{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-c9044e56da02e30b", "name": "Stray `console.log` in TS/JS \u2014 Trade-Machine/api/index.js:114", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 Trade-Machine/api/index.js:114"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7c2bdbcc4f5e1a68", "name": "Stray `console.log` in TS/JS \u2014 Trade-Machine/scripts/scraper.js:49", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 Trade-Machine/scripts/scraper.js:49"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8ad49fe564170369", "name": "Stray `console.log` in TS/JS \u2014 Trade-Machine/scripts/find_opportunities.js:51", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 Trade-Machine/scripts/find_opportunities.js:51"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-13d3f6ef542fa6ed", "name": "Stray `console.log` in TS/JS \u2014 Image-Gen/list-models.js:8", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 Image-Gen/list-models.js:8"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9f3817069cbfeae2", "name": "Stray `console.log` in TS/JS \u2014 Image-Gen/src/server.js:62", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 Image-Gen/src/server.js:62"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-27264cb61ff340b2", "name": "Stray `console.log` in TS/JS \u2014 JARVIS/test-catbox.js:20", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 JARVIS/test-catbox.js:20"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-037f380c3f62b057", "name": "Stray `console.log` in TS/JS \u2014 JARVIS/testNews.js:16", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 JARVIS/testNews.js:16"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ee896a19f212e553", "name": "Stray `console.log` in TS/JS \u2014 JARVIS/index.js:62", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 JARVIS/index.js:62"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6286d25133dace8d", "name": "Stray `console.log` in TS/JS \u2014 JARVIS/test-gemini.js:9", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 JARVIS/test-gemini.js:9"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-27fc008e398d57fb", "name": "Stray `console.log` in TS/JS \u2014 JARVIS/src/newsScraper.js:11", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 JARVIS/src/newsScraper.js:11"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2a0ccbb4ce7a90a7", "name": "Stray `console.log` in TS/JS \u2014 JARVIS/src/evaluator.js:20", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 JARVIS/src/evaluator.js:20"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7e8ae0e648cbb54e", "name": "Stray `console.log` in TS/JS \u2014 JARVIS/src/sleeperClient.js:40", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 JARVIS/src/sleeperClient.js:40"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2804aaa6dcfb16c5", "name": "Stray `console.log` in TS/JS \u2014 JARVIS/src/prefixManager.js:89", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 JARVIS/src/prefixManager.js:89"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7302a8e633efa840", "name": "Stray `console.log` in TS/JS \u2014 JARVIS/src/poster.js:77", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 JARVIS/src/poster.js:77"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-df6abf089a876454", "name": "Stray `console.log` in TS/JS \u2014 JARVIS/src/imageClient.js:45", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 JARVIS/src/imageClient.js:45"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3142fcc169defd89", "name": "Stray `console.log` in TS/JS \u2014 JARVIS/src/scraper.js:46", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 JARVIS/src/scraper.js:46"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fbb8e2c292b728a5", "name": "Stray `console.log` in TS/JS \u2014 JARVIS/src/generator.js:42", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 JARVIS/src/generator.js:42"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c7c20e9cc68b7c4d", "name": "Privileged port 13 in use", "shortDescription": {"text": "Privileged port 13 in use"}, "fullDescription": {"text": "Port 13 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-5965f341b422de1f", "name": "Insecure pattern 'cors_wildcard' in Trade-Machine/api/index.js:8", "shortDescription": {"text": "Insecure pattern 'cors_wildcard' in Trade-Machine/api/index.js:8"}, "fullDescription": {"text": "Found a known-risky pattern (cors_wildcard). