{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-596d5291a1db5b0a", "name": "Stray `console.log` in TS/JS \u2014 cli/src/build-template.ts:66", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 cli/src/build-template.ts:66"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cdfc11699018d5ac", "name": "Stray `console.log` in TS/JS \u2014 cli/src/index.ts:123", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 cli/src/index.ts:123"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-18b1145875a0f7eb", "name": "`truncate` class without `title=` for hover reveal \u2014 src/components/settings/AuthSettings.tsx:128", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 src/components/settings/AuthSettings.tsx:128"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-918ee3b10033f2eb", "name": "`truncate` class without `title=` for hover reveal \u2014 src/components/settings/ConnectionSettings.tsx:258", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 src/components/settings/ConnectionSettings.tsx:258"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-c8f8841f2dbca767", "name": "`truncate` class without `title=` for hover reveal \u2014 src/components/layout/AppSidebar.tsx:164", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 src/components/layout/AppSidebar.tsx:164"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-e59341d9b411f48f", "name": "`truncate` class without `title=` for hover reveal \u2014 src/components/layout/EnvironmentSwitcher.tsx:65", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 src/components/layout/EnvironmentSwitcher.tsx:65"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-29ccdae73918686f", "name": "`truncate` class without `title=` for hover reveal \u2014 src/components/layout/WorkspaceSwitcher.tsx:78", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 src/components/layout/WorkspaceSwitcher.tsx:78"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-2c7a1532676ba806", "name": "`truncate` class without `title=` for hover reveal \u2014 src/components/layout/Header.tsx:60", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 src/components/layout/Header.tsx:60"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-751a53b093e831d3", "name": "`truncate` class without `title=` for hover reveal \u2014 src/components/endpoints/TryTab.tsx:104", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 src/components/endpoints/TryTab.tsx:104"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-da18f0cd84ac7e33", "name": "`truncate` class without `title=` for hover reveal \u2014 src/components/endpoints/ResponseAgGrid.tsx:84", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 src/components/endpoints/ResponseAgGrid.tsx:84"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-2c737be3e3ac4811", "name": "`truncate` class without `title=` for hover reveal \u2014 src/components/endpoints/RouteCard.tsx:118", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 src/components/endpoints/RouteCard.tsx:118"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-ceef73ad90b2e36d", "name": "`truncate` class without `title=` for hover reveal \u2014 src/components/endpoints/HistoryTab.tsx:153", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 src/components/endpoints/HistoryTab.tsx:153"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-271f9088d49219f4", "name": "`truncate` class without `title=` for hover reveal \u2014 src/components/endpoints/EndpointFilterBar.tsx:179", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 src/components/endpoints/EndpointFilterBar.tsx:179"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-054bce6b1b8e359c", "name": "`truncate` class without `title=` for hover reveal \u2014 src/components/models/ModelCard.tsx:100", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 src/components/models/ModelCard.tsx:100"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-764b5c8444d538cd", "name": "React Flow <Controls> without dark theming \u2014 src/components/models/ModelGraphView.tsx:1133", "shortDescription": {"text": "React Flow <Controls> without dark theming \u2014 src/components/models/ModelGraphView.tsx:1133"}, "fullDescription": {"text": "`<Controls>` ships with white buttons. Override `.react-flow__controls` and `.react-flow__controls-button` in your stylesheet or pass a styled wrapper.\n\nWhy: P1 in CHECKLIST.md \u2014 vendor defaults bleed light through.\nRule id: fq.controls.no-bg"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2a6ac93cb4318add", "name": "`dangerouslySetInnerHTML` used in a React component \u2014 src/components/ui/markdown.tsx:29", "shortDescription": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 src/components/ui/markdown.tsx:29"}, "fullDescription": {"text": "Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library.