{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-e2f0fbd6e80df80f", "name": "Possibly dead Python function: list_ids", "shortDescription": {"text": "Possibly dead Python function: list_ids"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3bb71445a48a42f8", "name": "Stray `console.log` in TS/JS \u2014 check_divisions.js:29", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 check_divisions.js:29"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a68a02192032a042", "name": "Stray `console.log` in TS/JS \u2014 check_lesson_divs.js:29", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 check_lesson_divs.js:29"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d27fa944c257a67c", "name": "Stray `console.log` in TS/JS \u2014 check_class_conflicts.js:21", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 check_class_conflicts.js:21"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e4cad4c890eb8cb2", "name": "Stray `console.log` in TS/JS \u2014 js/solver/csp_solver.js:4669", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 js/solver/csp_solver.js:4669"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8f61493c6da76124", "name": "Stray `console.log` in TS/JS \u2014 js/solver/__tests__/audit_regression.test.js:33", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 js/solver/__tests__/audit_regression.test.js:33"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-71179edcf96ba60b", "name": "Stray `console.log` in TS/JS \u2014 js/solver/__tests__/fixes_2026-06-11.test.js:27", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 js/solver/__tests__/fixes_2026-06-11.test.js:27"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d9e6b6c79d6e0a38", "name": "Icon-only button without accessible name \u2014 js/ui/pwa_install.js:46", "shortDescription": {"text": "Icon-only button without accessible name \u2014 js/ui/pwa_install.js:46"}, "fullDescription": {"text": "A `<button>` whose only child is a single glyph or symbol needs `title=` or `aria-label=` so screen readers (and tooltips on hover) work.\n\nWhy: P3 in CHECKLIST.md \u2014 icon-only buttons skipped a title.\nRule id: fq.button.no-label"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7ca343684f116156", "name": "Icon-only button without accessible name \u2014 js/ui/inspector.js:32", "shortDescription": {"text": "Icon-only button without accessible name \u2014 js/ui/inspector.js:32"}, "fullDescription": {"text": "A `<button>` whose only child is a single glyph or symbol needs `title=` or `aria-label=` so screen readers (and tooltips on hover) work.\n\nWhy: P3 in CHECKLIST.md \u2014 icon-only buttons skipped a title.\nRule id: fq.button.no-label"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fde1ed0f4f595cb6", "name": "Stray `console.log` in TS/JS \u2014 js/ui/main.js:284", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 js/ui/main.js:284"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c3fdee91beb88b4c", "name": "Stray `console.log` in TS/JS \u2014 js/ui/editor/row_context_menu.js:27", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 js/ui/editor/row_context_menu.js:27"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3a88043c14602e3e", "name": "Stray `console.log` in TS/JS \u2014 js/ui/editor/card_context_menu.js:25", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 js/ui/editor/card_context_menu.js:25"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ee185e914e4de093", "name": "Stray `console.log` in TS/JS \u2014 js/ui/solver_ui/backend_client.js:129", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 js/ui/solver_ui/backend_client.js:129"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5bf9c0115150b881", "name": "Stray `console.log` in TS/JS \u2014 js/ui/solver_ui/multi_branch.js:106", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 js/ui/solver_ui/multi_branch.js:106"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-980f320706bddbcd", "name": "Stray `console.log` in TS/JS \u2014 benchmarks/run_benchmark.js:8", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 benchmarks/run_benchmark.js:8"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c188695566560f3c", "name": "Stray `console.log` in TS/JS \u2014 benchmarks/generate_large_realistic.js:3", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 benchmarks/generate_large_realistic.js:3"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-655038b3cfba19f0", "name": "Stray `console.log` in TS/JS \u2014 benchmarks/run_real_xml.js:18", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 benchmarks/run_real_xml.js:18"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-714c31ca9f474ae6", "name": "Docker base image is tag-pinned but not digest-pinned: python:3.12-slim", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: python:3.12-slim"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-40f3633109c63579", "name": "Insecure pattern 'direct_innerhtml_assignment' in index.html:512", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in index.html:512"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b40e1dbe3592c59c", "name": "Insecure pattern 'direct_innerhtml_assignment' in js/solver/__tests__/solver.test.html:204", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/solver/__tests__/solver.test.html:204"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ed199f6129ed75f5", "name": "Insecure pattern 'direct_innerhtml_assignment' in js/ui/class_grid.js:9", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/ui/class_grid.js:9"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-990cee7e35b49df6", "name": "Insecure pattern 'direct_innerhtml_assignment' in js/ui/grid_view.js:85", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/ui/grid_view.js:85"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7798f7a1f647229e", "name": "Insecure pattern 'direct_innerhtml_assignment' in js/ui/shell_v3.js:77", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/ui/shell_v3.js:77"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7a9f374f28f95011", "name": "Insecure pattern 'direct_innerhtml_assignment' in js/ui/pwa_install.js:37", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/ui/pwa_install.js:37"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ef3810bdccc8c757", "name": "Insecure pattern 'direct_innerhtml_assignment' in js/ui/school_info.js:23", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/ui/school_info.js:23"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6c65e36c7f3d48dd", "name": "Insecure pattern 'direct_innerhtml_assignment' in js/ui/inspector.js:28", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/ui/inspector.js:28"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-de3b9d4bd93de710", "name": "Insecure pattern 'direct_innerhtml_assignment' in js/ui/teacher_grid.js:9", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/ui/teacher_grid.js:9"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c699ec487478e656", "name": "Insecure pattern 'direct_innerhtml_assignment' in js/ui/room_grid.js:16", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/ui/room_grid.js:16"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-affc91c1fdcc5146", "name": "Insecure pattern 'direct_innerhtml_assignment' in js/ui/start_screen.js:67", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/ui/start_screen.js:67"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c8b7513dce9295ed", "name": "Insecure pattern 'direct_innerhtml_assignment' in js/ui/entity_router.js:63", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/ui/entity_router.js:63"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d92e8c5343ff0154", "name": "Insecure pattern 'direct_innerhtml_assignment' in js/ui/main.js:18", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/ui/main.js:18"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4c5f3257d0fa453b", "name": "Insecure pattern 'direct_innerhtml_assignment' in js/ui/wizard/wizard_walkthrough.js:141", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/ui/wizard/wizard_walkthrough.js:141"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ad9487671b6cbe30", "name": "Insecure pattern 'direct_innerhtml_assignment' in js/ui/ribbon/topbar.js:14", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/ui/ribbon/topbar.js:14"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c121204318984db0", "name": "Insecure pattern 'direct_innerhtml_assignment' in js/ui/ribbon/menus/help_menu.js:12", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/ui/ribbon/menus/help_menu.js:12"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-115c7436b07fc295", "name": "Insecure pattern 'direct_innerhtml_assignment' in js/ui/print_preview/print_preview.js:29", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/ui/print_preview/print_preview.js:29"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-82bef0f77a35d48f", "name": "Insecure pattern 'direct_innerhtml_assignment' in js/ui/components/palette.js:43", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/ui/components/palette.js:43"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-16fd97af70622d94", "name": "Insecure pattern 'direct_innerhtml_assignment' in js/ui/components/stats.js:57", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/ui/components/stats.js:57"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8ee72f2c95d32793", "name": "Insecure pattern 'direct_innerhtml_assignment' in js/ui/components/school_hub.js:62", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/ui/components/school_hub.js:62"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2e910b6858f7a7ac", "name": "Insecure pattern 'direct_innerhtml_assignment' in js/ui/components/color_taxonomy.js:126", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/ui/components/color_taxonomy.js:126"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a9fde81e078bbb32", "name": "Insecure pattern 'direct_innerhtml_assignment' in