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-39b213cfd833f450", "name": "Insecure pattern 'node_child_process' in JARVIS/src/imageClient.js:111", "shortDescription": {"text": "Insecure pattern 'node_child_process' in JARVIS/src/imageClient.js:111"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-5ba1f3fda7e6f481", "name": "Insecure pattern 'node_child_process' in JARVIS/src/heartbeat.js:14", "shortDescription": {"text": "Insecure pattern 'node_child_process' in JARVIS/src/heartbeat.js:14"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-fa7e1038562004d2", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-45b0218a462a4a9f", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-16a8a51950c93710", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-bd266b0f0340369d", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-24b85f3b9a7e331f", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea3b5e389d8c9c0f", "name": "Low test-to-source ratio", "shortDescription": {"text": "Low test-to-source ratio"}, "fullDescription": {"text": "4 tests / 30 src (ratio 0.13)."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-141b30a41e03817b", "name": "No license file detected", "shortDescription": {"text": "No license file detected"}, "fullDescription": {"text": "No LICENSE/COPYING/NOTICE file was found. Generated repositories often omit licensing, which blocks reuse and automated intake."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 131 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-72b2a6250083a784", "name": "Placeholder or mock-heavy implementation detected", "shortDescription": {"text": "Placeholder or mock-heavy implementation detected"}, "fullDescription": {"text": "Found 15 placeholder/mock markers across 6 source files. This often means the repo looks complete while core flows still use generated scaffolding or fake data."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-749d4bc1bd66df5f", "name": "Agent instructions exist but release-hardening basics are missing", "shortDescription": {"text": "Agent instructions exist but release-hardening basics are missing"}, "fullDescription": {"text": "AI-coder instruction files were found, but the repo is missing license. Treat this as a contract gap: the agent is guided, but the generated output is not yet guarded by the controls that make it repeatable."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-17d866d91a7c451e", "name": "Agent instruction/config may expose a secret: CLAUDE.md", "shortDescription": {"text": "Agent instruction/config may expose a secret: CLAUDE.md"}, "fullDescription": {"text": "Agent-facing files are routinely pasted into LLM/tool contexts. Move literal tokens, keys, and passwords into a secret manager or document them as placeholders only."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-2c5f98b152cddb6d", "name": "Agent authority lacks a verifier contract: .claude/launch.json", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/launch.json"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7c39f47779f684a9", "name": "`fetch()` without try/.catch or AbortSignal \u2014 Trade-Machine/scripts/scraper.js:39", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 Trade-Machine/scripts/scraper.js:39"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8733c5b45e48bcd7", "name": "`fetch()` without try/.catch or AbortSignal \u2014 Trade-Machine/scripts/find_opportunities.js:84", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 Trade-Machine/scripts/find_opportunities.js:84"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a15d9d35af294cd1", "name": "`fetch()` without try/.catch or AbortSignal \u2014 Trade-Machine/src/components/TradeMachine.jsx:264", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 Trade-Machine/src/components/TradeMachine.jsx:264"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ad5f90ab887e06f3", "name": "`fetch()` without try/.catch or AbortSignal \u2014 JARVIS/src/scraper.js:36", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 JARVIS/src/scraper.js:36"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-816c23fdcfec1442", "name": "Dangling fetch: GET http://localhost:5000/api/rankings (Trade-Machine/scripts/find_opportunities.js:84)", "shortDescription": {"text": "Dangling fetch: GET http://localhost:5000/api/rankings (Trade-Machine/scripts/find_opportunities.js:84)"}, "fullDescription": {"text": "`Trade-Machine/scripts/find_opportunities.js:84` calls `GET