{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-4f4ddd729302beb8", "name": "Stray `console.log` in TS/JS \u2014 public/js/websocket.js:46", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 public/js/websocket.js:46"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4358197dd2ec8a93", "name": "Stray `console.log` in TS/JS \u2014 src/index.ts:49", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 src/index.ts:49"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-960bc442b674cf35", "name": "Stray `console.log` in TS/JS \u2014 src/web/websocket.ts:21", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 src/web/websocket.ts:21"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9aea623ecbe72c26", "name": "Stray `console.log` in TS/JS \u2014 src/web/server.ts:61", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 src/web/server.ts:61"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4a8e47802b602f43", "name": "Stray `console.log` in TS/JS \u2014 src/web/routes/auth.ts:22", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 src/web/routes/auth.ts:22"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fcd62b98064732f8", "name": "Stray `console.log` in TS/JS \u2014 src/core/reporter.ts:314", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 src/core/reporter.ts:314"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6e104c87a7963a3a", "name": "Stray `console.log` in TS/JS \u2014 src/core/evaluator.ts:68", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 src/core/evaluator.ts:68"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8d279605b4dc9547", "name": "Privileged port 14 in use", "shortDescription": {"text": "Privileged port 14 in use"}, "fullDescription": {"text": "Port 14 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-47636e33caef255d", "name": "Dockerfile runs as root: docker/Dockerfile", "shortDescription": {"text": "Dockerfile runs as root: docker/Dockerfile"}, "fullDescription": {"text": "No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-28b46c86f5a3f7e8", "name": "Docker base image is tag-pinned but not digest-pinned: node:20-alpine", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: node:20-alpine"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-aa5acaa49eb8315b", "name": "Containers defined but no K8s/orchestration manifest found", "shortDescription": {"text": "Containers defined but no K8s/orchestration manifest found"}, "fullDescription": {"text": "Repo has Dockerfiles/compose but no Kubernetes/Nomad manifests. If the target deployment is K8s, the manifests may live in a separate ops repo."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-77a464701f01cedf", "name": "Possible secret in README.md", "shortDescription": {"text": "Possible secret in README.md"}, "fullDescription": {"text": "Detected pattern matching password_literal. Rotate the credential and move to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-bca2933aa61aca32", "name": "Possible secret in jest.setup.js", "shortDescription": {"text": "Possible secret in jest.setup.js"}, "fullDescription": {"text": "Detected pattern matching password_literal. Rotate the credential and move to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-c3115fc5a44071eb", "name": "Insecure pattern 'local_storage_auth_token' in public/index.html:46", "shortDescription": {"text": "Insecure pattern 'local_storage_auth_token' in public/index.html:46"}, "fullDescription": {"text": "Found a known-risky pattern (local_storage_auth_token). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c7cf0264ffa69538", "name": "Insecure pattern 'direct_innerhtml_assignment' in public/js/evaluation.js:26", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in public/js/evaluation.js:26"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c251db5633725189", "name": "Insecure pattern 'direct_innerhtml_assignment' in public/js/configs.js:27", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in public/js/configs.js:27"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2948306b48615c86", "name": "Insecure pattern 'node_child_process' in src/sandbox/python-sandbox.ts:4", "shortDescription": {"text": "Insecure pattern 'node_child_process' in src/sandbox/python-sandbox.ts:4"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7f0f9976570faa6d", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-27924aa79fa4a517", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-deab3501ad6b6a68", "name": "Very large file: src/core/evaluator.ts (1296 lines)", "shortDescription": {"text": "Very large file: src/core/evaluator.ts (1296 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 63 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9d79c4077342a7d0", "name": "Runtime service client appears to use placeholder configuration", "shortDescription": {"text": "Runtime service client appears to use placeholder configuration"}, "fullDescription": {"text": "A runtime source file appears to wire Supabase/Firebase/AI/payment-style clients to placeholder URLs, keys, or fallback values. In the Fable corpus this often means the UI/API shape is present while the backend service is not actually configured."