js/ui/components/command_palette.js:221", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/ui/components/command_palette.js:221"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6015d62de56e1d4a", "name": "Insecure pattern 'direct_innerhtml_assignment' in js/ui/components/auto_save.js:117", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/ui/components/auto_save.js:117"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e9feb075dfe5b8fd", "name": "Insecure pattern 'direct_innerhtml_assignment' in js/ui/components/ai_actions.js:119", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/ui/components/ai_actions.js:119"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e19f2df4e9359824", "name": "Insecure pattern 'direct_innerhtml_assignment' in js/ui/components/inspector.js:44", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/ui/components/inspector.js:44"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-28dae41bae45a837", "name": "Insecure pattern 'direct_innerhtml_assignment' in js/ui/components/period_override_matrix.js:30", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/ui/components/period_override_matrix.js:30"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0487ccdd83f32fe0", "name": "Insecure pattern 'direct_innerhtml_assignment' in js/ui/components/divisions_tree.js:48", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/ui/components/divisions_tree.js:48"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d36453560838fa97", "name": "Insecure pattern 'direct_innerhtml_assignment' in js/ui/components/help_center.js:149", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/ui/components/help_center.js:149"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ae5ca170a0ca2070", "name": "Insecure pattern 'direct_innerhtml_assignment' in js/ui/components/verification_panel_pro.js:102", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/ui/components/verification_panel_pro.js:102"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ab70e75ccac6ebbc", "name": "Insecure pattern 'direct_innerhtml_assignment' in js/ui/components/school_toolbar.js:63", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/ui/components/school_toolbar.js:63"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ccabdfb3b4e9b044", "name": "Insecure pattern 'direct_innerhtml_assignment' in js/ui/components/verification.js:109", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/ui/components/verification.js:109"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-297cf7291578f643", "name": "Insecure pattern 'direct_innerhtml_assignment' in js/ui/editor/activator.js:33", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/ui/editor/activator.js:33"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-97738e4751f64bf3", "name": "Insecure pattern 'direct_innerhtml_assignment' in js/ui/editor/constraint_explainer.js:226", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/ui/editor/constraint_explainer.js:226"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d573b73f1511f62c", "name": "Insecure pattern 'direct_innerhtml_assignment' in js/ui/editor/focus_mode.js:218", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/ui/editor/focus_mode.js:218"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-fffe7c5e2bc53ac3", "name": "Insecure pattern 'direct_innerhtml_assignment' in js/ui/editor/row_context_menu.js:206", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/ui/editor/row_context_menu.js:206"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1fea7820e4d8a472", "name": "Insecure pattern 'direct_innerhtml_assignment' in js/ui/editor/card_context_menu.js:191", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/ui/editor/card_context_menu.js:191"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e25c132ac85e4e03", "name": "Insecure pattern 'direct_innerhtml_assignment' in js/ui/editor/card_in_hand.js:58", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/ui/editor/card_in_hand.js:58"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-5754de368dabcb8d", "name": "Insecure pattern 'direct_innerhtml_assignment' in js/ui/editor/pending_strip.js:21", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/ui/editor/pending_strip.js:21"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-97c9174015039737", "name": "Insecure pattern 'direct_innerhtml_assignment' in js/ui/editor/grid_canvas.js:19", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/ui/editor/grid_canvas.js:19"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-98a1c6a387ae1469", "name": "Insecure pattern 'direct_innerhtml_assignment' in js/ui/io/snapshots.js:85", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/ui/io/snapshots.js:85"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9e748c103a06170f", "name": "Insecure pattern 'direct_innerhtml_assignment' in js/ui/entities/weeks.js:74", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/ui/entities/weeks.js:74"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4d82f2b2388f4d96", "name": "Insecure pattern 'direct_innerhtml_assignment' in js/ui/entities/terms.js:71", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/ui/entities/terms.js:71"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b8ebfa8c523890c2", "name": "Insecure pattern 'direct_innerhtml_assignment' in js/ui/entities/lessons.js:225", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/ui/entities/lessons.js:225"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a5fe94841779d4b8", "name": "Insecure pattern 'direct_innerhtml_assignment' in js/ui/entities/teachers.js:128", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/ui/entities/teachers.js:128"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ac653dad9f1b6c4e", "name": "Insecure pattern 'direct_innerhtml_assignment' in js/ui/entities/classes.js:100", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/ui/entities/classes.js:100"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2e887c70f25ce9e1", "name": "Insecure pattern 'direct_innerhtml_assignment' in js/ui/entities/dialog_shell.js:51", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/ui/entities/dialog_shell.js:51"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-be2eefb7c84013f9", "name": "Insecure pattern 'direct_innerhtml_assignment' in js/ui/entities/subjects.js:227", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/ui/entities/subjects.js:227"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7f0bf783995c93c1", "name": "Insecure pattern 'direct_innerhtml_assignment' in js/ui/entities/relations.js:311", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/ui/entities/relations.js:311"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2641d3d82bf6d369", "name": "Insecure pattern 'direct_innerhtml_assignment' in js/ui/entities/bells.js:99", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/ui/entities/bells.js:99"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-deb8a02c1856b4f6", "name": "Insecure pattern 'direct_innerhtml_assignment' in js/ui/onboarding/wiring.js:83", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/ui/onboarding/wiring.js:83"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-54487397c0e905a0", "name": "Insecure pattern 'direct_innerhtml_assignment' in js/ui/onboarding/tour.js:53", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/ui/onboarding/tour.js:53"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e200b11dcd77beac", "name": "Insecure pattern 'direct_innerhtml_assignment' in js/ui/onboarding/smart_defaults.js:111", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/ui/onboarding/smart_defaults.js:111"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b903fb0ff0f82fec", "name": "Insecure pattern 'direct_innerhtml_assignment' in js/ui/substitution/classwise_output.js:35", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/ui/substitution/classwise_output.js:35"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6efce10d8b7181f9", "name": "Insecure pattern 'direct_innerhtml_assignment' in js/ui/substitution/print_memo.js:32", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/ui/substitution/print_memo.js:32"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-538eb390fd222c7a", "name": "Insecure pattern 'direct_innerhtml_assignment' in js/ui/substitution/absence_input.js:20", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/ui/substitution/absence_input.js:20"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-696277a632d26cb3", "name": "Insecure pattern 'direct_innerhtml_assignment' in js/ui/substitution/teacherwise_output.js:18", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/ui/substitution/teacherwise_output.js:18"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a70fc625ae3589dd", "name": "Insecure pattern 'direct_innerhtml_assignment' in js/ui/substitution/main.js:60", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/ui/substitution/main.js:60"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4fd9e6003d5fd906", "name": "Insecure pattern 'direct_innerhtml_assignment' in js/ui/solver_ui/progress_modal.js:218", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/ui/solver_ui/progress_modal.js:218"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0cefbe02ad230143", "name": "Insecure pattern 'direct_innerhtml_assignment' in js/ui/solver_ui/result_panel.js:83", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/ui/solver_ui/result_panel.js:83"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-37ff50d7972e945b", "name": "Insecure pattern 'node_child_process' in tools/ab_lns.mjs:5", "shortDescription": {"text": "Insecure pattern 'node_child_process' in tools/ab_lns.mjs:5"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-83f1633ed3bc4377", "name": "Insecure pattern 'node_child_process' in tools/sim_ui_generate.mjs:12", "shortDescription": {"text": "Insecure pattern 'node_child_process' in tools/sim_ui_generate.mjs:12"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6372cebde0220094", "name": "No auth library detected", "shortDescription": {"text": "No auth library detected"}, "fullDescription": {"text": "The scanner did not find any standard auth library (JWT, OAuth, NextAuth, Auth0, etc.). The repo has auth/admin/session surface indicators, so auth may live in custom code, in a separate service, or be missing."