\n\nWhy: OWASP basics. Already partially flagged by the security analyzer.\nRule id: fq.dangerous-html"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0a48e75d45cd7fc6", "name": "`dangerouslySetInnerHTML` used in a React component \u2014 src/components/ui/chart.tsx:95", "shortDescription": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 src/components/ui/chart.tsx:95"}, "fullDescription": {"text": "Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library.\n\nWhy: OWASP basics. Already partially flagged by the security analyzer.\nRule id: fq.dangerous-html"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d2643b29e4b7071c", "name": "`truncate` class without `title=` for hover reveal \u2014 src/components/schema/SchemaInput.tsx:176", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 src/components/schema/SchemaInput.tsx:176"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-cb98bc08ea8e4628", "name": "`dangerouslySetInnerHTML` used in a React component \u2014 src/components/schema/SchemaTree.tsx:69", "shortDescription": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 src/components/schema/SchemaTree.tsx:69"}, "fullDescription": {"text": "Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library.\n\nWhy: OWASP basics. Already partially flagged by the security analyzer.\nRule id: fq.dangerous-html"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f5650e3f67608379", "name": "`truncate` class without `title=` for hover reveal \u2014 src/components/schema/SchemaViewerView.tsx:181", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 src/components/schema/SchemaViewerView.tsx:181"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-9020370542b9b449", "name": "`truncate` class without `title=` for hover reveal \u2014 src/components/schema/PhoneInput.tsx:211", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 src/components/schema/PhoneInput.tsx:211"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-58344c76683ec3bc", "name": "`truncate` class without `title=` for hover reveal \u2014 src/components/search/CommandPalette.tsx:85", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 src/components/search/CommandPalette.tsx:85"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-0562eaf6f01b7b0a", "name": "`truncate` class without `title=` for hover reveal \u2014 src/components/tools/MultiEnvDiffView.tsx:266", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 src/components/tools/MultiEnvDiffView.tsx:266"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-92bde8d383943f40", "name": "`truncate` class without `title=` for hover reveal \u2014 src/components/tools/ProjectToolsView.tsx:169", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 src/components/tools/ProjectToolsView.tsx:169"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-45a9ba41d423d34f", "name": "`truncate` class without `title=` for hover reveal \u2014 src/components/channels/ChannelTestTab.tsx:103", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 src/components/channels/ChannelTestTab.tsx:103"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-7ca311874c61b791", "name": "`dangerouslySetInnerHTML` used in a React component \u2014 src/components/channels/ChannelDocTab.tsx:26", "shortDescription": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 src/components/channels/ChannelDocTab.tsx:26"}, "fullDescription": {"text": "Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library.\n\nWhy: OWASP basics. Already partially flagged by the security analyzer.\nRule id: fq.dangerous-html"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-065b6f8bdc2cd7c5", "name": "`truncate` class without `title=` for hover reveal \u2014 src/components/channels/ChannelsView.tsx:132", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 src/components/channels/ChannelsView.tsx:132"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-e7f565914076ec13", "name": "`truncate` class without `title=` for hover reveal \u2014 src/components/console/ConsoleListPage.tsx:190", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 src/components/console/ConsoleListPage.tsx:190"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-1af63b6c1ee45221", "name": "`truncate` class without `title=` for hover reveal \u2014 src/components/console/templates/SearchResultsTemplate.tsx:124", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 src/components/console/templates/SearchResultsTemplate.tsx:124"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-1e7218fca7a8197a", "name": "`truncate` class without `title=` for hover reveal \u2014 src/components/console/templates/ActionListTemplate.tsx:27", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 