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-386814e6c29f0d79", "name": "`fetch()` without try/.catch or AbortSignal \u2014 public/js/auth.js:38", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 public/js/auth.js:38"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c02801616b870c49", "name": "`fetch()` without try/.catch or AbortSignal \u2014 src/adapters/anthropic-adapter.ts:56", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/adapters/anthropic-adapter.ts:56"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c9dee89915d9877f", "name": "`fetch()` without try/.catch or AbortSignal \u2014 src/adapters/glm-adapter.ts:36", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/adapters/glm-adapter.ts:36"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-655262ad5639f5cd", "name": "Legacy-named symbol `aa_agentperf_v1` in src/types/index.ts:181", "shortDescription": {"text": "Legacy-named symbol `aa_agentperf_v1` in src/types/index.ts:181"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-19a032e028046a78", "name": "`fetch()` without try/.catch or AbortSignal \u2014 src/types/index.ts:182", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/types/index.ts:182"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-61fb0e6d0b425de7", "name": "Legacy-named symbol `longbench_v2` in src/core/evaluator.ts:1030", "shortDescription": {"text": "Legacy-named symbol `longbench_v2` in src/core/evaluator.ts:1030"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6aa637fc0695bdb5", "name": "Commented-code block (5 lines) in src/core/evaluator.ts:161", "shortDescription": {"text": "Commented-code block (5 lines) in src/core/evaluator.ts:161"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-7a34fa63eef78826", "name": "`fetch()` without try/.catch or AbortSignal \u2014 src/core/evaluator.ts:99", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/core/evaluator.ts:99"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6eb452fbfb454d20", "name": "Unused endpoint: USE /api/auth", "shortDescription": {"text": "Unused endpoint: USE /api/auth"}, "fullDescription": {"text": "`src/web/server.ts` declares `USE /api/auth` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-202732bda92708ec", "name": "Unused endpoint: USE /api/configs", "shortDescription": {"text": "Unused endpoint: USE /api/configs"}, "fullDescription": {"text": "`src/web/server.ts` declares `USE /api/configs` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9ad67e5d0bbd2fea", "name": "Unused endpoint: USE /api/evaluations", "shortDescription": {"text": "Unused endpoint: USE /api/evaluations"}, "fullDescription": {"text": "`src/web/server.ts` declares `USE /api/evaluations` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-aba4d8aa86b24a52", "name": "Unused endpoint: USE /api/questions", "shortDescription": {"text": "Unused endpoint: USE /api/questions"}, "fullDescription": {"text": "`src/web/server.ts` declares `USE /api/questions` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4756b4c4da7d2088", "name": "Unused endpoint: GET /api/health", "shortDescription": {"text": "Unused endpoint: GET /api/health"}, "fullDescription": {"text": "`src/web/server.ts` declares `GET /api/health` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5baa8971ebe192a1", "name": "Unused endpoint: GET /", "shortDescription": {"text": "Unused endpoint: GET /"}, "fullDescription": {"text": "`src/web/routes/evaluations.ts` declares `GET /` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7a009b1a56794f45", "name": "Unused endpoint: POST /", "shortDescription": {"text": "Unused endpoint: POST /"}, "fullDescription": {"text": "`src/web/routes/evaluations.ts` declares `POST /` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ca5756175765b49d", "name": "Unused endpoint: GET /:id", "shortDescription": {"text": "Unused endpoint: GET /:id"}, "fullDescription": {"text": "`src/web/routes/evaluations.ts` declares `GET /:id` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-91de0b59fb6d6e8f", "name": "Unused endpoint: GET /:id/results", "shortDescription": {"text": "Unused endpoint: GET /:id/results"}, "fullDescription": {"text": "`src/web/routes/evaluations.ts` declares `GET /:id/results` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-618721b912bad1c2", "name": "Unused endpoint: POST /login", "shortDescription": {"text": "Unused endpoint: POST /login"}, "fullDescription": {"text": "`src/web/routes/auth.ts` declares `POST /login` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fd1dc91abf32142d", "name": "Unused endpoint: GET /me", "shortDescription": {"text": "Unused endpoint: GET /me"}, "fullDescription": {"text": "`src/web/routes/auth.ts` declares `GET /me` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8d5b2b188d08ca82", "name": "Unused