{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-9710c8d059e53154", "name": "No frontend routes/components detected", "shortDescription": {"text": "No frontend routes/components detected"}, "fullDescription": {"text": "No React/Vue/Next routes were found. This is fine for backend-only repos."}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-93d9ac545e3c2a70", "name": "Insecure pattern 'node_child_process' in src/git.ts:1", "shortDescription": {"text": "Insecure pattern 'node_child_process' in src/git.ts:1"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e36f2c05715d2029", "name": "Insecure pattern 'node_child_process' in src/extension.ts:1", "shortDescription": {"text": "Insecure pattern 'node_child_process' in src/extension.ts:1"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4b3d6662b6a6ef36", "name": "Insecure pattern 'node_child_process' in src/adapters/scrub.ts:1", "shortDescription": {"text": "Insecure pattern 'node_child_process' in src/adapters/scrub.ts:1"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2624a6ed7e5ce675", "name": "Insecure pattern 'node_child_process' in src/adapters/codex.ts:1", "shortDescription": {"text": "Insecure pattern 'node_child_process' in src/adapters/codex.ts:1"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0ed7fe44d5544eb8", "name": "Insecure pattern 'node_child_process' in src/adapters/copilot.ts:1", "shortDescription": {"text": "Insecure pattern 'node_child_process' in src/adapters/copilot.ts:1"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1ddc354c731a18d0", "name": "Insecure pattern 'node_child_process' in src/adapters/claude.ts:1", "shortDescription": {"text": "Insecure pattern 'node_child_process' in src/adapters/claude.ts:1"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d4f094287238a55b", "name": "Insecure pattern 'direct_innerhtml_assignment' in src/ui/chatHtml.ts:843", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in src/ui/chatHtml.ts:843"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d8bb26d24cb0d0e8", "name": "Insecure pattern 'direct_innerhtml_assignment' in src/ui/configHtml.ts:120", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in src/ui/configHtml.ts:120"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6ba9bfab5f283202", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/upload-artifact@v5 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b769174c9fcf8ea8", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-33f27a0fbab15914", "name": "Very large file: src/ui/chatHtml.ts (2521 lines)", "shortDescription": {"text": "Very large file: src/ui/chatHtml.ts (2521 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ea3b5e389d8c9c0f", "name": "Low test-to-source ratio", "shortDescription": {"text": "Low test-to-source ratio"}, "fullDescription": {"text": "4 tests / 33 src (ratio 0.12)."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-72b2a6250083a784", "name": "Placeholder or mock-heavy implementation detected", "shortDescription": {"text": "Placeholder or mock-heavy implementation detected"}, "fullDescription": {"text": "Found 16 placeholder/mock markers across 4 source files. This often means the repo looks complete while core flows still use generated scaffolding or fake data."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-b2ed709a0a3008a0", "name": "`fetch()` without try/.catch or AbortSignal \u2014 src/adapters/openai.ts:363", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/adapters/openai.ts:363"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-712babba16849de2", "name": "`fetch()` without try/.catch or AbortSignal \u2014 src/sync/hubClient.ts:98", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/sync/hubClient.ts:98"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-eb1593952e2f8eee", "name": "`fetch()` without try/.catch or AbortSignal \u2014 src/auth/identity.ts:66", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/auth/identity.ts:66"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/20457"}, "properties": {"repository": "sufficit/sufficit-vscode-symposium", "repoUrl": "https://github.com/sufficit/sufficit-vscode-symposium", "branch": "main"}, "results": [{"ruleId": "scanner-9710c8d059e53154", "level": "none", "message": {"text": "No frontend routes/components detected"}, "properties": {"repobilityId": "44ca61485762e494", "scanner": "scanner-primary", "fingerprint": "9710c8d059e53154", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-93d9ac545e3c2a70", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in src/git.ts:1"}, "properties": {"repobilityId": "c89977f344666b4b", "scanner": "scanner-primary", "fingerprint": "93d9ac545e3c2a70", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/git.ts"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e36f2c05715d2029", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in