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1838a141491ce38c", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-65141922bbebdb19", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "docker/setup-buildx-action@v3 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2d9341095719452a", "name": "Very large file: js/solver/csp_solver.js (5339 lines)", "shortDescription": {"text": "Very large file: js/solver/csp_solver.js (5339 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6a1fb9700ea857c6", "name": "Very large file: js/ui/entities/lessons.js (1405 lines)", "shortDescription": {"text": "Very large file: js/ui/entities/lessons.js (1405 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ea3b5e389d8c9c0f", "name": "Low test-to-source ratio", "shortDescription": {"text": "Low test-to-source ratio"}, "fullDescription": {"text": "25 tests / 216 src (ratio 0.12)."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-141b30a41e03817b", "name": "No license file detected", "shortDescription": {"text": "No license file detected"}, "fullDescription": {"text": "No LICENSE/COPYING/NOTICE file was found. Generated repositories often omit licensing, which blocks reuse and automated intake."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-240c7a932d3912bf", "name": "Node manifest has dependencies but no lockfile: js/solver/wasm/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: js/solver/wasm/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 334 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-72b2a6250083a784", "name": "Placeholder or mock-heavy implementation detected", "shortDescription": {"text": "Placeholder or mock-heavy implementation detected"}, "fullDescription": {"text": "Found 60 placeholder/mock markers across 36 source files. This often means the repo looks complete while core flows still use generated scaffolding or fake data."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b9088664ace7f748", "name": "Composite production-readiness gap", "shortDescription": {"text": "Composite production-readiness gap"}, "fullDescription": {"text": "Multiple low-cost hardening controls are missing together: license, lockfile. Opus verification showed these co-occurring gaps are a better readiness signal than reading each flag in isolation."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e33659ff7126f341", "name": "Network/subprocess call without timeout or try/except \u2014 check_logs_runner.py:3", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 check_logs_runner.py:3"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-32621c0cb81f27bf", "name": "Network/subprocess call without timeout or try/except \u2014 runner_repro.py:3", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 runner_repro.py:3"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b8d4f491676ce159", "name": "Network/subprocess call without timeout or try/except \u2014 runner.py:3", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 runner.py:3"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-67eebe7a1c3a037f", "name": "Network/subprocess call without timeout or try/except \u2014 runner_new.py:3", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 runner_new.py:3"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3cbd839d76d1fa6a", "name": "Commented-code block (5 lines) in js/solver/bitmask.js:3", "shortDescription": {"text": "Commented-code block (5 lines) in js/solver/bitmask.js:3"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-1ff19343b64a1818", "name": "Commented-code block (5 lines) in js/solver/worker.js:3", "shortDescription": {"text": "Commented-code block (5 lines) in js/solver/worker.js:3"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-5024b893d93e5d16", "name": "Commented-code block (7 lines) in js/solver/constraints.js:179", "shortDescription": {"text": "Commented-code block (7 lines) in js/solver/constraints.js:179"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-aa30f68efe8522bc", "name": "Commented-code block (11 lines) in js/solver/csp_solver.js:3", "shortDescription": {"text": "Commented-code block (11 lines) in js/solver/csp_solver.js:3"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-e949053303d02276", "name": "Commented-code block (5 lines) in js/solver/wasm/csp_wasm.js:9", "shortDescription": {"text": "Commented-code block (5 lines) in js/solver/wasm/csp_wasm.js:9"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-a2c73bdbd4e60327", "name": "`fetch()` without try/.catch or AbortSignal \u2014 js/solver/wasm/csp_wasm.js:31", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 js/solver/wasm/csp_wasm.js:31"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a9bc1d223a5df6d1", "name": "Commented-code block (5 lines) in js/solver/wasm/loader.js:13", "shortDescription": {"text": "Commented-code block (5 lines) in js/solver/wasm/loader.js:13"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-da10497629bc86ef", "name": "Commented-code block (12 lines) in js/solver/__tests__/audit_regression.test.js:5", "shortDescription": {"text": "Commented-code block (12 lines) in js/solver/__tests__/audit_regression.test.js:5"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-5420319fadcf50c3", "name": "Commented-code block (11 lines) in js/solver/__tests__/fixes_2026-06-11.test.js:4", "shortDescription": {"text": "Commented-code block (11 lines) in js/solver/__tests__/fixes_2026-06-11.test.js:4"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-e8bce92e9e81abf4", "name": "Commented-code block (8 lines) in js/xml/parse_timetable_xml.js:61", "shortDescription": {"text": "Commented-code block (8 lines) in js/xml/parse_timetable_xml.js:61"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-c225b7d8947f2175", "name": "Commented-code block (5 lines) in js/ui/multi_doc_tabs.js:65", "shortDescription": {"text": "Commented-code block (5 lines) in js/ui/multi_doc_tabs.js:65"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-31e03b58e6754646", "name": "Legacy-named symbol `clickLegacy` in js/ui/shell_v3.js:116", "shortDescription": {"text": "Legacy-named symbol `clickLegacy` in js/ui/shell_v3.js:116"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cd83ca4813d44769", "name": "Commented-code block (9 lines) in js/ui/pwa_install.js:88", "shortDescription": {"text": "Commented-code block (9 lines) in js/ui/pwa_install.js:88"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-5120cdb0ef236d3f", "name": "Commented-code block (7 lines) in js/ui/print_preview/print_preview.js:386", "shortDescription": {"text": "Commented-code block (7 lines) in js/ui/print_preview/print_preview.js:386"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-7f9641bf95f8838b", "name": "Commented-code block (5 lines) in js/ui/print_preview/templates/_helpers.js:78", "shortDescription": {"text": "Commented-code block (5 lines) in js/ui/print_preview/templates/_helpers.js:78"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-4cb281ebf9b0080e", "name": "Commented-code block (6 lines) in js/ui/components/divisions_tree.js:181", "shortDescription": {"text": "Commented-code block (6 lines) in js/ui/components/divisions_tree.js:181"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-f8d9dc437e4d9c30", "name": "Commented-code block (8 lines) in js/ui/editor/canvas_geometry.js:66", "shortDescription": {"text": "Commented-code block (8 lines) in js/ui/editor/canvas_geometry.js:66"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-c9531e7a540bcc9a", "name": "Commented-code block (6 lines) in js/ui/editor/card_in_hand.js:118", "shortDescription": {"text": "Commented-code block (6 lines) in js/ui/editor/card_in_hand.js:118"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-7536a6ae1f7470dc", "name": "Commented-code block (5 lines) in js/ui/editor/grid_canvas.js:317", "shortDescription": {"text": "Commented-code block (5 lines) in js/ui/editor/grid_canvas.js:317"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-0f244ecbb793958f", "name": "Commented-code block (6 lines) in js/ui/io/export_excel.js:108", "shortDescription": {"text": "Commented-code block (6 lines) in js/ui/io/export_excel.js:108"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-f08a644f87711fca", "name": "Commented-code block (6 lines) in js/ui/io/import_cardrelationships_har.js:62", "shortDescription": {"text": "Commented-code block (6 lines) in js/ui/io/import_cardrelationships_har.js:62"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-243eb88f43e82208", "name": "Commented-code block (8 lines) in js/ui/entities/classrooms.js:62", "shortDescription": {"text": "Commented-code block (8 lines) in js/ui/entities/classrooms.js:62"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-bac1905d83488c7f", "name": "Commented-code block (5 lines) in js/ui/entities/dialog_shell.js:531", "shortDescription": {"text": "Commented-code block (5 lines) in js/ui/entities/dialog_shell.js:531"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-b923b98b7540695a", "name": "Commented-code block (5 lines) in js/ui/entities/relations.js:377", "shortDescription": {"text": "Commented-code block (5 lines) in js/ui/entities/relations.js:377"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-e04009812cb56eba", "name": "Commented-code block (6 lines) in js/ui/onboarding/smart_defaults.js:55", "shortDescription": {"text": "Commented-code block (6 lines) in js/ui/onboarding/smart_defaults.js:55"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-a47948e9ff6e03c7", "name": "`fetch()` without try/.catch or AbortSignal \u2014 js/ui/solver_ui/backend_client.js:219", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 