{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-77effece67fd5eb0", "name": "Stray `console.log` in TS/JS \u2014 packages/playwright-tests/web-patch-fullstack.spec.js:107", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 packages/playwright-tests/web-patch-fullstack.spec.js:107"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-016647ba30eef2fe", "name": "TODO/FIXME marker in shipping code \u2014 packages/playwright-tests/playwright.config.js:67", "shortDescription": {"text": "TODO/FIXME marker in shipping code \u2014 packages/playwright-tests/playwright.config.js:67"}, "fullDescription": {"text": "Track in /reviews or /issues, not as a code comment that rots.\n\nWhy: Drift control \u2014 shouldn't be the same as Quality TODO scanner.\nRule id: fq.todo-marker"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-02d8a7cb169307f5", "name": "Stray `console.log` in TS/JS \u2014 packages/playwright-tests/fullstack.spec.js:78", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 packages/playwright-tests/fullstack.spec.js:78"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-90d1010130c56dda", "name": "Stray `console.log` in TS/JS \u2014 packages/playwright-tests/web-patch.spec.js:96", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 packages/playwright-tests/web-patch.spec.js:96"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-822e824198e8629e", "name": "TODO/FIXME marker in shipping code \u2014 packages/interpreter/src/ts/serialize.ts:519", "shortDescription": {"text": "TODO/FIXME marker in shipping code \u2014 packages/interpreter/src/ts/serialize.ts:519"}, "fullDescription": {"text": "Track in /reviews or /issues, not as a code comment that rots.\n\nWhy: Drift control \u2014 shouldn't be the same as Quality TODO scanner.\nRule id: fq.todo-marker"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-b9bcf5ca8555be08", "name": "TODO/FIXME marker in shipping code \u2014 packages/interpreter/src/ts/native.ts:412", "shortDescription": {"text": "TODO/FIXME marker in shipping code \u2014 packages/interpreter/src/ts/native.ts:412"}, "fullDescription": {"text": "Track in /reviews or /issues, not as a code comment that rots.\n\nWhy: Drift control \u2014 shouldn't be the same as Quality TODO scanner.\nRule id: fq.todo-marker"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-b00286e3782b5bde", "name": "TODO/FIXME marker in shipping code \u2014 packages/extension/src/main.ts:22", "shortDescription": {"text": "TODO/FIXME marker in shipping code \u2014 packages/extension/src/main.ts:22"}, "fullDescription": {"text": "Track in /reviews or /issues, not as a code comment that rots.\n\nWhy: Drift control \u2014 shouldn't be the same as Quality TODO scanner.\nRule id: fq.todo-marker"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-2161b6aad7d2a9ac", "name": "TODO/FIXME marker in shipping code \u2014 packages/liveview/src/main.js:29", "shortDescription": {"text": "TODO/FIXME marker in shipping code \u2014 packages/liveview/src/main.js:29"}, "fullDescription": {"text": "Track in /reviews or /issues, not as a code comment that rots.\n\nWhy: Drift control \u2014 shouldn't be the same as Quality TODO scanner.\nRule id: fq.todo-marker"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-8dd9d7ecfae9d179", "name": "Stray `console.log` in TS/JS \u2014 examples/10-integrations/pwa/public/sw.js:3", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 examples/10-integrations/pwa/public/sw.js:3"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8273f2ddc4c1c143", "name": "unquoted attribute var \u2014 packages/cli/assets/android/gen/app/src/main/AndroidManifest.xml.hbs:25", "shortDescription": {"text": "unquoted attribute var \u2014 packages/cli/assets/android/gen/app/src/main/AndroidManifest.xml.hbs:25"}, "fullDescription": {"text": "Detected a unquoted template variable as an attribute. If unquoted, a malicious actor could inject custom JavaScript handlers. To fix this, add quotes around the template expression, like this: \"{{ expr }}\".\n\nRule: generic.html-templates.security.unquoted-attribute-var.unquoted-attribute-var\nSeverity: WARNING\nOWASP: A07:2017 - Cross-Site Scripting (XSS), A03:2021 - Injection, A05:2025 - Injection\nCWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')\nCategory: security"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-199b954f5f99a06e", "name": "unquoted attribute var \u2014 packages/cli/assets/android/gen/app/src/main/AndroidManifest.xml.hbs:26", "shortDescription": {"text": "unquoted attribute var \u2014 packages/cli/assets/android/gen/app/src/main/AndroidManifest.xml.hbs:26"}, "fullDescription": {"text": "Detected a unquoted template variable as an attribute. If unquoted, a malicious actor could inject custom JavaScript handlers. To fix this, add quotes around the template expression, like this: \"{{ expr }}\".\n\nRule: generic.html-templates.security.unquoted-attribute-var.unquoted-attribute-var\nSeverity: WARNING\nOWASP: A07:2017 - Cross-Site Scripting (XSS), A03:2021 - Injection, A05:2025 - Injection\nCWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')\nCategory: security"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7d85a0952942c106", "name": "GHSA-wrw7-89jp-8q8g: glib 0.18.5 \u2014 Cargo.lock", "shortDescription": {"text": "GHSA-wrw7-89jp-8q8g: glib 0.18.5 \u2014 Cargo.lock"}, "fullDescription": {"text": "Unsoundness in `Iterator` and `DoubleEndedIterator` impls for `glib::VariantStrIter`\n\nThe `VariantStrIter::impl_get` function (called internally by implementations of the `Iterator` and `DoubleEndedIterator` traits for this type) was unsound, resulting in undefined behaviour.\n\nAn immutable reference `&p` to a `*mut libc::c_char` pointer initialized to `NULL` was passed as an argument to a C function that that mutates the pointer behind `&p` in-place (i.e. as an out-argument), which was unsound. After changes in recent versions of the Rust compiler, these unsound writes through `&\n\nPackage: glib\nInstalled: 0.18.5\nFixed in: 0.20.0\nSeverity: MEDIUM\nFix: Upgrade glib to 0.20.