{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-5c9a6bc3d632b89a", "name": "Possibly dead Python function: extract_basics_section", "shortDescription": {"text": "Possibly dead Python function: extract_basics_section"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-877a4c7aa5945e75", "name": "Possibly dead Python function: extract_work_section", "shortDescription": {"text": "Possibly dead Python function: extract_work_section"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8fb79dd8001514fc", "name": "Possibly dead Python function: extract_education_section", "shortDescription": {"text": "Possibly dead Python function: extract_education_section"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b9068babdfde5623", "name": "Possibly dead Python function: extract_skills_section", "shortDescription": {"text": "Possibly dead Python function: extract_skills_section"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6f95bca1e38de3f6", "name": "Possibly dead Python function: extract_projects_section", "shortDescription": {"text": "Possibly dead Python function: extract_projects_section"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1dc3d9ca02851b8b", "name": "Possibly dead Python function: extract_awards_section", "shortDescription": {"text": "Possibly dead Python function: extract_awards_section"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-24eff42fb7fa7b9d", "name": "Possibly dead Python function: extract_json_from_text", "shortDescription": {"text": "Possibly dead Python function: extract_json_from_text"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3e8af2ac18b611d7", "name": "CVE-2026-32274: black 25.9.0 \u2014 requirements.txt", "shortDescription": {"text": "CVE-2026-32274: black 25.9.0 \u2014 requirements.txt"}, "fullDescription": {"text": "black: Black: Arbitrary file writes from unsanitized user input in cache file name\n\nBlack is the uncompromising Python code formatter. Prior to 26.3.1, Black writes a cache file, the name of which is computed from various formatting options. The value of the --python-cell-magics option was placed in the filename without sanitization, which allowed an attacker who controls the value of this argument to write cache files to arbitrary file system locations. Fixed in Black 26.3.1.\n\nPackage: black\nInstalled: 25.9.0\nFixed in: 26.3.1\nSeverity: HIGH\nFix: Upgrade black to 26.3.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-6372cebde0220094", "name": "No auth library detected", "shortDescription": {"text": "No auth library detected"}, "fullDescription": {"text": "The scanner did not find any standard auth library (JWT, OAuth, NextAuth, Auth0, etc.). The repo has auth/admin/session surface indicators, so auth may live in custom code, in a separate service, or be missing."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7445cca95c4d8459", "name": "Very large file: pymupdf_rag.py (1377 lines)", "shortDescription": {"text": "Very large file: pymupdf_rag.py (1377 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6893a6c8b0861585", "name": "Very low test-to-source ratio", "shortDescription": {"text": "Very low test-to-source ratio"}, "fullDescription": {"text": "0 test file(s) for 11 source file(s) (ratio 0.00). Consider adding integration or unit tests for critical paths."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 86 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b9088664ace7f748", "name": "Composite production-readiness gap", "shortDescription": {"text": "Composite production-readiness gap"}, "fullDescription": {"text": "Multiple low-cost hardening controls are missing together: ci, tests. Opus verification showed these co-occurring gaps are a better readiness signal than reading each flag in isolation."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1b5a76780c3df9aa", "name": "1 env vars used in code but missing from .env.example", "shortDescription": {"text": "1 env vars used in code but missing from .env.example"}, "fullDescription": {"text": "Drift between code and config docs. The first few: `GITHUB_TOKEN`. Add them (with a placeholder/comment) to .env.example so onboarding doesn't break."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-a4c33efb4fc4bf77", "name": "Vulnerable dependency black 25.9.0: GHSA-3936-cmfr-pm3m", "shortDescription": {"text": "Vulnerable dependency black 25.9.0: GHSA-3936-cmfr-pm3m"}, "fullDescription": {"text": "OSV.dev reports `black` at version `25.9.0` (declared in `requirements.txt`) is affected by GHSA-3936-cmfr-pm3m (aka CVE-2026-32274).\n\nBlack: Arbitrary file writes from unsanitized user input in cache file name\n\nAliases: CVE-2026-32274, GHSA-3936-cmfr-pm3m, PYSEC-2026-2121\nAdvisory: https://osv.dev/vulnerability/GHSA-3936-cmfr-pm3m\nFix: upgrade `black` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 1.0}}, {"id": "scanner-a75767d642db4949", "name": "Vulnerable dependency black 25.9.0: PYSEC-2026-2120", "shortDescription": {"text": "Vulnerable dependency black 25.9.0: PYSEC-2026-2120"}, "fullDescription": {"text": "OSV.dev reports `black` at version `25.9.0` (declared in `requirements.txt`) is affected by PYSEC-2026-2120 (aka CVE-2026-31900).\n\nNo summary published yet.\n\nAliases: CVE-2026-31900, GHSA-v53h-f6m7-xcgm\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-2120\nFix: upgrade `black` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-c03182f9caa6706e", "name": "Dependency black is a major version behind", "shortDescription": {"text": "Dependency black is a major version behind"}, "fullDescription": {"text": "`black` is pinned at `25.9.0` in `requirements.txt` while the latest release on the pypi registry is `26.5.1` \u2014 1 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `black` to `26.5.1`."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "low", "confidence": 0.9}}, {"id": "scanner-62e6c3e5520ca461", "name": "Dependency pymupdf4llm is a major version behind", "shortDescription": {"text": "Dependency pymupdf4llm is a major version behind"}, "fullDescription": {"text": "`pymupdf4llm` is pinned at `0.0.27` in `requirements.txt` while the latest release on the pypi registry is `1.28.0` \u2014 1 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `pymupdf4llm` to `1.28.0`."