js/ui/solver_ui/backend_client.js:219"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1e389dc990813e1c", "name": "Commented-code block (5 lines) in js/ui/solver_ui/test_dialog.js:87", "shortDescription": {"text": "Commented-code block (5 lines) in js/ui/solver_ui/test_dialog.js:87"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-6db878b11d18d8e8", "name": "Commented-code block (5 lines) in backend/app/solver.py:245", "shortDescription": {"text": "Commented-code block (5 lines) in backend/app/solver.py:245"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-9800635315ec7fe5", "name": "Commented-code block (7 lines) in tools/test_remove_single_probe.mjs:79", "shortDescription": {"text": "Commented-code block (7 lines) in tools/test_remove_single_probe.mjs:79"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-96eddb8b8db153d6", "name": "Commented-code block (6 lines) in tools/test_multisession_lesson_lock.mjs:1", "shortDescription": {"text": "Commented-code block (6 lines) in tools/test_multisession_lesson_lock.mjs:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-9457fa0155208eb5", "name": "Commented-code block (5 lines) in tools/smoke_wasm_canplace.mjs:1", "shortDescription": {"text": "Commented-code block (5 lines) in tools/smoke_wasm_canplace.mjs:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-04a68cf5228c8315", "name": "Commented-code block (5 lines) in tools/test_editor_pickup_lifecycle.mjs:5", "shortDescription": {"text": "Commented-code block (5 lines) in tools/test_editor_pickup_lifecycle.mjs:5"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-76e831c4d8437ae8", "name": "Commented-code block (5 lines) in tools/run_baseline.mjs:12", "shortDescription": {"text": "Commented-code block (5 lines) in tools/run_baseline.mjs:12"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-e99c7c49c5019599", "name": "Commented-code block (7 lines) in tools/test_remove_single_div_match.mjs:35", "shortDescription": {"text": "Commented-code block (7 lines) in tools/test_remove_single_div_match.mjs:35"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-6a4bb38a6b84704f", "name": "Commented-code block (5 lines) in tools/test_class_conflict_group_aware.mjs:1", "shortDescription": {"text": "Commented-code block (5 lines) in tools/test_class_conflict_group_aware.mjs:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-f3114358e6d683df", "name": "Commented-code block (6 lines) in tools/evaluate_asc.mjs:5", "shortDescription": {"text": "Commented-code block (6 lines) in tools/evaluate_asc.mjs:5"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-bbd348654cc76e28", "name": "Commented-code block (6 lines) in tools/test_division_aware_conflict.mjs:1", "shortDescription": {"text": "Commented-code block (6 lines) in tools/test_division_aware_conflict.mjs:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-89a944cd5c7a6232", "name": "Commented-code block (6 lines) in tools/test_codex_fixes.mjs:1", "shortDescription": {"text": "Commented-code block (6 lines) in tools/test_codex_fixes.mjs:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-973c6f8f693354b0", "name": "Commented-code block (5 lines) in tools/test_no_double_booking.mjs:1", "shortDescription": {"text": "Commented-code block (5 lines) in tools/test_no_double_booking.mjs:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-a2589e163771771a", "name": "Commented-code block (6 lines) in tools/test_print_pivot_dims.mjs:1", "shortDescription": {"text": "Commented-code block (6 lines) in tools/test_print_pivot_dims.mjs:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-cc0f9d8e41b33b0e", "name": "11 env vars used in code but missing from .env.example", "shortDescription": {"text": "11 env vars used in code but missing from .env.example"}, "fullDescription": {"text": "Drift between code and config docs. The first few: `AB_CHILD`, `AB_LNS`, `AB_SEED`, `AB_TIME`, `CHRONEXA_SIM_CHILD`, `CHRONEXA_SIM_REPO`, `CHRONEXA_SIM_SEED`, `CHRONEXA_SIM_STAG` + 3 more. Add them (with a placeholder/comment) to .env.example so onboarding doesn't break."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2c04133e54348533", "name": "Near-duplicate function bodies in 2 places", "shortDescription": {"text": "Near-duplicate function bodies in 2 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nbackend/app/jobs.py:cancel_requested, backend/app/jobs.py:cancel\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2104533c28a880e7", "name": "FastAPI POST `solve` without auth dependency \u2014 backend/app/main.py:327", "shortDescription": {"text": "FastAPI POST `solve` without auth dependency \u2014 backend/app/main.py:327"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-a390655e55db0cd5", "name": "FastAPI POST `solve_start` without auth dependency \u2014 backend/app/main.py:341", "shortDescription": {"text": "FastAPI POST `solve_start` without auth dependency \u2014 backend/app/main.py:341"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-8c4b83e553c1a0e9", "name": "FastAPI POST `solve_cancel` without auth dependency \u2014 backend/app/main.py:381", "shortDescription": {"text": "FastAPI POST `solve_cancel` without auth dependency \u2014 backend/app/main.py:381"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/23865"}, "properties": {"repository": "Abhishekchhetri020/chronexa-web", "repoUrl": "https://github.com/Abhishekchhetri020/chronexa-web", "branch": "main"}, "results": [{"ruleId": "scanner-e2f0fbd6e80df80f", "level": "note", "message": {"text": "Possibly dead Python function: list_ids"}, "properties": {"repobilityId": "643f8f4a04694b93", "scanner": "scanner-primary", "fingerprint": "e2f0fbd6e80df80f", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/jobs.py:174"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3bb71445a48a42f8", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 check_divisions.js:29"}, "properties": {"repobilityId": "d7a120cd9ac418f2", "scanner": "scanner-primary", "fingerprint": "3bb71445a48a42f8", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-a68a02192032a042", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 check_lesson_divs.js:29"}, "properties": {"repobilityId": "848a7f2fb287e2cd", "scanner": "scanner-primary", "fingerprint": "a68a02192032a042", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-d27fa944c257a67c", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 check_class_conflicts.js:21"}, "properties": {"repobilityId": "042962a39ec052c3", "scanner": "scanner-primary", "fingerprint": "d27fa944c257a67c", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-e4cad4c890eb8cb2", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 js/solver/csp_solver.js:4669"}, "properties": {"repobilityId": "57b8370b49e7a04f", "scanner": "scanner-primary", "fingerprint": "e4cad4c890eb8cb2", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-8f61493c6da76124", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 js/solver/__tests__/audit_regression.test.js:33"}, "properties": {"repobilityId": "0bd5838c0e101f7c", "scanner": "scanner-primary", "fingerprint": "8f61493c6da76124", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-71179edcf96ba60b", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 js/solver/__tests__/fixes_2026-06-11.test.js:27"}, "properties": {"repobilityId": "d1c98bcc43fcb5e6", "scanner": "scanner-primary", "fingerprint": "71179edcf96ba60b", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-d9e6b6c79d6e0a38", "level": "note", "message": {"text": "Icon-only button without accessible name \u2014 js/ui/pwa_install.js:46"}, "properties": {"repobilityId": "8f49137a5cf1834a", "scanner": "scanner-primary", "fingerprint": "d9e6b6c79d6e0a38", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.button.no-label"]}}, {"ruleId": "scanner-7ca343684f116156", "level": "note", "message": {"text": "Icon-only button without accessible name \u2014 js/ui/inspector.js:32"}, "properties": {"repobilityId": "fbf667f86a36df14", "scanner": "scanner-primary", "fingerprint": "7ca343684f116156", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.button.no-label"]}}, {"ruleId": "scanner-fde1ed0f4f595cb6", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 js/ui/main.js:284"}, "properties": {"repobilityId": "c5354060fd3966fa", "scanner": "scanner-primary", "fingerprint": "fde1ed0f4f595cb6", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-c3fdee91beb88b4c", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 js/ui/editor/row_context_menu.js:27"}, "properties": {"repobilityId": "e956e1c2da09af40", "scanner": "scanner-primary", "fingerprint": "c3fdee91beb88b4c", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-3a88043c14602e3e", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 js/ui/editor/card_context_menu.js:25"}, "properties": {"repobilityId": "d4a488ee1cf0e7d1", "scanner": "scanner-primary", "fingerprint": "3a88043c14602e3e", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-ee185e914e4de093", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 js/ui/solver_ui/backend_client.js:129"}, "properties": {"repobilityId": "0ff5c8fb61ff64de", "scanner": "scanner-primary", "fingerprint": "ee185e914e4de093", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-5bf9c0115150b881", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 js/ui/solver_ui/multi_branch.js:106"}, "properties": {"repobilityId": "389dcf840cdce89c", "scanner": "scanner-primary", "fingerprint": "5bf9c0115150b881", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-980f320706bddbcd", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 benchmarks/run_benchmark.js:8"}, "properties": {"repobilityId": "648aa04dbf973776", "scanner": "scanner-primary", "fingerprint": "980f320706bddbcd", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-c188695566560f3c", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 benchmarks/generate_large_realistic.js:3"}, "properties": {"repobilityId": "f6b2829ee9a02501", "scanner": "scanner-primary", "fingerprint": "c188695566560f3c", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-655038b3cfba19f0", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 