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7fd81f235952a13f", "name": "GHSA-rhfx-m35p-ff5j: lru 0.12.5 \u2014 Cargo.lock", "shortDescription": {"text": "GHSA-rhfx-m35p-ff5j: lru 0.12.5 \u2014 Cargo.lock"}, "fullDescription": {"text": "`IterMut` violates Stacked Borrows by invalidating internal pointer\n\nAffected versions of this crate contain a soundness issue in the `IterMut` iterator implementation. The `IterMut::next` and `IterMut::next_back` methods temporarily create an exclusive reference to the key when dereferencing the internal node pointer.\n\nThis invalidates the shared pointer held by the internal `HashMap`, violating Stacked Borrows rules.\n\nPackage: lru\nInstalled: 0.12.5\nFixed in: 0.16.3\nSeverity: LOW\nFix: Upgrade lru to 0.16.3"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-17012128e5dd8d1f", "name": "DS-0002: Image user should not be 'root' \u2014 .devcontainer/Dockerfile", "shortDescription": {"text": "DS-0002: Image user should not be 'root' \u2014 .devcontainer/Dockerfile"}, "fullDescription": {"text": "Image user should not be 'root'\n\nSpecify at least 1 USER command in Dockerfile with non-root user as argument\n\nRule: DS-0002\nSeverity: HIGH\nTarget: .devcontainer/Dockerfile"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-c9c8522741c191fe", "name": "DS-0026: No HEALTHCHECK defined \u2014 .devcontainer/Dockerfile", "shortDescription": {"text": "DS-0026: No HEALTHCHECK defined \u2014 .devcontainer/Dockerfile"}, "fullDescription": {"text": "No HEALTHCHECK defined\n\nAdd HEALTHCHECK instruction in your Dockerfile\n\nRule: DS-0026\nSeverity: LOW\nTarget: .devcontainer/Dockerfile"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e2c81574da3989e2", "name": "DS-0029: 'apt-get' missing '--no-install-recommends' \u2014 .devcontainer/Dockerfile", "shortDescription": {"text": "DS-0029: 'apt-get' missing '--no-install-recommends' \u2014 .devcontainer/Dockerfile"}, "fullDescription": {"text": "'apt-get' missing '--no-install-recommends'\n\n'--no-install-recommends' flag is missed: 'apt-get update -qq     && apt-get install -y -qq     libgdk3.0-cil     libatk1.0-dev     libcairo2-dev     libpango1.0-dev     libgdk-pixbuf2.0-dev     libsoup-3.0-dev     libjavascriptcoregtk-4.1-dev     libwebkit2gtk-4.1-dev     npm     && rm -rf /var/lib/apt/lists/*'\n\nRule: DS-0029\nSeverity: HIGH\nTarget: .devcontainer/Dockerfile"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-62c46f1646054585", "name": "DS-0002: Image user should not be 'root' \u2014 examples/01-app-demos/hotdog/Dockerfile", "shortDescription": {"text": "DS-0002: Image user should not be 'root' \u2014 examples/01-app-demos/hotdog/Dockerfile"}, "fullDescription": {"text": "Image user should not be 'root'\n\nSpecify at least 1 USER command in Dockerfile with non-root user as argument\n\nRule: DS-0002\nSeverity: HIGH\nTarget: examples/01-app-demos/hotdog/Dockerfile"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-c7c2cec35c9ac7df", "name": "DS-0026: No HEALTHCHECK defined \u2014 examples/01-app-demos/hotdog/Dockerfile", "shortDescription": {"text": "DS-0026: No HEALTHCHECK defined \u2014 examples/01-app-demos/hotdog/Dockerfile"}, "fullDescription": {"text": "No HEALTHCHECK defined\n\nAdd HEALTHCHECK instruction in your Dockerfile\n\nRule: DS-0026\nSeverity: LOW\nTarget: examples/01-app-demos/hotdog/Dockerfile"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4a210ac3b4b59ff4", "name": "Dockerfile runs as root: .devcontainer/Dockerfile", "shortDescription": {"text": "Dockerfile runs as root: .devcontainer/Dockerfile"}, "fullDescription": {"text": "No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-96d8e193a80b3f69", "name": "Docker base image is tag-pinned but not digest-pinned: rustlang/rust:${VARIANT}", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: rustlang/rust:${VARIANT}"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c5cec4db9e501836", "name": "Dockerfile runs as root: examples/01-app-demos/hotdog/Dockerfile", "shortDescription": {"text": "Dockerfile runs as root: examples/01-app-demos/hotdog/Dockerfile"}, "fullDescription": {"text": "No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-cf2db21ecf5a0dde", "name": "Docker base image is tag-pinned but not digest-pinned: rust:1", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: rust:1"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ee88c77ef95d8c20", "name": "Dockerfile pipes a remote installer into a shell", "shortDescription": {"text": "Dockerfile pipes a remote installer into a shell"}, "fullDescription": {"text": "Executing downloaded code during image build gives the remote endpoint build-time code execution. Prefer pinned packages or verify downloaded installers by checksum/signature."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "high", "confidence": 1.0}}, {"id": "scanner-ea0730130ba9b331", "name": "Insecure pattern 'direct_innerhtml_assignment' in packages/cli/assets/web/dev.loading.html:364", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in packages/cli/assets/web/dev.loading.html:364"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.65}}, {"id": "scanner-4cb0d6b74788c860", "name": "Possible secret in packages/cli/src/bundler/macos.rs", "shortDescription": {"text": "Possible secret in packages/cli/src/bundler/macos.rs"}, "fullDescription": {"text": "Detected 1 occurrence(s) matching password_literal. Rotate real credentials and move them to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.58}}, {"id": "scanner-2f5c1f8aae8a23bd", "name": "Insecure pattern 'cors_wildcard' in packages/desktop/src/protocol.rs:135", "shortDescription": {"text": "Insecure pattern 'cors_wildcard' in packages/desktop/src/protocol.rs:135"}, "fullDescription": {"text": "Found a known-risky pattern (cors_wildcard). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1c9c207d7df87712", "name": "Insecure pattern 'eval_used' in packages/desktop/src/launch.rs:64", "shortDescription": {"text": "Insecure pattern 'eval_used' in packages/desktop/src/launch.rs:64"}, "fullDescription": {"text": "Found a known-risky pattern (eval_used). