{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-e969806b9ac9d62f", "name": "Possibly dead Python function: index_preference", "shortDescription": {"text": "Possibly dead Python function: index_preference"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9bb5b40c51ea2929", "name": "Possibly dead Python function: planner_node", "shortDescription": {"text": "Possibly dead Python function: planner_node"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1c0fefd40510b4b8", "name": "Possibly dead Python function: guardrails_node", "shortDescription": {"text": "Possibly dead Python function: guardrails_node"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ea3b5e389d8c9c0f", "name": "Low test-to-source ratio", "shortDescription": {"text": "Low test-to-source ratio"}, "fullDescription": {"text": "6 tests / 38 src (ratio 0.16)."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-141b30a41e03817b", "name": "No license file detected", "shortDescription": {"text": "No license file detected"}, "fullDescription": {"text": "No LICENSE/COPYING/NOTICE file was found. Generated repositories often omit licensing, which blocks reuse and automated intake."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 10 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-749d4bc1bd66df5f", "name": "Agent instructions exist but release-hardening basics are missing", "shortDescription": {"text": "Agent instructions exist but release-hardening basics are missing"}, "fullDescription": {"text": "AI-coder instruction files were found, but the repo is missing license. Treat this as a contract gap: the agent is guided, but the generated output is not yet guarded by the controls that make it repeatable."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-bd734e9addefebc7", "name": "Legacy-named symbol `model_copy` in app/agents/response_composer.py:77", "shortDescription": {"text": "Legacy-named symbol `model_copy` in app/agents/response_composer.py:77"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-51103f39f14a8a7e", "name": "Legacy-named symbol `model_copy` in app/llm/client.py:45", "shortDescription": {"text": "Legacy-named symbol `model_copy` in app/llm/client.py:45"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b31a3a1c5dee9e7f", "name": "Commented-code block (5 lines) in app/orchestration/nodes/planner.py:24", "shortDescription": {"text": "Commented-code block (5 lines) in app/orchestration/nodes/planner.py:24"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-dc2ac8661550ef18", "name": "Commented-code block (6 lines) in app/orchestration/nodes/guard.py:23", "shortDescription": {"text": "Commented-code block (6 lines) in app/orchestration/nodes/guard.py:23"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-956a8a4de1ae7b1c", "name": "FastAPI POST `invoke` without auth dependency \u2014 app/api/invoke.py:147", "shortDescription": {"text": "FastAPI POST `invoke` without auth dependency \u2014 app/api/invoke.py:147"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-fd5bad4bae011262", "name": "FastAPI PATCH `rename_session_endpoint` without auth dependency \u2014 app/api/sessions.py:44", "shortDescription": {"text": "FastAPI PATCH `rename_session_endpoint` without auth dependency \u2014 app/api/sessions.py:44"}, "fullDescription": {"text": "`@router.patch` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-4dd44eb93c8b4d67", "name": "FastAPI POST `submit_approval` without auth dependency \u2014 app/api/approvals.py:90", "shortDescription": {"text": "FastAPI POST `submit_approval` without auth dependency \u2014 app/api/approvals.py:90"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-216913e2d5ec66b0", "name": "FastAPI POST `submit_feedback` without auth dependency \u2014 app/api/feedback.py:21", "shortDescription": {"text": "FastAPI POST `submit_feedback` without auth dependency \u2014 app/api/feedback.py:21"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-166d34825c4625e1", "name": "FastAPI POST `store_integration_token` without auth dependency \u2014 app/api/integrations.py:25", "shortDescription": {"text": "FastAPI POST `store_integration_token` without auth dependency \u2014 app/api/integrations.py:25"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/24921"}, "properties": {"repository": "chetan6019/agentic-workflow-engine", "repoUrl": "https://github.com/chetan6019/agentic-workflow-engine", "branch": "main"}, "results": [{"ruleId": "scanner-e969806b9ac9d62f", "level": "note", "message": {"text": "Possibly dead Python function: index_preference"}, "properties": {"repobilityId": "665bbef25650b6cc", "scanner": "scanner-primary", "fingerprint": "e969806b9ac9d62f", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "app/rag/indexer.py:40"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-9bb5b40c51ea2929", "level": "note", "message": {"text": "Possibly