src/extension.ts:1"}, "properties": {"repobilityId": "d3374763a1887cfc", "scanner": "scanner-primary", "fingerprint": "e36f2c05715d2029", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/extension.ts"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-4b3d6662b6a6ef36", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in src/adapters/scrub.ts:1"}, "properties": {"repobilityId": "6143c12a93fc30e2", "scanner": "scanner-primary", "fingerprint": "4b3d6662b6a6ef36", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/adapters/scrub.ts"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-2624a6ed7e5ce675", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in src/adapters/codex.ts:1"}, "properties": {"repobilityId": "0115afb093c0d780", "scanner": "scanner-primary", "fingerprint": "2624a6ed7e5ce675", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/adapters/codex.ts"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-0ed7fe44d5544eb8", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in src/adapters/copilot.ts:1"}, "properties": {"repobilityId": "37788d1fac5f9b29", "scanner": "scanner-primary", "fingerprint": "0ed7fe44d5544eb8", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/adapters/copilot.ts"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-1ddc354c731a18d0", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in src/adapters/claude.ts:1"}, "properties": {"repobilityId": "fd114186532b4291", "scanner": "scanner-primary", "fingerprint": "1ddc354c731a18d0", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/adapters/claude.ts"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d4f094287238a55b", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in src/ui/chatHtml.ts:843"}, "properties": {"repobilityId": "cbc7b639a3ca9336", "scanner": "scanner-primary", "fingerprint": "d4f094287238a55b", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/ui/chatHtml.ts"}, "region": {"startLine": 843}}}]}, {"ruleId": "scanner-d8bb26d24cb0d0e8", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in src/ui/configHtml.ts:120"}, "properties": {"repobilityId": "0ced9b8edf697d49", "scanner": "scanner-primary", "fingerprint": "d8bb26d24cb0d0e8", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/ui/configHtml.ts"}, "region": {"startLine": 120}}}]}, {"ruleId": "scanner-6ba9bfab5f283202", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "1e41e63a6cd912c0", "scanner": "scanner-primary", "fingerprint": "6ba9bfab5f283202", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/build.yml"}, "region": {"startLine": 38}}}]}, {"ruleId": "scanner-6ba9bfab5f283202", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "6ac4ae69c5a42541", "scanner": "scanner-primary", "fingerprint": "6ba9bfab5f283202", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/build.yml"}, "region": {"startLine": 46}}}]}, {"ruleId": "scanner-b769174c9fcf8ea8", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "e34b6cb9b56931d2", "scanner": "scanner-primary", "fingerprint": "b769174c9fcf8ea8", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/build.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-33f27a0fbab15914", "level": "note", "message": {"text": "Very large file: src/ui/chatHtml.ts (2521 lines)"}, "properties": {"repobilityId": "485264e7236e2251", "scanner": "scanner-primary", "fingerprint": "33f27a0fbab15914", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-ea3b5e389d8c9c0f", "level": "note", "message": {"text": "Low test-to-source ratio"}, "properties": {"repobilityId": "ef7b2552cc00a375", "scanner": "scanner-primary", "fingerprint": "ea3b5e389d8c9c0f", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["tests"]}}, {"ruleId": "scanner-72b2a6250083a784", "level": "warning", "message": {"text": "Placeholder or mock-heavy implementation detected"}, "properties": {"repobilityId": "97e0af34e1df3b3b", "scanner": "scanner-primary", "fingerprint": "72b2a6250083a784", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "incomplete", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "bf16b4fd5deaebbf", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "a1562b56a326bf47", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "1fe0429324f72d8c", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-b2ed709a0a3008a0", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/adapters/openai.ts:363"}, "properties": {"repobilityId": "f7c3f1ce10bb5213", "scanner": "scanner-primary", "fingerprint": "b2ed709a0a3008a0", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-712babba16849de2", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/sync/hubClient.ts:98"}, "properties": {"repobilityId": "8f40538c3c7d07f0", "scanner": "scanner-primary", "fingerprint": "712babba16849de2", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-eb1593952e2f8eee", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/auth/identity.ts:66"}, "properties": {"repobilityId": "fc7c5ecf404b8ee8", "scanner": "scanner-primary", "fingerprint": "eb1593952e2f8eee", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}]}]}