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-1ba0facab0e23101", "name": "Insecure pattern 'direct_innerhtml_assignment' in packages/interpreter/src/js/set_attribute.js:1", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in packages/interpreter/src/js/set_attribute.js:1"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.65}}, {"id": "scanner-4c3aae12a07c778b", "name": "Insecure pattern 'direct_innerhtml_assignment' in packages/interpreter/src/js/core.js:1", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in packages/interpreter/src/js/core.js:1"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.65}}, {"id": "scanner-70a79ab0be2da9f0", "name": "Insecure pattern 'direct_innerhtml_assignment' in packages/interpreter/src/js/common.js:1", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in packages/interpreter/src/js/common.js:1"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.65}}, {"id": "scanner-d1a4206477243c27", "name": "Insecure pattern 'direct_innerhtml_assignment' in packages/interpreter/src/ts/set_attribute.ts:64", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in packages/interpreter/src/ts/set_attribute.ts:64"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.65}}, {"id": "scanner-4ab37b8d5a08aef1", "name": "Insecure pattern 'cors_wildcard' in packages/asset-resolver/src/native.rs:79", "shortDescription": {"text": "Insecure pattern 'cors_wildcard' in packages/asset-resolver/src/native.rs:79"}, "fullDescription": {"text": "Found a known-risky pattern (cors_wildcard). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6372cebde0220094", "name": "No auth library detected", "shortDescription": {"text": "No auth library detected"}, "fullDescription": {"text": "The scanner did not find any standard auth library (JWT, OAuth, NextAuth, Auth0, etc.). The repo has auth/admin/session surface indicators, so auth may live in custom code, in a separate service, or be missing."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-094eacf7a6439965", "name": "GitHub Action tracks a moving branch", "shortDescription": {"text": "GitHub Action tracks a moving branch"}, "fullDescription": {"text": "crate-ci/typos@master can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "high", "confidence": 1.0}}, {"id": "scanner-1d7e834080dbebed", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/cache@v5 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a53bf972e19b52fd", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v5 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-504cb78cbfafe0bd", "name": "GitHub Action tracks a moving branch", "shortDescription": {"text": "GitHub Action tracks a moving branch"}, "fullDescription": {"text": "dtolnay/rust-toolchain@master can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "high", "confidence": 1.0}}, {"id": "scanner-7ffa33751be3d771", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-45297bdc17c14c8a", "name": "Very large file: packages/fullstack/src/payloads/websocket.rs (1625 lines)", "shortDescription": {"text": "Very large file: packages/fullstack/src/payloads/websocket.rs (1625 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-11fd8a4a4788111f", "name": "Very large file: packages/html/src/attribute_groups.rs (2516 lines)", "shortDescription": {"text": "Very large file: packages/html/src/attribute_groups.rs (2516 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a34b7a05852c6966", "name": "Very large file: packages/html/src/elements.rs (2173 lines)", "shortDescription": {"text": "Very large file: packages/html/src/elements.rs (2173 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6b46bbe5cee76d09", "name": "Very large file: packages/cli/src/logging.rs (1454 lines)", "shortDescription": {"text": "Very large file: packages/cli/src/logging.rs (1454 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-57b6e2b9aec468d2", "name": "Very large file: packages/cli/src/config/manifest.rs (1790 lines)", "shortDescription": {"text": "Very large file: packages/cli/src/config/manifest.rs (1790 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9e14abe313d2e876", "name": "Very large file: packages/cli/src/serve/runner.rs (3213 lines)", "shortDescription": {"text": "Very large file: packages/cli/src/serve/runner.rs (3213 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-513c17698a00c3f0", "name": "Very large file: packages/wasm-split/wasm-split-cli/src/lib.rs (1549 lines)", "shortDescription": {"text": "Very large file: packages/wasm-split/wasm-split-cli/src/lib.rs (1549 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-86a82f676ce492e6", "name": "Very large file: packages/fullstack-macro/src/lib.rs (1924 lines)", "shortDescription": {"text": "Very large file: packages/fullstack-macro/src/lib.rs (1924 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-42a14d877de71729", "name": "Very large file: packages/core-macro/src/props/mod.rs (1848 lines)", "shortDescription": {"text": "Very large file: packages/core-macro/src/props/mod.rs (1848 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-03d6fd0be4bb59af", "name": "158 TODO/FIXME markers", "shortDescription": {"text": "158 TODO/FIXME markers"}, "fullDescription": {"text": "High count of TODO/FIXME/HACK markers \u2014 track them as issues so they're not forgotten."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 19 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-72b2a6250083a784", "name": "Placeholder or mock-heavy implementation detected", "shortDescription": {"text": "Placeholder or mock-heavy implementation detected"}, "fullDescription": {"text": "Found 153 placeholder/mock markers across 59 source files. This often means the repo looks complete while core flows still use generated scaffolding or fake data."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9f59b9d053b6b2b4", "name": "Commented-code block (6 lines) in packages/playwright-tests/cli-optimization.spec.js:66", "shortDescription": {"text": "Commented-code block (6 lines) in packages/playwright-tests/cli-optimization.spec.js:66"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-9d1439f6112bfdc7", "name": "Commented-code block (5 lines) in packages/playwright-tests/fullstack.spec.js:110", "shortDescription": {"text": "Commented-code block (5 lines) in packages/playwright-tests/fullstack.spec.js:110"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-3bd59f7f509af044", "name": "Commented-code block (5 lines) in packages/playwright-tests/cli-optimization/assets/esm_module.js:1", "shortDescription": {"text": "Commented-code block (5 lines) in packages/playwright-tests/cli-optimization/assets/esm_module.js:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-bc7764a4f6b816e4", "name": "`fetch()` without try/.catch or AbortSignal \u2014 packages/interpreter/src/js/native.js:1", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 packages/interpreter/src/js/native.js:1"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b9648f4e349760df", "name": "`fetch()` without try/.catch or AbortSignal \u2014 packages/interpreter/src/ts/native.ts:170", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 packages/interpreter/src/ts/native.ts:170"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-13f24b5d2689e542", "name": "Vulnerable dependency anyhow 1.0.102: RUSTSEC-2026-0190", "shortDescription": {"text": "Vulnerable dependency anyhow 1.0.102: RUSTSEC-2026-0190"}, "fullDescription": {"text": "OSV.dev reports `anyhow` at version `1.0.102` (resolved in `Cargo.lock`) is affected by RUSTSEC-2026-0190.