benchmarks/run_real_xml.js:18"}, "properties": {"repobilityId": "b1b21ed208f78add", "scanner": "scanner-primary", "fingerprint": "655038b3cfba19f0", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-714c31ca9f474ae6", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: python:3.12-slim"}, "properties": {"repobilityId": "2cc603ec2d5f0c4b", "scanner": "scanner-primary", "fingerprint": "714c31ca9f474ae6", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/Dockerfile"}, "region": {"startLine": 7}}}]}, {"ruleId": "scanner-40f3633109c63579", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in index.html:512"}, "properties": {"repobilityId": "f91708437a3a5445", "scanner": "scanner-primary", "fingerprint": "40f3633109c63579", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "index.html"}, "region": {"startLine": 512}}}]}, {"ruleId": "scanner-b40e1dbe3592c59c", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/solver/__tests__/solver.test.html:204"}, "properties": {"repobilityId": "fb533df103c683d4", "scanner": "scanner-primary", "fingerprint": "b40e1dbe3592c59c", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "js/solver/__tests__/solver.test.html"}, "region": {"startLine": 204}}}]}, {"ruleId": "scanner-ed199f6129ed75f5", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/ui/class_grid.js:9"}, "properties": {"repobilityId": "fee23d6718dd02ba", "scanner": "scanner-primary", "fingerprint": "ed199f6129ed75f5", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "js/ui/class_grid.js"}, "region": {"startLine": 9}}}]}, {"ruleId": "scanner-990cee7e35b49df6", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/ui/grid_view.js:85"}, "properties": {"repobilityId": "0bab341722433e7f", "scanner": "scanner-primary", "fingerprint": "990cee7e35b49df6", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "js/ui/grid_view.js"}, "region": {"startLine": 85}}}]}, {"ruleId": "scanner-7798f7a1f647229e", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/ui/shell_v3.js:77"}, "properties": {"repobilityId": "8dd790738b60e3f1", "scanner": "scanner-primary", "fingerprint": "7798f7a1f647229e", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "js/ui/shell_v3.js"}, "region": {"startLine": 77}}}]}, {"ruleId": "scanner-7a9f374f28f95011", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/ui/pwa_install.js:37"}, "properties": {"repobilityId": "49948e650153ad74", "scanner": "scanner-primary", "fingerprint": "7a9f374f28f95011", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "js/ui/pwa_install.js"}, "region": {"startLine": 37}}}]}, {"ruleId": "scanner-ef3810bdccc8c757", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/ui/school_info.js:23"}, "properties": {"repobilityId": "345d3a69e38efcc6", "scanner": "scanner-primary", "fingerprint": "ef3810bdccc8c757", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "js/ui/school_info.js"}, "region": {"startLine": 23}}}]}, {"ruleId": "scanner-6c65e36c7f3d48dd", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/ui/inspector.js:28"}, "properties": {"repobilityId": "742a93c761cac2f5", "scanner": "scanner-primary", "fingerprint": "6c65e36c7f3d48dd", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "js/ui/inspector.js"}, "region": {"startLine": 28}}}]}, {"ruleId": "scanner-de3b9d4bd93de710", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/ui/teacher_grid.js:9"}, "properties": {"repobilityId": "1bd85f3c12b7756a", "scanner": "scanner-primary", "fingerprint": "de3b9d4bd93de710", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "js/ui/teacher_grid.js"}, "region": {"startLine": 9}}}]}, {"ruleId": "scanner-c699ec487478e656", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/ui/room_grid.js:16"}, "properties": {"repobilityId": "eaacfbc3a0ca3f15", "scanner": "scanner-primary", "fingerprint": "c699ec487478e656", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "js/ui/room_grid.js"}, "region": {"startLine": 16}}}]}, {"ruleId": "scanner-affc91c1fdcc5146", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/ui/start_screen.js:67"}, "properties": {"repobilityId": "5c36ea17780a0a90", "scanner": "scanner-primary", "fingerprint": "affc91c1fdcc5146", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "js/ui/start_screen.js"}, "region": {"startLine": 67}}}]}, {"ruleId": "scanner-c8b7513dce9295ed", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/ui/entity_router.js:63"}, "properties": {"repobilityId": "ac5ecef6c110a77e", "scanner": "scanner-primary", "fingerprint": "c8b7513dce9295ed", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "js/ui/entity_router.js"}, "region": {"startLine": 63}}}]}, {"ruleId": "scanner-d92e8c5343ff0154", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/ui/main.js:18"}, "properties": {"repobilityId": "3075b03f000bb83d", "scanner": "scanner-primary", "fingerprint": "d92e8c5343ff0154", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "js/ui/main.js"}, "region": {"startLine": 18}}}]}, {"ruleId": "scanner-4c5f3257d0fa453b", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/ui/wizard/wizard_walkthrough.js:141"}, "properties": {"repobilityId": "97147ba128ef6b01", "scanner": "scanner-primary", "fingerprint": "4c5f3257d0fa453b", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "js/ui/wizard/wizard_walkthrough.js"}, "region": {"startLine": 141}}}]}, {"ruleId": "scanner-ad9487671b6cbe30", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/ui/ribbon/topbar.js:14"}, "properties": {"repobilityId": "221b6a00b31efdef", "scanner": "scanner-primary", "fingerprint": "ad9487671b6cbe30", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "js/ui/ribbon/topbar.js"}, "region": {"startLine": 14}}}]}, {"ruleId": "scanner-c121204318984db0", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/ui/ribbon/menus/help_menu.js:12"}, "properties": {"repobilityId": "954994d4e5792e28", "scanner": "scanner-primary", "fingerprint": "c121204318984db0", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "js/ui/ribbon/menus/help_menu.js"}, "region": {"startLine": 12}}}]}, {"ruleId": "scanner-115c7436b07fc295", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/ui/print_preview/print_preview.js:29"}, "properties": {"repobilityId": "cd9cf5737c4b33a8", "scanner": "scanner-primary", "fingerprint": "115c7436b07fc295", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "js/ui/print_preview/print_preview.js"}, "region": {"startLine": 29}}}]}, {"ruleId": "scanner-82bef0f77a35d48f", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/ui/components/palette.js:43"}, "properties": {"repobilityId": "01f472ca3e885ddf", "scanner": "scanner-primary", "fingerprint": "82bef0f77a35d48f", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "js/ui/components/palette.js"}, "region": {"startLine": 43}}}]}, {"ruleId": "scanner-16fd97af70622d94", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/ui/components/stats.js:57"}, "properties": {"repobilityId": "67a9dca1f667b0df", "scanner": "scanner-primary", "fingerprint": "16fd97af70622d94", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "js/ui/components/stats.js"}, "region": {"startLine": 57}}}]}, {"ruleId": "scanner-8ee72f2c95d32793", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/ui/components/school_hub.js:62"}, "properties": {"repobilityId": "5dd1d067020d9043", "scanner": "scanner-primary", "fingerprint": "8ee72f2c95d32793", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "js/ui/components/school_hub.js"}, "region": {"startLine": 62}}}]}, {"ruleId": "scanner-2e910b6858f7a7ac", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/ui/components/color_taxonomy.js:126"}, "properties": {"repobilityId": "4e4c7181578e3b05", "scanner": "scanner-primary", "fingerprint": "2e910b6858f7a7ac", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "js/ui/components/color_taxonomy.js"}, "region": {"startLine": 126}}}]}, {"ruleId": "scanner-a9fde81e078bbb32", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/ui/components/command_palette.js:221"}, "properties": {"repobilityId": "ea02c4bc6420beed", "scanner": "scanner-primary", "fingerprint": "a9fde81e078bbb32", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "js/ui/components/command_palette.js"}, "region": {"startLine": 221}}}]}, {"ruleId": "scanner-6015d62de56e1d4a", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/ui/components/auto_save.js:117"}, "properties": {"repobilityId": "315da5a34d0fdc37", "scanner": "scanner-primary", "fingerprint": "6015d62de56e1d4a", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "js/ui/components/auto_save.js"}, "region": {"startLine": 117}}}]}, {"ruleId": "scanner-e9feb075dfe5b8fd", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/ui/components/ai_actions.js:119"}, "properties": {"repobilityId": "d054caaa96bf12bb", "scanner": "scanner-primary", "fingerprint": "e9feb075dfe5b8fd", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "js/ui/components/ai_actions.js"}, "region": {"startLine": 119}}}]}, {"ruleId": "scanner-e19f2df4e9359824", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/ui/components/inspector.js:44"}, "properties": {"repobilityId": "3bc41f5d5ff0a1d3", "scanner": "scanner-primary", "fingerprint": "e19f2df4e9359824", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "js/ui/components/inspector.js"}, "region": {"startLine": 44}}}]}, {"ruleId": "scanner-28dae41bae45a837", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/ui/components/period_override_matrix.js:30"}, "properties": {"repobilityId": "82a198681afcbddb", "scanner": "scanner-primary", "fingerprint": "28dae41bae45a837", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "js/ui/components/period_override_matrix.js"}, "region": {"startLine": 30}}}]}, {"ruleId": "scanner-0487ccdd83f32fe0", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/ui/components/divisions_tree.js:48"}, "properties": {"repobilityId": "4ee4365670f4d9c2", "scanner": "scanner-primary", "fingerprint": "0487ccdd83f32fe0", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "js/ui/components/divisions_tree.js"}, "region": {"startLine": 