dead Python function: planner_node"}, "properties": {"repobilityId": "210a6732baa0f084", "scanner": "scanner-primary", "fingerprint": "9bb5b40c51ea2929", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "app/orchestration/nodes/planner.py:72"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-1c0fefd40510b4b8", "level": "note", "message": {"text": "Possibly dead Python function: guardrails_node"}, "properties": {"repobilityId": "44996ee4ba2c35ca", "scanner": "scanner-primary", "fingerprint": "1c0fefd40510b4b8", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "app/orchestration/nodes/guard.py:102"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ea3b5e389d8c9c0f", "level": "note", "message": {"text": "Low test-to-source ratio"}, "properties": {"repobilityId": "ef7b2552cc00a375", "scanner": "scanner-primary", "fingerprint": "ea3b5e389d8c9c0f", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["tests"]}}, {"ruleId": "scanner-141b30a41e03817b", "level": "note", "message": {"text": "No license file detected"}, "properties": {"repobilityId": "705e51015fb4acb8", "scanner": "scanner-primary", "fingerprint": "141b30a41e03817b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["license", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "ca6e572a48873312", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "d87fb4a636233ae8", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-749d4bc1bd66df5f", "level": "warning", "message": {"text": "Agent instructions exist but release-hardening basics are missing"}, "properties": {"repobilityId": "4949779c060cf146", "scanner": "scanner-primary", "fingerprint": "749d4bc1bd66df5f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-bd734e9addefebc7", "level": "note", "message": {"text": "Legacy-named symbol `model_copy` in app/agents/response_composer.py:77"}, "properties": {"repobilityId": "d3d4aeb37838bc9f", "scanner": "scanner-primary", "fingerprint": "bd734e9addefebc7", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-51103f39f14a8a7e", "level": "note", "message": {"text": "Legacy-named symbol `model_copy` in app/llm/client.py:45"}, "properties": {"repobilityId": "df21b99f6de8b66d", "scanner": "scanner-primary", "fingerprint": "51103f39f14a8a7e", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-b31a3a1c5dee9e7f", "level": "none", "message": {"text": "Commented-code block (5 lines) in app/orchestration/nodes/planner.py:24"}, "properties": {"repobilityId": "e33507b7dd00f345", "scanner": "scanner-primary", "fingerprint": "b31a3a1c5dee9e7f", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-dc2ac8661550ef18", "level": "none", "message": {"text": "Commented-code block (6 lines) in app/orchestration/nodes/guard.py:23"}, "properties": {"repobilityId": "cee4159bc1d0ac0d", "scanner": "scanner-primary", "fingerprint": "dc2ac8661550ef18", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-956a8a4de1ae7b1c", "level": "error", "message": {"text": "FastAPI POST `invoke` without auth dependency \u2014 app/api/invoke.py:147"}, "properties": {"repobilityId": "84bde658f90c1ce1", "scanner": "scanner-primary", "fingerprint": "956a8a4de1ae7b1c", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "app/api/invoke.py"}, "region": {"startLine": 147}}}]}, {"ruleId": "scanner-fd5bad4bae011262", "level": "error", "message": {"text": "FastAPI PATCH `rename_session_endpoint` without auth dependency \u2014 app/api/sessions.py:44"}, "properties": {"repobilityId": "9ef6317d0ff325aa", "scanner": "scanner-primary", "fingerprint": "fd5bad4bae011262", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "app/api/sessions.py"}, "region": {"startLine": 44}}}]}, {"ruleId": "scanner-4dd44eb93c8b4d67", "level": "error", "message": {"text": "FastAPI POST `submit_approval` without auth dependency \u2014 app/api/approvals.py:90"}, "properties": {"repobilityId": "61e6906f779ef65b", "scanner": "scanner-primary", "fingerprint": "4dd44eb93c8b4d67", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "app/api/approvals.py"}, "region": {"startLine": 90}}}]}, {"ruleId": "scanner-216913e2d5ec66b0", "level": "error", "message": {"text": "FastAPI POST `submit_feedback` without auth dependency \u2014 app/api/feedback.py:21"}, "properties": {"repobilityId": "801b4982c026a400", "scanner": "scanner-primary", "fingerprint": "216913e2d5ec66b0", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "app/api/feedback.py"}, "region": {"startLine": 21}}}]}, {"ruleId": "scanner-166d34825c4625e1", "level": "error", "message": {"text": "FastAPI POST `store_integration_token` without auth dependency \u2014 app/api/integrations.py:25"}, "properties": {"repobilityId": "25beee5d73e056de", "scanner": "scanner-primary", "fingerprint": "166d34825c4625e1", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "app/api/integrations.py"}, "region": {"startLine": 25}}}]}]}]}