\n\nUnsoundness in `Error::downcast_mut()`\n\nAdvisory: https://osv.dev/vulnerability/RUSTSEC-2026-0190\nFix: upgrade `anyhow` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1af1812c80724553", "name": "Vulnerable dependency async-std 1.13.2: RUSTSEC-2025-0052", "shortDescription": {"text": "Vulnerable dependency async-std 1.13.2: RUSTSEC-2025-0052"}, "fullDescription": {"text": "OSV.dev reports `async-std` at version `1.13.2` (resolved in `Cargo.lock`) is affected by RUSTSEC-2025-0052.\n\nasync-std has been discontinued\n\nAdvisory: https://osv.dev/vulnerability/RUSTSEC-2025-0052\nFix: upgrade `async-std` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-81246e425aeee53b", "name": "Vulnerable dependency lru 0.12.5: GHSA-rhfx-m35p-ff5j", "shortDescription": {"text": "Vulnerable dependency lru 0.12.5: GHSA-rhfx-m35p-ff5j"}, "fullDescription": {"text": "OSV.dev reports `lru` at version `0.12.5` (resolved in `Cargo.lock`) is affected by GHSA-rhfx-m35p-ff5j.\n\n`IterMut` violates Stacked Borrows by invalidating internal pointer\n\nAliases: GHSA-rhfx-m35p-ff5j, RUSTSEC-2026-0002\nAdvisory: https://osv.dev/vulnerability/GHSA-rhfx-m35p-ff5j\nFix: upgrade `lru` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4c6e155e237ee6db", "name": "Vulnerable dependency memmap2 0.9.10: RUSTSEC-2026-0186", "shortDescription": {"text": "Vulnerable dependency memmap2 0.9.10: RUSTSEC-2026-0186"}, "fullDescription": {"text": "OSV.dev reports `memmap2` at version `0.9.10` (resolved in `Cargo.lock`) is affected by RUSTSEC-2026-0186.\n\nUnchecked pointer offset in crate `memmap2`\n\nAdvisory: https://osv.dev/vulnerability/RUSTSEC-2026-0186\nFix: upgrade `memmap2` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-33f1bc3bce547be2", "name": "Vulnerable dependency webpack 5.94.0: GHSA-38r7-794h-5758", "shortDescription": {"text": "Vulnerable dependency webpack 5.94.0: GHSA-38r7-794h-5758"}, "fullDescription": {"text": "OSV.dev reports `webpack` at version `5.94.0` (resolved in `packages/extension/package-lock.json`) is affected by GHSA-38r7-794h-5758 (aka CVE-2025-68157).\n\nwebpack buildHttp HttpUriPlugin allowedUris bypass via HTTP redirects \u2192 SSRF + cache persistence\n\nAliases: CVE-2025-68157\nAdvisory: https://osv.dev/vulnerability/GHSA-38r7-794h-5758\nFix: upgrade `webpack` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "low", "confidence": 0.9}}, {"id": "scanner-5b3a25a73b9042a7", "name": "Vulnerable dependency webpack 5.94.0: GHSA-8fgc-7cc6-rx7x", "shortDescription": {"text": "Vulnerable dependency webpack 5.94.0: GHSA-8fgc-7cc6-rx7x"}, "fullDescription": {"text": "OSV.dev reports `webpack` at version `5.94.0` (resolved in `packages/extension/package-lock.json`) is affected by GHSA-8fgc-7cc6-rx7x (aka CVE-2025-68458).\n\nwebpack buildHttp: allowedUris allow-list bypass via URL userinfo (@) leading to build-time SSRF behavior\n\nAliases: CVE-2025-68458\nAdvisory: https://osv.dev/vulnerability/GHSA-8fgc-7cc6-rx7x\nFix: upgrade `webpack` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "low", "confidence": 0.9}}, {"id": "scanner-f764b3b0193f150d", "name": "Vulnerable dependency bytes 1.10.1: GHSA-434x-w66g-qw3r", "shortDescription": {"text": "Vulnerable dependency bytes 1.10.1: GHSA-434x-w66g-qw3r"}, "fullDescription": {"text": "OSV.dev reports `bytes` at version `1.10.1` (declared in `Cargo.toml`) is affected by GHSA-434x-w66g-qw3r (aka CVE-2026-25541).\nNote: `1.10.1` is the declared floor of a range \u2014 the installed version may be newer.\n\nbytes has integer overflow in BytesMut::reserve\n\nAliases: CVE-2026-25541, GHSA-434x-w66g-qw3r, RUSTSEC-2026-0007\nAdvisory: https://osv.dev/vulnerability/GHSA-434x-w66g-qw3r\nFix: upgrade `bytes` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.7}}, {"id": "scanner-c4ac8e6d271c9885", "name": "Vulnerable dependency atk 0.18.2: RUSTSEC-2024-0413", "shortDescription": {"text": "Vulnerable dependency atk 0.18.2: RUSTSEC-2024-0413"}, "fullDescription": {"text": "OSV.dev reports `atk` at version `0.18.2` (resolved in `Cargo.lock`) is affected by RUSTSEC-2024-0413.\nNote: `atk` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\ngtk-rs GTK3 bindings - no longer maintained\n\nAdvisory: https://osv.dev/vulnerability/RUSTSEC-2024-0413\nFix: upgrade `atk` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-842c917ae827e02e", "name": "Vulnerable dependency atk-sys 0.18.2: RUSTSEC-2024-0416", "shortDescription": {"text": "Vulnerable dependency atk-sys 0.18.2: RUSTSEC-2024-0416"}, "fullDescription": {"text": "OSV.dev reports `atk-sys` at version `0.18.2` (resolved in `Cargo.lock`) is affected by RUSTSEC-2024-0416.\nNote: `atk-sys` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\ngtk-rs GTK3 bindings - no longer maintained\n\nAdvisory: https://osv.dev/vulnerability/RUSTSEC-2024-0416\nFix: upgrade `atk-sys` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-e357551991f3ec4f", "name": "Vulnerable dependency atomic-polyfill 1.0.3: RUSTSEC-2023-0089", "shortDescription": {"text": "Vulnerable dependency atomic-polyfill 1.0.3: RUSTSEC-2023-0089"}, "fullDescription": {"text": "OSV.dev reports `atomic-polyfill` at version `1.0.3` (resolved in `Cargo.lock`) is affected by RUSTSEC-2023-0089.\nNote: `atomic-polyfill` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\natomic-polyfill is unmaintained\n\nAdvisory: https://osv.dev/vulnerability/RUSTSEC-2023-0089\nFix: upgrade `atomic-polyfill` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-1395070335461b7b", "name": "Vulnerable dependency crossbeam-epoch 0.9.18: RUSTSEC-2026-0204", "shortDescription": {"text": "Vulnerable dependency crossbeam-epoch 0.9.18: RUSTSEC-2026-0204"}, "fullDescription": {"text": "OSV.dev reports `crossbeam-epoch` at version `0.9.18` (resolved in `Cargo.lock`) is affected by RUSTSEC-2026-0204.