48}}}]}, {"ruleId": "scanner-d36453560838fa97", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/ui/components/help_center.js:149"}, "properties": {"repobilityId": "4cd64bcabd34b66c", "scanner": "scanner-primary", "fingerprint": "d36453560838fa97", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "js/ui/components/help_center.js"}, "region": {"startLine": 149}}}]}, {"ruleId": "scanner-ae5ca170a0ca2070", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/ui/components/verification_panel_pro.js:102"}, "properties": {"repobilityId": "34fc2416f017ba6d", "scanner": "scanner-primary", "fingerprint": "ae5ca170a0ca2070", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "js/ui/components/verification_panel_pro.js"}, "region": {"startLine": 102}}}]}, {"ruleId": "scanner-ab70e75ccac6ebbc", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/ui/components/school_toolbar.js:63"}, "properties": {"repobilityId": "47823d77872496d1", "scanner": "scanner-primary", "fingerprint": "ab70e75ccac6ebbc", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "js/ui/components/school_toolbar.js"}, "region": {"startLine": 63}}}]}, {"ruleId": "scanner-ccabdfb3b4e9b044", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/ui/components/verification.js:109"}, "properties": {"repobilityId": "ee5157c284601cbd", "scanner": "scanner-primary", "fingerprint": "ccabdfb3b4e9b044", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "js/ui/components/verification.js"}, "region": {"startLine": 109}}}]}, {"ruleId": "scanner-297cf7291578f643", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/ui/editor/activator.js:33"}, "properties": {"repobilityId": "363f941ce80aff1a", "scanner": "scanner-primary", "fingerprint": "297cf7291578f643", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "js/ui/editor/activator.js"}, "region": {"startLine": 33}}}]}, {"ruleId": "scanner-97738e4751f64bf3", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/ui/editor/constraint_explainer.js:226"}, "properties": {"repobilityId": "9b01d08acc6c340c", "scanner": "scanner-primary", "fingerprint": "97738e4751f64bf3", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "js/ui/editor/constraint_explainer.js"}, "region": {"startLine": 226}}}]}, {"ruleId": "scanner-d573b73f1511f62c", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/ui/editor/focus_mode.js:218"}, "properties": {"repobilityId": "9742a06f6a2d3389", "scanner": "scanner-primary", "fingerprint": "d573b73f1511f62c", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "js/ui/editor/focus_mode.js"}, "region": {"startLine": 218}}}]}, {"ruleId": "scanner-fffe7c5e2bc53ac3", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/ui/editor/row_context_menu.js:206"}, "properties": {"repobilityId": "8a7ee691bf7907a6", "scanner": "scanner-primary", "fingerprint": "fffe7c5e2bc53ac3", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "js/ui/editor/row_context_menu.js"}, "region": {"startLine": 206}}}]}, {"ruleId": "scanner-1fea7820e4d8a472", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/ui/editor/card_context_menu.js:191"}, "properties": {"repobilityId": "0395cd181a34023a", "scanner": "scanner-primary", "fingerprint": "1fea7820e4d8a472", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "js/ui/editor/card_context_menu.js"}, "region": {"startLine": 191}}}]}, {"ruleId": "scanner-e25c132ac85e4e03", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/ui/editor/card_in_hand.js:58"}, "properties": {"repobilityId": "ccc45e1b2e6c287f", "scanner": "scanner-primary", "fingerprint": "e25c132ac85e4e03", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "js/ui/editor/card_in_hand.js"}, "region": {"startLine": 58}}}]}, {"ruleId": "scanner-5754de368dabcb8d", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/ui/editor/pending_strip.js:21"}, "properties": {"repobilityId": "f1ce4d5b51a8c517", "scanner": "scanner-primary", "fingerprint": "5754de368dabcb8d", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "js/ui/editor/pending_strip.js"}, "region": {"startLine": 21}}}]}, {"ruleId": "scanner-97c9174015039737", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/ui/editor/grid_canvas.js:19"}, "properties": {"repobilityId": "632e05889feee0fc", "scanner": "scanner-primary", "fingerprint": "97c9174015039737", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "js/ui/editor/grid_canvas.js"}, "region": {"startLine": 19}}}]}, {"ruleId": "scanner-98a1c6a387ae1469", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/ui/io/snapshots.js:85"}, "properties": {"repobilityId": "4d7a6bb81d345736", "scanner": "scanner-primary", "fingerprint": "98a1c6a387ae1469", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "js/ui/io/snapshots.js"}, "region": {"startLine": 85}}}]}, {"ruleId": "scanner-9e748c103a06170f", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/ui/entities/weeks.js:74"}, "properties": {"repobilityId": "ef8c9083c1b3f719", "scanner": "scanner-primary", "fingerprint": "9e748c103a06170f", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "js/ui/entities/weeks.js"}, "region": {"startLine": 74}}}]}, {"ruleId": "scanner-4d82f2b2388f4d96", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/ui/entities/terms.js:71"}, "properties": {"repobilityId": "d136ede358759eea", "scanner": "scanner-primary", "fingerprint": "4d82f2b2388f4d96", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "js/ui/entities/terms.js"}, "region": {"startLine": 71}}}]}, {"ruleId": "scanner-b8ebfa8c523890c2", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/ui/entities/lessons.js:225"}, "properties": {"repobilityId": "2505f12de3eb1bd1", "scanner": "scanner-primary", "fingerprint": "b8ebfa8c523890c2", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "js/ui/entities/lessons.js"}, "region": {"startLine": 225}}}]}, {"ruleId": "scanner-a5fe94841779d4b8", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/ui/entities/teachers.js:128"}, "properties": {"repobilityId": "4236d70a3469288b", "scanner": "scanner-primary", "fingerprint": "a5fe94841779d4b8", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "js/ui/entities/teachers.js"}, "region": {"startLine": 128}}}]}, {"ruleId": "scanner-ac653dad9f1b6c4e", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/ui/entities/classes.js:100"}, "properties": {"repobilityId": "a383d72e90497f8a", "scanner": "scanner-primary", "fingerprint": "ac653dad9f1b6c4e", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "js/ui/entities/classes.js"}, "region": {"startLine": 100}}}]}, {"ruleId": "scanner-2e887c70f25ce9e1", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/ui/entities/dialog_shell.js:51"}, "properties": {"repobilityId": "7d49ab153d6efa5e", "scanner": "scanner-primary", "fingerprint": "2e887c70f25ce9e1", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "js/ui/entities/dialog_shell.js"}, "region": {"startLine": 51}}}]}, {"ruleId": "scanner-be2eefb7c84013f9", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/ui/entities/subjects.js:227"}, "properties": {"repobilityId": "92331d167e0253c6", "scanner": "scanner-primary", "fingerprint": "be2eefb7c84013f9", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "js/ui/entities/subjects.js"}, "region": {"startLine": 227}}}]}, {"ruleId": "scanner-7f0bf783995c93c1", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/ui/entities/relations.js:311"}, "properties": {"repobilityId": "f30d3194303dd43a", "scanner": "scanner-primary", "fingerprint": "7f0bf783995c93c1", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "js/ui/entities/relations.js"}, "region": {"startLine": 311}}}]}, {"ruleId": "scanner-2641d3d82bf6d369", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/ui/entities/bells.js:99"}, "properties": {"repobilityId": "839c4dbfcd6067a4", "scanner": "scanner-primary", "fingerprint": "2641d3d82bf6d369", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "js/ui/entities/bells.js"}, "region": {"startLine": 99}}}]}, {"ruleId": "scanner-deb8a02c1856b4f6", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/ui/onboarding/wiring.js:83"}, "properties": {"repobilityId": "78260c0470854efa", "scanner": "scanner-primary", "fingerprint": "deb8a02c1856b4f6", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "js/ui/onboarding/wiring.js"}, "region": {"startLine": 83}}}]}, {"ruleId": "scanner-54487397c0e905a0", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/ui/onboarding/tour.js:53"}, "properties": {"repobilityId": "b579fdaf505d8e7f", "scanner": "scanner-primary", "fingerprint": "54487397c0e905a0", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "js/ui/onboarding/tour.js"}, "region": {"startLine": 53}}}]}, {"ruleId": "scanner-e200b11dcd77beac", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/ui/onboarding/smart_defaults.js:111"}, "properties": {"repobilityId": "61db86c8eec8ca12", "scanner": "scanner-primary", "fingerprint": "e200b11dcd77beac", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "js/ui/onboarding/smart_defaults.js"}, "region": {"startLine": 111}}}]}, {"ruleId": "scanner-b903fb0ff0f82fec", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/ui/substitution/classwise_output.js:35"}, "properties": {"repobilityId": "c38975bfca0eb3b3", "scanner": "scanner-primary", "fingerprint": "b903fb0ff0f82fec", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "js/ui/substitution/classwise_output.js"}, "region": {"startLine": 35}}}]}, {"ruleId": "scanner-6efce10d8b7181f9", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/ui/substitution/print_memo.js:32"}, "properties": {"repobilityId": "60b0dacfe024ef18", "scanner": "scanner-primary", "fingerprint": "6efce10d8b7181f9", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "js/ui/substitution/print_memo.js"}, "region": {"startLine": 