endpoint: PUT /:id", "shortDescription": {"text": "Unused endpoint: PUT /:id"}, "fullDescription": {"text": "`src/web/routes/configs.ts` declares `PUT /:id` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7a61c112b611f4bb", "name": "Unused endpoint: DELETE /:id", "shortDescription": {"text": "Unused endpoint: DELETE /:id"}, "fullDescription": {"text": "`src/web/routes/configs.ts` declares `DELETE /:id` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/23012"}, "properties": {"repository": "XingP14/llm-benchmark", "repoUrl": "https://github.com/XingP14/llm-benchmark", "branch": "main"}, "results": [{"ruleId": "scanner-4f4ddd729302beb8", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 public/js/websocket.js:46"}, "properties": {"repobilityId": "7b25ea2a2adbf274", "scanner": "scanner-primary", "fingerprint": "4f4ddd729302beb8", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-4358197dd2ec8a93", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 src/index.ts:49"}, "properties": {"repobilityId": "867f5b4f120dafeb", "scanner": "scanner-primary", "fingerprint": "4358197dd2ec8a93", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-960bc442b674cf35", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 src/web/websocket.ts:21"}, "properties": {"repobilityId": "b285b5d8cc7f5a7b", "scanner": "scanner-primary", "fingerprint": "960bc442b674cf35", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-9aea623ecbe72c26", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 src/web/server.ts:61"}, "properties": {"repobilityId": "d1156307c7a6f7e5", "scanner": "scanner-primary", "fingerprint": "9aea623ecbe72c26", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-4a8e47802b602f43", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 src/web/routes/auth.ts:22"}, "properties": {"repobilityId": "375d80d61740effb", "scanner": "scanner-primary", "fingerprint": "4a8e47802b602f43", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-fcd62b98064732f8", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 src/core/reporter.ts:314"}, "properties": {"repobilityId": "6aca7b816234d790", "scanner": "scanner-primary", "fingerprint": "fcd62b98064732f8", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-6e104c87a7963a3a", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 src/core/evaluator.ts:68"}, "properties": {"repobilityId": "0080f30cb44a590d", "scanner": "scanner-primary", "fingerprint": "6e104c87a7963a3a", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-8d279605b4dc9547", "level": "warning", "message": {"text": "Privileged port 14 in use"}, "properties": {"repobilityId": "2dbd4b719a1412ff", "scanner": "scanner-primary", "fingerprint": "8d279605b4dc9547", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docker-compose.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-47636e33caef255d", "level": "warning", "message": {"text": "Dockerfile runs as root: docker/Dockerfile"}, "properties": {"repobilityId": "8a345ba4198453bd", "scanner": "scanner-primary", "fingerprint": "47636e33caef255d", "layer": "hardware", "severity": "medium", "confidence": 1.0, "tags": ["security", "container"]}}, {"ruleId": "scanner-28b46c86f5a3f7e8", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: node:20-alpine"}, "properties": {"repobilityId": "a5cd92c42cc064ef", "scanner": "scanner-primary", "fingerprint": "28b46c86f5a3f7e8", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docker/Dockerfile"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-aa5acaa49eb8315b", "level": "note", "message": {"text": "Containers defined but no K8s/orchestration manifest found"}, "properties": {"repobilityId": "b230ea9b68736081", "scanner": "scanner-primary", "fingerprint": "aa5acaa49eb8315b", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["coverage", "deployment"]}}, {"ruleId": "scanner-77a464701f01cedf", "level": "error", "message": {"text": "Possible secret in README.md"}, "properties": {"repobilityId": "03df1be0543b7759", "scanner": "scanner-primary", "fingerprint": "77a464701f01cedf", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "README.md"}, "region": {"startLine": 113}}}]}, {"ruleId": "scanner-77a464701f01cedf", "level": "error", "message": {"text": "Possible secret in README.md"}, "properties": {"repobilityId": "03df1be0543b7759", "scanner": "scanner-primary", "fingerprint": "77a464701f01cedf", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "README.md"}, "region": {"startLine": 137}}}]}, {"ruleId": "scanner-bca2933aa61aca32", "level": "error", "message": {"text": "Possible secret in jest.setup.js"}, "properties": {"repobilityId": "62cb686a14fd9ed9", "scanner": "scanner-primary", "fingerprint": "bca2933aa61aca32", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "jest.setup.js"}, "region": {"startLine": 8}}}]}, {"ruleId": "scanner-c3115fc5a44071eb", "level": "warning", "message": {"text": "Insecure pattern 'local_storage_auth_token' in