{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-bead75b0f9233e05", "name": "No API endpoints detected", "shortDescription": {"text": "No API endpoints detected"}, "fullDescription": {"text": "The scanner did not find FastAPI/Flask/Express/NestJS/GraphQL/gRPC routes. If this repo exposes APIs, the framework may be unsupported."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "info", "confidence": 1.0}}, {"id": "scanner-51bbe7ef49fc7b89", "name": "Stray `console.log` in TS/JS \u2014 scripts/gen-sample-chart.ts:16", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 scripts/gen-sample-chart.ts:16"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8df3f1d433363357", "name": "Stray `console.log` in TS/JS \u2014 scripts/validate-engine.ts:94", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 scripts/validate-engine.ts:94"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e7eb338968701c18", "name": "`dangerouslySetInnerHTML` used in a React component \u2014 src/components/Svg.tsx:7", "shortDescription": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 src/components/Svg.tsx:7"}, "fullDescription": {"text": "Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library.\n\nWhy: OWASP basics. Already partially flagged by the security analyzer.\nRule id: fq.dangerous-html"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9ae8bc8d0d1737dc", "name": "`dangerouslySetInnerHTML` used in a React component \u2014 src/components/flashcards/NodesDiagram.tsx:198", "shortDescription": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 src/components/flashcards/NodesDiagram.tsx:198"}, "fullDescription": {"text": "Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library.\n\nWhy: OWASP basics. Already partially flagged by the security analyzer.\nRule id: fq.dangerous-html"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-18fba2df662fcc24", "name": "`dangerouslySetInnerHTML` used in a React component \u2014 design-reference/birth-modal/birth-modal.jsx:30", "shortDescription": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 design-reference/birth-modal/birth-modal.jsx:30"}, "fullDescription": {"text": "Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library.\n\nWhy: OWASP basics. Already partially flagged by the security analyzer.\nRule id: fq.dangerous-html"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7f58e0dae2650a10", "name": "`dangerouslySetInnerHTML` used in a React component \u2014 design-reference/planet-panel/flashcard.jsx:11", "shortDescription": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 design-reference/planet-panel/flashcard.jsx:11"}, "fullDescription": {"text": "Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library.\n\nWhy: OWASP basics. Already partially flagged by the security analyzer.\nRule id: fq.dangerous-html"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-5474e6d120e01e48", "name": "`dangerouslySetInnerHTML` used in a React component \u2014 design-reference/planet-panel/panel.jsx:13", "shortDescription": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 design-reference/planet-panel/panel.jsx:13"}, "fullDescription": {"text": "Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library.\n\nWhy: OWASP basics. Already partially flagged by the security analyzer.\nRule id: fq.dangerous-html"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-707832d2bb8c6aae", "name": "`dangerouslySetInnerHTML` used in a React component \u2014 design-reference/flashcards/home.jsx:10", "shortDescription": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 design-reference/flashcards/home.jsx:10"}, "fullDescription": {"text": "Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library.\n\nWhy: OWASP basics. Already partially flagged by the security analyzer.\nRule id: fq.dangerous-html"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d392d8fd82e09182", "name": "`dangerouslySetInnerHTML` used in a React component \u2014 design-reference/flashcards/nodes-diagram.jsx:192", "shortDescription": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 design-reference/flashcards/nodes-diagram.jsx:192"}, "fullDescription": {"text": "Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library.\n\nWhy: OWASP basics. Already partially flagged by the security analyzer.\nRule id: fq.dangerous-html"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1266be45c8598f28", "name": "`dangerouslySetInnerHTML` used in a React component \u2014 design-reference/flashcards/components.jsx:5", "shortDescription": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 design-reference/flashcards/components.jsx:5"}, "fullDescription": {"text": "Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library.\n\nWhy: OWASP basics. Already partially flagged by the security analyzer.