32}}}]}, {"ruleId": "scanner-538eb390fd222c7a", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/ui/substitution/absence_input.js:20"}, "properties": {"repobilityId": "1fcafb9a2a9b0094", "scanner": "scanner-primary", "fingerprint": "538eb390fd222c7a", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "js/ui/substitution/absence_input.js"}, "region": {"startLine": 20}}}]}, {"ruleId": "scanner-696277a632d26cb3", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/ui/substitution/teacherwise_output.js:18"}, "properties": {"repobilityId": "75cf1f2cba64bbdd", "scanner": "scanner-primary", "fingerprint": "696277a632d26cb3", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "js/ui/substitution/teacherwise_output.js"}, "region": {"startLine": 18}}}]}, {"ruleId": "scanner-a70fc625ae3589dd", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/ui/substitution/main.js:60"}, "properties": {"repobilityId": "74c82814d54fb38a", "scanner": "scanner-primary", "fingerprint": "a70fc625ae3589dd", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "js/ui/substitution/main.js"}, "region": {"startLine": 60}}}]}, {"ruleId": "scanner-4fd9e6003d5fd906", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/ui/solver_ui/progress_modal.js:218"}, "properties": {"repobilityId": "c411822b36703601", "scanner": "scanner-primary", "fingerprint": "4fd9e6003d5fd906", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "js/ui/solver_ui/progress_modal.js"}, "region": {"startLine": 218}}}]}, {"ruleId": "scanner-0cefbe02ad230143", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/ui/solver_ui/result_panel.js:83"}, "properties": {"repobilityId": "4f964bb9e9a832e8", "scanner": "scanner-primary", "fingerprint": "0cefbe02ad230143", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "js/ui/solver_ui/result_panel.js"}, "region": {"startLine": 83}}}]}, {"ruleId": "scanner-37ff50d7972e945b", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in tools/ab_lns.mjs:5"}, "properties": {"repobilityId": "fbe1c27486bf28fc", "scanner": "scanner-primary", "fingerprint": "37ff50d7972e945b", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/ab_lns.mjs"}, "region": {"startLine": 5}}}]}, {"ruleId": "scanner-83f1633ed3bc4377", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in tools/sim_ui_generate.mjs:12"}, "properties": {"repobilityId": "9c2f63288ebfc7ba", "scanner": "scanner-primary", "fingerprint": "83f1633ed3bc4377", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/sim_ui_generate.mjs"}, "region": {"startLine": 12}}}]}, {"ruleId": "scanner-6372cebde0220094", "level": "warning", "message": {"text": "No auth library detected"}, "properties": {"repobilityId": "a5b6035a5bbf8054", "scanner": "scanner-primary", "fingerprint": "6372cebde0220094", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["coverage", "auth"]}}, {"ruleId": "scanner-1838a141491ce38c", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "b8fd4f5048f96576", "scanner": "scanner-primary", "fingerprint": "1838a141491ce38c", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-65141922bbebdb19", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "810bc2702d039163", "scanner": "scanner-primary", "fingerprint": "65141922bbebdb19", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/backend.yml"}, "region": {"startLine": 20}}}]}, {"ruleId": "scanner-2d9341095719452a", "level": "note", "message": {"text": "Very large file: js/solver/csp_solver.js (5339 lines)"}, "properties": {"repobilityId": "a20af9b4e5d125e8", "scanner": "scanner-primary", "fingerprint": "2d9341095719452a", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-6a1fb9700ea857c6", "level": "note", "message": {"text": "Very large file: js/ui/entities/lessons.js (1405 lines)"}, "properties": {"repobilityId": "7360c7aa0b3952c9", "scanner": "scanner-primary", "fingerprint": "6a1fb9700ea857c6", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-ea3b5e389d8c9c0f", "level": "note", "message": {"text": "Low test-to-source ratio"}, "properties": {"repobilityId": "ef7b2552cc00a375", "scanner": "scanner-primary", "fingerprint": "ea3b5e389d8c9c0f", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["tests"]}}, {"ruleId": "scanner-141b30a41e03817b", "level": "note", "message": {"text": "No license file detected"}, "properties": {"repobilityId": "8a6a4215ac7d48f7", "scanner": "scanner-primary", "fingerprint": "141b30a41e03817b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["license", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-240c7a932d3912bf", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: js/solver/wasm/package.json"}, "properties": {"repobilityId": "e06765ab70d4d4d7", "scanner": "scanner-primary", "fingerprint": "240c7a932d3912bf", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "js/solver/wasm/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "81294c758fa14be3", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-72b2a6250083a784", "level": "warning", "message": {"text": "Placeholder or mock-heavy implementation detected"}, "properties": {"repobilityId": "228b3ab2f66e2c55", "scanner": "scanner-primary", "fingerprint": "72b2a6250083a784", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "incomplete", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "dd0b07640d0afbe1", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-b9088664ace7f748", "level": "note", "message": {"text": "Composite production-readiness gap"}, "properties": {"repobilityId": "e4f74963f50c3659", "scanner": "scanner-primary", "fingerprint": "b9088664ace7f748", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["production-readiness", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-e33659ff7126f341", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 check_logs_runner.py:3"}, "properties": {"repobilityId": "b4448bf1e7a5011b", "scanner": "scanner-primary", "fingerprint": "e33659ff7126f341", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-32621c0cb81f27bf", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 runner_repro.py:3"}, "properties": {"repobilityId": "30efab95c374b4bd", "scanner": "scanner-primary", "fingerprint": "32621c0cb81f27bf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-b8d4f491676ce159", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 runner.py:3"}, "properties": {"repobilityId": "72770ade58890f97", "scanner": "scanner-primary", "fingerprint": "b8d4f491676ce159", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-67eebe7a1c3a037f", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 runner_new.py:3"}, "properties": {"repobilityId": "262d6c46a9b8ac93", "scanner": "scanner-primary", "fingerprint": "67eebe7a1c3a037f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-3cbd839d76d1fa6a", "level": "none", "message": {"text": "Commented-code block (5 lines) in js/solver/bitmask.js:3"}, "properties": {"repobilityId": "646734e297b4422d", "scanner": "scanner-primary", "fingerprint": "3cbd839d76d1fa6a", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-1ff19343b64a1818", "level": "none", "message": {"text": "Commented-code block (5 lines) in js/solver/worker.js:3"}, "properties": {"repobilityId": "c479f3df22132b65", "scanner": "scanner-primary", "fingerprint": "1ff19343b64a1818", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-5024b893d93e5d16", "level": "none", "message": {"text": "Commented-code block (7 lines) in js/solver/constraints.js:179"}, "properties": {"repobilityId": "a0500d10a584ae72", "scanner": "scanner-primary", "fingerprint": "5024b893d93e5d16", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-aa30f68efe8522bc", "level": "none", "message": {"text": "Commented-code block (11 lines) in js/solver/csp_solver.js:3"}, "properties": {"repobilityId": "d7443dcef52cb09a", "scanner": "scanner-primary", "fingerprint": "aa30f68efe8522bc", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-e949053303d02276", "level": "none", "message": {"text": "Commented-code block (5 lines) in js/solver/wasm/csp_wasm.js:9"}, "properties": {"repobilityId": "fa497c2c7d84d5b0", "scanner": "scanner-primary", "fingerprint": "e949053303d02276", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-a2c73bdbd4e60327", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 js/solver/wasm/csp_wasm.js:31"}, "properties": {"repobilityId": "47a6f41dae095b94", "scanner": "scanner-primary", "fingerprint": "a2c73bdbd4e60327", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-a9bc1d223a5df6d1", "level": "none", "message": {"text": "Commented-code block (5 lines) in js/solver/wasm/loader.js:13"}, "properties": {"repobilityId": "2deedc69285ad29b", "scanner": "scanner-primary", "fingerprint": "a9bc1d223a5df6d1", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-da10497629bc86ef", "level": "none", "message": {"text": "Commented-code block (12 lines) in js/solver/__tests__/audit_regression.test.js:5"}, "properties": {"repobilityId": "488689f12f561cb0", "scanner": "scanner-primary", "fingerprint": "da10497629bc86ef", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-5420319fadcf50c3", "level": "none", "message": {"text": "Commented-code block (11 lines) in js/solver/__tests__/fixes_2026-06-11.test.js:4"}, "properties": {"repobilityId": "958db31621d4f668", "scanner": "scanner-primary", "fingerprint": "5420319fadcf50c3", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-e8bce92e9e81abf4", "level": "none", "message": {"text": "Commented-code block (8 lines) in js/xml/parse_timetable_xml.js:61"}, "properties": {"repobilityId": "7ffe0684aafefd4d", "scanner": "scanner-primary", "fingerprint": "e8bce92e9e81abf4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-c225b7d8947f2175", "level": "none", "message": {"text": "Commented-code block (5 lines) in js/ui/multi_doc_tabs.js:65"}, "properties": {"repobilityId": "ffd98a209f4d8767", "scanner": "scanner-primary", "fingerprint": "c225b7d8947f2175", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-31e03b58e6754646", "level": "note", "message": {"text": "Legacy-named symbol `clickLegacy` in