http://localhost:5000/api/rankings` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/http:/localhost:5000/api/rankings`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-19ee8c6e0cd148cc", "name": "Dangling fetch: GET https://api.sleeper.app/v1/league/${leagueId}/users (Trade-Machine/scripts/find_opportunities.js:91)", "shortDescription": {"text": "Dangling fetch: GET https://api.sleeper.app/v1/league/${leagueId}/users (Trade-Machine/scripts/find_opportunities.js:91)"}, "fullDescription": {"text": "`Trade-Machine/scripts/find_opportunities.js:91` calls `GET https://api.sleeper.app/v1/league/${leagueId}/users` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/https:/api.sleeper.app/v1/league/<p>/users`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-67253cd14188727b", "name": "Dangling fetch: GET https://api.sleeper.app/v1/league/${leagueId}/rosters (Trade-Machine/scripts/find_opportunities.js:9", "shortDescription": {"text": "Dangling fetch: GET https://api.sleeper.app/v1/league/${leagueId}/rosters (Trade-Machine/scripts/find_opportunities.js:92)"}, "fullDescription": {"text": "`Trade-Machine/scripts/find_opportunities.js:92` calls `GET https://api.sleeper.app/v1/league/${leagueId}/rosters` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/https:/api.sleeper.app/v1/league/<p>/rosters`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-90f035484c721d39", "name": "Dangling fetch: GET /leagues.json (Trade-Machine/src/components/TradeMachine.jsx:75)", "shortDescription": {"text": "Dangling fetch: GET /leagues.json (Trade-Machine/src/components/TradeMachine.jsx:75)"}, "fullDescription": {"text": "`Trade-Machine/src/components/TradeMachine.jsx:75` calls `GET /leagues.json` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/leagues.json`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-a8e380d63503f840", "name": "Dangling fetch: GET /config.json (Trade-Machine/src/components/TradeMachine.jsx:76)", "shortDescription": {"text": "Dangling fetch: GET /config.json (Trade-Machine/src/components/TradeMachine.jsx:76)"}, "fullDescription": {"text": "`Trade-Machine/src/components/TradeMachine.jsx:76` calls `GET /config.json` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/config.json`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-d30e9b540d8caf32", "name": "Dangling fetch: GET https://api.sleeper.app/v1/league/${selectedLeagueId} (Trade-Machine/src/components/TradeMachine.jsx", "shortDescription": {"text": "Dangling fetch: GET https://api.sleeper.app/v1/league/${selectedLeagueId} (Trade-Machine/src/components/TradeMachine.jsx:110)"}, "fullDescription": {"text": "`Trade-Machine/src/components/TradeMachine.jsx:110` calls `GET https://api.sleeper.app/v1/league/${selectedLeagueId}` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/https:/api.sleeper.app/v1/league/<p>`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-efd22664bb6cbf4d", "name": "Dangling fetch: GET https://api.sleeper.app/v1/league/${selectedLeagueId}/users (Trade-Machine/src/components/TradeMachi", "shortDescription": {"text": "Dangling fetch: GET https://api.sleeper.app/v1/league/${selectedLeagueId}/users (Trade-Machine/src/components/TradeMachine.jsx:128)"}, "fullDescription": {"text": "`Trade-Machine/src/components/TradeMachine.jsx:128` calls `GET https://api.sleeper.app/v1/league/${selectedLeagueId}/users` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/https:/api.sleeper.app/v1/league/<p>/users`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-33fc3fe6388947ca", "name": "Dangling fetch: GET https://api.sleeper.app/v1/league/${selectedLeagueId}/rosters (Trade-Machine/src/components/TradeMac", "shortDescription": {"text": "Dangling fetch: GET https://api.sleeper.app/v1/league/${selectedLeagueId}/rosters (Trade-Machine/src/components/TradeMachine.jsx:129)"}, "fullDescription": {"text": "`Trade-Machine/src/components/TradeMachine.jsx:129` calls `GET https://api.sleeper.app/v1/league/${selectedLeagueId}/rosters` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/https:/api.sleeper.app/v1/league/<p>/rosters`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-9b42e3183b8627ca", "name": "Dangling fetch: GET https://api.sleeper.app/v1/league/${selectedLeagueId}/traded_picks (Trade-Machine/src/components/Tra", "shortDescription": {"text": "Dangling fetch: GET https://api.sleeper.app/v1/league/${selectedLeagueId}/traded_picks (Trade-Machine/src/components/TradeMachine.jsx:130)"}, "fullDescription": {"text": "`Trade-Machine/src/components/TradeMachine.jsx:130` calls `GET https://api.sleeper.app/v1/league/${selectedLeagueId}/traded_picks` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/https:/api.sleeper.app/v1/league/<p>/traded_picks`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-43dfda946f98bfe0", "name": "Dangling fetch: GET https://api.sleeper.app/v1/league/${selectedLeagueId}/drafts (Trade-Machine/src/components/TradeMach", "shortDescription": {"text": "Dangling fetch: GET https://api.sleeper.app/v1/league/${selectedLeagueId}/drafts (Trade-Machine/src/components/TradeMachine.jsx:131)"}, "fullDescription": {"text": "`Trade-Machine/src/components/TradeMachine.jsx:131` calls `GET https://api.sleeper.app/v1/league/${selectedLeagueId}/drafts` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/https:/api.sleeper.app/v1/league/<p>/drafts`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-28ff76f1f3347441", "name": "Dangling fetch: GET https://api.sleeper.app/v1/user/${sleeperUsername.trim()} (Trade-Machine/src/components/TradeMachine", "shortDescription": {"text": "Dangling fetch: GET https://api.sleeper.app/v1/user/${sleeperUsername.trim()} (Trade-Machine/src/components/TradeMachine.jsx:254)"}, "fullDescription": {"text": "`Trade-Machine/src/components/TradeMachine.jsx:254` calls `GET https://api.sleeper.app/v1/user/${sleeperUsername.trim()}` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/https:/api.sleeper.app/v1/user/<p>`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-da8432ca11e4d67f", "name": "Dangling fetch: GET https://api.sleeper.app/v1/user/${userData.user_id}/leagues/nfl/${y} (Trade-Machine/src/components/T", "shortDescription": {"text": "Dangling fetch: GET https://api.sleeper.app/v1/user/${userData.user_id}/leagues/nfl/${y} (Trade-Machine/src/components/TradeMachine.jsx:264)"}, "fullDescription": {"text": "`Trade-Machine/src/components/TradeMachine.jsx:264` calls `GET https://api.sleeper.app/v1/user/${userData.user_id}/leagues/nfl/${y}` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/https:/api.sleeper.app/v1/user/<p>/leagues/nfl/<p>`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-13bc326b31ba258a", "name": "Dangling fetch: POST https://catbox.moe/user/api.php (JARVIS/test-catbox.js:17)", "shortDescription": {"text": "Dangling fetch: POST https://catbox.moe/user/api.php (JARVIS/test-catbox.js:17)"}, "fullDescription": {"text": "`JARVIS/test-catbox.js:17` calls `POST https://catbox.moe/user/api.php` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: axios\nNormalized path used for matching: `/https:/catbox.moe/user/api.php`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-a339e11ad8fe214d", "name": "Dangling fetch: POST https://sleeper.com/graphql (JARVIS/src/poster.js:117)", "shortDescription": {"text": "Dangling fetch: POST https://sleeper.com/graphql (JARVIS/src/poster.js:117)"}, "fullDescription": {"text": "`JARVIS/src/poster.js:117` calls `POST https://sleeper.com/graphql` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: axios\nNormalized path used for matching: `/https:/sleeper.com/graphql`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-5613785fd2812318", "name": "Unused endpoint: GET /api/rankings", "shortDescription": {"text": "Unused endpoint: GET /api/rankings"}, "fullDescription": {"text": "`Trade-Machine/api/index.js` declares `GET /api/rankings` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e8498331939ceefb", "name": "Unused endpoint: POST /api/evaluate", "shortDescription": {"text": "Unused endpoint: POST /api/evaluate"}, "fullDescription": {"text": "`Trade-Machine/api/index.js` declares `POST /api/evaluate` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-093467ddc6e6a64d", "name": "Unused endpoint: POST /api/generate", "shortDescription": {"text": "Unused endpoint: POST /api/generate"}, "fullDescription": {"text": "`Image-Gen/src/server.js` declares `POST /api/generate` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4006f18ec4db10cf", "name": "Unused endpoint: USE /images", "shortDescription": {"text": "Unused endpoint: USE /images"}, "fullDescription": {"text": "`Image-Gen/src/server.js` declares `USE /images` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/20103"}, "properties": {"repository": "SpeedyMc5peeder/fantasy-football-suite", "repoUrl": "https://github.com/SpeedyMc5peeder/fantasy-football-suite", "branch": "main"}, "results": [{"ruleId": "scanner-c9044e56da02e30b", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 