{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-6bc5a80e3270605e", "name": "Possibly dead Python function: do_GET", "shortDescription": {"text": "Possibly dead Python function: do_GET"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8e1304ded3e2ecb4", "name": "Possibly dead Python function: do_GET", "shortDescription": {"text": "Possibly dead Python function: do_GET"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-dc3ce750e4458b8f", "name": "Possibly dead Python function: do_GET", "shortDescription": {"text": "Possibly dead Python function: do_GET"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-39f9eb75457d6dfd", "name": "Possibly dead Python function: do_GET", "shortDescription": {"text": "Possibly dead Python function: do_GET"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2b3be45e2ee4c427", "name": "Possibly dead Python function: pipe", "shortDescription": {"text": "Possibly dead Python function: pipe"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-96a8f5d582ce61ac", "name": "Possibly dead Python function: download_audio", "shortDescription": {"text": "Possibly dead Python function: download_audio"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-463d24df6eaa783c", "name": "Possibly dead Python function: transcribe_audio", "shortDescription": {"text": "Possibly dead Python function: transcribe_audio"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-435ede6fe3042f17", "name": "Possibly dead Python function: extract_highlights", "shortDescription": {"text": "Possibly dead Python function: extract_highlights"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e0645dfcd2b6a964", "name": "Possibly dead Python function: worker_loop", "shortDescription": {"text": "Possibly dead Python function: worker_loop"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-285d8acb5a6dca2e", "name": "Possibly dead Python function: do_GET", "shortDescription": {"text": "Possibly dead Python function: do_GET"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3e92891a35c82103", "name": "Possibly dead Python function: start_metrics_server", "shortDescription": {"text": "Possibly dead Python function: start_metrics_server"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d6f4c17cb4cc33f0", "name": "Possibly dead Python function: do_POST", "shortDescription": {"text": "Possibly dead Python function: do_POST"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6d56668a207bdd8c", "name": "Possibly dead Python function: do_GET", "shortDescription": {"text": "Possibly dead Python function: do_GET"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7657d3f598e11724", "name": "Possibly dead Python function: resolve", "shortDescription": {"text": "Possibly dead Python function: resolve"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-bbdac239c3b7bf6a", "name": "Possibly dead Python function: cmd_status", "shortDescription": {"text": "Possibly dead Python function: cmd_status"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1509e801621af1ae", "name": "Possibly dead Python function: cmd_interfaces", "shortDescription": {"text": "Possibly dead Python function: cmd_interfaces"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-287dc8d2f4571e31", "name": "Possibly dead Python function: cmd_gateways", "shortDescription": {"text": "Possibly dead Python function: cmd_gateways"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6db6a1461f157e41", "name": "Possibly dead Python function: cmd_rules", "shortDescription": {"text": "Possibly dead Python function: cmd_rules"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0f3836b74358f8c7", "name": "Possibly dead Python function: cmd_nat", "shortDescription": {"text": "Possibly dead Python function: cmd_nat"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c322d932f1b915ac", "name": "Possibly dead Python function: cmd_aliases", "shortDescription": {"text": "Possibly dead Python function: cmd_aliases"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8491a3971998cae2", "name": "Possibly dead Python function: cmd_alias", "shortDescription": {"text": "Possibly dead Python function: cmd_alias"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f89c1c42805fb90d", "name": "Possibly dead Python function: cmd_states", "shortDescription": {"text": "Possibly dead Python function: cmd_states"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b558ade62baee99e", "name": "Possibly dead Python function: cmd_states_top", "shortDescription": {"text": "Possibly dead Python function: cmd_states_top"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e906052758f50a83", "name": "Possibly dead Python function: cmd_dhcp_leases", "shortDescription": {"text": "Possibly dead Python function: cmd_dhcp_leases"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0b6317007255c5f4", "name": "Possibly dead Python function: cmd_arp", "shortDescription": {"text": "Possibly dead Python function: cmd_arp"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9e7c365fe46a1a79", "name": "Possibly dead Python function: cmd_routes", "shortDescription": {"text": "Possibly dead Python function: cmd_routes"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-67bb7527d1697344", "name": "Possibly dead Python function: cmd_services", "shortDescription": {"text": "Possibly dead Python function: cmd_services"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-480f11b3b6b55e1b", "name": "Possibly dead Python function: cmd_service", "shortDescription": {"text": "Possibly dead Python function: cmd_service"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-095e4858dd83b963", "name": "Stray `console.log` in TS/JS \u2014 stacks/t3-afk/files/dispatcher.js:135", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 stacks/t3-afk/files/dispatcher.js:135"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e1f02d4b32485148", "name": "Stray `console.log` in TS/JS \u2014 scripts/frigate-bulk-classify.js:29", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 scripts/frigate-bulk-classify.js:29"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-faee1c05bad157f6", "name": "Privileged port 11 in use", "shortDescription": {"text": "Privileged port 11 in use"}, "fullDescription": {"text": "Port 11 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-be5ade662ef5e7d1", "name": "Privileged port 10 in use", "shortDescription": {"text": "Privileged port 10 in use"}, "fullDescription": {"text": "Port 10 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d6469c3354f18816", "name": "Privileged port 16 in use", "shortDescription": {"text": "Privileged port 16 in use"}, "fullDescription": {"text": "Port 16 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c09aa584a1948e47", "name": "Privileged port 55 in use", "shortDescription": {"text": "Privileged port 55 in use"}, "fullDescription": {"text": "Port 55 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-eb888ffd2833b582", "name": "Privileged port 30 in use", "shortDescription": {"text": "Privileged port 30 in use"}, "fullDescription": {"text": "Port 30 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-482c2d6757b18447", "name": "Privileged port 60 in use", "shortDescription": {"text": "Privileged port 60 in use"}, "fullDescription": {"text": "Port 60 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c72b96fdbd0e181b", "name": "Privileged port 40 in use", "shortDescription": {"text": "Privileged port 40 in use"}, "fullDescription": {"text": "Port 40 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7e4b279b876a7c11", "name": "Privileged port 150 in use", "shortDescription": {"text": "Privileged port 150 in use"}, "fullDescription": {"text": "Port 150 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c98349f112503db3", "name": "Privileged port 120 in use", "shortDescription": {"text": "Privileged port 120 in use"}, "fullDescription": {"text": "Port 120 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d94d8f69ba870dea", "name": "Privileged port 12 in use", "shortDescription": {"text": "Privileged port 12 in use"}, "fullDescription": {"text": "Port 12 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-94b4da2d60befc14", "name": "Privileged port 730 in use", "shortDescription": {"text": "Privileged port 730 in use"}, "fullDescription": {"text": "Port 730 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-eb2cb6657f9ba055", "name": "Privileged port 44 in use", "shortDescription": {"text": "Privileged port 44 in use"}, "fullDescription": {"text": "Port 44 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1856c4f094f7e6b7", "name": "Privileged port 1 in use", "shortDescription": {"text": "Privileged port 1 in use"}, "fullDescription": {"text": "Port 1 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1c6aca43c9d6ec8e", "name": "Docker base image is tag-pinned but not digest-pinned: eclipse-temurin:17-jdk-jammy", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: eclipse-temurin:17-jdk-jammy"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fcb2be493e994f7f", "name": "Dockerfile runs as root: stacks/monitoring/modules/monitoring/Dockerfile", "shortDescription": {"text": "Dockerfile runs as root: stacks/monitoring/modules/monitoring/Dockerfile"}, "fullDescription": {"text": "No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4afaf4fa60dadb0c", "name": "Docker base image is tag-pinned but not digest-pinned: golang:rc-bullseye", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: golang:rc-bullseye"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c51681f0a94cc719", "name": "Dockerfile runs as root: stacks/nvidia/modules/nvidia/Dockerfile", "shortDescription": {"text": "Dockerfile runs as root: stacks/nvidia/modules/nvidia/Dockerfile"}, "fullDescription": {"text": "No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-80d2baf2f78569c5", "name": "Docker base image uses a mutable or implicit tag: ubuntu", "shortDescription": {"text": "Docker base image uses a mutable or implicit tag: ubuntu"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-51d0a9d836fac554", "name": "Dockerfile runs as root: stacks/k8s-portal/modules/k8s-portal/files/Dockerfile", "shortDescription": {"text": "Dockerfile runs as root: stacks/k8s-portal/modules/k8s-portal/files/Dockerfile"}, "fullDescription": {"text": "No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0a8f955cd9f2160b", "name": "Docker base image is tag-pinned but not digest-pinned: node:22-alpine", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: node:22-alpine"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a773f5fbea8a355b", "name": "Dockerfile runs as root: stacks/chrome-service/files/novnc/Dockerfile", "shortDescription": {"text": "Dockerfile runs as root: stacks/chrome-service/files/novnc/Dockerfile"}, "fullDescription": {"text": "No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-980eba3d144d84fd", "name": "Docker base image is tag-pinned but not digest-pinned: docker.io/library/ubuntu:24.04", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: docker.io/library/ubuntu:24.04"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fe690e34366c84d7", "name": "Dockerfile runs as root: stacks/excalidraw/project/Dockerfile", "shortDescription": {"text": "Dockerfile runs as root: stacks/excalidraw/project/Dockerfile"}, "fullDescription": {"text": "No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e7f9dd11b6cb4f45", "name": "Docker base image is tag-pinned but not digest-pinned: golang:1.21-alpine", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: golang:1.21-alpine"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-412d55ef5a519c8e", "name": "Docker base image uses a mutable or implicit tag: alpine:latest", "shortDescription": {"text": "Docker base image uses a mutable or implicit tag: alpine:latest"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-5d71bf057b2cd584", "name": "Dockerfile runs as root: stacks/ytdlp/yt-highlights/Dockerfile", "shortDescription": {"text": "Dockerfile runs as root: stacks/ytdlp/yt-highlights/Dockerfile"}, "fullDescription": {"text": "No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-11f53be63649c979", "name": "Docker base image is tag-pinned but not digest-pinned: nvidia/cuda:12.6.3-cudnn-runtime-ubuntu22.04", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: nvidia/cuda:12.6.3-cudnn-runtime-ubuntu22.04"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4566019e57671352", "name": "Dockerfile runs as root: stacks/diun/Dockerfile", "shortDescription": {"text": "Dockerfile runs as root: stacks/diun/Dockerfile"}, "fullDescription": {"text": "No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c2c03f9461d77a92", "name": "Docker base image uses a mutable or implicit tag: crazymax/diun:latest", "shortDescription": {"text": "Docker base image uses a mutable or implicit tag: crazymax/diun:latest"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b39675f141a4deaf", "name": "Docker base image is tag-pinned but not digest-pinned: golang:alpine", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: golang:alpine"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3e1e5631fe0321e1", "name": "Dockerfile runs as root: ci/Dockerfile", "shortDescription": {"text": "Dockerfile runs as root: ci/Dockerfile"}, "fullDescription": {"text": "No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c038c9c5c219742f", "name": "Docker base image is tag-pinned but not digest-pinned: alpine:3.20", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: alpine:3.20"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9ef18a6a0f48ab67", "name": "Insecure pattern 'weak_hash' in stacks/monitoring/modules/monitoring/ups_snmp_values.yaml:6", "shortDescription": {"text": "Insecure pattern 'weak_hash' in stacks/monitoring/modules/monitoring/ups_snmp_values.yaml:6"}, "fullDescription": {"text": "Found a known-risky pattern (weak_hash). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b516d02ce72edbdd", "name": "Insecure pattern 'direct_innerhtml_assignment' in stacks/excalidraw/project/main.go:378", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in stacks/excalidraw/project/main.go:378"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f25c09e0326129cf", "name": "Insecure pattern 'direct_innerhtml_assignment' in stacks/excalidraw/project/static/editor.html:89", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in stacks/excalidraw/project/static/editor.html:89"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1c7b15a3615c7dbd", "name": "Insecure pattern 'direct_innerhtml_assignment' in stacks/ytdlp/yt-highlights/app/static/index.html:390", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in stacks/ytdlp/yt-highlights/app/static/index.html:390"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8f85f314a08575b0", "name": "Insecure pattern 'node_child_process' in stacks/t3-afk/files/dispatcher.js:16", "shortDescription": {"text": "Insecure pattern 'node_child_process' in stacks/t3-afk/files/dispatcher.js:16"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-57dfbeae93660534", "name": "Insecure pattern 'direct_innerhtml_assignment' in stacks/status-page/index.html:223", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in stacks/status-page/index.html:223"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-5118591d7db2b7a2", "name": "Insecure pattern 'direct_innerhtml_assignment' in scripts/frigate-bulk-classify.js:462", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in scripts/frigate-bulk-classify.js:462"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-699e8fdc9d56d1d3", "name": "Insecure pattern 'node_child_process' in scripts/frigate-inspect.mjs:7", "shortDescription": {"text": "Insecure pattern 'node_child_process' in scripts/frigate-inspect.mjs:7"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-00dc750d40cc0abc", "name": "Possible secret in scripts/cluster_healthcheck.sh", "shortDescription": {"text": "Possible secret in scripts/cluster_healthcheck.sh"}, "fullDescription": {"text": "Detected pattern matching password_literal. Rotate the credential and move to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-ddbbad020aecc751", "name": "Insecure pattern 'weak_hash' in .claude/skills/archived/coturn-k8s-without-hostnetwork/SKILL.md:10", "shortDescription": {"text": "Insecure pattern 'weak_hash' in .claude/skills/archived/coturn-k8s-without-hostnetwork/SKILL.md:10"}, "fullDescription": {"text": "Found a known-risky pattern (weak_hash). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a6dfaba704e6cfa6", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3a4b4495d44d6c3d", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d67091c1fb9f764a", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4c1bba9478bc73d2", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/deploy-pages@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c2b1ff9b9ed66f84", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-343efd76d6bb2753", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-21e229f26d3bd891", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7420936d72a679e1", "name": "package.json defines install-time lifecycle scripts", "shortDescription": {"text": "package.json defines install-time lifecycle scripts"}, "fullDescription": {"text": "preinstall/install/postinstall/prepare scripts execute during dependency installation. Review them carefully for network calls, obfuscation, shell execution, or credential access."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8eae7a3a4a5165a3", "name": "Very large file: scripts/cluster_healthcheck.sh (3263 lines)", "shortDescription": {"text": "Very large file: scripts/cluster_healthcheck.sh (3263 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6893a6c8b0861585", "name": "Very low test-to-source ratio", "shortDescription": {"text": "Very low test-to-source ratio"}, "fullDescription": {"text": "3 test file(s) for 52 source file(s) (ratio 0.06). Consider adding integration or unit tests for critical paths."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 340 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-122f91b7f2906dc4", "name": "Agent authority lacks a verifier contract: .claude/settings.json", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/settings.json"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-94a6a5ed8dcd4211", "name": "Agent authority lacks a verifier contract: .claude/reference/github-api.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/reference/github-api.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-119caaa5b87e17eb", "name": "Agent authority lacks a verifier contract: .claude/commands/kubectl.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/commands/kubectl.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ce365ce8ae7ff940", "name": "Agent authority lacks a verifier contract: .claude/commands/list-services.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/commands/list-services.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-42d46693e69372c6", "name": "Agent authority lacks a verifier contract: .claude/commands/tf-plan.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/commands/tf-plan.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f9c44a4dc1323a86", "name": "Agent authority lacks a verifier contract: .claude/commands/tf-apply.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/commands/tf-apply.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3475f75feec88ee3", "name": "Agent authority lacks a verifier contract: .claude/agents/sev-triage.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/agents/sev-triage.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-daa5c3a4f7f597d3", "name": "Agent authority lacks a verifier contract: .claude/agents/sev-historian.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/agents/sev-historian.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b641819d05fd2b8b", "name": "Agent authority lacks a verifier contract: .claude/agents/sev-report-writer.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/agents/sev-report-writer.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f182ab6413309da6", "name": "Agent authority lacks a verifier contract: .claude/agents/post-mortem.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/agents/post-mortem.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e8090bfb302ae6ab", "name": "Agent instruction/config may expose a secret: .claude/skills/archived/fastapi-svelte-gpu-webui/SKILL.md", "shortDescription": {"text": "Agent instruction/config may expose a secret: .claude/skills/archived/fastapi-svelte-gpu-webui/SKILL.md"}, "fullDescription": {"text": "Agent-facing files are routinely pasted into LLM/tool contexts. Move literal tokens, keys, and passwords into a secret manager or document them as placeholders only."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-0cb96a687281cacc", "name": "Agent instruction/config may expose a secret: .claude/skills/archived/music-assistant-librespot-wrong-account/SKILL.md", "shortDescription": {"text": "Agent instruction/config may expose a secret: .claude/skills/archived/music-assistant-librespot-wrong-account/SKILL.md"}, "fullDescription": {"text": "Agent-facing files are routinely pasted into LLM/tool contexts. Move literal tokens, keys, and passwords into a secret manager or document them as placeholders only."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-8c703b77081c723c", "name": "Agent instruction/config may expose a secret: .claude/skills/archived/proxmox-vm-disk-expansion-pitfalls/SKILL.md", "shortDescription": {"text": "Agent instruction/config may expose a secret: .claude/skills/archived/proxmox-vm-disk-expansion-pitfalls/SKILL.md"}, "fullDescription": {"text": "Agent-facing files are routinely pasted into LLM/tool contexts. Move literal tokens, keys, and passwords into a secret manager or document them as placeholders only."