\nNote: `crossbeam-epoch` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nInvalid pointer dereference in `fmt::Pointer` impl for `Atomic` and `Shared` when the underlying pointer is invalid\n\nAdvisory: https://osv.dev/vulnerability/RUSTSEC-2026-0204\nFix: upgrade `crossbeam-epoch` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-f136f4ebf00f9cdb", "name": "Dependency ansi-to-tui is a major version behind", "shortDescription": {"text": "Dependency ansi-to-tui is a major version behind"}, "fullDescription": {"text": "`ansi-to-tui` is pinned at `7.0` in `packages/cli/Cargo.toml` while the latest release on the cargo registry is `8.0.1` \u2014 1 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `ansi-to-tui` to `8.0.1`."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "low", "confidence": 0.9}}]}}, "automationDetails": {"id": "repobility/30761"}, "properties": {"repository": "DioxusLabs/dioxus", "repoUrl": "https://github.com/DioxusLabs/dioxus", "branch": "main"}, "results": [{"ruleId": "scanner-77effece67fd5eb0", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 packages/playwright-tests/web-patch-fullstack.spec.js:107"}, "properties": {"repobilityId": "041b1c629e2310a1", "scanner": "scanner-primary", "fingerprint": "77effece67fd5eb0", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-016647ba30eef2fe", "level": "none", "message": {"text": "TODO/FIXME marker in shipping code \u2014 packages/playwright-tests/playwright.config.js:67"}, "properties": {"repobilityId": "24a7892e92ea3de8", "scanner": "scanner-primary", "fingerprint": "016647ba30eef2fe", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.todo-marker"]}}, {"ruleId": "scanner-02d8a7cb169307f5", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 packages/playwright-tests/fullstack.spec.js:78"}, "properties": {"repobilityId": "7e29b2d90964d385", "scanner": "scanner-primary", "fingerprint": "02d8a7cb169307f5", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-90d1010130c56dda", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 packages/playwright-tests/web-patch.spec.js:96"}, "properties": {"repobilityId": "64a8aa9c86fbefe4", "scanner": "scanner-primary", "fingerprint": "90d1010130c56dda", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-822e824198e8629e", "level": "none", "message": {"text": "TODO/FIXME marker in shipping code \u2014 packages/interpreter/src/ts/serialize.ts:519"}, "properties": {"repobilityId": "4f482f5774080c8f", "scanner": "scanner-primary", "fingerprint": "822e824198e8629e", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.todo-marker"]}}, {"ruleId": "scanner-b9bcf5ca8555be08", "level": "none", "message": {"text": "TODO/FIXME marker in shipping code \u2014 packages/interpreter/src/ts/native.ts:412"}, "properties": {"repobilityId": "01122e7016d7bd91", "scanner": "scanner-primary", "fingerprint": "b9bcf5ca8555be08", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.todo-marker"]}}, {"ruleId": "scanner-b00286e3782b5bde", "level": "none", "message": {"text": "TODO/FIXME marker in shipping code \u2014 packages/extension/src/main.ts:22"}, "properties": {"repobilityId": "c0d149aff7cb456b", "scanner": "scanner-primary", "fingerprint": "b00286e3782b5bde", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.todo-marker"]}}, {"ruleId": "scanner-2161b6aad7d2a9ac", "level": "none", "message": {"text": "TODO/FIXME marker in shipping code \u2014 packages/liveview/src/main.js:29"}, "properties": {"repobilityId": "4eb697cbd2be7a3f", "scanner": "scanner-primary", "fingerprint": "2161b6aad7d2a9ac", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.todo-marker"]}}, {"ruleId": "scanner-8dd9d7ecfae9d179", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 examples/10-integrations/pwa/public/sw.js:3"}, "properties": {"repobilityId": "393cee146b704828", "scanner": "scanner-primary", "fingerprint": "8dd9d7ecfae9d179", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-8273f2ddc4c1c143", "level": "warning", "message": {"text": "unquoted attribute var \u2014 packages/cli/assets/android/gen/app/src/main/AndroidManifest.xml.hbs:25"}, "properties": {"repobilityId": "53eb5f2d7065ff56", "scanner": "scanner-primary", "fingerprint": "8273f2ddc4c1c143", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["semgrep", "security", "html-templates"]}}, {"ruleId": "scanner-199b954f5f99a06e", "level": "warning", "message": {"text": "unquoted attribute var \u2014 packages/cli/assets/android/gen/app/src/main/AndroidManifest.xml.hbs:26"}, "properties": {"repobilityId": "6e53f01ec5a0399c", "scanner": "scanner-primary", "fingerprint": "199b954f5f99a06e", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["semgrep", "security", "html-templates"]}}, {"ruleId": "scanner-7d85a0952942c106", "level": "warning", "message": {"text": "GHSA-wrw7-89jp-8q8g: glib 0.18.5 \u2014 Cargo.lock"}, "properties": {"repobilityId": "ea7fb90c0d6c704b", "scanner": "scanner-primary", "fingerprint": "7d85a0952942c106", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-wrw7-89jp-8q8g"]}}, {"ruleId": "scanner-7fd81f235952a13f", "level": "note", "message": {"text": "GHSA-rhfx-m35p-ff5j: lru 0.12.5 \u2014 Cargo.lock"}, "properties": {"repobilityId": "133a6d9cbc5b40d0", "scanner": "scanner-primary", "fingerprint": "7fd81f235952a13f", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-rhfx-m35p-ff5j"]}}, {"ruleId": "scanner-17012128e5dd8d1f", "level": "error", "message": {"text": "DS-0002: Image user should not be 'root' \u2014 .devcontainer/Dockerfile"}, "properties": {"repobilityId": "f3fb0929c161c149", "scanner": "scanner-primary", "fingerprint": "17012128e5dd8d1f", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "misconfig"]}}, {"ruleId": "scanner-c9c8522741c191fe", "level": "note", "message": {"text": "DS-0026: No HEALTHCHECK defined \u2014 .devcontainer/Dockerfile"}, "properties": {"repobilityId": "b92ce3048e4ec526", "scanner": "scanner-primary", "fingerprint": "c9c8522741c191fe", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "misconfig"]}}, {"ruleId": "scanner-e2c81574da3989e2", "level": "error", "message": {"text": "DS-0029: 