public/index.html:46"}, "properties": {"repobilityId": "57f0ac51df265a35", "scanner": "scanner-primary", "fingerprint": "c3115fc5a44071eb", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "local_storage_auth_token"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "public/index.html"}, "region": {"startLine": 46}}}]}, {"ruleId": "scanner-c7cf0264ffa69538", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in public/js/evaluation.js:26"}, "properties": {"repobilityId": "a27135f60ab284c0", "scanner": "scanner-primary", "fingerprint": "c7cf0264ffa69538", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "public/js/evaluation.js"}, "region": {"startLine": 26}}}]}, {"ruleId": "scanner-c251db5633725189", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in public/js/configs.js:27"}, "properties": {"repobilityId": "1cf7e7beb332093a", "scanner": "scanner-primary", "fingerprint": "c251db5633725189", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "public/js/configs.js"}, "region": {"startLine": 27}}}]}, {"ruleId": "scanner-2948306b48615c86", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in src/sandbox/python-sandbox.ts:4"}, "properties": {"repobilityId": "8fd4397dc7d6093c", "scanner": "scanner-primary", "fingerprint": "2948306b48615c86", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/sandbox/python-sandbox.ts"}, "region": {"startLine": 4}}}]}, {"ruleId": "scanner-7f0f9976570faa6d", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "8ae5e48e366ecdcb", "scanner": "scanner-primary", "fingerprint": "7f0f9976570faa6d", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/docker.yml"}, "region": {"startLine": 35}}}]}, {"ruleId": "scanner-7f0f9976570faa6d", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "5d8aeac5eb6f4868", "scanner": "scanner-primary", "fingerprint": "7f0f9976570faa6d", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/docker.yml"}, "region": {"startLine": 38}}}]}, {"ruleId": "scanner-7f0f9976570faa6d", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "49f477cbbe083433", "scanner": "scanner-primary", "fingerprint": "7f0f9976570faa6d", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/docker.yml"}, "region": {"startLine": 41}}}]}, {"ruleId": "scanner-7f0f9976570faa6d", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "d6aa7210cf6c969d", "scanner": "scanner-primary", "fingerprint": "7f0f9976570faa6d", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/docker.yml"}, "region": {"startLine": 45}}}]}, {"ruleId": "scanner-7f0f9976570faa6d", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "19a3e05b43a287b5", "scanner": "scanner-primary", "fingerprint": "7f0f9976570faa6d", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/docker.yml"}, "region": {"startLine": 59}}}]}, {"ruleId": "scanner-7f0f9976570faa6d", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "f6d49e2214a0df04", "scanner": "scanner-primary", "fingerprint": "7f0f9976570faa6d", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/docker.yml"}, "region": {"startLine": 66}}}]}, {"ruleId": "scanner-27924aa79fa4a517", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "ae16880318b99912", "scanner": "scanner-primary", "fingerprint": "27924aa79fa4a517", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 19}}}]}, {"ruleId": "scanner-27924aa79fa4a517", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "989a74409a402368", "scanner": "scanner-primary", "fingerprint": "27924aa79fa4a517", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 22}}}]}, {"ruleId": "scanner-deab3501ad6b6a68", "level": "note", "message": {"text": "Very large file: src/core/evaluator.ts (1296 lines)"}, "properties": {"repobilityId": "76f12ef678a2575c", "scanner": "scanner-primary", "fingerprint": "deab3501ad6b6a68", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "f1c1b20f0fd5efaa", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-9d79c4077342a7d0", "level": "warning", "message": {"text": "Runtime service client appears to use placeholder configuration"}, "properties": {"repobilityId": "640d6cd809d58eb6", "scanner": "scanner-primary", "fingerprint": "9d79c4077342a7d0", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "runtime-config", "service-client", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "e3c335074460e533", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "953404256d1dcbda", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "548fa294fcf82477", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-386814e6c29f0d79", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 public/js/auth.js:38"}, "properties": {"repobilityId": "cfe287cb04c68914", "scanner": "scanner-primary", "fingerprint": "386814e6c29f0d79", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-c02801616b870c49", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/adapters/anthropic-adapter.ts:56"}, "properties": {"repobilityId": "020514edd2652c1d", "scanner": "scanner-primary", "fingerprint": "c02801616b870c49", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-c9dee89915d9877f", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/adapters/glm-adapter.ts:36"}, "properties": {"repobilityId": "40cd8f035fed49eb", "scanner": "scanner-primary", "fingerprint": "c9dee89915d9877f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-655262ad5639f5cd", "level": "note", "message": {"text": "Legacy-named