src/components/console/templates/ActionListTemplate.tsx:27"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-239f65238ce5a7bf", "name": "`truncate` class without `title=` for hover reveal \u2014 src/components/console/templates/UploadTemplate.tsx:111", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 src/components/console/templates/UploadTemplate.tsx:111"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-9ba0e986729cf751", "name": "`truncate` class without `title=` for hover reveal \u2014 src/components/console/builder/StatsConfigEditor.tsx:79", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 src/components/console/builder/StatsConfigEditor.tsx:79"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-0f10c364b6c79a4f", "name": "`truncate` class without `title=` for hover reveal \u2014 src/components/console/builder/ComponentLibrary.tsx:64", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 src/components/console/builder/ComponentLibrary.tsx:64"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-1b8084fb8a5268d8", "name": "`truncate` class without `title=` for hover reveal \u2014 src/components/console/builder/SortableFieldItem.tsx:51", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 src/components/console/builder/SortableFieldItem.tsx:51"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-e847dfe8d3dd08cd", "name": "Stray `console.log` in TS/JS \u2014 src/lib/asyncapi/build-ws-snippet.ts:57", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 src/lib/asyncapi/build-ws-snippet.ts:57"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9269f4675f03ac27", "name": "Insecure pattern 'node_child_process' in vite.config.ts:6", "shortDescription": {"text": "Insecure pattern 'node_child_process' in vite.config.ts:6"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0672e9e1cafc3293", "name": "Possible secret in src/components/settings/AuthSettings.tsx", "shortDescription": {"text": "Possible secret in src/components/settings/AuthSettings.tsx"}, "fullDescription": {"text": "Detected pattern matching password_literal. Rotate the credential and move to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-6b82ee18a0121501", "name": "Insecure pattern 'dangerous_innerhtml' in src/components/ui/markdown.tsx:29", "shortDescription": {"text": "Insecure pattern 'dangerous_innerhtml' in src/components/ui/markdown.tsx:29"}, "fullDescription": {"text": "Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f36756e4816e3f59", "name": "Insecure pattern 'dangerous_innerhtml' in src/components/ui/chart.tsx:95", "shortDescription": {"text": "Insecure pattern 'dangerous_innerhtml' in src/components/ui/chart.tsx:95"}, "fullDescription": {"text": "Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6f9679f99cd1e3ed", "name": "Insecure pattern 'dangerous_innerhtml' in src/components/schema/SchemaTree.tsx:69", "shortDescription": {"text": "Insecure pattern 'dangerous_innerhtml' in src/components/schema/SchemaTree.tsx:69"}, "fullDescription": {"text": "Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a1ea3e29d21c79f4", "name": "Insecure pattern 'dangerous_innerhtml' in src/components/channels/ChannelDocTab.tsx:26", "shortDescription": {"text": "Insecure pattern 'dangerous_innerhtml' in src/components/channels/ChannelDocTab.tsx:26"}, "fullDescription": {"text": "Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-dec6dfb32972597f", "name": "Possible secret in src/lib/openapi/parser.ts", "shortDescription": {"text": "Possible secret in src/lib/openapi/parser.ts"}, "fullDescription": {"text": "Detected pattern matching password_literal. Rotate the credential and move to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-27924aa79fa4a517", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/attest-build-provenance@v2 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-64192a3c67110d01", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6893a6c8b0861585", "name": "Very low test-to-source ratio", "shortDescription": {"text": "Very low test-to-source ratio"}, "fullDescription": {"text": "25 test file(s) for 252 source file(s) (ratio 0.10). Consider adding integration or unit tests for critical paths."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 14 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-72b2a6250083a784", "name": "Placeholder or mock-heavy implementation detected", "shortDescription": {"text": "Placeholder or mock-heavy implementation detected"}, "fullDescription": {"text": "Found 87 placeholder/mock markers across 37 source files. This often means the repo looks complete while core flows still use generated scaffolding or fake data."