'apt-get' missing '--no-install-recommends' \u2014 .devcontainer/Dockerfile"}, "properties": {"repobilityId": "4abfa8247e933ea8", "scanner": "scanner-primary", "fingerprint": "e2c81574da3989e2", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "misconfig"]}}, {"ruleId": "scanner-62c46f1646054585", "level": "error", "message": {"text": "DS-0002: Image user should not be 'root' \u2014 examples/01-app-demos/hotdog/Dockerfile"}, "properties": {"repobilityId": "0e80a6adb373a6cf", "scanner": "scanner-primary", "fingerprint": "62c46f1646054585", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "misconfig"]}}, {"ruleId": "scanner-c7c2cec35c9ac7df", "level": "note", "message": {"text": "DS-0026: No HEALTHCHECK defined \u2014 examples/01-app-demos/hotdog/Dockerfile"}, "properties": {"repobilityId": "4881187e0621a3b1", "scanner": "scanner-primary", "fingerprint": "c7c2cec35c9ac7df", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "misconfig"]}}, {"ruleId": "scanner-4a210ac3b4b59ff4", "level": "warning", "message": {"text": "Dockerfile runs as root: .devcontainer/Dockerfile"}, "properties": {"repobilityId": "7855b1f55d0800cf", "scanner": "scanner-primary", "fingerprint": "4a210ac3b4b59ff4", "layer": "hardware", "severity": "medium", "confidence": 1.0, "tags": ["security", "container"]}}, {"ruleId": "scanner-96d8e193a80b3f69", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: rustlang/rust:${VARIANT}"}, "properties": {"repobilityId": "54b0df251015cd51", "scanner": "scanner-primary", "fingerprint": "96d8e193a80b3f69", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".devcontainer/Dockerfile"}, "region": {"startLine": 2}}}]}, {"ruleId": "scanner-c5cec4db9e501836", "level": "warning", "message": {"text": "Dockerfile runs as root: examples/01-app-demos/hotdog/Dockerfile"}, "properties": {"repobilityId": "1f252896fb4fb359", "scanner": "scanner-primary", "fingerprint": "c5cec4db9e501836", "layer": "hardware", "severity": "medium", "confidence": 1.0, "tags": ["security", "container"]}}, {"ruleId": "scanner-cf2db21ecf5a0dde", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: rust:1"}, "properties": {"repobilityId": "8e6691beea5dc527", "scanner": "scanner-primary", "fingerprint": "cf2db21ecf5a0dde", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "examples/01-app-demos/hotdog/Dockerfile"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ee88c77ef95d8c20", "level": "error", "message": {"text": "Dockerfile pipes a remote installer into a shell"}, "properties": {"repobilityId": "54ec6f9169e03b14", "scanner": "scanner-primary", "fingerprint": "ee88c77ef95d8c20", "layer": "hardware", "severity": "high", "confidence": 1.0, "tags": ["supply-chain", "docker", "remote-installer"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "examples/01-app-demos/hotdog/Dockerfile"}, "region": {"startLine": 13}}}]}, {"ruleId": "scanner-ea0730130ba9b331", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in packages/cli/assets/web/dev.loading.html:364"}, "properties": {"repobilityId": "bc174d836c440534", "scanner": "scanner-primary", "fingerprint": "ea0730130ba9b331", "layer": "security", "severity": "medium", "confidence": 0.65, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/cli/assets/web/dev.loading.html"}, "region": {"startLine": 364}}}]}, {"ruleId": "scanner-4cb0d6b74788c860", "level": "warning", "message": {"text": "Possible secret in packages/cli/src/bundler/macos.rs"}, "properties": {"repobilityId": "bb818e5cd5c25aa2", "scanner": "scanner-primary", "fingerprint": "4cb0d6b74788c860", "layer": "security", "severity": "medium", "confidence": 0.58, "tags": ["secrets", "password_literal"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/cli/src/bundler/macos.rs"}, "region": {"startLine": 671}}}]}, {"ruleId": "scanner-2f5c1f8aae8a23bd", "level": "warning", "message": {"text": "Insecure pattern 'cors_wildcard' in packages/desktop/src/protocol.rs:135"}, "properties": {"repobilityId": "f999f66a06b82734", "scanner": "scanner-primary", "fingerprint": "2f5c1f8aae8a23bd", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "cors_wildcard"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/desktop/src/protocol.rs"}, "region": {"startLine": 135}}}]}, {"ruleId": "scanner-1c9c207d7df87712", "level": "error", "message": {"text": "Insecure pattern 'eval_used' in packages/desktop/src/launch.rs:64"}, "properties": {"repobilityId": "aec73da8989a4f63", "scanner": "scanner-primary", "fingerprint": "1c9c207d7df87712", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "eval_used"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/desktop/src/launch.rs"}, "region": {"startLine": 64}}}]}, {"ruleId": "scanner-1ba0facab0e23101", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in packages/interpreter/src/js/set_attribute.js:1"}, "properties": {"repobilityId": "6ccf752f2940032d", "scanner": "scanner-primary", "fingerprint": "1ba0facab0e23101", "layer": "security", "severity": "medium", "confidence": 0.65, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/interpreter/src/js/set_attribute.js"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-4c3aae12a07c778b", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in packages/interpreter/src/js/core.js:1"}, "properties": {"repobilityId": "567f61284fd559c8", "scanner": "scanner-primary", "fingerprint": "4c3aae12a07c778b", "layer": "security", "severity": "medium", "confidence": 0.65, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/interpreter/src/js/core.js"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-70a79ab0be2da9f0", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in packages/interpreter/src/js/common.js:1"}, "properties": {"repobilityId": "eb304cc6e1bc8b14", "scanner": "scanner-primary", "fingerprint": "70a79ab0be2da9f0", "layer": "security", "severity": "medium", "confidence": 0.65, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/interpreter/src/js/common.js"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d1a4206477243c27", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in packages/interpreter/src/ts/set_attribute.ts:64"}, "properties": {"repobilityId": "f562d6c7c2bc1ec6", "scanner": "scanner-primary", "fingerprint": "d1a4206477243c27", "layer": "security", "severity": "medium", "confidence": 