js/ui/shell_v3.js:116"}, "properties": {"repobilityId": "7e9bd70ff06d1864", "scanner": "scanner-primary", "fingerprint": "31e03b58e6754646", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-cd83ca4813d44769", "level": "none", "message": {"text": "Commented-code block (9 lines) in js/ui/pwa_install.js:88"}, "properties": {"repobilityId": "f2a138831bb95621", "scanner": "scanner-primary", "fingerprint": "cd83ca4813d44769", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-5120cdb0ef236d3f", "level": "none", "message": {"text": "Commented-code block (7 lines) in js/ui/print_preview/print_preview.js:386"}, "properties": {"repobilityId": "99859428ca12fe60", "scanner": "scanner-primary", "fingerprint": "5120cdb0ef236d3f", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-7f9641bf95f8838b", "level": "none", "message": {"text": "Commented-code block (5 lines) in js/ui/print_preview/templates/_helpers.js:78"}, "properties": {"repobilityId": "5e12546e225a141f", "scanner": "scanner-primary", "fingerprint": "7f9641bf95f8838b", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-4cb281ebf9b0080e", "level": "none", "message": {"text": "Commented-code block (6 lines) in js/ui/components/divisions_tree.js:181"}, "properties": {"repobilityId": "b457176e2c562280", "scanner": "scanner-primary", "fingerprint": "4cb281ebf9b0080e", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-f8d9dc437e4d9c30", "level": "none", "message": {"text": "Commented-code block (8 lines) in js/ui/editor/canvas_geometry.js:66"}, "properties": {"repobilityId": "114ce1ad298afe0f", "scanner": "scanner-primary", "fingerprint": "f8d9dc437e4d9c30", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-c9531e7a540bcc9a", "level": "none", "message": {"text": "Commented-code block (6 lines) in js/ui/editor/card_in_hand.js:118"}, "properties": {"repobilityId": "2c3693b1a0dcc249", "scanner": "scanner-primary", "fingerprint": "c9531e7a540bcc9a", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-7536a6ae1f7470dc", "level": "none", "message": {"text": "Commented-code block (5 lines) in js/ui/editor/grid_canvas.js:317"}, "properties": {"repobilityId": "354c80e0f3550ed8", "scanner": "scanner-primary", "fingerprint": "7536a6ae1f7470dc", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-0f244ecbb793958f", "level": "none", "message": {"text": "Commented-code block (6 lines) in js/ui/io/export_excel.js:108"}, "properties": {"repobilityId": "e7fa318e2b50b860", "scanner": "scanner-primary", "fingerprint": "0f244ecbb793958f", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-f08a644f87711fca", "level": "none", "message": {"text": "Commented-code block (6 lines) in js/ui/io/import_cardrelationships_har.js:62"}, "properties": {"repobilityId": "4f8123fcfc1a55c8", "scanner": "scanner-primary", "fingerprint": "f08a644f87711fca", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-243eb88f43e82208", "level": "none", "message": {"text": "Commented-code block (8 lines) in js/ui/entities/classrooms.js:62"}, "properties": {"repobilityId": "be6ce8f04be6bd54", "scanner": "scanner-primary", "fingerprint": "243eb88f43e82208", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-bac1905d83488c7f", "level": "none", "message": {"text": "Commented-code block (5 lines) in js/ui/entities/dialog_shell.js:531"}, "properties": {"repobilityId": "6b812924ee807579", "scanner": "scanner-primary", "fingerprint": "bac1905d83488c7f", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-b923b98b7540695a", "level": "none", "message": {"text": "Commented-code block (5 lines) in js/ui/entities/relations.js:377"}, "properties": {"repobilityId": "895e903fac5f3341", "scanner": "scanner-primary", "fingerprint": "b923b98b7540695a", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-e04009812cb56eba", "level": "none", "message": {"text": "Commented-code block (6 lines) in js/ui/onboarding/smart_defaults.js:55"}, "properties": {"repobilityId": "763e5f69d83865ab", "scanner": "scanner-primary", "fingerprint": "e04009812cb56eba", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-a47948e9ff6e03c7", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 js/ui/solver_ui/backend_client.js:219"}, "properties": {"repobilityId": "8ef14c9b63c35120", "scanner": "scanner-primary", "fingerprint": "a47948e9ff6e03c7", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-1e389dc990813e1c", "level": "none", "message": {"text": "Commented-code block (5 lines) in js/ui/solver_ui/test_dialog.js:87"}, "properties": {"repobilityId": "6bab9373e066db9f", "scanner": "scanner-primary", "fingerprint": "1e389dc990813e1c", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-6db878b11d18d8e8", "level": "none", "message": {"text": "Commented-code block (5 lines) in backend/app/solver.py:245"}, "properties": {"repobilityId": "82c08bd48e0dc12c", "scanner": "scanner-primary", "fingerprint": "6db878b11d18d8e8", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-9800635315ec7fe5", "level": "none", "message": {"text": "Commented-code block (7 lines) in tools/test_remove_single_probe.mjs:79"}, "properties": {"repobilityId": "88f4546d8d463f34", "scanner": "scanner-primary", "fingerprint": "9800635315ec7fe5", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-96eddb8b8db153d6", "level": "none", "message": {"text": "Commented-code block (6 lines) in tools/test_multisession_lesson_lock.mjs:1"}, "properties": {"repobilityId": "8bc24f1d61a7e72f", "scanner": "scanner-primary", "fingerprint": "96eddb8b8db153d6", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-9457fa0155208eb5", "level": "none", "message": {"text": "Commented-code block (5 lines) in tools/smoke_wasm_canplace.mjs:1"}, "properties": {"repobilityId": "a4c30a51c61af2bf", "scanner": "scanner-primary", "fingerprint": "9457fa0155208eb5", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-04a68cf5228c8315", "level": "none", "message": {"text": "Commented-code block (5 lines) in tools/test_editor_pickup_lifecycle.mjs:5"}, "properties": {"repobilityId": "3f47d5949419c04f", "scanner": "scanner-primary", "fingerprint": "04a68cf5228c8315", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-76e831c4d8437ae8", "level": "none", "message": {"text": "Commented-code block (5 lines) in tools/run_baseline.mjs:12"}, "properties": {"repobilityId": "7a6cf4da15a29589", "scanner": "scanner-primary", "fingerprint": "76e831c4d8437ae8", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-e99c7c49c5019599", "level": "none", "message": {"text": "Commented-code block (7 lines) in tools/test_remove_single_div_match.mjs:35"}, "properties": {"repobilityId": "98cb2e86e2929b09", "scanner": "scanner-primary", "fingerprint": "e99c7c49c5019599", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-6a4bb38a6b84704f", "level": "none", "message": {"text": "Commented-code block (5 lines) in tools/test_class_conflict_group_aware.mjs:1"}, "properties": {"repobilityId": "02ac0f152fedeed4", "scanner": "scanner-primary", "fingerprint": "6a4bb38a6b84704f", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-f3114358e6d683df", "level": "none", "message": {"text": "Commented-code block (6 lines) in tools/evaluate_asc.mjs:5"}, "properties": {"repobilityId": "5e0ab2df73236a91", "scanner": "scanner-primary", "fingerprint": "f3114358e6d683df", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-bbd348654cc76e28", "level": "none", "message": {"text": "Commented-code block (6 lines) in tools/test_division_aware_conflict.mjs:1"}, "properties": {"repobilityId": "edf5daebe2a420a5", "scanner": "scanner-primary", "fingerprint": "bbd348654cc76e28", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-89a944cd5c7a6232", "level": "none", "message": {"text": "Commented-code block (6 lines) in tools/test_codex_fixes.mjs:1"}, "properties": {"repobilityId": "02e4d6858bdee23f", "scanner": "scanner-primary", "fingerprint": "89a944cd5c7a6232", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-973c6f8f693354b0", "level": "none", "message": {"text": "Commented-code block (5 lines) in tools/test_no_double_booking.mjs:1"}, "properties": {"repobilityId": "641a116c9590f5e1", "scanner": "scanner-primary", "fingerprint": "973c6f8f693354b0", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-a2589e163771771a", "level": "none", "message": {"text": "Commented-code block (6 lines) in tools/test_print_pivot_dims.mjs:1"}, "properties": {"repobilityId": "c80b61a65bcbf07f", "scanner": "scanner-primary", "fingerprint": "a2589e163771771a", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-cc0f9d8e41b33b0e", "level": "note", "message": {"text": "11 env vars used in code but missing from .env.example"}, "properties": {"repobilityId": "c82cd8cd626c3599", "scanner": "scanner-primary", "fingerprint": "cc0f9d8e41b33b0e", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "config-drift"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "eb48b4e2c41a904d", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2104533c28a880e7", "level": "error", "message": {"text": "FastAPI POST `solve` without auth dependency \u2014 backend/app/main.py:327"}, "properties": {"repobilityId": "bf9601641c9276cf", "scanner": "scanner-primary", "fingerprint": "2104533c28a880e7", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/main.py"}, "region": {"startLine": 327}}}]}, {"ruleId": "scanner-a390655e55db0cd5", "level": "error", "message": {"text": "FastAPI POST `solve_start` without auth dependency \u2014 backend/app/main.py:341"}, "properties": {"repobilityId": "dbfea40e9017ff50", "scanner": "scanner-primary", "fingerprint": "a390655e55db0cd5", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/main.py"}, "region": {"startLine": 341}}}]}, {"ruleId": "scanner-8c4b83e553c1a0e9", "level": "error", "message": {"text": "FastAPI POST `solve_cancel` without auth dependency \u2014 backend/app/main.py:381"}, "properties": {"repobilityId": "29853e4280485fe1", "scanner": "scanner-primary", "fingerprint": "8c4b83e553c1a0e9", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/main.py"}, "region": {"startLine": 381}}}]}]}]}