Trade-Machine/api/index.js:114"}, "properties": {"repobilityId": "2b316b8f96805ff6", "scanner": "scanner-primary", "fingerprint": "c9044e56da02e30b", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-7c2bdbcc4f5e1a68", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 Trade-Machine/scripts/scraper.js:49"}, "properties": {"repobilityId": "016883dda2ac5861", "scanner": "scanner-primary", "fingerprint": "7c2bdbcc4f5e1a68", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-8ad49fe564170369", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 Trade-Machine/scripts/find_opportunities.js:51"}, "properties": {"repobilityId": "90ac7ca02f4951da", "scanner": "scanner-primary", "fingerprint": "8ad49fe564170369", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-13d3f6ef542fa6ed", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 Image-Gen/list-models.js:8"}, "properties": {"repobilityId": "e7ee18fd8faa2955", "scanner": "scanner-primary", "fingerprint": "13d3f6ef542fa6ed", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-9f3817069cbfeae2", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 Image-Gen/src/server.js:62"}, "properties": {"repobilityId": "1210537f5977a6cb", "scanner": "scanner-primary", "fingerprint": "9f3817069cbfeae2", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-27264cb61ff340b2", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 JARVIS/test-catbox.js:20"}, "properties": {"repobilityId": "355601a09feb6753", "scanner": "scanner-primary", "fingerprint": "27264cb61ff340b2", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-037f380c3f62b057", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 JARVIS/testNews.js:16"}, "properties": {"repobilityId": "e9d9b3f26fd1dfdc", "scanner": "scanner-primary", "fingerprint": "037f380c3f62b057", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-ee896a19f212e553", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 JARVIS/index.js:62"}, "properties": {"repobilityId": "b3edc050daba6608", "scanner": "scanner-primary", "fingerprint": "ee896a19f212e553", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-6286d25133dace8d", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 JARVIS/test-gemini.js:9"}, "properties": {"repobilityId": "dbdf68af609d3e60", "scanner": "scanner-primary", "fingerprint": "6286d25133dace8d", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-27fc008e398d57fb", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 JARVIS/src/newsScraper.js:11"}, "properties": {"repobilityId": "13e11376b62bf213", "scanner": "scanner-primary", "fingerprint": "27fc008e398d57fb", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-2a0ccbb4ce7a90a7", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 JARVIS/src/evaluator.js:20"}, "properties": {"repobilityId": "42c628362a429101", "scanner": "scanner-primary", "fingerprint": "2a0ccbb4ce7a90a7", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-7e8ae0e648cbb54e", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 JARVIS/src/sleeperClient.js:40"}, "properties": {"repobilityId": "d8f2bb01e2a35b2c", "scanner": "scanner-primary", "fingerprint": "7e8ae0e648cbb54e", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-2804aaa6dcfb16c5", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 JARVIS/src/prefixManager.js:89"}, "properties": {"repobilityId": "f8a55cb5d8792d25", "scanner": "scanner-primary", "fingerprint": "2804aaa6dcfb16c5", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-7302a8e633efa840", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 JARVIS/src/poster.js:77"}, "properties": {"repobilityId": "3088f39ff0f8d662", "scanner": "scanner-primary", "fingerprint": "7302a8e633efa840", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-df6abf089a876454", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 JARVIS/src/imageClient.js:45"}, "properties": {"repobilityId": "8a357b78efc5dc8b", "scanner": "scanner-primary", "fingerprint": "df6abf089a876454", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-3142fcc169defd89", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 JARVIS/src/scraper.js:46"}, "properties": {"repobilityId": "9226c0a434634e64", "scanner": "scanner-primary", "fingerprint": "3142fcc169defd89", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-fbb8e2c292b728a5", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 JARVIS/src/generator.js:42"}, "properties": {"repobilityId": "4e3fbd1c48da5800", "scanner": "scanner-primary", "fingerprint": "fbb8e2c292b728a5", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-c7c20e9cc68b7c4d", "level": "warning", "message": {"text": "Privileged port 13 in use"}, "properties": {"repobilityId": "79d721e4d6f64798", "scanner": "scanner-primary", "fingerprint": "c7c20e9cc68b7c4d", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/weekly-opportunities.