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-e9fc7915a87306b7", "name": "Agent instruction contains unpinned remote install: .claude/skills/archived/openclaw-k8s-deployment/SKILL.md", "shortDescription": {"text": "Agent instruction contains unpinned remote install: .claude/skills/archived/openclaw-k8s-deployment/SKILL.md"}, "fullDescription": {"text": "Remote install commands in agent instructions are a supply-chain risk, especially when an agent can execute shell commands."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-876181bf7e0ed998", "name": "Agent instruction/config may expose a secret: .claude/skills/archived/ingress-factory-migration/SKILL.md", "shortDescription": {"text": "Agent instruction/config may expose a secret: .claude/skills/archived/ingress-factory-migration/SKILL.md"}, "fullDescription": {"text": "Agent-facing files are routinely pasted into LLM/tool contexts. Move literal tokens, keys, and passwords into a secret manager or document them as placeholders only."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-e209a0b426d796fc", "name": "Agent authority lacks a verifier contract: .claude/skills/post-mortem/skill.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/skills/post-mortem/skill.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-dee80847b1156d30", "name": "Agent instruction/config may expose a secret: .claude/skills/setup-project/SKILL.md", "shortDescription": {"text": "Agent instruction/config may expose a secret: .claude/skills/setup-project/SKILL.md"}, "fullDescription": {"text": "Agent-facing files are routinely pasted into LLM/tool contexts. Move literal tokens, keys, and passwords into a secret manager or document them as placeholders only."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-1712c3bec155819d", "name": "Agent authority lacks a verifier contract: .claude/skills/uptime-kuma/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/skills/uptime-kuma/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-5eb2e07baaa26998", "name": "Agent authority lacks a verifier contract: .claude/skills/disk-wear/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/skills/disk-wear/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7d5197418fd097cd", "name": "Stub function `log_message` (body is just `pass`/`return`) \u2014 stacks/openclaw/files/exporter.py:254", "shortDescription": {"text": "Stub function `log_message` (body is just `pass`/`return`) \u2014 stacks/openclaw/files/exporter.py:254"}, "fullDescription": {"text": "Likely an AI scaffold that was never filled in. Remove or implement."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a4e940508bc8acfd", "name": "Commented-code block (5 lines) in stacks/k8s-portal/modules/k8s-portal/files/src/app.d.ts:5", "shortDescription": {"text": "Commented-code block (5 lines) in stacks/k8s-portal/modules/k8s-portal/files/src/app.d.ts:5"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-0d220a99eee72752", "name": "`fetch()` without try/.catch or AbortSignal \u2014 stacks/rybbit/worker/index.js:55", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 stacks/rybbit/worker/index.js:55"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-79e5d42196a569c7", "name": "Commented-code block (6 lines) in stacks/chrome-service/files/cdp_bridge.py:168", "shortDescription": {"text": "Commented-code block (6 lines) in stacks/chrome-service/files/cdp_bridge.py:168"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-90da584ed6727694", "name": "Commented-code block (5 lines) in stacks/chrome-service/files/stealth.js:1", "shortDescription": {"text": "Commented-code block (5 lines) in stacks/chrome-service/files/stealth.js:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-4b94f7ec6eadf4aa", "name": "Network/subprocess call without timeout or try/except \u2014 stacks/ytdlp/yt-highlights/app/main.py:338", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 stacks/ytdlp/yt-highlights/app/main.py:338"}, "fullDescription": {"text": "`requests.post(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-41ae0208e0993b9a", "name": "Legacy-named symbol `stalled_old` in stacks/servarr/mam-farming/files/mam-farming-janitor.py:33", "shortDescription": {"text": "Legacy-named symbol `stalled_old` in stacks/servarr/mam-farming/files/mam-farming-janitor.py:33"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ce8f3dbb0c5915c5", "name": "Commented-code block (5 lines) in stacks/servarr/mam-farming/files/freeleech-grabber.py:35", "shortDescription": {"text": "Commented-code block (5 lines) in stacks/servarr/mam-farming/files/freeleech-grabber.py:35"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-4b6387f961ef43aa", "name": "Network/subprocess call without timeout or try/except \u2014 stacks/servarr/mam-farming/files/freeleech-grabber.py:231", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 stacks/servarr/mam-farming/files/freeleech-grabber.py:231"}, "fullDescription": {"text": "`requests.post(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3c4ad4fc02c1ddd8", "name": "Stub function `log_message` (body is just `pass`/`return`) \u2014 stacks/kms/files/slack-notifier.py:232", "shortDescription": {"text": "Stub function `log_message` (body is just `pass`/`return`) \u2014 stacks/kms/files/slack-notifier.py:232"}, "fullDescription": {"text": "Likely an AI scaffold that was never filled in. Remove or implement."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-bfe76eb3f3eb7dd0", "name": "Stub function `log_message` (body is just `pass`/`return`) \u2014 stacks/kms/files/diag-collector.py:29", "shortDescription": {"text": "Stub function `log_message` (body is just `pass`/`return`) \u2014 stacks/kms/files/diag-collector.py:29"}, "fullDescription": {"text": "Likely an AI scaffold that was never filled in. Remove or implement."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7d0943c73e3cea9d", "name": "Commented-code block (10 lines) in stacks/t3-afk/files/dispatcher.js:1", "shortDescription": {"text": "Commented-code block (10 lines) in stacks/t3-afk/files/dispatcher.js:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-ab47207216680100", "name": "Stub function `close` (body is just `pass`/`return`) \u2014 stacks/t3code/probe.py:83", "shortDescription": {"text": "Stub function `close` (body is just `pass`/`return`) \u2014 stacks/t3code/probe.py:83"}, "fullDescription": {"text": "Likely an AI scaffold that was never filled in. Remove or implement."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e0e1025bd37b7ca8", "name": "Legacy-named symbol `api_v1` in scripts/cluster_manager.py:96", "shortDescription": {"text": "Legacy-named symbol `api_v1` in scripts/cluster_manager.py:96"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-00fc23ffecb5364a", "name": "Stub function `cli` (body is just `pass`/`return`) \u2014 scripts/cluster_manager.py:152", "shortDescription": {"text": "Stub function `cli` (body is just `pass`/`return`) \u2014 scripts/cluster_manager.py:152"}, "fullDescription": {"text": "Likely an AI scaffold that was never filled in. Remove or implement."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6ba80825acb9a534", "name": "Commented-code block (7 lines) in scripts/frigate-bulk-classify.js:5", "shortDescription": {"text": "Commented-code block (7 lines) in scripts/frigate-bulk-classify.js:5"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-3c9bf6879d8bca05", "name": "Commented-code block (5 lines) in scripts/gen_service_stacks.py:8", "shortDescription": {"text": "Commented-code block (5 lines) in scripts/gen_service_stacks.py:8"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-cd293464d8ad4038", "name": "Legacy-named symbol `cmd_backup` in .claude/pfsense.py:222", "shortDescription": {"text": "Legacy-named symbol `cmd_backup` in .claude/pfsense.py:222"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2c04133e54348533", "name": "Near-duplicate function bodies in 2 places", "shortDescription": {"text": "Near-duplicate function bodies in 2 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nstacks/openclaw/files/exporter.py:do_GET, stacks/kms/files/slack-notifier.py:do_GET\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-be46ea126aa5d8dc", "name": "Near-duplicate function bodies in 3 places", "shortDescription": {"text": "Near-duplicate function bodies in 3 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\n.claude/pfsense.py:cmd_services, .claude/pfsense.py:cmd_service, .claude/pfsense.py:cmd_snort\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-49c98f7cedd9c977", "name": "Near-duplicate function bodies in 4 places", "shortDescription": {"text": "Near-duplicate function bodies in 4 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\n.claude/home-assistant.py:get_states, .claude/home-assistant.py:get_state, .claude/home-assistant-sofia.py:get_states, .claude/home-assistant-sofia.py:get_state\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e38bd2c3e82e8d02", "name": "FastAPI POST `process` without auth dependency \u2014 stacks/ytdlp/yt-highlights/app/main.py:1019", "shortDescription": {"text": "FastAPI POST `process` without auth dependency \u2014 stacks/ytdlp/yt-highlights/app/main.py:1019"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-1fe32b026e12ba63", "name": "FastAPI DELETE `delete_job` without auth dependency \u2014 stacks/ytdlp/yt-highlights/app/main.py:1069", "shortDescription": {"text": "FastAPI DELETE `delete_job` without auth dependency \u2014 stacks/ytdlp/yt-highlights/app/main.py:1069"}, "fullDescription": {"text": "`@router.delete` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-c71c61811217ccff", "name": "FastAPI POST `add_channel` without auth dependency \u2014 stacks/ytdlp/yt-highlights/app/main.py:1126", "shortDescription": {"text": "FastAPI POST `add_channel` without auth dependency \u2014 stacks/ytdlp/yt-highlights/app/main.py:1126"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-98987098015272e2", "name": "FastAPI DELETE `remove_channel` without auth dependency \u2014 stacks/ytdlp/yt-highlights/app/main.py:1160", "shortDescription": {"text": "FastAPI DELETE `remove_channel` without auth dependency \u2014 stacks/ytdlp/yt-highlights/app/main.py:1160"}, "fullDescription": {"text": "`@router.delete` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-372745d8b2ce0b9b", "name": "FastAPI POST `migrate_channels` without auth dependency \u2014 stacks/ytdlp/yt-highlights/app/main.py:1172", "shortDescription": {"text": "FastAPI POST `migrate_channels` without auth dependency \u2014 stacks/ytdlp/yt-highlights/app/main.py:1172"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-e95c9f88229ec22e", "name": "FastAPI POST `check_new_videos` without auth dependency \u2014 stacks/ytdlp/yt-highlights/app/main.py:1205", "shortDescription": {"text": "FastAPI POST `check_new_videos` without auth dependency \u2014 stacks/ytdlp/yt-highlights/app/main.py:1205"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-b568eecabe03ec8a", "name": "FastAPI POST `auto_process` without