0.65, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/interpreter/src/ts/set_attribute.ts"}, "region": {"startLine": 64}}}]}, {"ruleId": "scanner-4ab37b8d5a08aef1", "level": "warning", "message": {"text": "Insecure pattern 'cors_wildcard' in packages/asset-resolver/src/native.rs:79"}, "properties": {"repobilityId": "41f7b472d66cec6c", "scanner": "scanner-primary", "fingerprint": "4ab37b8d5a08aef1", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "cors_wildcard"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/asset-resolver/src/native.rs"}, "region": {"startLine": 79}}}]}, {"ruleId": "scanner-6372cebde0220094", "level": "warning", "message": {"text": "No auth library detected"}, "properties": {"repobilityId": "a5b6035a5bbf8054", "scanner": "scanner-primary", "fingerprint": "6372cebde0220094", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["coverage", "auth"]}}, {"ruleId": "scanner-094eacf7a6439965", "level": "error", "message": {"text": "GitHub Action tracks a moving branch"}, "properties": {"repobilityId": "7d6d1ba4ad98d5c2", "scanner": "scanner-primary", "fingerprint": "094eacf7a6439965", "layer": "cicd", "severity": "high", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/main.yml"}, "region": {"startLine": 72}}}]}, {"ruleId": "scanner-1d7e834080dbebed", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "29017210739f3a48", "scanner": "scanner-primary", "fingerprint": "1d7e834080dbebed", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/main.yml"}, "region": {"startLine": 81}}}]}, {"ruleId": "scanner-a53bf972e19b52fd", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "c3a7fd7808c1c0eb", "scanner": "scanner-primary", "fingerprint": "a53bf972e19b52fd", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/publish.yml"}, "region": {"startLine": 73}}}]}, {"ruleId": "scanner-504cb78cbfafe0bd", "level": "error", "message": {"text": "GitHub Action tracks a moving branch"}, "properties": {"repobilityId": "57c9f39e1c5717ea", "scanner": "scanner-primary", "fingerprint": "504cb78cbfafe0bd", "layer": "cicd", "severity": "high", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/publish.yml"}, "region": {"startLine": 116}}}]}, {"ruleId": "scanner-7ffa33751be3d771", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "491a3ad29cbaf189", "scanner": "scanner-primary", "fingerprint": "7ffa33751be3d771", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/publish.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-45297bdc17c14c8a", "level": "note", "message": {"text": "Very large file: packages/fullstack/src/payloads/websocket.rs (1625 lines)"}, "properties": {"repobilityId": "16fc449e0353e2d4", "scanner": "scanner-primary", "fingerprint": "45297bdc17c14c8a", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-11fd8a4a4788111f", "level": "note", "message": {"text": "Very large file: packages/html/src/attribute_groups.rs (2516 lines)"}, "properties": {"repobilityId": "35074c69dad7e457", "scanner": "scanner-primary", "fingerprint": "11fd8a4a4788111f", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-a34b7a05852c6966", "level": "note", "message": {"text": "Very large file: packages/html/src/elements.rs (2173 lines)"}, "properties": {"repobilityId": "5974c285458a3b75", "scanner": "scanner-primary", "fingerprint": "a34b7a05852c6966", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-6b46bbe5cee76d09", "level": "note", "message": {"text": "Very large file: packages/cli/src/logging.rs (1454 lines)"}, "properties": {"repobilityId": "c804cdefab45c072", "scanner": "scanner-primary", "fingerprint": "6b46bbe5cee76d09", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-57b6e2b9aec468d2", "level": "note", "message": {"text": "Very large file: packages/cli/src/config/manifest.rs (1790 lines)"}, "properties": {"repobilityId": "87176165a612836e", "scanner": "scanner-primary", "fingerprint": "57b6e2b9aec468d2", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-9e14abe313d2e876", "level": "note", "message": {"text": "Very large file: packages/cli/src/serve/runner.rs (3213 lines)"}, "properties": {"repobilityId": "18970d5b09e8b18b", "scanner": "scanner-primary", "fingerprint": "9e14abe313d2e876", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-513c17698a00c3f0", "level": "note", "message": {"text": "Very large file: packages/wasm-split/wasm-split-cli/src/lib.rs (1549 lines)"}, "properties": {"repobilityId": "fa34c3af2c3daf3b", "scanner": "scanner-primary", "fingerprint": "513c17698a00c3f0", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-86a82f676ce492e6", "level": "note", "message": {"text": "Very large file: packages/fullstack-macro/src/lib.rs (1924 lines)"}, "properties": {"repobilityId": "a6a787944decf050", "scanner": "scanner-primary", "fingerprint": "86a82f676ce492e6", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-42a14d877de71729", "level": "note", "message": {"text": "Very large file: packages/core-macro/src/props/mod.rs (1848 lines)"}, "properties": {"repobilityId": "2e3575ca0416cf35", "scanner": "scanner-primary", "fingerprint": "42a14d877de71729", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-03d6fd0be4bb59af", "level": "note", "message": {"text": "158 TODO/FIXME markers"}, "properties": {"repobilityId": "4b38c118003e07d2", "scanner": "scanner-primary", "fingerprint": "03d6fd0be4bb59af", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["maintenance"]}}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "c95649aa7670e572", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-72b2a6250083a784", "level": "warning", "message": {"text": "Placeholder or mock-heavy implementation detected"}, "properties": {"repobilityId": "16a3e2bf9319af14", "scanner": "scanner-primary", "fingerprint": "72b2a6250083a784", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "incomplete", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "4852e7353715ede4", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-9f59b9d053b6b2b4", "level": "none", "message": {"text": "Commented-code block (6 lines) in packages/playwright-tests/cli-optimization.spec.js:66"}, "properties": {"repobilityId": "50ccd086941531af", "scanner": "scanner-primary", "fingerprint": "9f59b9d053b6b2b4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-9d1439f6112bfdc7", "level": "none", "message": {"text": "Commented-code block (5 lines) in