\nRule id: fq.dangerous-html"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4e98e4f3926b2e17", "name": "Insecure pattern 'dangerous_innerhtml' in src/components/Svg.tsx:7", "shortDescription": {"text": "Insecure pattern 'dangerous_innerhtml' in src/components/Svg.tsx:7"}, "fullDescription": {"text": "Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-20cd4824a7161d8f", "name": "Insecure pattern 'dangerous_innerhtml' in src/components/flashcards/NodesDiagram.tsx:198", "shortDescription": {"text": "Insecure pattern 'dangerous_innerhtml' in src/components/flashcards/NodesDiagram.tsx:198"}, "fullDescription": {"text": "Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-cecf3a90f322a57e", "name": "Insecure pattern 'direct_innerhtml_assignment' in design-reference/Vedic Astrology Lab - Identity.html:627", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in design-reference/Vedic Astrology Lab - Identity.html:627"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a76e20d42616b7f8", "name": "Insecure pattern 'dangerous_innerhtml' in design-reference/birth-modal/birth-modal.jsx:30", "shortDescription": {"text": "Insecure pattern 'dangerous_innerhtml' in design-reference/birth-modal/birth-modal.jsx:30"}, "fullDescription": {"text": "Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f2d84ef3f7ba5406", "name": "Insecure pattern 'dangerous_innerhtml' in design-reference/planet-panel/flashcard.jsx:11", "shortDescription": {"text": "Insecure pattern 'dangerous_innerhtml' in design-reference/planet-panel/flashcard.jsx:11"}, "fullDescription": {"text": "Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3f57634444f62695", "name": "Insecure pattern 'dangerous_innerhtml' in design-reference/planet-panel/panel.jsx:13", "shortDescription": {"text": "Insecure pattern 'dangerous_innerhtml' in design-reference/planet-panel/panel.jsx:13"}, "fullDescription": {"text": "Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6f672bf4fe869460", "name": "Insecure pattern 'dangerous_innerhtml' in design-reference/flashcards/home.jsx:10", "shortDescription": {"text": "Insecure pattern 'dangerous_innerhtml' in design-reference/flashcards/home.jsx:10"}, "fullDescription": {"text": "Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a435fca7031e6d14", "name": "Insecure pattern 'dangerous_innerhtml' in design-reference/flashcards/nodes-diagram.jsx:192", "shortDescription": {"text": "Insecure pattern 'dangerous_innerhtml' in design-reference/flashcards/nodes-diagram.jsx:192"}, "fullDescription": {"text": "Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9ffc0a11023f8a8c", "name": "Insecure pattern 'dangerous_innerhtml' in design-reference/flashcards/components.jsx:5", "shortDescription": {"text": "Insecure pattern 'dangerous_innerhtml' in design-reference/flashcards/components.jsx:5"}, "fullDescription": {"text": "Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6372cebde0220094", "name": "No auth library detected", "shortDescription": {"text": "No auth library detected"}, "fullDescription": {"text": "The scanner did not find any standard auth library (JWT, OAuth, NextAuth, Auth0, etc.). The repo has auth/admin/session surface indicators, so auth may live in custom code, in a separate service, or be missing."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-cb639d9a10a47b23", "name": "package.json defines install-time lifecycle scripts", "shortDescription": {"text": "package.json defines install-time lifecycle scripts"}, "fullDescription": {"text": "preinstall/install/postinstall/prepare scripts execute during dependency installation. Review them carefully for network calls, obfuscation, shell execution, or credential access."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4601e3ad3bb28677", "name": "No CI/CD pipelines detected", "shortDescription": {"text": "No CI/CD pipelines detected"}, "fullDescription": {"text": "No GitHub Actions, GitLab CI, or CircleCI configs found. Without CI you can't gate deploys on tests/lints."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-577055dc0e1cc1c5", "name": "Very large file: design-reference/birth-modal/design-canvas.jsx (974 lines)", "shortDescription": {"text": "Very large file: design-reference/birth-modal/design-canvas.jsx (974 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ea3b5e389d8c9c0f", "name": "Low test-to-source ratio", "shortDescription": {"text": "Low test-to-source ratio"}, "fullDescription": {"text": "11 tests / 83 src (ratio 0.13)."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 7 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-72b2a6250083a784", "name": "Placeholder or mock-heavy implementation detected", "shortDescription": {"text": "Placeholder or mock-heavy implementation detected"}, "fullDescription": {"text": "Found 19 placeholder/mock markers across 11 source files. This often means the repo looks complete while core flows still use generated scaffolding or fake data."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-749d4bc1bd66df5f", "name": "Agent instructions exist but release-hardening basics are missing", "shortDescription": {"text": "Agent instructions exist but release-hardening basics are missing"}, "fullDescription": {"text": "AI-coder instruction files were found, but the repo is missing ci. Treat this as a contract gap: the agent is guided, but the generated output is not yet guarded by the controls that make it repeatable."