auth dependency \u2014 stacks/ytdlp/yt-highlights/app/main.py:1275", "shortDescription": {"text": "FastAPI POST `auto_process` without auth dependency \u2014 stacks/ytdlp/yt-highlights/app/main.py:1275"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-fd278a3c91aa5b3c", "name": "Unused endpoint: POST /process", "shortDescription": {"text": "Unused endpoint: POST /process"}, "fullDescription": {"text": "`stacks/ytdlp/yt-highlights/app/main.py` declares `POST /process` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-66bddf72c96b3ab4", "name": "Unused endpoint: GET /results/{job_id}", "shortDescription": {"text": "Unused endpoint: GET /results/{job_id}"}, "fullDescription": {"text": "`stacks/ytdlp/yt-highlights/app/main.py` declares `GET /results/{job_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6d0b60cfd130dc4c", "name": "Unused endpoint: DELETE /jobs/{job_id}", "shortDescription": {"text": "Unused endpoint: DELETE /jobs/{job_id}"}, "fullDescription": {"text": "`stacks/ytdlp/yt-highlights/app/main.py` declares `DELETE /jobs/{job_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e0b9bdc04b58bea3", "name": "Unused endpoint: GET /channels", "shortDescription": {"text": "Unused endpoint: GET /channels"}, "fullDescription": {"text": "`stacks/ytdlp/yt-highlights/app/main.py` declares `GET /channels` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-14a78266393888c7", "name": "Unused endpoint: POST /channels", "shortDescription": {"text": "Unused endpoint: POST /channels"}, "fullDescription": {"text": "`stacks/ytdlp/yt-highlights/app/main.py` declares `POST /channels` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7bf87051e7102a17", "name": "Unused endpoint: DELETE /channels/{channel_id}", "shortDescription": {"text": "Unused endpoint: DELETE /channels/{channel_id}"}, "fullDescription": {"text": "`stacks/ytdlp/yt-highlights/app/main.py` declares `DELETE /channels/{channel_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ec05e763c1c4f327", "name": "Unused endpoint: POST /channels/migrate", "shortDescription": {"text": "Unused endpoint: POST /channels/migrate"}, "fullDescription": {"text": "`stacks/ytdlp/yt-highlights/app/main.py` declares `POST /channels/migrate` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-53d1bff3c2772782", "name": "Unused endpoint: POST /check-new", "shortDescription": {"text": "Unused endpoint: POST /check-new"}, "fullDescription": {"text": "`stacks/ytdlp/yt-highlights/app/main.py` declares `POST /check-new` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1008c575819b3d37", "name": "Unused endpoint: GET /jobs", "shortDescription": {"text": "Unused endpoint: GET /jobs"}, "fullDescription": {"text": "`stacks/ytdlp/yt-highlights/app/main.py` declares `GET /jobs` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9ced535873546562", "name": "Unused endpoint: GET /processed", "shortDescription": {"text": "Unused endpoint: GET /processed"}, "fullDescription": {"text": "`stacks/ytdlp/yt-highlights/app/main.py` declares `GET /processed` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-27172c806590591e", "name": "Unused endpoint: POST /auto-process", "shortDescription": {"text": "Unused endpoint: POST /auto-process"}, "fullDescription": {"text": "`stacks/ytdlp/yt-highlights/app/main.py` declares `POST /auto-process` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5baa8971ebe192a1", "name": "Unused endpoint: GET /", "shortDescription": {"text": "Unused endpoint: GET /"}, "fullDescription": {"text": "`stacks/ytdlp/yt-highlights/app/main.py` declares `GET /` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/22246"}, "properties": {"repository": "ViktorBarzin/infra", "repoUrl": "https://github.com/ViktorBarzin/infra", "branch": "main"}, "results": [{"ruleId": "scanner-6bc5a80e3270605e", "level": "note", "message": {"text": "Possibly dead Python function: do_GET"}, "properties": {"repobilityId": "2d943bb45e4f13bd", "scanner": "scanner-primary", "fingerprint": "6bc5a80e3270605e", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "stacks/poison-fountain/app/server.py:90"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-8e1304ded3e2ecb4", "level": "note", "message": {"text": "Possibly dead Python function: do_GET"}, "properties": {"repobilityId": "2d943bb45e4f13bd", "scanner": "scanner-primary", "fingerprint": "8e1304ded3e2ecb4", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "stacks/openclaw/files/exporter.py:225"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-dc3ce750e4458b8f", "level": "note", "message": {"text": "Possibly dead Python function: do_GET"}, "properties": {"repobilityId": "2d943bb45e4f13bd", "scanner": "scanner-primary", "fingerprint": "dc3ce750e4458b8f", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "stacks/android-emulator/gate.py:80"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-39f9eb75457d6dfd", "level": "note", "message": {"text": "Possibly dead Python function: do_GET"}, "properties": {"repobilityId": "2d943bb45e4f13bd", "scanner": "scanner-primary", "fingerprint": "39f9eb75457d6dfd", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "stacks/chrome-service/files/snapshot_server.py:35"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-2b3be45e2ee4c427", "level": "note", "message": {"text": "Possibly dead Python function: pipe"}, "properties": {"repobilityId": "898ed0e84e7d1cd8", "scanner": "scanner-primary", "fingerprint": "2b3be45e2ee4c427", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "stacks/chrome-service/files/cdp_bridge.py:78"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-96a8f5d582ce61ac", "level": "note", "message": {"text": "Possibly dead Python function: download_audio"}, "properties": {"repobilityId": "f30b01b1eaf27fb4", "scanner": "scanner-primary", "fingerprint": "96a8f5d582ce61ac", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "stacks/ytdlp/yt-highlights/app/main.py:455"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-463d24df6eaa783c", "level": "note", "message": {"text": "Possibly dead Python function: transcribe_audio"}, "properties": {"repobilityId": "36f3002f5cab55bd", "scanner": "scanner-primary", "fingerprint": "463d24df6eaa783c", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "stacks/ytdlp/yt-highlights/app/main.py:493"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-435ede6fe3042f17", "level": "note", "message": {"text": "Possibly dead Python function: extract_highlights"}, "properties": {"repobilityId": "fdaa9860dae4d1bb", "scanner": "scanner-primary", "fingerprint": "435ede6fe3042f17", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "stacks/ytdlp/yt-highlights/app/main.py:536"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e0645dfcd2b6a964", "level": "note", "message": {"text": "Possibly dead Python function: worker_loop"}, "properties": {"repobilityId": "4954625ddd25975f", "scanner": "scanner-primary", "fingerprint": "e0645dfcd2b6a964", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "stacks/ytdlp/yt-highlights/app/main.py:917"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-285d8acb5a6dca2e", "level": "note", "message": {"text": "Possibly dead Python function: do_GET"}, "properties": {"repobilityId": "2d943bb45e4f13bd", "scanner": "scanner-primary", "fingerprint": "285d8acb5a6dca2e", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "stacks/kms/files/slack-notifier.py:214"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3e92891a35c82103", "level": "note", "message": {"text": "Possibly dead Python function: start_metrics_server"}, "properties": {"repobilityId": "6bc1f66c75c807d7", "scanner": "scanner-primary", "fingerprint": "3e92891a35c82103", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "stacks/kms/files/slack-notifier.py:236"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d6f4c17cb4cc33f0", "level": "note", "message": {"text": "Possibly dead Python function: do_POST"}, "properties": {"repobilityId": "53357410ca9379a9", "scanner": "scanner-primary", "fingerprint": "d6f4c17cb4cc33f0", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "stacks/kms/files/diag-collector.py:11"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6d56668a207bdd8c", "level": "note", "message": {"text": "Possibly dead Python function: do_GET"}, "properties": {"repobilityId": "2d943bb45e4f13bd", "scanner": "scanner-primary", "fingerprint": "6d56668a207bdd8c", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "stacks/kms/files/diag-collector.py:27"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-7657d3f598e11724", "level": "note", "message": {"text": "Possibly dead Python function: resolve"}, "properties": {"repobilityId": "7c71ac162466eafc", "scanner": "scanner-primary", "fingerprint": "7657d3f598e11724", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "stacks/t3code/probe.py:95"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-bbdac239c3b7bf6a", "level": "note", "message": {"text": "Possibly dead Python function: cmd_status"}, "properties": {"repobilityId": "244b91f3ae7622bf", "scanner": "scanner-primary", "fingerprint": "bbdac239c3b7bf6a", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/pfsense.py:66"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-1509e801621af1ae", "level": "note", "message": {"text": "Possibly dead Python function: cmd_interfaces"}, "properties": {"repobilityId": "89e169ea428f7a60", "scanner": "scanner-primary", "fingerprint": "1509e801621af1ae", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/pfsense.py:99"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-287dc8d2f4571e31", "level": "note", "message": {"text": "Possibly dead Python function: cmd_gateways"}, "properties": {"repobilityId": "89179cd46e6dc986", "scanner": "scanner-primary", "fingerprint": "287dc8d2f4571e31", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/pfsense.py:118"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6db6a1461f157e41", "level": "note", "message": {"text": "Possibly dead Python function: cmd_rules"}, "properties": {"repobilityId": "4093e66fa9397501", "scanner": "scanner-primary", "fingerprint": "6db6a1461f157e41", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/pfsense.py:122"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-0f3836b74358f8c7", "level": "note", "message": {"text": "Possibly dead Python function: cmd_nat"}, "properties": {"repobilityId": "dd4cd59373ddf0a1", "scanner": "scanner-primary", "fingerprint": "0f3836b74358f8c7", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/pfsense.py:130"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c322d932f1b915ac", "level": "note", "message": {"text": "Possibly dead Python function: cmd_aliases"}, "properties": {"repobilityId": "e6e36e6ac1633772", "scanner": "scanner-primary", "fingerprint": "c322d932f1b915ac", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/pfsense.py:134"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-8491a3971998cae2", "level": "note", "message": {"text": "Possibly