yml"}, "region": {"startLine": 29}}}]}, {"ruleId": "scanner-28c4a04bd807da0c", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "a14a700833f07929", "scanner": "scanner-primary", "fingerprint": "28c4a04bd807da0c", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/deploy.yml"}, "region": {"startLine": 51}}}]}, {"ruleId": "scanner-28c4a04bd807da0c", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "e2bbcbcc5f68615d", "scanner": "scanner-primary", "fingerprint": "28c4a04bd807da0c", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/deploy.yml"}, "region": {"startLine": 54}}}]}, {"ruleId": "scanner-28c4a04bd807da0c", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "4544a649b35fa68b", "scanner": "scanner-primary", "fingerprint": "28c4a04bd807da0c", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/deploy.yml"}, "region": {"startLine": 67}}}]}, {"ruleId": "scanner-ad6701f0a8405e22", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "8384c23520d55657", "scanner": "scanner-primary", "fingerprint": "ad6701f0a8405e22", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/deploy.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-99b2cff57e7b6a82", "level": "note", "message": {"text": "Very large file: src/utils/geometryBuilders.js (1497 lines)"}, "properties": {"repobilityId": "16ed476c8262639f", "scanner": "scanner-primary", "fingerprint": "99b2cff57e7b6a82", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-d500cbae330d2edb", "level": "note", "message": {"text": "Very large file: src/components/Sidebar.jsx (1214 lines)"}, "properties": {"repobilityId": "11b4f70241fa1687", "scanner": "scanner-primary", "fingerprint": "d500cbae330d2edb", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-ea3b5e389d8c9c0f", "level": "note", "message": {"text": "Low test-to-source ratio"}, "properties": {"repobilityId": "ef7b2552cc00a375", "scanner": "scanner-primary", "fingerprint": "ea3b5e389d8c9c0f", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["tests"]}}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "60c12a98947d42ba", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "5ff733b5040b23e7", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "d07e677c64ebfd67", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-3157a8b739714093", "level": "none", "message": {"text": "Commented-code block (5 lines) in tests/benchmark.spec.js:174"}, "properties": {"repobilityId": "f3f6f49da3913d27", "scanner": "scanner-primary", "fingerprint": "3157a8b739714093", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-c8295ee698d81a8d", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/App.jsx:288"}, "properties": {"repobilityId": "1a47b71f4973e097", "scanner": "scanner-primary", "fingerprint": "c8295ee698d81a8d", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-5b311492c07a4b6f", "level": "none", "message": {"text": "Commented-code block (7 lines) in src/utils/svgExport.js:167"}, "properties": {"repobilityId": "a80141cdf626dcfa", "scanner": "scanner-primary", "fingerprint": "5b311492c07a4b6f", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-7ac6a88c43178d26", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/utils/geometryBuilders.js:166"}, "properties": {"repobilityId": "6f33abaa9be7ac1c", "scanner": "scanner-primary", "fingerprint": "7ac6a88c43178d26", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-128c15d5b5954656", "level": "note", "message": {"text": "Legacy-named symbol `hOld` in src/utils/erosion.js:84"}, "properties": {"repobilityId": "56fb8e4bac75e555", "scanner": "scanner-primary", "fingerprint": "128c15d5b5954656", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-aa77fb1cf26611b4", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/components/SurfaceMesh.jsx:545"}, "properties": {"repobilityId": "987ed8e84cbf920b", "scanner": "scanner-primary", "fingerprint": "aa77fb1cf26611b4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-72a958460ac04d07", "level": "none", "message": {"text": "Commented-code block (8 lines) in src/components/Scene.jsx:75"}, "properties": {"repobilityId": "6cd3288bb368c698", "scanner": "scanner-primary", "fingerprint": "72a958460ac04d07", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-85aabf235da549df", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/hooks/useHeightmap.js:255"}, "properties": {"repobilityId": "2e471852eb8c5527", "scanner": "scanner-primary", "fingerprint": "85aabf235da549df", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}]}]}