{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-bead75b0f9233e05", "name": "No API endpoints detected", "shortDescription": {"text": "No API endpoints detected"}, "fullDescription": {"text": "The scanner did not find FastAPI/Flask/Express/NestJS/GraphQL/gRPC routes. If this repo exposes APIs, the framework may be unsupported."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "info", "confidence": 1.0}}, {"id": "scanner-9c1455f57bf2de40", "name": "Stray `console.log` in TS/JS \u2014 tests/e2e/regenerate-card.spec.ts:37", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 tests/e2e/regenerate-card.spec.ts:37"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-53cc4545965eada0", "name": "Stray `console.log` in TS/JS \u2014 assets/techwind/js/plugins.init.js:633", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 assets/techwind/js/plugins.init.js:633"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c9fefb70e0d10cb2", "name": "Stray `console.log` in TS/JS \u2014 tools/carousel-render/render.js:61", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 tools/carousel-render/render.js:61"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fda8d27860d7c8bd", "name": "Insecure pattern 'direct_innerhtml_assignment' in assets/js/cardify-forms.js:156", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in assets/js/cardify-forms.js:156"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b2bcb90278958c0d", "name": "Insecure pattern 'new_function_used' in assets/js/alpine-3.15.12.min.js:5", "shortDescription": {"text": "Insecure pattern 'new_function_used' in assets/js/alpine-3.15.12.min.js:5"}, "fullDescription": {"text": "Found a known-risky pattern (new_function_used). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-3f68a100e9e403f6", "name": "Insecure pattern 'direct_innerhtml_assignment' in assets/js/alpine-3.15.12.min.js:5", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in assets/js/alpine-3.15.12.min.js:5"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-07f83e1a33540b34", "name": "Insecure pattern 'direct_innerhtml_assignment' in assets/js/cardify-toast.js:73", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in assets/js/cardify-toast.js:73"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-910fb3bf380f044f", "name": "Insecure pattern 'direct_innerhtml_assignment' in assets/js/fontawesome.js:6", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in assets/js/fontawesome.js:6"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3b913866d08f62ca", "name": "Insecure pattern 'direct_outerhtml_assignment' in assets/js/fontawesome.js:6", "shortDescription": {"text": "Insecure pattern 'direct_outerhtml_assignment' in assets/js/fontawesome.js:6"}, "fullDescription": {"text": "Found a known-risky pattern (direct_outerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-01f1f5b7909c15b1", "name": "Insecure pattern 'direct_innerhtml_assignment' in assets/techwind/js/easy_background.js:27", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in assets/techwind/js/easy_background.js:27"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d8bdcd9acf063e6d", "name": "Insecure pattern 'direct_innerhtml_assignment' in assets/techwind/js/plugins.init.js:506", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in assets/techwind/js/plugins.init.js:506"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-175009cf537158a7", "name": "Insecure pattern 'direct_innerhtml_assignment' in assets/techwind/js/app.js:245", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in assets/techwind/js/app.js:245"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-29e1f0dd45f1ec70", "name": "Insecure pattern 'direct_innerhtml_assignment' in analytics-ui/src/main.tsx:29", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in analytics-ui/src/main.tsx:29"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-468cbe0ae136b710", "name": "Very large file: scripts/parse_card_pdf.py (1088 lines)", "shortDescription": {"text": "Very large file: scripts/parse_card_pdf.py (1088 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-400fda903a872c08", "name": "Very large file: assets/js/card-editor.js (1801 lines)", "shortDescription": {"text": "Very large file: assets/js/card-editor.js (1801 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f40fcbf8eae69d6a", "name": "Very large file: assets/techwind/js/plugins.init.js (1668 lines)", "shortDescription": {"text": "Very large file: assets/techwind/js/plugins.init.js (1668 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-890d46966f9de23b", "name": "Node manifest has dependencies but no lockfile: convex/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: convex/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-74b171534167b558", "name": "Node manifest has dependencies but no lockfile: analytics-ui/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: analytics-ui/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-547f7f69492c3830", "name": "Node manifest has dependencies but no lockfile: tools/carousel-render/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: tools/carousel-render/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 103 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-72b2a6250083a784", "name": "Placeholder or mock-heavy implementation detected", "shortDescription": {"text": "Placeholder or mock-heavy implementation detected"}, "fullDescription": {"text": "Found 379 placeholder/mock markers across 109 source files. This often means the repo looks complete while core flows still use generated scaffolding or fake data."