symbol `aa_agentperf_v1` in src/types/index.ts:181"}, "properties": {"repobilityId": "431b39a151ecd6ad", "scanner": "scanner-primary", "fingerprint": "655262ad5639f5cd", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-19a032e028046a78", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/types/index.ts:182"}, "properties": {"repobilityId": "b6b952743b8c658e", "scanner": "scanner-primary", "fingerprint": "19a032e028046a78", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-61fb0e6d0b425de7", "level": "note", "message": {"text": "Legacy-named symbol `longbench_v2` in src/core/evaluator.ts:1030"}, "properties": {"repobilityId": "e5078b6cf72e6893", "scanner": "scanner-primary", "fingerprint": "61fb0e6d0b425de7", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-6aa637fc0695bdb5", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/core/evaluator.ts:161"}, "properties": {"repobilityId": "28b2a54bc99b79e7", "scanner": "scanner-primary", "fingerprint": "6aa637fc0695bdb5", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-7a34fa63eef78826", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/core/evaluator.ts:99"}, "properties": {"repobilityId": "771c62ff2e9cd4e2", "scanner": "scanner-primary", "fingerprint": "7a34fa63eef78826", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-6eb452fbfb454d20", "level": "note", "message": {"text": "Unused endpoint: USE /api/auth"}, "properties": {"repobilityId": "2ae74c68aa81b0c3", "scanner": "scanner-primary", "fingerprint": "6eb452fbfb454d20", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-202732bda92708ec", "level": "note", "message": {"text": "Unused endpoint: USE /api/configs"}, "properties": {"repobilityId": "9927fd5bc5077f0c", "scanner": "scanner-primary", "fingerprint": "202732bda92708ec", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-9ad67e5d0bbd2fea", "level": "note", "message": {"text": "Unused endpoint: USE /api/evaluations"}, "properties": {"repobilityId": "5db65966cabfb25a", "scanner": "scanner-primary", "fingerprint": "9ad67e5d0bbd2fea", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-aba4d8aa86b24a52", "level": "note", "message": {"text": "Unused endpoint: USE /api/questions"}, "properties": {"repobilityId": "c509963c29ee3c44", "scanner": "scanner-primary", "fingerprint": "aba4d8aa86b24a52", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-4756b4c4da7d2088", "level": "note", "message": {"text": "Unused endpoint: GET /api/health"}, "properties": {"repobilityId": "ae4154cd2e1b3582", "scanner": "scanner-primary", "fingerprint": "4756b4c4da7d2088", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-5baa8971ebe192a1", "level": "note", "message": {"text": "Unused endpoint: GET /"}, "properties": {"repobilityId": "fa83fdc5eacb3c11", "scanner": "scanner-primary", "fingerprint": "5baa8971ebe192a1", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-7a009b1a56794f45", "level": "note", "message": {"text": "Unused endpoint: POST /"}, "properties": {"repobilityId": "fa266681cc156ba6", "scanner": "scanner-primary", "fingerprint": "7a009b1a56794f45", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-ca5756175765b49d", "level": "note", "message": {"text": "Unused endpoint: GET /:id"}, "properties": {"repobilityId": "9e4a2e77f15fd162", "scanner": "scanner-primary", "fingerprint": "ca5756175765b49d", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-91de0b59fb6d6e8f", "level": "note", "message": {"text": "Unused endpoint: GET /:id/results"}, "properties": {"repobilityId": "8fed2965da79467a", "scanner": "scanner-primary", "fingerprint": "91de0b59fb6d6e8f", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-618721b912bad1c2", "level": "note", "message": {"text": "Unused endpoint: POST /login"}, "properties": {"repobilityId": "9703b741e0a91831", "scanner": "scanner-primary", "fingerprint": "618721b912bad1c2", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-fd1dc91abf32142d", "level": "note", "message": {"text": "Unused endpoint: GET /me"}, "properties": {"repobilityId": "9fec96d43ccc4613", "scanner": "scanner-primary", "fingerprint": "fd1dc91abf32142d", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-8d5b2b188d08ca82", "level": "note", "message": {"text": "Unused endpoint: PUT /:id"}, "properties": {"repobilityId": "ddae1276116fc8b1", "scanner": "scanner-primary", "fingerprint": "8d5b2b188d08ca82", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-7a61c112b611f4bb", "level": "note", "message": {"text": "Unused endpoint: DELETE /:id"}, "properties": {"repobilityId": "6be846793a74eab2", "scanner": "scanner-primary", "fingerprint": "7a61c112b611f4bb", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}]}]}