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-cbd2c4c521432012", "name": "Commented-code block (7 lines) in next.config.ts:6", "shortDescription": {"text": "Commented-code block (7 lines) in next.config.ts:6"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-8388374b4557c9d8", "name": "Commented-code block (5 lines) in scripts/validate-engine.ts:14", "shortDescription": {"text": "Commented-code block (5 lines) in scripts/validate-engine.ts:14"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-adb23dc373ce5452", "name": "`fetch()` without try/.catch or AbortSignal \u2014 scripts/validate-engine.ts:35", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 scripts/validate-engine.ts:35"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-905883c985c1a6fb", "name": "Commented-code block (5 lines) in src/components/flashcards/Deck.tsx:126", "shortDescription": {"text": "Commented-code block (5 lines) in src/components/flashcards/Deck.tsx:126"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-2201a3859533a9e0", "name": "`fetch()` without try/.catch or AbortSignal \u2014 src/lib/geo.ts:70", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/lib/geo.ts:70"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-5e7706af5c9b7206", "name": "Commented-code block (5 lines) in src/core/index.ts:132", "shortDescription": {"text": "Commented-code block (5 lines) in src/core/index.ts:132"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-b957c3ea200d14d3", "name": "Commented-code block (7 lines) in design-reference/birth-modal/design-canvas.jsx:4", "shortDescription": {"text": "Commented-code block (7 lines) in design-reference/birth-modal/design-canvas.jsx:4"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-1e833536d905839a", "name": "`fetch()` without try/.catch or AbortSignal \u2014 design-reference/birth-modal/design-canvas.jsx:136", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 design-reference/birth-modal/design-canvas.jsx:136"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/23321"}, "properties": {"repository": "yoshnee/vedic-lab", "repoUrl": "https://github.com/yoshnee/vedic-lab", "branch": "main"}, "results": [{"ruleId": "scanner-bead75b0f9233e05", "level": "none", "message": {"text": "No API endpoints detected"}, "properties": {"repobilityId": "0f8bb852027c38f8", "scanner": "scanner-primary", "fingerprint": "bead75b0f9233e05", "layer": "api", "severity": "info", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-51bbe7ef49fc7b89", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 scripts/gen-sample-chart.ts:16"}, "properties": {"repobilityId": "91b8853e9c2711dc", "scanner": "scanner-primary", "fingerprint": "51bbe7ef49fc7b89", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-8df3f1d433363357", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 scripts/validate-engine.ts:94"}, "properties": {"repobilityId": "9266d08af07dafd5", "scanner": "scanner-primary", "fingerprint": "8df3f1d433363357", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-e7eb338968701c18", "level": "warning", "message": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 src/components/Svg.tsx:7"}, "properties": {"repobilityId": "d1f201e48034800f", "scanner": "scanner-primary", "fingerprint": "e7eb338968701c18", "layer": "frontend", "severity": "medium", "confidence": 1.0, "tags": ["frontend-quality", "fq.dangerous-html"]}}, {"ruleId": "scanner-9ae8bc8d0d1737dc", "level": "warning", "message": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 src/components/flashcards/NodesDiagram.tsx:198"}, "properties": {"repobilityId": "f3b70620745392a3", "scanner": "scanner-primary", "fingerprint": "9ae8bc8d0d1737dc", "layer": "frontend", "severity": "medium", "confidence": 1.0, "tags": ["frontend-quality", "fq.dangerous-html"]}}, {"ruleId": "scanner-18fba2df662fcc24", "level": "warning", "message": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 design-reference/birth-modal/birth-modal.jsx:30"}, "properties": {"repobilityId": "aa6709dad6323e5d", "scanner": "scanner-primary", "fingerprint": "18fba2df662fcc24", "layer": "frontend", "severity": "medium", "confidence": 1.0, "tags": ["frontend-quality", "fq.dangerous-html"]}}, {"ruleId": "scanner-7f58e0dae2650a10", "level": "warning", "message": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 design-reference/planet-panel/flashcard.jsx:11"}, "properties": {"repobilityId": "9327f56df41d43ff", "scanner": "scanner-primary", "fingerprint": "7f58e0dae2650a10", "layer": "frontend", "severity": "medium", "confidence": 1.0, "tags": ["frontend-quality", "fq.dangerous-html"]}}, {"ruleId": "scanner-5474e6d120e01e48", "level": "warning", "message": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 design-reference/planet-panel/panel.jsx:13"}, "properties": {"repobilityId": "dc6198f199230d6b", "scanner": "scanner-primary", "fingerprint": "5474e6d120e01e48", "layer": "frontend", "severity": "medium", "confidence": 1.0, "tags": ["frontend-quality", "fq.dangerous-html"]}}, {"ruleId": "scanner-707832d2bb8c6aae", "level": "warning", "message": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 