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-5965f341b422de1f", "level": "warning", "message": {"text": "Insecure pattern 'cors_wildcard' in Trade-Machine/api/index.js:8"}, "properties": {"repobilityId": "b8bf779aaab725b3", "scanner": "scanner-primary", "fingerprint": "5965f341b422de1f", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "cors_wildcard"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Trade-Machine/api/index.js"}, "region": {"startLine": 8}}}]}, {"ruleId": "scanner-39b213cfd833f450", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in JARVIS/src/imageClient.js:111"}, "properties": {"repobilityId": "d8b08e9188aea26a", "scanner": "scanner-primary", "fingerprint": "39b213cfd833f450", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "JARVIS/src/imageClient.js"}, "region": {"startLine": 111}}}]}, {"ruleId": "scanner-5ba1f3fda7e6f481", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in JARVIS/src/heartbeat.js:14"}, "properties": {"repobilityId": "dee34969ec366b9e", "scanner": "scanner-primary", "fingerprint": "5ba1f3fda7e6f481", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "JARVIS/src/heartbeat.js"}, "region": {"startLine": 14}}}]}, {"ruleId": "scanner-fa7e1038562004d2", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "1cf3838427e93233", "scanner": "scanner-primary", "fingerprint": "fa7e1038562004d2", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/daily-scrape.yml"}, "region": {"startLine": 13}}}]}, {"ruleId": "scanner-fa7e1038562004d2", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "49edea44ffc7630f", "scanner": "scanner-primary", "fingerprint": "fa7e1038562004d2", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/daily-scrape.yml"}, "region": {"startLine": 16}}}]}, {"ruleId": "scanner-fa7e1038562004d2", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "704d5cdb709efa7b", "scanner": "scanner-primary", "fingerprint": "fa7e1038562004d2", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/daily-scrape.yml"}, "region": {"startLine": 29}}}]}, {"ruleId": "scanner-45b0218a462a4a9f", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "d3e9f2efb41c5680", "scanner": "scanner-primary", "fingerprint": "45b0218a462a4a9f", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/weekly-opportunities.yml"}, "region": {"startLine": 17}}}]}, {"ruleId": "scanner-45b0218a462a4a9f", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "397cf6636ae34e62", "scanner": "scanner-primary", "fingerprint": "45b0218a462a4a9f", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/weekly-opportunities.yml"}, "region": {"startLine": 22}}}]}, {"ruleId": "scanner-16a8a51950c93710", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "27f2fe1e9545c9a0", "scanner": "scanner-primary", "fingerprint": "16a8a51950c93710", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/weekly-opportunities.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-bd266b0f0340369d", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "959712956b1579ec", "scanner": "scanner-primary", "fingerprint": "bd266b0f0340369d", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/jarvis-bot.yml"}, "region": {"startLine": 27}}}]}, {"ruleId": "scanner-bd266b0f0340369d", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "7071ba3946c4caaa", "scanner": "scanner-primary", "fingerprint": "bd266b0f0340369d", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/jarvis-bot.yml"}, "region": {"startLine": 62}}}]}, {"ruleId": "scanner-24b85f3b9a7e331f", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "45127fe91733ec0c", "scanner": "scanner-primary", "fingerprint": "24b85f3b9a7e331f", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/jarvis-bot.