dead Python function: cmd_alias"}, "properties": {"repobilityId": "1cec95ab866944cf", "scanner": "scanner-primary", "fingerprint": "8491a3971998cae2", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/pfsense.py:138"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f89c1c42805fb90d", "level": "note", "message": {"text": "Possibly dead Python function: cmd_states"}, "properties": {"repobilityId": "67e586261d249745", "scanner": "scanner-primary", "fingerprint": "f89c1c42805fb90d", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/pfsense.py:142"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b558ade62baee99e", "level": "note", "message": {"text": "Possibly dead Python function: cmd_states_top"}, "properties": {"repobilityId": "1c934df0d1cbb3a9", "scanner": "scanner-primary", "fingerprint": "b558ade62baee99e", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/pfsense.py:146"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e906052758f50a83", "level": "note", "message": {"text": "Possibly dead Python function: cmd_dhcp_leases"}, "properties": {"repobilityId": "f5a162ec4e8e723d", "scanner": "scanner-primary", "fingerprint": "e906052758f50a83", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/pfsense.py:151"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-0b6317007255c5f4", "level": "note", "message": {"text": "Possibly dead Python function: cmd_arp"}, "properties": {"repobilityId": "5ec87b9da380511d", "scanner": "scanner-primary", "fingerprint": "0b6317007255c5f4", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/pfsense.py:170"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-9e7c365fe46a1a79", "level": "note", "message": {"text": "Possibly dead Python function: cmd_routes"}, "properties": {"repobilityId": "cc50d984ad75fc94", "scanner": "scanner-primary", "fingerprint": "9e7c365fe46a1a79", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/pfsense.py:174"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-67bb7527d1697344", "level": "note", "message": {"text": "Possibly dead Python function: cmd_services"}, "properties": {"repobilityId": "54bafcbbfb879735", "scanner": "scanner-primary", "fingerprint": "67bb7527d1697344", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/pfsense.py:178"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-480f11b3b6b55e1b", "level": "note", "message": {"text": "Possibly dead Python function: cmd_service"}, "properties": {"repobilityId": "b55515ee5defc004", "scanner": "scanner-primary", "fingerprint": "480f11b3b6b55e1b", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/pfsense.py:192"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-095e4858dd83b963", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 stacks/t3-afk/files/dispatcher.js:135"}, "properties": {"repobilityId": "a6bac474ca0819b6", "scanner": "scanner-primary", "fingerprint": "095e4858dd83b963", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-e1f02d4b32485148", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 scripts/frigate-bulk-classify.js:29"}, "properties": {"repobilityId": "1261065deec5ea10", "scanner": "scanner-primary", "fingerprint": "e1f02d4b32485148", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-faee1c05bad157f6", "level": "warning", "message": {"text": "Privileged port 11 in use"}, "properties": {"repobilityId": "5b3038c67fabb4c8", "scanner": "scanner-primary", "fingerprint": "faee1c05bad157f6", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "stacks/monitoring/modules/monitoring/dashboards/ups-prometheus-metrics.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-be5ade662ef5e7d1", "level": "warning", "message": {"text": "Privileged port 10 in use"}, "properties": {"repobilityId": "735372d6b5594915", "scanner": "scanner-primary", "fingerprint": "be5ade662ef5e7d1", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/node_registry_manager.sh"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d6469c3354f18816", "level": "warning", "message": {"text": "Privileged port 16 in use"}, "properties": {"repobilityId": "d31009168c502ace", "scanner": "scanner-primary", "fingerprint": "d6469c3354f18816", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/test-fan-control.sh"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c09aa584a1948e47", "level": "warning", "message": {"text": "Privileged port 55 in use"}, "properties": {"repobilityId": "51a768b3e1831ac0", "scanner": "scanner-primary", "fingerprint": "c09aa584a1948e47", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/test-fan-control.sh"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-eb888ffd2833b582", "level": "warning", "message": {"text": "Privileged port 30 in use"}, "properties": {"repobilityId": "54f172e7d16fc662", "scanner": "scanner-primary", "fingerprint": "eb888ffd2833b582", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/t3-backup-state.sh"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-482c2d6757b18447", "level": "warning", "message": {"text": "Privileged port 60 in use"}, "properties": {"repobilityId": "f4424efab727024f", "scanner": "scanner-primary", "fingerprint": "482c2d6757b18447", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/apply-mbps-caps.sh"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c72b96fdbd0e181b", "level": "warning", "message": {"text": "Privileged port 40 in use"}, "properties": {"repobilityId": "28c59d470d4929c6", "scanner": "scanner-primary", "fingerprint": "c72b96fdbd0e181b", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/apply-mbps-caps.sh"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-7e4b279b876a7c11", "level": "warning", "message": {"text": "Privileged port 150 in use"}, "properties": {"repobilityId": "06dfcea24ef263cd", "scanner": "scanner-primary", "fingerprint": "7e4b279b876a7c11", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/apply-mbps-caps.sh"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c98349f112503db3", "level": "warning", "message": {"text": "Privileged port 120 in use"}, "properties": {"repobilityId": "1b5bc14c8e1d1785", "scanner": "scanner-primary", "fingerprint": "c98349f112503db3", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/apply-mbps-caps.sh"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d94d8f69ba870dea", "level": "warning", "message": {"text": "Privileged port 12 in use"}, "properties": {"repobilityId": "65e7eefa33f2def4", "scanner": "scanner-primary", "fingerprint": "d94d8f69ba870dea", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/upgrade_state.sh"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-94b4da2d60befc14", "level": "warning", "message": {"text": "Privileged port 730 in use"}, "properties": {"repobilityId": "d7c8f7cc756000fe", "scanner": "scanner-primary", "fingerprint": "94b4da2d60befc14", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/cluster_healthcheck.sh"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-eb2cb6657f9ba055", "level": "warning", "message": {"text": "Privileged port 44 in use"}, "properties": {"repobilityId": "1f021a2e926773a0", "scanner": "scanner-primary", "fingerprint": "eb2cb6657f9ba055", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/cluster_healthcheck.sh"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-1856c4f094f7e6b7", "level": "warning", "message": {"text": "Privileged port 1 in use"}, "properties": {"repobilityId": "ddf3fa6c29abb8d2", "scanner": "scanner-primary", "fingerprint": "1856c4f094f7e6b7", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/vzdump-vms.sh"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-1c6aca43c9d6ec8e", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: eclipse-temurin:17-jdk-jammy"}, "properties": {"repobilityId": "a1b8a9c0c1760e58", "scanner": "scanner-primary", "fingerprint": "1c6aca43c9d6ec8e", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "stacks/android-emulator/docker/Dockerfile"}, "region": {"startLine": 9}}}]}, {"ruleId": "scanner-fcb2be493e994f7f", "level": "warning", "message": {"text": "Dockerfile runs as root: stacks/monitoring/modules/monitoring/Dockerfile"}, "properties": {"repobilityId": "3f631781ddd81c0e", "scanner": "scanner-primary", "fingerprint": "fcb2be493e994f7f", "layer": "hardware", "severity": "medium", "confidence": 1.0, "tags": ["security", "container"]}}, {"ruleId": "scanner-4afaf4fa60dadb0c", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: golang:rc-bullseye"}, "properties": {"repobilityId": "7462969716ba132f", "scanner": "scanner-primary", "fingerprint": "4afaf4fa60dadb0c", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "stacks/monitoring/modules/monitoring/Dockerfile"}, "region": {"startLine": 3}}}]}, {"ruleId": "scanner-4afaf4fa60dadb0c", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: golang:rc-bullseye"}, "properties": {"repobilityId": "7c80601822a4c5fe", "scanner": "scanner-primary", "fingerprint": "4afaf4fa60dadb0c", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "stacks/monitoring/modules/monitoring/Dockerfile"}, "region": {"startLine": 21}}}]}, {"ruleId": "scanner-c51681f0a94cc719", "level": "warning", "message": {"text": "Dockerfile runs as root: stacks/nvidia/modules/nvidia/Dockerfile"}, "properties": {"repobilityId": "53164e07dffeccf3", "scanner": "scanner-primary", "fingerprint": "c51681f0a94cc719", "layer": "hardware", "severity": "medium", "confidence": 1.0, "tags": ["security", "container"]}}, {"ruleId": "scanner-80d2baf2f78569c5", "level": "warning", "message": {"text": "Docker base image uses a mutable or implicit tag: ubuntu"}, "properties": {"repobilityId": "508a42b054385e51", "scanner": "scanner-primary", "fingerprint": "80d2baf2f78569c5", "layer": "hardware", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "stacks/nvidia/modules/nvidia/Dockerfile"}, "region": {"startLine": 2}}}]}, {"ruleId": "scanner-51d0a9d836fac554", "level": "warning", "message": {"text": "Dockerfile runs as root: stacks/k8s-portal/modules/k8s-portal/files/Dockerfile"}, "properties": {"repobilityId": "5add986a809caa74", "scanner": "scanner-primary", "fingerprint": "51d0a9d836fac554", "layer": "hardware", "severity": "medium", "confidence": 1.0, "tags": ["security", "container"]}}, {"ruleId": "scanner-0a8f955cd9f2160b", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: node:22-alpine"}, "properties": {"repobilityId": "87f90a83d6ac137c", "scanner": "scanner-primary", "fingerprint": "0a8f955cd9f2160b", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "stacks/k8s-portal/modules/k8s-portal/files/Dockerfile"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-0a8f955cd9f2160b", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: node:22-alpine"}, "properties": {"repobilityId": "e646e3dfad34dbbb", "scanner": "scanner-primary", "fingerprint": "0a8f955cd9f2160b", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "stacks/k8s-portal/modules/k8s-portal/files/Dockerfile"}, "region": {"startLine": 7}}}]}, {"ruleId": "scanner-a773f5fbea8a355b", "level": "warning", "message": {"text": "Dockerfile