design-reference/flashcards/home.jsx:10"}, "properties": {"repobilityId": "15743ed6e4a03e38", "scanner": "scanner-primary", "fingerprint": "707832d2bb8c6aae", "layer": "frontend", "severity": "medium", "confidence": 1.0, "tags": ["frontend-quality", "fq.dangerous-html"]}}, {"ruleId": "scanner-d392d8fd82e09182", "level": "warning", "message": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 design-reference/flashcards/nodes-diagram.jsx:192"}, "properties": {"repobilityId": "48d626e086098134", "scanner": "scanner-primary", "fingerprint": "d392d8fd82e09182", "layer": "frontend", "severity": "medium", "confidence": 1.0, "tags": ["frontend-quality", "fq.dangerous-html"]}}, {"ruleId": "scanner-1266be45c8598f28", "level": "warning", "message": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 design-reference/flashcards/components.jsx:5"}, "properties": {"repobilityId": "9519dc7af59e1392", "scanner": "scanner-primary", "fingerprint": "1266be45c8598f28", "layer": "frontend", "severity": "medium", "confidence": 1.0, "tags": ["frontend-quality", "fq.dangerous-html"]}}, {"ruleId": "scanner-4e98e4f3926b2e17", "level": "warning", "message": {"text": "Insecure pattern 'dangerous_innerhtml' in src/components/Svg.tsx:7"}, "properties": {"repobilityId": "8818809f685fe82e", "scanner": "scanner-primary", "fingerprint": "4e98e4f3926b2e17", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "dangerous_innerhtml"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/components/Svg.tsx"}, "region": {"startLine": 7}}}]}, {"ruleId": "scanner-20cd4824a7161d8f", "level": "warning", "message": {"text": "Insecure pattern 'dangerous_innerhtml' in src/components/flashcards/NodesDiagram.tsx:198"}, "properties": {"repobilityId": "8e68107993216e2d", "scanner": "scanner-primary", "fingerprint": "20cd4824a7161d8f", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "dangerous_innerhtml"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/components/flashcards/NodesDiagram.tsx"}, "region": {"startLine": 198}}}]}, {"ruleId": "scanner-cecf3a90f322a57e", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in design-reference/Vedic Astrology Lab - Identity.html:627"}, "properties": {"repobilityId": "5dfb2c7866c28294", "scanner": "scanner-primary", "fingerprint": "cecf3a90f322a57e", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "design-reference/Vedic Astrology Lab - Identity.html"}, "region": {"startLine": 627}}}]}, {"ruleId": "scanner-a76e20d42616b7f8", "level": "warning", "message": {"text": "Insecure pattern 'dangerous_innerhtml' in design-reference/birth-modal/birth-modal.jsx:30"}, "properties": {"repobilityId": "f55328e294f63832", "scanner": "scanner-primary", "fingerprint": "a76e20d42616b7f8", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "dangerous_innerhtml"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "design-reference/birth-modal/birth-modal.jsx"}, "region": {"startLine": 30}}}]}, {"ruleId": "scanner-f2d84ef3f7ba5406", "level": "warning", "message": {"text": "Insecure pattern 'dangerous_innerhtml' in design-reference/planet-panel/flashcard.jsx:11"}, "properties": {"repobilityId": "167d9ab43adb7dcb", "scanner": "scanner-primary", "fingerprint": "f2d84ef3f7ba5406", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "dangerous_innerhtml"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "design-reference/planet-panel/flashcard.jsx"}, "region": {"startLine": 11}}}]}, {"ruleId": "scanner-3f57634444f62695", "level": "warning", "message": {"text": "Insecure pattern 'dangerous_innerhtml' in design-reference/planet-panel/panel.jsx:13"}, "properties": {"repobilityId": "e65a1ff2d137be49", "scanner": "scanner-primary", "fingerprint": "3f57634444f62695", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "dangerous_innerhtml"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "design-reference/planet-panel/panel.jsx"}, "region": {"startLine": 13}}}]}, {"ruleId": "scanner-6f672bf4fe869460", "level": "warning", "message": {"text": "Insecure pattern 'dangerous_innerhtml' in design-reference/flashcards/home.jsx:10"}, "properties": {"repobilityId": "80e4d5d1c60d1034", "scanner": "scanner-primary", "fingerprint": "6f672bf4fe869460", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "dangerous_innerhtml"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "design-reference/flashcards/home.jsx"}, "region": {"startLine": 10}}}]}, {"ruleId": "scanner-a435fca7031e6d14", "level": "warning", "message": {"text": "Insecure pattern 'dangerous_innerhtml' in design-reference/flashcards/nodes-diagram.jsx:192"}, "properties": {"repobilityId": "6b48f9a6d0eb5257", "scanner": "scanner-primary", "fingerprint": "a435fca7031e6d14", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "dangerous_innerhtml"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "design-reference/flashcards/nodes-diagram.jsx"}, "region": {"startLine": 192}}}]}, {"ruleId": "scanner-9ffc0a11023f8a8c", "level": "warning", "message": {"text": "Insecure pattern 'dangerous_innerhtml' in