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "low", "confidence": 0.9}}]}}, "automationDetails": {"id": "repobility/30781"}, "properties": {"repository": "interviewstreet/hiring-agent", "repoUrl": "https://github.com/interviewstreet/hiring-agent", "branch": "main"}, "results": [{"ruleId": "scanner-5c9a6bc3d632b89a", "level": "note", "message": {"text": "Possibly dead Python function: extract_basics_section"}, "properties": {"repobilityId": "08fad524654154c9", "scanner": "scanner-primary", "fingerprint": "5c9a6bc3d632b89a", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pdf.py:134"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-877a4c7aa5945e75", "level": "note", "message": {"text": "Possibly dead Python function: extract_work_section"}, "properties": {"repobilityId": "0886bc418b2d869e", "scanner": "scanner-primary", "fingerprint": "877a4c7aa5945e75", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pdf.py:143"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-8fb79dd8001514fc", "level": "note", "message": {"text": "Possibly dead Python function: extract_education_section"}, "properties": {"repobilityId": "02d0a176d112373e", "scanner": "scanner-primary", "fingerprint": "8fb79dd8001514fc", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pdf.py:150"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b9068babdfde5623", "level": "note", "message": {"text": "Possibly dead Python function: extract_skills_section"}, "properties": {"repobilityId": "d58945e5dd5cc70e", "scanner": "scanner-primary", "fingerprint": "b9068babdfde5623", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pdf.py:161"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6f95bca1e38de3f6", "level": "note", "message": {"text": "Possibly dead Python function: extract_projects_section"}, "properties": {"repobilityId": "e7ff8a2789b9c283", "scanner": "scanner-primary", "fingerprint": "6f95bca1e38de3f6", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pdf.py:170"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-1dc3d9ca02851b8b", "level": "note", "message": {"text": "Possibly dead Python function: extract_awards_section"}, "properties": {"repobilityId": "50ad364745e6c711", "scanner": "scanner-primary", "fingerprint": "1dc3d9ca02851b8b", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pdf.py:181"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-24eff42fb7fa7b9d", "level": "note", "message": {"text": "Possibly dead Python function: extract_json_from_text"}, "properties": {"repobilityId": "258f95fd488548dc", "scanner": "scanner-primary", "fingerprint": "24eff42fb7fa7b9d", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pdf.py:190"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3e8af2ac18b611d7", "level": "error", "message": {"text": "CVE-2026-32274: black 25.9.0 \u2014 requirements.txt"}, "properties": {"repobilityId": "87bf4394b05c725e", "scanner": "scanner-primary", "fingerprint": "3e8af2ac18b611d7", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-32274"]}}, {"ruleId": "scanner-6372cebde0220094", "level": "warning", "message": {"text": "No auth library detected"}, "properties": {"repobilityId": "a5b6035a5bbf8054", "scanner": "scanner-primary", "fingerprint": "6372cebde0220094", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["coverage", "auth"]}}, {"ruleId": "scanner-7445cca95c4d8459", "level": "note", "message": {"text": "Very large file: pymupdf_rag.py (1377 lines)"}, "properties": {"repobilityId": "df4c6125df730c6e", "scanner": "scanner-primary", "fingerprint": "7445cca95c4d8459", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-6893a6c8b0861585", "level": "warning", "message": {"text": "Very low test-to-source ratio"}, "properties": {"repobilityId": "54a7de3f06314bf0", "scanner": "scanner-primary", "fingerprint": "6893a6c8b0861585", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["tests", "coverage"]}}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "76f31fa7375e67d9", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-b9088664ace7f748", "level": "note", "message": {"text": "Composite production-readiness gap"}, "properties": {"repobilityId": "8734b4c08e66f4dd", "scanner": "scanner-primary", "fingerprint": "b9088664ace7f748", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["production-readiness", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-1b5a76780c3df9aa", "level": "none", "message": {"text": "1 env vars used in code but missing from .env.example"}, "properties": {"repobilityId": "d04379b337b44a15", "scanner": "scanner-primary", "fingerprint": "1b5a76780c3df9aa", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "config-drift"]}}, {"ruleId": "scanner-a4c33efb4fc4bf77", "level": "error", "message": {"text": "Vulnerable dependency black 25.9.0: GHSA-3936-cmfr-pm3m"}, "properties": {"repobilityId": "a698b06b02ec5fd6", "scanner": "scanner-primary", "fingerprint": "a4c33efb4fc4bf77", "layer": "dependencies", "severity": "high", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-3936-cmfr-pm3m"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a75767d642db4949", "level": "error", "message": {"text": "Vulnerable dependency black 25.9.0: PYSEC-2026-2120"}, "properties": {"repobilityId": "3dd6286017469719", "scanner": "scanner-primary", "fingerprint": "a75767d642db4949", "layer": "dependencies", "severity": "critical", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "PYSEC-2026-2120"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c03182f9caa6706e", "level": "note", "message": {"text": "Dependency black is a major version behind"}, "properties": {"repobilityId": "a606e283cf503863", "scanner": "scanner-primary", "fingerprint": "c03182f9caa6706e", "layer": "dependencies", "severity": "low", "confidence": 0.9, "tags": ["dependency", "freshness", "outdated"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-62e6c3e5520ca461", "level": "note", "message": {"text": "Dependency pymupdf4llm is a major version behind"}, "properties": {"repobilityId": "82cad6e296ee0136", "scanner": "scanner-primary", "fingerprint": "62e6c3e5520ca461", "layer": "dependencies", "severity": "low", "confidence": 0.9, "tags": ["dependency", "freshness", "outdated"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "requirements.txt"}, "region": {"startLine": 1}}}]}]}]}