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-cc55229a7a3c078d", "name": "Agent authority lacks a verifier contract: .mcp.json", "shortDescription": {"text": "Agent authority lacks a verifier contract: .mcp.json"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-39efd6fd34195900", "name": "`fetch()` without try/.catch or AbortSignal \u2014 src/components/tools/MultiEnvDiffView.tsx:121", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/components/tools/MultiEnvDiffView.tsx:121"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b5aa69d7a5d842e3", "name": "`fetch()` without try/.catch or AbortSignal \u2014 src/lib/openapi/parser.ts:57", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/lib/openapi/parser.ts:57"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b102b599d3098e7f", "name": "Commented-code block (5 lines) in src/lib/openapi/generate-example.ts:277", "shortDescription": {"text": "Commented-code block (5 lines) in src/lib/openapi/generate-example.ts:277"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-53edb65934ccdd37", "name": "Commented-code block (5 lines) in src/lib/openapi/url-guard.ts:1", "shortDescription": {"text": "Commented-code block (5 lines) in src/lib/openapi/url-guard.ts:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-34261f2edfde5159", "name": "`fetch()` without try/.catch or AbortSignal \u2014 src/hooks/use-multi-env-status.ts:113", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/hooks/use-multi-env-status.ts:113"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/23394"}, "properties": {"repository": "Yuerchu/Apilot", "repoUrl": "https://github.com/Yuerchu/Apilot", "branch": "main"}, "results": [{"ruleId": "scanner-596d5291a1db5b0a", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 cli/src/build-template.ts:66"}, "properties": {"repobilityId": "e9524be6bb607260", "scanner": "scanner-primary", "fingerprint": "596d5291a1db5b0a", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-cdfc11699018d5ac", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 cli/src/index.ts:123"}, "properties": {"repobilityId": "6be0a382ee9892de", "scanner": "scanner-primary", "fingerprint": "cdfc11699018d5ac", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-18b1145875a0f7eb", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 src/components/settings/AuthSettings.tsx:128"}, "properties": {"repobilityId": "f249dca795c86fda", "scanner": "scanner-primary", "fingerprint": "18b1145875a0f7eb", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-918ee3b10033f2eb", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 src/components/settings/ConnectionSettings.tsx:258"}, "properties": {"repobilityId": "8be14ad6bafb5b7d", "scanner": "scanner-primary", "fingerprint": "918ee3b10033f2eb", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-c8f8841f2dbca767", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 src/components/layout/AppSidebar.tsx:164"}, "properties": {"repobilityId": "4e138d87902dc6ca", "scanner": "scanner-primary", "fingerprint": "c8f8841f2dbca767", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-e59341d9b411f48f", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 src/components/layout/EnvironmentSwitcher.tsx:65"}, "properties": {"repobilityId": "d95006fc6f6b4d0f", "scanner": "scanner-primary", "fingerprint": "e59341d9b411f48f", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-29ccdae73918686f", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 src/components/layout/WorkspaceSwitcher.tsx:78"}, "properties": {"repobilityId": "0a7e5008eec5eab7", "scanner": "scanner-primary", "fingerprint": "29ccdae73918686f", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-2c7a1532676ba806", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 src/components/layout/Header.tsx:60"}, "properties": {"repobilityId": "c848c722ce61f0cc", "scanner": "scanner-primary", "fingerprint": "2c7a1532676ba806", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-751a53b093e831d3", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 src/components/endpoints/TryTab.tsx:104"}, "properties": {"repobilityId": "d8702ecc48c03a16", "scanner": "scanner-primary", "fingerprint": "751a53b093e831d3", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-da18f0cd84ac7e33", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 src/components/endpoints/ResponseAgGrid.tsx:84"}, "properties": {"repobilityId": "5facfc3439457455", "scanner": "scanner-primary", "fingerprint": "da18f0cd84ac7e33", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-2c737be3e3ac4811", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 src/components/endpoints/RouteCard.tsx:118"}, "properties": {"repobilityId": "3ddd8090677a5a14", "scanner": "scanner-primary", "fingerprint": "2c737be3e3ac4811", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-ceef73ad90b2e36d", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 