design-reference/flashcards/components.jsx:5"}, "properties": {"repobilityId": "7104e1ff151795d6", "scanner": "scanner-primary", "fingerprint": "9ffc0a11023f8a8c", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "dangerous_innerhtml"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "design-reference/flashcards/components.jsx"}, "region": {"startLine": 5}}}]}, {"ruleId": "scanner-6372cebde0220094", "level": "warning", "message": {"text": "No auth library detected"}, "properties": {"repobilityId": "a5b6035a5bbf8054", "scanner": "scanner-primary", "fingerprint": "6372cebde0220094", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["coverage", "auth"]}}, {"ruleId": "scanner-cb639d9a10a47b23", "level": "note", "message": {"text": "package.json defines install-time lifecycle scripts"}, "properties": {"repobilityId": "edeab51902066991", "scanner": "scanner-primary", "fingerprint": "cb639d9a10a47b23", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "npm", "install-scripts"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-4601e3ad3bb28677", "level": "warning", "message": {"text": "No CI/CD pipelines detected"}, "properties": {"repobilityId": "c3ee439bce2bc51e", "scanner": "scanner-primary", "fingerprint": "4601e3ad3bb28677", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-577055dc0e1cc1c5", "level": "note", "message": {"text": "Very large file: design-reference/birth-modal/design-canvas.jsx (974 lines)"}, "properties": {"repobilityId": "d2a0f8279d9f7715", "scanner": "scanner-primary", "fingerprint": "577055dc0e1cc1c5", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-ea3b5e389d8c9c0f", "level": "note", "message": {"text": "Low test-to-source ratio"}, "properties": {"repobilityId": "ef7b2552cc00a375", "scanner": "scanner-primary", "fingerprint": "ea3b5e389d8c9c0f", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["tests"]}}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "0dabb22f5b284b08", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-72b2a6250083a784", "level": "warning", "message": {"text": "Placeholder or mock-heavy implementation detected"}, "properties": {"repobilityId": "b9d9aca2544fdaac", "scanner": "scanner-primary", "fingerprint": "72b2a6250083a784", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "incomplete", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "8d2b651cf2bdc246", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-749d4bc1bd66df5f", "level": "warning", "message": {"text": "Agent instructions exist but release-hardening basics are missing"}, "properties": {"repobilityId": "9e82a0332fd308b1", "scanner": "scanner-primary", "fingerprint": "749d4bc1bd66df5f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "dbc0a73eb7e4b1ae", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "f8fc0292a79a747e", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-cbd2c4c521432012", "level": "none", "message": {"text": "Commented-code block (7 lines) in next.config.ts:6"}, "properties": {"repobilityId": "6439b84a0aaaf9eb", "scanner": "scanner-primary", "fingerprint": "cbd2c4c521432012", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-8388374b4557c9d8", "level": "none", "message": {"text": "Commented-code block (5 lines) in scripts/validate-engine.ts:14"}, "properties": {"repobilityId": "5e9314fed6a98371", "scanner": "scanner-primary", "fingerprint": "8388374b4557c9d8", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-adb23dc373ce5452", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 scripts/validate-engine.ts:35"}, "properties": {"repobilityId": "7806ed2f60586612", "scanner": "scanner-primary", "fingerprint": "adb23dc373ce5452", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-905883c985c1a6fb", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/components/flashcards/Deck.tsx:126"}, "properties": {"repobilityId": "d9be064b12aaad9e", "scanner": "scanner-primary", "fingerprint": "905883c985c1a6fb", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-2201a3859533a9e0", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/lib/geo.ts:70"}, "properties": {"repobilityId": "f456af0ced7754f7", "scanner": "scanner-primary", "fingerprint": "2201a3859533a9e0", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-5e7706af5c9b7206", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/core/index.ts:132"}, "properties": {"repobilityId": "a4ced3c8b429aa42", "scanner": "scanner-primary", "fingerprint": "5e7706af5c9b7206", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-b957c3ea200d14d3", "level": "none", "message": {"text": "Commented-code block (7 lines) in design-reference/birth-modal/design-canvas.jsx:4"}, "properties": {"repobilityId": "418ba2034338889a", "scanner": "scanner-primary", "fingerprint": "b957c3ea200d14d3", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-1e833536d905839a", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 design-reference/birth-modal/design-canvas.jsx:136"}, "properties": {"repobilityId": "c02ea502c78bff29", "scanner": "scanner-primary", "fingerprint": "1e833536d905839a", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}]}]}