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-749d4bc1bd66df5f", "name": "Agent instructions exist but release-hardening basics are missing", "shortDescription": {"text": "Agent instructions exist but release-hardening basics are missing"}, "fullDescription": {"text": "AI-coder instruction files were found, but the repo is missing lockfile. Treat this as a contract gap: the agent is guided, but the generated output is not yet guarded by the controls that make it repeatable."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-739cc2fad50c942f", "name": "Commented-code block (6 lines) in tests/e2e/header-footer-audit.spec.ts:83", "shortDescription": {"text": "Commented-code block (6 lines) in tests/e2e/header-footer-audit.spec.ts:83"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-0dbfb1a3edbd4b37", "name": "Commented-code block (5 lines) in tests/e2e/cardify-core.spec.ts:185", "shortDescription": {"text": "Commented-code block (5 lines) in tests/e2e/cardify-core.spec.ts:185"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-85cc10bfece79f0b", "name": "Commented-code block (6 lines) in tests/e2e/vector-pdf.spec.ts:12", "shortDescription": {"text": "Commented-code block (6 lines) in tests/e2e/vector-pdf.spec.ts:12"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-1ad2a4fd191c3c80", "name": "Commented-code block (5 lines) in tests/e2e/i18n-leak.spec.ts:94", "shortDescription": {"text": "Commented-code block (5 lines) in tests/e2e/i18n-leak.spec.ts:94"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-763b40397d07825a", "name": "Commented-code block (5 lines) in ops/k6-load-test.js:8", "shortDescription": {"text": "Commented-code block (5 lines) in ops/k6-load-test.js:8"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-722e482c0b55066d", "name": "Commented-code block (5 lines) in scripts/parse_card_pdf.py:237", "shortDescription": {"text": "Commented-code block (5 lines) in scripts/parse_card_pdf.py:237"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-eeabb54b80038263", "name": "Commented-code block (5 lines) in scripts/render-card-pdf.py:56", "shortDescription": {"text": "Commented-code block (5 lines) in scripts/render-card-pdf.py:56"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-b792a2e3c5a28427", "name": "Commented-code block (5 lines) in assets/js/card-editor.js:454", "shortDescription": {"text": "Commented-code block (5 lines) in assets/js/card-editor.js:454"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-dfb3be1a4f53cc86", "name": "`fetch()` without try/.catch or AbortSignal \u2014 assets/js/card-editor.js:1483", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 assets/js/card-editor.js:1483"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-08e681c137392c46", "name": "Commented-code block (5 lines) in assets/js/font-loader.js:262", "shortDescription": {"text": "Commented-code block (5 lines) in assets/js/font-loader.js:262"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-b27439d62b332bd2", "name": "`fetch()` without try/.catch or AbortSignal \u2014 assets/js/cardify-webvitals.js:14", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 assets/js/cardify-webvitals.js:14"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/23482"}, "properties": {"repository": "zaabi1995/business-card-generator", "repoUrl": "https://github.com/zaabi1995/business-card-generator", "branch": "main"}, "results": [{"ruleId": "scanner-bead75b0f9233e05", "level": "none", "message": {"text": "No API endpoints detected"}, "properties": {"repobilityId": "0f8bb852027c38f8", "scanner": "scanner-primary", "fingerprint": "bead75b0f9233e05", "layer": "api", "severity": "info", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-9c1455f57bf2de40", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 tests/e2e/regenerate-card.spec.ts:37"}, "properties": {"repobilityId": "aaab53a1aa24267d", "scanner": "scanner-primary", "fingerprint": "9c1455f57bf2de40", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-53cc4545965eada0", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 assets/techwind/js/plugins.init.js:633"}, "properties": {"repobilityId": "76ac80e02e37f06e", "scanner": "scanner-primary", "fingerprint": "53cc4545965eada0", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-c9fefb70e0d10cb2", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 