src/components/endpoints/HistoryTab.tsx:153"}, "properties": {"repobilityId": "80465bc7274c3867", "scanner": "scanner-primary", "fingerprint": "ceef73ad90b2e36d", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-271f9088d49219f4", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 src/components/endpoints/EndpointFilterBar.tsx:179"}, "properties": {"repobilityId": "04fac15103e63645", "scanner": "scanner-primary", "fingerprint": "271f9088d49219f4", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-054bce6b1b8e359c", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 src/components/models/ModelCard.tsx:100"}, "properties": {"repobilityId": "ea764c274875bb59", "scanner": "scanner-primary", "fingerprint": "054bce6b1b8e359c", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-764b5c8444d538cd", "level": "note", "message": {"text": "React Flow <Controls> without dark theming \u2014 src/components/models/ModelGraphView.tsx:1133"}, "properties": {"repobilityId": "109b68994c9d1daf", "scanner": "scanner-primary", "fingerprint": "764b5c8444d538cd", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.controls.no-bg"]}}, {"ruleId": "scanner-2a6ac93cb4318add", "level": "warning", "message": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 src/components/ui/markdown.tsx:29"}, "properties": {"repobilityId": "943cfc0684827064", "scanner": "scanner-primary", "fingerprint": "2a6ac93cb4318add", "layer": "frontend", "severity": "medium", "confidence": 1.0, "tags": ["frontend-quality", "fq.dangerous-html"]}}, {"ruleId": "scanner-0a48e75d45cd7fc6", "level": "warning", "message": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 src/components/ui/chart.tsx:95"}, "properties": {"repobilityId": "b8c68f17a4018107", "scanner": "scanner-primary", "fingerprint": "0a48e75d45cd7fc6", "layer": "frontend", "severity": "medium", "confidence": 1.0, "tags": ["frontend-quality", "fq.dangerous-html"]}}, {"ruleId": "scanner-d2643b29e4b7071c", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 src/components/schema/SchemaInput.tsx:176"}, "properties": {"repobilityId": "555409507cebf53b", "scanner": "scanner-primary", "fingerprint": "d2643b29e4b7071c", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-cb98bc08ea8e4628", "level": "warning", "message": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 src/components/schema/SchemaTree.tsx:69"}, "properties": {"repobilityId": "3ed39642877e2e43", "scanner": "scanner-primary", "fingerprint": "cb98bc08ea8e4628", "layer": "frontend", "severity": "medium", "confidence": 1.0, "tags": ["frontend-quality", "fq.dangerous-html"]}}, {"ruleId": "scanner-f5650e3f67608379", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 src/components/schema/SchemaViewerView.tsx:181"}, "properties": {"repobilityId": "f39c3944026eb694", "scanner": "scanner-primary", "fingerprint": "f5650e3f67608379", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-9020370542b9b449", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 src/components/schema/PhoneInput.tsx:211"}, "properties": {"repobilityId": "4c74df0378d8a8f9", "scanner": "scanner-primary", "fingerprint": "9020370542b9b449", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-58344c76683ec3bc", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 src/components/search/CommandPalette.tsx:85"}, "properties": {"repobilityId": "c4eeb69c88b0c31a", "scanner": "scanner-primary", "fingerprint": "58344c76683ec3bc", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-0562eaf6f01b7b0a", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 src/components/tools/MultiEnvDiffView.tsx:266"}, "properties": {"repobilityId": "f3333823013af7d0", "scanner": "scanner-primary", "fingerprint": "0562eaf6f01b7b0a", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-92bde8d383943f40", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 src/components/tools/ProjectToolsView.tsx:169"}, "properties": {"repobilityId": "101ef4435a00fb48", "scanner": "scanner-primary", "fingerprint": "92bde8d383943f40", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-45a9ba41d423d34f", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 src/components/channels/ChannelTestTab.tsx:103"}, "properties": {"repobilityId": "201b8b9e779a07a2", "scanner": "scanner-primary", "fingerprint": "45a9ba41d423d34f", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-7ca311874c61b791", "level": "warning", "message": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 src/components/channels/ChannelDocTab.tsx:26"}, "properties": {"repobilityId": "6536c82c5f76ec1c", "scanner": "scanner-primary", "fingerprint": "7ca311874c61b791", "layer": "frontend", "severity": "medium", "confidence": 