runs as root: stacks/chrome-service/files/novnc/Dockerfile"}, "properties": {"repobilityId": "b6c0c787f6cd6619", "scanner": "scanner-primary", "fingerprint": "a773f5fbea8a355b", "layer": "hardware", "severity": "medium", "confidence": 1.0, "tags": ["security", "container"]}}, {"ruleId": "scanner-980eba3d144d84fd", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: docker.io/library/ubuntu:24.04"}, "properties": {"repobilityId": "b7ee94e21eee0516", "scanner": "scanner-primary", "fingerprint": "980eba3d144d84fd", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "stacks/chrome-service/files/novnc/Dockerfile"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-fe690e34366c84d7", "level": "warning", "message": {"text": "Dockerfile runs as root: stacks/excalidraw/project/Dockerfile"}, "properties": {"repobilityId": "c7388d8e759a291f", "scanner": "scanner-primary", "fingerprint": "fe690e34366c84d7", "layer": "hardware", "severity": "medium", "confidence": 1.0, "tags": ["security", "container"]}}, {"ruleId": "scanner-e7f9dd11b6cb4f45", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: golang:1.21-alpine"}, "properties": {"repobilityId": "4dfb2a6593a4e191", "scanner": "scanner-primary", "fingerprint": "e7f9dd11b6cb4f45", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "stacks/excalidraw/project/Dockerfile"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-412d55ef5a519c8e", "level": "warning", "message": {"text": "Docker base image uses a mutable or implicit tag: alpine:latest"}, "properties": {"repobilityId": "51bed311e94d3a2c", "scanner": "scanner-primary", "fingerprint": "412d55ef5a519c8e", "layer": "hardware", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "stacks/excalidraw/project/Dockerfile"}, "region": {"startLine": 9}}}]}, {"ruleId": "scanner-5d71bf057b2cd584", "level": "warning", "message": {"text": "Dockerfile runs as root: stacks/ytdlp/yt-highlights/Dockerfile"}, "properties": {"repobilityId": "40ebe513750a5f18", "scanner": "scanner-primary", "fingerprint": "5d71bf057b2cd584", "layer": "hardware", "severity": "medium", "confidence": 1.0, "tags": ["security", "container"]}}, {"ruleId": "scanner-11f53be63649c979", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: nvidia/cuda:12.6.3-cudnn-runtime-ubuntu22.04"}, "properties": {"repobilityId": "d7d658fb36b12f47", "scanner": "scanner-primary", "fingerprint": "11f53be63649c979", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "stacks/ytdlp/yt-highlights/Dockerfile"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-4566019e57671352", "level": "warning", "message": {"text": "Dockerfile runs as root: stacks/diun/Dockerfile"}, "properties": {"repobilityId": "f9aeb4297ae54ace", "scanner": "scanner-primary", "fingerprint": "4566019e57671352", "layer": "hardware", "severity": "medium", "confidence": 1.0, "tags": ["security", "container"]}}, {"ruleId": "scanner-c2c03f9461d77a92", "level": "warning", "message": {"text": "Docker base image uses a mutable or implicit tag: crazymax/diun:latest"}, "properties": {"repobilityId": "454b52b35a949e04", "scanner": "scanner-primary", "fingerprint": "c2c03f9461d77a92", "layer": "hardware", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "stacks/diun/Dockerfile"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b39675f141a4deaf", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: golang:alpine"}, "properties": {"repobilityId": "03d6af0378329c58", "scanner": "scanner-primary", "fingerprint": "b39675f141a4deaf", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "cli/Dockerfile"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3e1e5631fe0321e1", "level": "warning", "message": {"text": "Dockerfile runs as root: ci/Dockerfile"}, "properties": {"repobilityId": "3aaa4f14db97c57d", "scanner": "scanner-primary", "fingerprint": "3e1e5631fe0321e1", "layer": "hardware", "severity": "medium", "confidence": 1.0, "tags": ["security", "container"]}}, {"ruleId": "scanner-c038c9c5c219742f", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: alpine:3.20"}, "properties": {"repobilityId": "7a8fd9297b449bc0", "scanner": "scanner-primary", "fingerprint": "c038c9c5c219742f", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "ci/Dockerfile"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-9ef18a6a0f48ab67", "level": "warning", "message": {"text": "Insecure pattern 'weak_hash' in stacks/monitoring/modules/monitoring/ups_snmp_values.yaml:6"}, "properties": {"repobilityId": "9aaff7b4cb36b50e", "scanner": "scanner-primary", "fingerprint": "9ef18a6a0f48ab67", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "weak_hash"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "stacks/monitoring/modules/monitoring/ups_snmp_values.yaml"}, "region": {"startLine": 6}}}]}, {"ruleId": "scanner-b516d02ce72edbdd", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in stacks/excalidraw/project/main.go:378"}, "properties": {"repobilityId": "1a682938b7fe66b1", "scanner": "scanner-primary", "fingerprint": "b516d02ce72edbdd", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "stacks/excalidraw/project/main.go"}, "region": {"startLine": 378}}}]}, {"ruleId": "scanner-f25c09e0326129cf", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in stacks/excalidraw/project/static/editor.html:89"}, "properties": {"repobilityId": "3f42e09ff2a4d934", "scanner": "scanner-primary", "fingerprint": "f25c09e0326129cf", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "stacks/excalidraw/project/static/editor.html"}, "region": {"startLine": 89}}}]}, {"ruleId": "scanner-1c7b15a3615c7dbd", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in stacks/ytdlp/yt-highlights/app/static/index.html:390"}, "properties": {"repobilityId": "cd3042e9f4533eb2", "scanner": "scanner-primary", "fingerprint": "1c7b15a3615c7dbd", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "stacks/ytdlp/yt-highlights/app/static/index.html"}, "region": {"startLine": 390}}}]}, {"ruleId": "scanner-8f85f314a08575b0", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in stacks/t3-afk/files/dispatcher.js:16"}, "properties": {"repobilityId": "bc690263fe911186", "scanner": "scanner-primary", "fingerprint": "8f85f314a08575b0", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "stacks/t3-afk/files/dispatcher.js"}, "region": {"startLine": 16}}}]}, {"ruleId": "scanner-57dfbeae93660534", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in stacks/status-page/index.html:223"}, "properties": {"repobilityId": "18d49bc475d7e0eb", "scanner": "scanner-primary", "fingerprint": "57dfbeae93660534", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "stacks/status-page/index.html"}, "region": {"startLine": 223}}}]}, {"ruleId": "scanner-5118591d7db2b7a2", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in scripts/frigate-bulk-classify.js:462"}, "properties": {"repobilityId": "9d2d24130780425e", "scanner": "scanner-primary", "fingerprint": "5118591d7db2b7a2", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/frigate-bulk-classify.js"}, "region": {"startLine": 462}}}]}, {"ruleId": "scanner-699e8fdc9d56d1d3", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in scripts/frigate-inspect.mjs:7"}, "properties": {"repobilityId": "2c63112b82b4dee0", "scanner": "scanner-primary", "fingerprint": "699e8fdc9d56d1d3", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/frigate-inspect.mjs"}, "region": {"startLine": 7}}}]}, {"ruleId": "scanner-00dc750d40cc0abc", "level": "error", "message": {"text": "Possible secret in scripts/cluster_healthcheck.sh"}, "properties": {"repobilityId": "e65c265c35610f3e", "scanner": "scanner-primary", "fingerprint": "00dc750d40cc0abc", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/cluster_healthcheck.sh"}, "region": {"startLine": 771}}}]}, {"ruleId": "scanner-ddbbad020aecc751", "level": "warning", "message": {"text": "Insecure pattern 'weak_hash' in .claude/skills/archived/coturn-k8s-without-hostnetwork/SKILL.md:10"}, "properties": {"repobilityId": "dca94f00dd11e0c0", "scanner": "scanner-primary", "fingerprint": "ddbbad020aecc751", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "weak_hash"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/archived/coturn-k8s-without-hostnetwork/SKILL.md"}, "region": {"startLine": 10}}}]}, {"ruleId": "scanner-a6dfaba704e6cfa6", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "a2bd11838389a67d", "scanner": "scanner-primary", "fingerprint": "a6dfaba704e6cfa6", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/build-infra-ci.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3a4b4495d44d6c3d", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "07cefff131381a07", "scanner": "scanner-primary", "fingerprint": "3a4b4495d44d6c3d", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/build-cli.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d67091c1fb9f764a", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "0ab64c47cb27973c", "scanner": "scanner-primary", "fingerprint": "d67091c1fb9f764a", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/build-k8s-portal.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-4c1bba9478bc73d2", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "6f95a9f3986eca03", "scanner": "scanner-primary", "fingerprint": "4c1bba9478bc73d2", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/deploy-postmortems.yml"}, "region": {"startLine": 32}}}]}, {"ruleId": "scanner-c2b1ff9b9ed66f84", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "096aea27b96fbcb5", "scanner": "scanner-primary", "fingerprint": "c2b1ff9b9ed66f84", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/deploy-postmortems.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-343efd76d6bb2753", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "e6fcc19f5f8eaa96", "scanner": "scanner-primary", "fingerprint": "343efd76d6bb2753", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/build-android-emulator.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-21e229f26d3bd891", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "81ab93178be6402e", "scanner": "scanner-primary", "fingerprint": "21e229f26d3bd891", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/build-chrome-service-novnc.