tools/carousel-render/render.js:61"}, "properties": {"repobilityId": "4401d319935fcb73", "scanner": "scanner-primary", "fingerprint": "c9fefb70e0d10cb2", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-fda8d27860d7c8bd", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in assets/js/cardify-forms.js:156"}, "properties": {"repobilityId": "398ec5864def9a33", "scanner": "scanner-primary", "fingerprint": "fda8d27860d7c8bd", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "assets/js/cardify-forms.js"}, "region": {"startLine": 156}}}]}, {"ruleId": "scanner-b2bcb90278958c0d", "level": "error", "message": {"text": "Insecure pattern 'new_function_used' in assets/js/alpine-3.15.12.min.js:5"}, "properties": {"repobilityId": "2891c7d560f2decc", "scanner": "scanner-primary", "fingerprint": "b2bcb90278958c0d", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "new_function_used"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "assets/js/alpine-3.15.12.min.js"}, "region": {"startLine": 5}}}]}, {"ruleId": "scanner-3f68a100e9e403f6", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in assets/js/alpine-3.15.12.min.js:5"}, "properties": {"repobilityId": "76dff622cb586de3", "scanner": "scanner-primary", "fingerprint": "3f68a100e9e403f6", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "assets/js/alpine-3.15.12.min.js"}, "region": {"startLine": 5}}}]}, {"ruleId": "scanner-07f83e1a33540b34", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in assets/js/cardify-toast.js:73"}, "properties": {"repobilityId": "96c8100a8c016e1f", "scanner": "scanner-primary", "fingerprint": "07f83e1a33540b34", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "assets/js/cardify-toast.js"}, "region": {"startLine": 73}}}]}, {"ruleId": "scanner-910fb3bf380f044f", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in assets/js/fontawesome.js:6"}, "properties": {"repobilityId": "c7e9b454d14f08ca", "scanner": "scanner-primary", "fingerprint": "910fb3bf380f044f", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "assets/js/fontawesome.js"}, "region": {"startLine": 6}}}]}, {"ruleId": "scanner-3b913866d08f62ca", "level": "warning", "message": {"text": "Insecure pattern 'direct_outerhtml_assignment' in assets/js/fontawesome.js:6"}, "properties": {"repobilityId": "ea474b6ce6625b2f", "scanner": "scanner-primary", "fingerprint": "3b913866d08f62ca", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_outerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "assets/js/fontawesome.js"}, "region": {"startLine": 6}}}]}, {"ruleId": "scanner-01f1f5b7909c15b1", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in assets/techwind/js/easy_background.js:27"}, "properties": {"repobilityId": "334b715655834085", "scanner": "scanner-primary", "fingerprint": "01f1f5b7909c15b1", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "assets/techwind/js/easy_background.js"}, "region": {"startLine": 27}}}]}, {"ruleId": "scanner-d8bdcd9acf063e6d", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in assets/techwind/js/plugins.init.js:506"}, "properties": {"repobilityId": "05b7ea8804e90b04", "scanner": "scanner-primary", "fingerprint": "d8bdcd9acf063e6d", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "assets/techwind/js/plugins.init.js"}, "region": {"startLine": 506}}}]}, {"ruleId": "scanner-175009cf537158a7", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in assets/techwind/js/app.js:245"}, "properties": {"repobilityId": "2606dbc407c6a936", "scanner": "scanner-primary", "fingerprint": "175009cf537158a7", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "assets/techwind/js/app.js"}, "region": {"startLine": 245}}}]}, {"ruleId": "scanner-29e1f0dd45f1ec70", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in analytics-ui/src/main.tsx:29"}, "properties": {"repobilityId": "ef20e208f953c95a", "scanner": "scanner-primary", "fingerprint": "29e1f0dd45f1ec70", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "analytics-ui/src/main.tsx"}, "region": {"startLine": 29}}}]}, {"ruleId": "scanner-468cbe0ae136b710", "level": "note", "message": {"text": "Very large file: scripts/parse_card_pdf.py (1088 lines)"}, "properties": {"repobilityId": "c089c558e60065a3", "scanner": "scanner-primary", "fingerprint": "468cbe0ae136b710", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-400fda903a872c08", "level": "note", "message": {"text": "Very large file: assets/js/card-editor.js (1801 lines)"}, "properties": {"repobilityId": "79776067d7ef1cf8", "scanner": "scanner-primary", "fingerprint": "400fda903a872c08", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-f40fcbf8eae69d6a", "level": "note", "message": {"text": "Very large file: assets/techwind/js/plugins.init.js (1668 lines)"}, "properties": {"repobilityId": "c6c6c2430ddd3db5", "scanner": "scanner-primary", "fingerprint": "f40fcbf8eae69d6a", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-890d46966f9de23b", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: convex/package.json"}, "properties": {"repobilityId": "8109f3c89b21666f", "scanner": "scanner-primary", "fingerprint": "890d46966f9de23b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "convex/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-74b171534167b558", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: analytics-ui/package.json"}, "properties": {"repobilityId": "c21aac6d3cf888a2", "scanner": "scanner-primary", "fingerprint": "74b171534167b558", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "analytics-ui/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-547f7f69492c3830", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: tools/carousel-render/package.json"}, "properties": {"repobilityId": "12bb3ca203be07f3", "scanner": "scanner-primary", "fingerprint": "547f7f69492c3830", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/carousel-render/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "b922cd4130e51531", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-72b2a6250083a784", "level": "warning", "message": {"text": "Placeholder or mock-heavy implementation detected"}, "properties": {"repobilityId": "05c1fb3497ca4a20", "scanner": "scanner-primary", "fingerprint": "72b2a6250083a784", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "incomplete", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "42004b136a3054ee", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-749d4bc1bd66df5f", "level": "warning", "message": {"text": "Agent instructions exist but release-hardening basics are missing"}, "properties": {"repobilityId": "d55a7812557e79db", "scanner": "scanner-primary", "fingerprint": "749d4bc1bd66df5f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "de712419646c516b", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "c8cdd40853443d19", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-739cc2fad50c942f", "level": "none", "message": {"text": "Commented-code block (6 lines) in tests/e2e/header-footer-audit.spec.ts:83"}, "properties": {"repobilityId": "b8c8cfdd2fe735cd", "scanner": "scanner-primary", "fingerprint": "739cc2fad50c942f", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-0dbfb1a3edbd4b37", "level": "none", "message": {"text": "Commented-code block (5 lines) in tests/e2e/cardify-core.spec.ts:185"}, "properties": {"repobilityId": "443b9a5367e5d77d", "scanner": "scanner-primary", "fingerprint": "0dbfb1a3edbd4b37", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-85cc10bfece79f0b", "level": "none", "message": {"text": "Commented-code block (6 lines) in tests/e2e/vector-pdf.spec.ts:12"}, "properties": {"repobilityId": "ad54fa58a96f4b9f", "scanner": "scanner-primary", "fingerprint": "85cc10bfece79f0b", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-1ad2a4fd191c3c80", "level": "none", "message": {"text": "Commented-code block (5 lines) in tests/e2e/i18n-leak.spec.ts:94"}, "properties": {"repobilityId": "acb44fadb21cbc1e", "scanner": "scanner-primary", "fingerprint": "1ad2a4fd191c3c80", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-763b40397d07825a", "level": "none", "message": {"text": "Commented-code block (5 lines) in ops/k6-load-test.js:8"}, "properties": {"repobilityId": "a027cc5375b7a280", "scanner": "scanner-primary", "fingerprint": "763b40397d07825a", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-722e482c0b55066d", "level": "none", "message": {"text": "Commented-code block (5 lines) in scripts/parse_card_pdf.py:237"}, "properties": {"repobilityId": "077ef59306861080", "scanner": "scanner-primary", "fingerprint": "722e482c0b55066d", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-eeabb54b80038263", "level": "none", "message": {"text": "Commented-code block (5 lines) in scripts/render-card-pdf.py:56"}, "properties": {"repobilityId": "ff463a250538e1e0", "scanner": "scanner-primary", "fingerprint": "eeabb54b80038263", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-b792a2e3c5a28427", "level": "none", "message": {"text": "Commented-code block (5 lines) in assets/js/card-editor.js:454"}, "properties": {"repobilityId": "16a997e8c221ba19", "scanner": "scanner-primary", "fingerprint": "b792a2e3c5a28427", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-dfb3be1a4f53cc86", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 assets/js/card-editor.js:1483"}, "properties": {"repobilityId": "c622e77d1809967e", "scanner": "scanner-primary", "fingerprint": "dfb3be1a4f53cc86", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-08e681c137392c46", "level": "none", "message": {"text": "Commented-code block (5 lines) in assets/js/font-loader.js:262"}, "properties": {"repobilityId": "39e122a98c94a08e", "scanner": "scanner-primary", "fingerprint": "08e681c137392c46", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-b27439d62b332bd2", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 assets/js/cardify-webvitals.js:14"}, "properties": {"repobilityId": "00ab8013bc3b1fee", "scanner": "scanner-primary", "fingerprint": "b27439d62b332bd2", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}]}]}