1.0, "tags": ["frontend-quality", "fq.dangerous-html"]}}, {"ruleId": "scanner-065b6f8bdc2cd7c5", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 src/components/channels/ChannelsView.tsx:132"}, "properties": {"repobilityId": "88a06d317bb88704", "scanner": "scanner-primary", "fingerprint": "065b6f8bdc2cd7c5", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-e7f565914076ec13", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 src/components/console/ConsoleListPage.tsx:190"}, "properties": {"repobilityId": "c22fdf9e498e0554", "scanner": "scanner-primary", "fingerprint": "e7f565914076ec13", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-1af63b6c1ee45221", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 src/components/console/templates/SearchResultsTemplate.tsx:124"}, "properties": {"repobilityId": "6c9dd26a97208629", "scanner": "scanner-primary", "fingerprint": "1af63b6c1ee45221", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-1e7218fca7a8197a", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 src/components/console/templates/ActionListTemplate.tsx:27"}, "properties": {"repobilityId": "d54126c1d0f099c7", "scanner": "scanner-primary", "fingerprint": "1e7218fca7a8197a", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-239f65238ce5a7bf", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 src/components/console/templates/UploadTemplate.tsx:111"}, "properties": {"repobilityId": "8edd03bf642b3633", "scanner": "scanner-primary", "fingerprint": "239f65238ce5a7bf", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-9ba0e986729cf751", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 src/components/console/builder/StatsConfigEditor.tsx:79"}, "properties": {"repobilityId": "007aa983f02b7c82", "scanner": "scanner-primary", "fingerprint": "9ba0e986729cf751", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-0f10c364b6c79a4f", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 src/components/console/builder/ComponentLibrary.tsx:64"}, "properties": {"repobilityId": "1994df7fd9bd299a", "scanner": "scanner-primary", "fingerprint": "0f10c364b6c79a4f", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-1b8084fb8a5268d8", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 src/components/console/builder/SortableFieldItem.tsx:51"}, "properties": {"repobilityId": "87a879ae1aac4e83", "scanner": "scanner-primary", "fingerprint": "1b8084fb8a5268d8", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-e847dfe8d3dd08cd", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 src/lib/asyncapi/build-ws-snippet.ts:57"}, "properties": {"repobilityId": "e21bce35ff8aaa74", "scanner": "scanner-primary", "fingerprint": "e847dfe8d3dd08cd", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-9269f4675f03ac27", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in vite.config.ts:6"}, "properties": {"repobilityId": "b194fcea7803da43", "scanner": "scanner-primary", "fingerprint": "9269f4675f03ac27", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "vite.config.ts"}, "region": {"startLine": 6}}}]}, {"ruleId": "scanner-0672e9e1cafc3293", "level": "error", "message": {"text": "Possible secret in src/components/settings/AuthSettings.tsx"}, "properties": {"repobilityId": "4173711ffcaa301d", "scanner": "scanner-primary", "fingerprint": "0672e9e1cafc3293", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/components/settings/AuthSettings.tsx"}, "region": {"startLine": 48}}}]}, {"ruleId": "scanner-6b82ee18a0121501", "level": "warning", "message": {"text": "Insecure pattern 'dangerous_innerhtml' in src/components/ui/markdown.tsx:29"}, "properties": {"repobilityId": "29727369567ca58f", "scanner": "scanner-primary", "fingerprint": "6b82ee18a0121501", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "dangerous_innerhtml"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/components/ui/markdown.tsx"}, "region": {"startLine": 29}}}]}, {"ruleId": "scanner-f36756e4816e3f59", "level": "warning", "message": {"text": "Insecure pattern 'dangerous_innerhtml' in src/components/ui/chart.tsx:95"}, "properties": {"repobilityId": "33f10636e53b4298", "scanner": "scanner-primary", "fingerprint": "f36756e4816e3f59", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "dangerous_innerhtml"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/components/ui/chart.tsx"}, "region": {"startLine": 95}}}]}, {"ruleId": "scanner-6f9679f99cd1e3ed", "level": "warning", "message": {"text": "Insecure pattern 'dangerous_innerhtml' in src/components/schema/SchemaTree.tsx:69"}, "properties": {"repobilityId": "5952b47ee2005844", "scanner": "scanner-primary", "fingerprint": "6f9679f99cd1e3ed", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "dangerous_innerhtml"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/components/schema/SchemaTree.tsx"}, "region": {"startLine": 