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-7420936d72a679e1", "level": "note", "message": {"text": "package.json defines install-time lifecycle scripts"}, "properties": {"repobilityId": "63d0b9b697cbfcb6", "scanner": "scanner-primary", "fingerprint": "7420936d72a679e1", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "npm", "install-scripts"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "stacks/k8s-portal/modules/k8s-portal/files/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-8eae7a3a4a5165a3", "level": "note", "message": {"text": "Very large file: scripts/cluster_healthcheck.sh (3263 lines)"}, "properties": {"repobilityId": "489b704d6a72fcd7", "scanner": "scanner-primary", "fingerprint": "8eae7a3a4a5165a3", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-6893a6c8b0861585", "level": "warning", "message": {"text": "Very low test-to-source ratio"}, "properties": {"repobilityId": "54a7de3f06314bf0", "scanner": "scanner-primary", "fingerprint": "6893a6c8b0861585", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["tests", "coverage"]}}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "e2c8d4151da83e51", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "223c898391c272dd", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "3af3bf6d7eb67e7f", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "013a65dff9f9c9b5", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-122f91b7f2906dc4", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/settings.json"}, "properties": {"repobilityId": "a2967269048b6a9d", "scanner": "scanner-primary", "fingerprint": "122f91b7f2906dc4", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/settings.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-94a6a5ed8dcd4211", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/reference/github-api.md"}, "properties": {"repobilityId": "7e4b6da8db319c38", "scanner": "scanner-primary", "fingerprint": "94a6a5ed8dcd4211", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/reference/github-api.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-119caaa5b87e17eb", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/commands/kubectl.md"}, "properties": {"repobilityId": "9bc4fb098813d28e", "scanner": "scanner-primary", "fingerprint": "119caaa5b87e17eb", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/commands/kubectl.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ce365ce8ae7ff940", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/commands/list-services.md"}, "properties": {"repobilityId": "e83162a4e90faddf", "scanner": "scanner-primary", "fingerprint": "ce365ce8ae7ff940", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/commands/list-services.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-42d46693e69372c6", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/commands/tf-plan.md"}, "properties": {"repobilityId": "2d40ef801b8dd1ca", "scanner": "scanner-primary", "fingerprint": "42d46693e69372c6", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/commands/tf-plan.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f9c44a4dc1323a86", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/commands/tf-apply.md"}, "properties": {"repobilityId": "a13b0b42d63e2b65", "scanner": "scanner-primary", "fingerprint": "f9c44a4dc1323a86", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/commands/tf-apply.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3475f75feec88ee3", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/agents/sev-triage.md"}, "properties": {"repobilityId": "5bd1b435915759e8", "scanner": "scanner-primary", "fingerprint": "3475f75feec88ee3", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/agents/sev-triage.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-daa5c3a4f7f597d3", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/agents/sev-historian.md"}, "properties": {"repobilityId": "ad72c34a85b9e8d1", "scanner": "scanner-primary", "fingerprint": "daa5c3a4f7f597d3", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/agents/sev-historian.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b641819d05fd2b8b", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/agents/sev-report-writer.md"}, "properties": {"repobilityId": "d0db1e2a3927e4cc", "scanner": "scanner-primary", "fingerprint": "b641819d05fd2b8b", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/agents/sev-report-writer.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f182ab6413309da6", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/agents/post-mortem.md"}, "properties": {"repobilityId": "054f14837b0fe8e1", "scanner": "scanner-primary", "fingerprint": "f182ab6413309da6", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/agents/post-mortem.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e8090bfb302ae6ab", "level": "error", "message": {"text": "Agent instruction/config may expose a secret: .claude/skills/archived/fastapi-svelte-gpu-webui/SKILL.md"}, "properties": {"repobilityId": "20372cf620357120", "scanner": "scanner-primary", "fingerprint": "e8090bfb302ae6ab", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["agent-instructions", "secrets", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/archived/fastapi-svelte-gpu-webui/SKILL.md"}, "region": {"startLine": 260}}}]}, {"ruleId": "scanner-0cb96a687281cacc", "level": "error", "message": {"text": "Agent instruction/config may expose a secret: .claude/skills/archived/music-assistant-librespot-wrong-account/SKILL.md"}, "properties": {"repobilityId": "c92415f3ad752ba8", "scanner": "scanner-primary", "fingerprint": "0cb96a687281cacc", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["agent-instructions", "secrets", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/archived/music-assistant-librespot-wrong-account/SKILL.md"}, "region": {"startLine": 71}}}]}, {"ruleId": "scanner-8c703b77081c723c", "level": "error", "message": {"text": "Agent instruction/config may expose a secret: .claude/skills/archived/proxmox-vm-disk-expansion-pitfalls/SKILL.md"}, "properties": {"repobilityId": "df98dd62583dcdc7", "scanner": "scanner-primary", "fingerprint": "8c703b77081c723c", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["agent-instructions", "secrets", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/archived/proxmox-vm-disk-expansion-pitfalls/SKILL.md"}, "region": {"startLine": 2}}}]}, {"ruleId": "scanner-e9fc7915a87306b7", "level": "warning", "message": {"text": "Agent instruction contains unpinned remote install: .claude/skills/archived/openclaw-k8s-deployment/SKILL.md"}, "properties": {"repobilityId": "a5ac489085ea5a67", "scanner": "scanner-primary", "fingerprint": "e9fc7915a87306b7", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "supply-chain", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/archived/openclaw-k8s-deployment/SKILL.md"}, "region": {"startLine": 191}}}]}, {"ruleId": "scanner-876181bf7e0ed998", "level": "error", "message": {"text": "Agent instruction/config may expose a secret: .claude/skills/archived/ingress-factory-migration/SKILL.md"}, "properties": {"repobilityId": "0a2831718016a563", "scanner": "scanner-primary", "fingerprint": "876181bf7e0ed998", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["agent-instructions", "secrets", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/archived/ingress-factory-migration/SKILL.md"}, "region": {"startLine": 42}}}]}, {"ruleId": "scanner-e209a0b426d796fc", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/skills/post-mortem/skill.md"}, "properties": {"repobilityId": "4123462491611031", "scanner": "scanner-primary", "fingerprint": "e209a0b426d796fc", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/post-mortem/skill.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-dee80847b1156d30", "level": "error", "message": {"text": "Agent instruction/config may expose a secret: .claude/skills/setup-project/SKILL.md"}, "properties": {"repobilityId": "8cc73348582945f1", "scanner": "scanner-primary", "fingerprint": "dee80847b1156d30", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["agent-instructions", "secrets", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/setup-project/SKILL.md"}, "region": {"startLine": 156}}}]}, {"ruleId": "scanner-1712c3bec155819d", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/skills/uptime-kuma/SKILL.md"}, "properties": {"repobilityId": "bb86cf90da93a116", "scanner": "scanner-primary", "fingerprint": "1712c3bec155819d", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/uptime-kuma/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-5eb2e07baaa26998", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/skills/disk-wear/SKILL.md"}, "properties": {"repobilityId": "71445165f2c25935", "scanner": "scanner-primary", "fingerprint": "5eb2e07baaa26998", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/disk-wear/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-7d5197418fd097cd", "level": "note", "message": {"text": "Stub function `log_message` (body is just `pass`/`return`) \u2014 stacks/openclaw/files/exporter.py:254"}, "properties": {"repobilityId": "b8eb13dacf91dce8", "scanner": "scanner-primary", "fingerprint": "7d5197418fd097cd", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "empty-handler", "dead-code"]}}, {"ruleId": "scanner-a4e940508bc8acfd", "level": "none", "message": {"text": "Commented-code block (5 lines) in stacks/k8s-portal/modules/k8s-portal/files/src/app.d.ts:5"}, "properties": {"repobilityId": "ed8d677bb6914209", "scanner": "scanner-primary", "fingerprint": "a4e940508bc8acfd", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-0d220a99eee72752", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 stacks/rybbit/worker/index.js:55"}, "properties": {"repobilityId": "2799de697e029a9f", "scanner": "scanner-primary", "fingerprint": "0d220a99eee72752", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-79e5d42196a569c7", "level": "none", "message": {"text": "Commented-code block (6 lines) in stacks/chrome-service/files/cdp_bridge.py:168"}, "properties": {"repobilityId": "f818c485bf85aabb", "scanner": "scanner-primary", "fingerprint": "79e5d42196a569c7", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-90da584ed6727694", "level": "none", "message": {"text": "Commented-code block (5 lines) in stacks/chrome-service/files/stealth.js:1"}, "properties": {"repobilityId": "454c4ec508d6bf10", "scanner": "scanner-primary", "fingerprint": "90da584ed6727694", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-4b94f7ec6eadf4aa", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 stacks/ytdlp/yt-highlights/app/main.py:338"}, "properties": {"repobilityId": "f11f2dbcfb609d00", "scanner": "scanner-primary", "fingerprint": "4b94f7ec6eadf4aa", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-41ae0208e0993b9a", "level": "note", "message": {"text": "Legacy-named symbol `stalled_old` in stacks/servarr/mam-farming/files/mam-farming-janitor.py:33"}, "properties": {"repobilityId": "52afbccf6c242d1c", "scanner": "scanner-primary", "fingerprint": "41ae0208e0993b9a", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-ce8f3dbb0c5915c5", "level": "none", "message": {"text": "Commented-code block (5 lines) in stacks/servarr/mam-farming/files/freeleech-grabber.py:35"}, "properties": {"repobilityId": "6f94f569ab6fc857", "scanner": "scanner-primary", "fingerprint": "ce8f3dbb0c5915c5", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-4b6387f961ef43aa", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 stacks/servarr/mam-farming/files/freeleech-grabber.py:231"}, "properties": {"repobilityId": "a2203fb7f5cc712d", "scanner": "scanner-primary", "fingerprint": "4b6387f961ef43aa", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-3c4ad4fc02c1ddd8", "level": "note", "message": {"text": "Stub