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ea3b5e389d8c9c0f", "level": "note", "message": {"text": "Low test-to-source ratio"}, "properties": {"repobilityId": "ef7b2552cc00a375", "scanner": "scanner-primary", "fingerprint": "ea3b5e389d8c9c0f", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["tests"]}}, {"ruleId": "scanner-141b30a41e03817b", "level": "note", "message": {"text": "No license file detected"}, "properties": {"repobilityId": "6cba03942b37c40a", "scanner": "scanner-primary", "fingerprint": "141b30a41e03817b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["license", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "72e6e0bce4de71b1", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-72b2a6250083a784", "level": "warning", "message": {"text": "Placeholder or mock-heavy implementation detected"}, "properties": {"repobilityId": "ee71ca24e1bbeb95", "scanner": "scanner-primary", "fingerprint": "72b2a6250083a784", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "incomplete", "generated-repo-pattern"]}}, {"ruleId": "scanner-749d4bc1bd66df5f", "level": "warning", "message": {"text": "Agent instructions exist but release-hardening basics are missing"}, "properties": {"repobilityId": "bdce2dd98fa80a6f", "scanner": "scanner-primary", "fingerprint": "749d4bc1bd66df5f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "6c50ced8a284873c", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "8a7684fd09429f29", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-17d866d91a7c451e", "level": "error", "message": {"text": "Agent instruction/config may expose a secret: CLAUDE.md"}, "properties": {"repobilityId": "ccce5984e58a48f0", "scanner": "scanner-primary", "fingerprint": "17d866d91a7c451e", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["agent-instructions", "secrets", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "CLAUDE.md"}, "region": {"startLine": 8}}}]}, {"ruleId": "scanner-2c5f98b152cddb6d", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/launch.json"}, "properties": {"repobilityId": "0de48c0f4ab303d8", "scanner": "scanner-primary", "fingerprint": "2c5f98b152cddb6d", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/launch.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-7c39f47779f684a9", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 Trade-Machine/scripts/scraper.js:39"}, "properties": {"repobilityId": "efedde690fc31365", "scanner": "scanner-primary", "fingerprint": "7c39f47779f684a9", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-8733c5b45e48bcd7", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 Trade-Machine/scripts/find_opportunities.js:84"}, "properties": {"repobilityId": "01a615015fe6d927", "scanner": "scanner-primary", "fingerprint": "8733c5b45e48bcd7", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-a15d9d35af294cd1", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 Trade-Machine/src/components/TradeMachine.jsx:264"}, "properties": {"repobilityId": "bf2e53467bd4c143", "scanner": "scanner-primary", "fingerprint": "a15d9d35af294cd1", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-ad5f90ab887e06f3", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 JARVIS/src/scraper.js:36"}, "properties": {"repobilityId": "82fc87b59f4c3ee8", "scanner": "scanner-primary", "fingerprint": "ad5f90ab887e06f3", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-816c23fdcfec1442", "level": "error", "message": {"text": "Dangling fetch: GET http://localhost:5000/api/rankings (Trade-Machine/scripts/find_opportunities.js:84)"}, "properties": {"repobilityId": "abef7edf10fd6959", "scanner": "scanner-primary", "fingerprint": "816c23fdcfec1442", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-19ee8c6e0cd148cc", "level": "error", "message": {"text": "Dangling fetch: GET https://api.sleeper.app/v1/league/${leagueId}/users (Trade-Machine/scripts/find_opportunities.js:91)"}, "properties": {"repobilityId": "dabc85f03b224e50", "scanner": "scanner-primary", "fingerprint": "19ee8c6e0cd148cc", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-67253cd14188727b", "level": "error", "message": {"text": "Dangling fetch: GET https://api.sleeper.app/v1/league/${leagueId}/rosters (Trade-Machine/scripts/find_opportunities.js:92)"}, "properties": {"repobilityId": "6a68bacbaffae36b", "scanner": "scanner-primary", "fingerprint": "67253cd14188727b", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-90f035484c721d39", "level": "error", "message": {"text": "Dangling fetch: GET /leagues.json (Trade-Machine/src/components/TradeMachine.jsx:75)"}, "properties": {"repobilityId": "138d85877bdfd97b", "scanner": "scanner-primary", "fingerprint": "90f035484c721d39", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-a8e380d63503f840", "level": "error", "message": {"text": "Dangling fetch: GET /config.json (Trade-Machine/src/components/TradeMachine.jsx:76)"}, "properties": {"repobilityId": "19da3aa8900d9f1d", "scanner": "scanner-primary", "fingerprint": "a8e380d63503f840", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-d30e9b540d8caf32", "level": "error", "message": {"text": "Dangling fetch: GET https://api.sleeper.app/v1/league/${selectedLeagueId} (Trade-Machine/src/components/TradeMachine.jsx:110)"}, "properties": {"repobilityId": "42f1edc495884a4a", "scanner": "scanner-primary", "fingerprint": "d30e9b540d8caf32", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-efd22664bb6cbf4d", "level": "error", "message": {"text": "Dangling fetch: GET https://api.sleeper.app/v1/league/${selectedLeagueId}/users (Trade-Machine/src/components/TradeMachine.jsx:128)"}, "properties": {"repobilityId": "0a4a054100542770", "scanner": "scanner-primary", "fingerprint": "efd22664bb6cbf4d", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-33fc3fe6388947ca", "level": "error", "message": {"text": "Dangling fetch: GET https://api.sleeper.app/v1/league/${selectedLeagueId}/rosters (Trade-Machine/src/components/TradeMachine.jsx:129)"}, "properties": {"repobilityId": "f0f8c19ca7ed65f9", "scanner": "scanner-primary", "fingerprint": "33fc3fe6388947ca", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-9b42e3183b8627ca", "level": "error", "message": {"text": "Dangling fetch: GET https://api.sleeper.app/v1/league/${selectedLeagueId}/traded_picks (Trade-Machine/src/components/TradeMachine.jsx:130)"}, "properties": {"repobilityId": "3bd418cbd5b6aa48", "scanner": "scanner-primary", "fingerprint": "9b42e3183b8627ca", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-43dfda946f98bfe0", "level": "error", "message": {"text": "Dangling fetch: GET https://api.sleeper.app/v1/league/${selectedLeagueId}/drafts (Trade-Machine/src/components/TradeMachine.jsx:131)"}, "properties": {"repobilityId": "e4c3d89df4340d4e", "scanner": "scanner-primary", "fingerprint": "43dfda946f98bfe0", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-28ff76f1f3347441", "level": "error", "message": {"text": "Dangling fetch: GET https://api.sleeper.app/v1/user/${sleeperUsername.trim()} (Trade-Machine/src/components/TradeMachine.jsx:254)"}, "properties": {"repobilityId": "a22327538e906967", "scanner": "scanner-primary", "fingerprint": "28ff76f1f3347441", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-da8432ca11e4d67f", "level": "error", "message": {"text": "Dangling fetch: GET https://api.sleeper.app/v1/user/${userData.user_id}/leagues/nfl/${y} (Trade-Machine/src/components/TradeMachine.jsx:264)"}, "properties": {"repobilityId": "d27d7d621f6e49c6", "scanner": "scanner-primary", "fingerprint": "da8432ca11e4d67f", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-13bc326b31ba258a", "level": "error", "message": {"text": "Dangling fetch: POST https://catbox.moe/user/api.php (JARVIS/test-catbox.js:17)"}, "properties": {"repobilityId": "dacdf531f2d6b59b", "scanner": "scanner-primary", "fingerprint": "13bc326b31ba258a", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "axios"]}}, {"ruleId": "scanner-a339e11ad8fe214d", "level": "error", "message": {"text": "Dangling fetch: POST https://sleeper.com/graphql (JARVIS/src/poster.js:117)"}, "properties": {"repobilityId": "70ff9e88442c35af", "scanner": "scanner-primary", "fingerprint": "a339e11ad8fe214d", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "axios"]}}, {"ruleId": "scanner-5613785fd2812318", "level": "note", "message": {"text": "Unused endpoint: GET /api/rankings"}, "properties": {"repobilityId": "3d0d1a53b6c4ceec", "scanner": "scanner-primary", "fingerprint": "5613785fd2812318", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-e8498331939ceefb", "level": "note", "message": {"text": "Unused endpoint: POST /api/evaluate"}, "properties": {"repobilityId": "7a635fa2c43e1605", "scanner": "scanner-primary", "fingerprint": "e8498331939ceefb", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-093467ddc6e6a64d", "level": "note", "message": {"text": "Unused endpoint: POST /api/generate"}, "properties": {"repobilityId": "cea4fc9d50ea0dec", "scanner": "scanner-primary", "fingerprint": "093467ddc6e6a64d", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-4006f18ec4db10cf", "level": "note", "message": {"text": "Unused endpoint: USE /images"}, "properties": {"repobilityId": "0a3e996727369139", "scanner": "scanner-primary", "fingerprint": "4006f18ec4db10cf", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}]}]}