69}}}]}, {"ruleId": "scanner-a1ea3e29d21c79f4", "level": "warning", "message": {"text": "Insecure pattern 'dangerous_innerhtml' in src/components/channels/ChannelDocTab.tsx:26"}, "properties": {"repobilityId": "62ad3c2af6585443", "scanner": "scanner-primary", "fingerprint": "a1ea3e29d21c79f4", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "dangerous_innerhtml"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/components/channels/ChannelDocTab.tsx"}, "region": {"startLine": 26}}}]}, {"ruleId": "scanner-dec6dfb32972597f", "level": "error", "message": {"text": "Possible secret in src/lib/openapi/parser.ts"}, "properties": {"repobilityId": "7f3efdc6287404eb", "scanner": "scanner-primary", "fingerprint": "dec6dfb32972597f", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/lib/openapi/parser.ts"}, "region": {"startLine": 262}}}]}, {"ruleId": "scanner-27924aa79fa4a517", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "abddef176b2038b4", "scanner": "scanner-primary", "fingerprint": "27924aa79fa4a517", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 49}}}]}, {"ruleId": "scanner-27924aa79fa4a517", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "bd7f3c1c34d83159", "scanner": "scanner-primary", "fingerprint": "27924aa79fa4a517", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 54}}}]}, {"ruleId": "scanner-27924aa79fa4a517", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "0dc55539758d3645", "scanner": "scanner-primary", "fingerprint": "27924aa79fa4a517", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 69}}}]}, {"ruleId": "scanner-27924aa79fa4a517", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "543e3a7666daf814", "scanner": "scanner-primary", "fingerprint": "27924aa79fa4a517", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 75}}}]}, {"ruleId": "scanner-64192a3c67110d01", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "87338a8bfcb6f435", "scanner": "scanner-primary", "fingerprint": "64192a3c67110d01", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6893a6c8b0861585", "level": "warning", "message": {"text": "Very low test-to-source ratio"}, "properties": {"repobilityId": "54a7de3f06314bf0", "scanner": "scanner-primary", "fingerprint": "6893a6c8b0861585", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["tests", "coverage"]}}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "00658c05e2732704", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-72b2a6250083a784", "level": "warning", "message": {"text": "Placeholder or mock-heavy implementation detected"}, "properties": {"repobilityId": "dd360d8a2397d894", "scanner": "scanner-primary", "fingerprint": "72b2a6250083a784", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "incomplete", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "138a97155e3f2883", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "9ffbd3266f217eba", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "0589ea0e0ee97c4c", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-cc55229a7a3c078d", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .mcp.json"}, "properties": {"repobilityId": "51942fb3d5b8b5b4", "scanner": "scanner-primary", "fingerprint": "cc55229a7a3c078d", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "mcp_config"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".mcp.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-39efd6fd34195900", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/components/tools/MultiEnvDiffView.tsx:121"}, "properties": {"repobilityId": "e0da7a959b9e8881", "scanner": "scanner-primary", "fingerprint": "39efd6fd34195900", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-b5aa69d7a5d842e3", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/lib/openapi/parser.ts:57"}, "properties": {"repobilityId": "302b928381c3d904", "scanner": "scanner-primary", "fingerprint": "b5aa69d7a5d842e3", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-b102b599d3098e7f", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/lib/openapi/generate-example.ts:277"}, "properties": {"repobilityId": "bca56dacbf978437", "scanner": "scanner-primary", "fingerprint": "b102b599d3098e7f", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-53edb65934ccdd37", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/lib/openapi/url-guard.ts:1"}, "properties": {"repobilityId": "bc1f8fb6e4fbb08d", "scanner": "scanner-primary", "fingerprint": "53edb65934ccdd37", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-34261f2edfde5159", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/hooks/use-multi-env-status.ts:113"}, "properties": {"repobilityId": "855af9269a381d5f", "scanner": "scanner-primary", "fingerprint": "34261f2edfde5159", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}]}]}