function `log_message` (body is just `pass`/`return`) \u2014 stacks/kms/files/slack-notifier.py:232"}, "properties": {"repobilityId": "71b59feb866f3318", "scanner": "scanner-primary", "fingerprint": "3c4ad4fc02c1ddd8", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "empty-handler", "dead-code"]}}, {"ruleId": "scanner-bfe76eb3f3eb7dd0", "level": "note", "message": {"text": "Stub function `log_message` (body is just `pass`/`return`) \u2014 stacks/kms/files/diag-collector.py:29"}, "properties": {"repobilityId": "4af5cff1c5d8e77d", "scanner": "scanner-primary", "fingerprint": "bfe76eb3f3eb7dd0", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "empty-handler", "dead-code"]}}, {"ruleId": "scanner-7d0943c73e3cea9d", "level": "none", "message": {"text": "Commented-code block (10 lines) in stacks/t3-afk/files/dispatcher.js:1"}, "properties": {"repobilityId": "1ee8e1ec5f652013", "scanner": "scanner-primary", "fingerprint": "7d0943c73e3cea9d", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-ab47207216680100", "level": "note", "message": {"text": "Stub function `close` (body is just `pass`/`return`) \u2014 stacks/t3code/probe.py:83"}, "properties": {"repobilityId": "34f5cb1c76b2107d", "scanner": "scanner-primary", "fingerprint": "ab47207216680100", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "empty-handler", "dead-code"]}}, {"ruleId": "scanner-e0e1025bd37b7ca8", "level": "note", "message": {"text": "Legacy-named symbol `api_v1` in scripts/cluster_manager.py:96"}, "properties": {"repobilityId": "cf700ef6dbffc6e8", "scanner": "scanner-primary", "fingerprint": "e0e1025bd37b7ca8", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-00fc23ffecb5364a", "level": "note", "message": {"text": "Stub function `cli` (body is just `pass`/`return`) \u2014 scripts/cluster_manager.py:152"}, "properties": {"repobilityId": "13c6a7dba56993d8", "scanner": "scanner-primary", "fingerprint": "00fc23ffecb5364a", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "empty-handler", "dead-code"]}}, {"ruleId": "scanner-6ba80825acb9a534", "level": "none", "message": {"text": "Commented-code block (7 lines) in scripts/frigate-bulk-classify.js:5"}, "properties": {"repobilityId": "480816291db42e75", "scanner": "scanner-primary", "fingerprint": "6ba80825acb9a534", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-3c9bf6879d8bca05", "level": "none", "message": {"text": "Commented-code block (5 lines) in scripts/gen_service_stacks.py:8"}, "properties": {"repobilityId": "4a7a11f0d2bf9aa6", "scanner": "scanner-primary", "fingerprint": "3c9bf6879d8bca05", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-cd293464d8ad4038", "level": "note", "message": {"text": "Legacy-named symbol `cmd_backup` in .claude/pfsense.py:222"}, "properties": {"repobilityId": "cd899ba5748a2f09", "scanner": "scanner-primary", "fingerprint": "cd293464d8ad4038", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "2daa5e52eb648331", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "259c96f62e4284c6", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "ff4dff47b96f843f", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "b3a4d45dab889185", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "8f76ff657ab1604a", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "f121573c40bde6b0", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "ced805427a361353", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "5bb08ddd88cb022a", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "bb700fdc8cda5ade", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-be46ea126aa5d8dc", "level": "note", "message": {"text": "Near-duplicate function bodies in 3 places"}, "properties": {"repobilityId": "ba1b82bf30d90a88", "scanner": "scanner-primary", "fingerprint": "be46ea126aa5d8dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "4d3e6538d2e61fd1", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "c43f590da3f87928", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-49c98f7cedd9c977", "level": "note", "message": {"text": "Near-duplicate function bodies in 4 places"}, "properties": {"repobilityId": "8ac90364add4fc7c", "scanner": "scanner-primary", "fingerprint": "49c98f7cedd9c977", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "03279ad30213773c", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "e09ad6a8586db2ae", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "8097f95db83a7e82", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "ce37ff397e52eb6c", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "4fb2490cc02cf1ce", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "02c03b1cdce9bdb2", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "474889569a38dc71", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-e38bd2c3e82e8d02", "level": "error", "message": {"text": "FastAPI POST `process` without auth dependency \u2014 stacks/ytdlp/yt-highlights/app/main.py:1019"}, "properties": {"repobilityId": "7663b400f32ec3ae", "scanner": "scanner-primary", "fingerprint": "e38bd2c3e82e8d02", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "stacks/ytdlp/yt-highlights/app/main.py"}, "region": {"startLine": 1019}}}]}, {"ruleId": "scanner-1fe32b026e12ba63", "level": "error", "message": {"text": "FastAPI DELETE `delete_job` without auth dependency \u2014 stacks/ytdlp/yt-highlights/app/main.py:1069"}, "properties": {"repobilityId": "dea58b55f0dce721", "scanner": "scanner-primary", "fingerprint": "1fe32b026e12ba63", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "stacks/ytdlp/yt-highlights/app/main.py"}, "region": {"startLine": 1069}}}]}, {"ruleId": "scanner-c71c61811217ccff", "level": "error", "message": {"text": "FastAPI POST `add_channel` without auth dependency \u2014 stacks/ytdlp/yt-highlights/app/main.py:1126"}, "properties": {"repobilityId": "dc9ae98f835a60c5", "scanner": "scanner-primary", "fingerprint": "c71c61811217ccff", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "stacks/ytdlp/yt-highlights/app/main.py"}, "region": {"startLine": 1126}}}]}, {"ruleId": "scanner-98987098015272e2", "level": "error", "message": {"text": "FastAPI DELETE `remove_channel` without auth dependency \u2014 stacks/ytdlp/yt-highlights/app/main.py:1160"}, "properties": {"repobilityId": "65fb9e350eb3e10e", "scanner": "scanner-primary", "fingerprint": "98987098015272e2", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "stacks/ytdlp/yt-highlights/app/main.py"}, "region": {"startLine": 1160}}}]}, {"ruleId": "scanner-372745d8b2ce0b9b", "level": "error", "message": {"text": "FastAPI POST `migrate_channels` without auth dependency \u2014 stacks/ytdlp/yt-highlights/app/main.py:1172"}, "properties": {"repobilityId": "a6587af1d9d46cf9", "scanner": "scanner-primary", "fingerprint": "372745d8b2ce0b9b", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "stacks/ytdlp/yt-highlights/app/main.py"}, "region": {"startLine": 1172}}}]}, {"ruleId": "scanner-e95c9f88229ec22e", "level": "error", "message": {"text": "FastAPI POST `check_new_videos` without auth dependency \u2014 stacks/ytdlp/yt-highlights/app/main.py:1205"}, "properties": {"repobilityId": "e6ae57d41b5a5f78", "scanner": "scanner-primary", "fingerprint": "e95c9f88229ec22e", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "stacks/ytdlp/yt-highlights/app/main.py"}, "region": {"startLine": 1205}}}]}, {"ruleId": "scanner-b568eecabe03ec8a", "level": "error", "message": {"text": "FastAPI POST `auto_process` without auth dependency \u2014 stacks/ytdlp/yt-highlights/app/main.py:1275"}, "properties": {"repobilityId": "8023776c8a378e3f", "scanner": "scanner-primary", "fingerprint": "b568eecabe03ec8a", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "stacks/ytdlp/yt-highlights/app/main.py"}, "region": {"startLine": 1275}}}]}, {"ruleId": "scanner-fd278a3c91aa5b3c", "level": "note", "message": {"text": "Unused endpoint: POST /process"}, "properties": {"repobilityId": "651a9535a6bc6711", "scanner": "scanner-primary", "fingerprint": "fd278a3c91aa5b3c", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-66bddf72c96b3ab4", "level": "note", "message": {"text": "Unused endpoint: GET /results/{job_id}"}, "properties": {"repobilityId": "4ec15f66fcf58158", "scanner": "scanner-primary", "fingerprint": "66bddf72c96b3ab4", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-6d0b60cfd130dc4c", "level": "note", "message": {"text": "Unused endpoint: DELETE /jobs/{job_id}"}, "properties": {"repobilityId": "d08c4f8e62ab1d7a", "scanner": "scanner-primary", "fingerprint": "6d0b60cfd130dc4c", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-e0b9bdc04b58bea3", "level": "note", "message": {"text": "Unused endpoint: GET /channels"}, "properties": {"repobilityId": "f0efa7818e9eded8", "scanner": "scanner-primary", "fingerprint": "e0b9bdc04b58bea3", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-14a78266393888c7", "level": "note", "message": {"text": "Unused endpoint: POST /channels"}, "properties": {"repobilityId": "3dc91f84f54b7c74", "scanner": "scanner-primary", "fingerprint": "14a78266393888c7", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-7bf87051e7102a17", "level": "note", "message": {"text": "Unused endpoint: DELETE /channels/{channel_id}"}, "properties": {"repobilityId": "47849f3f6189556b", "scanner": "scanner-primary", "fingerprint": "7bf87051e7102a17", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-ec05e763c1c4f327", "level": "note", "message": {"text": "Unused endpoint: POST /channels/migrate"}, "properties": {"repobilityId": "0f715851b8362b71", "scanner": "scanner-primary", "fingerprint": "ec05e763c1c4f327", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-53d1bff3c2772782", "level": "note", "message": {"text": "Unused endpoint: POST /check-new"}, "properties": {"repobilityId": "80287dc3c025c0f9", "scanner": "scanner-primary", "fingerprint": "53d1bff3c2772782", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-1008c575819b3d37", "level": "note", "message": {"text": "Unused endpoint: GET /jobs"}, "properties": {"repobilityId": "57bfaab6044169d1", "scanner": "scanner-primary", "fingerprint": "1008c575819b3d37", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-9ced535873546562", "level": "note", "message": {"text": "Unused endpoint: GET /processed"}, "properties": {"repobilityId": "d895a5dc85c96e59", "scanner": "scanner-primary", "fingerprint": "9ced535873546562", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-27172c806590591e", "level": "note", "message": {"text": "Unused endpoint: POST /auto-process"}, "properties": {"repobilityId": "e5f8fd8893b94c72", "scanner": "scanner-primary", "fingerprint": "27172c806590591e", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-5baa8971ebe192a1", "level": "note", "message": {"text": "Unused endpoint: GET /"}, "properties": {"repobilityId": "bedf0f66f1c67108", "scanner": "scanner-primary", "fingerprint": "5baa8971ebe192a1", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}]}]}