packages/playwright-tests/fullstack.spec.js:110"}, "properties": {"repobilityId": "831666e118e3baa3", "scanner": "scanner-primary", "fingerprint": "9d1439f6112bfdc7", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-3bd59f7f509af044", "level": "none", "message": {"text": "Commented-code block (5 lines) in packages/playwright-tests/cli-optimization/assets/esm_module.js:1"}, "properties": {"repobilityId": "682b98b638ebadeb", "scanner": "scanner-primary", "fingerprint": "3bd59f7f509af044", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-bc7764a4f6b816e4", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 packages/interpreter/src/js/native.js:1"}, "properties": {"repobilityId": "dc21c463637f62fe", "scanner": "scanner-primary", "fingerprint": "bc7764a4f6b816e4", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-b9648f4e349760df", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 packages/interpreter/src/ts/native.ts:170"}, "properties": {"repobilityId": "422313830e27f444", "scanner": "scanner-primary", "fingerprint": "b9648f4e349760df", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-13f24b5d2689e542", "level": "warning", "message": {"text": "Vulnerable dependency anyhow 1.0.102: RUSTSEC-2026-0190"}, "properties": {"repobilityId": "b0f8e201981c9769", "scanner": "scanner-primary", "fingerprint": "13f24b5d2689e542", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "RUSTSEC-2026-0190"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Cargo.toml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-1af1812c80724553", "level": "warning", "message": {"text": "Vulnerable dependency async-std 1.13.2: RUSTSEC-2025-0052"}, "properties": {"repobilityId": "79cd0fe8896c5207", "scanner": "scanner-primary", "fingerprint": "1af1812c80724553", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "RUSTSEC-2025-0052"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Cargo.toml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-81246e425aeee53b", "level": "warning", "message": {"text": "Vulnerable dependency lru 0.12.5: GHSA-rhfx-m35p-ff5j"}, "properties": {"repobilityId": "0510b44ff3d6180e", "scanner": "scanner-primary", "fingerprint": "81246e425aeee53b", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-rhfx-m35p-ff5j"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Cargo.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-4c6e155e237ee6db", "level": "warning", "message": {"text": "Vulnerable dependency memmap2 0.9.10: RUSTSEC-2026-0186"}, "properties": {"repobilityId": "09a8acb9d7c246c8", "scanner": "scanner-primary", "fingerprint": "4c6e155e237ee6db", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "RUSTSEC-2026-0186"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Cargo.toml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-33f1bc3bce547be2", "level": "note", "message": {"text": "Vulnerable dependency webpack 5.94.0: GHSA-38r7-794h-5758"}, "properties": {"repobilityId": "3afa0954f601fdfe", "scanner": "scanner-primary", "fingerprint": "33f1bc3bce547be2", "layer": "dependencies", "severity": "low", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-38r7-794h-5758", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/extension/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-5b3a25a73b9042a7", "level": "note", "message": {"text": "Vulnerable dependency webpack 5.94.0: GHSA-8fgc-7cc6-rx7x"}, "properties": {"repobilityId": "bda22859626de13e", "scanner": "scanner-primary", "fingerprint": "5b3a25a73b9042a7", "layer": "dependencies", "severity": "low", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-8fgc-7cc6-rx7x", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/extension/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f764b3b0193f150d", "level": "warning", "message": {"text": "Vulnerable dependency bytes 1.10.1: GHSA-434x-w66g-qw3r"}, "properties": {"repobilityId": "827a27482333256e", "scanner": "scanner-primary", "fingerprint": "f764b3b0193f150d", "layer": "dependencies", "severity": "medium", "confidence": 0.7, "tags": ["dependency", "sca", "osv", "GHSA-434x-w66g-qw3r", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Cargo.toml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c4ac8e6d271c9885", "level": "warning", "message": {"text": "Vulnerable dependency atk 0.18.2: RUSTSEC-2024-0413"}, "properties": {"repobilityId": "e8b78fb4e93005a6", "scanner": "scanner-primary", "fingerprint": "c4ac8e6d271c9885", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "RUSTSEC-2024-0413", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Cargo.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-842c917ae827e02e", "level": "warning", "message": {"text": "Vulnerable dependency atk-sys 0.18.2: RUSTSEC-2024-0416"}, "properties": {"repobilityId": "ac1b3966bac55e1d", "scanner": "scanner-primary", "fingerprint": "842c917ae827e02e", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "RUSTSEC-2024-0416", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Cargo.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e357551991f3ec4f", "level": "warning", "message": {"text": "Vulnerable dependency atomic-polyfill 1.0.3: RUSTSEC-2023-0089"}, "properties": {"repobilityId": "bcf8e56c221891d2", "scanner": "scanner-primary", "fingerprint": "e357551991f3ec4f", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "RUSTSEC-2023-0089", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Cargo.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-1395070335461b7b", "level": "warning", "message": {"text": "Vulnerable dependency crossbeam-epoch 0.9.18: RUSTSEC-2026-0204"}, "properties": {"repobilityId": "6ea139e316193f24", "scanner": "scanner-primary", "fingerprint": "1395070335461b7b", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "RUSTSEC-2026-0204", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Cargo.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f136f4ebf00f9cdb", "level": "note", "message": {"text": "Dependency ansi-to-tui is a major version behind"}, "properties": {"repobilityId": "5dd3ce060ec41a4d", "scanner": "scanner-primary", "fingerprint": "f136f4ebf00f9cdb", "layer": "dependencies", "severity": "low", "confidence": 0.9, "tags": ["dependency", "freshness", "outdated"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/cli/Cargo.toml"}, "region": {"startLine": 1}}}]}]}]}