{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "GHSA-58qx-3vcg-4xpx", "name": "ws: GHSA-58qx-3vcg-4xpx", "shortDescription": {"text": "ws: GHSA-58qx-3vcg-4xpx"}, "fullDescription": {"text": "ws: Uninitialized memory disclosure"}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "medium", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "GHSA-v6wh-96g9-6wx3", "name": "vite: GHSA-v6wh-96g9-6wx3", "shortDescription": {"text": "vite: GHSA-v6wh-96g9-6wx3"}, "fullDescription": {"text": "launch-editor: NTLMv2 hash disclosure via UNC path handling on Windows"}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "medium", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "GHSA-h67p-54hq-rp68", "name": "js-yaml: GHSA-h67p-54hq-rp68", "shortDescription": {"text": "js-yaml: GHSA-h67p-54hq-rp68"}, "fullDescription": {"text": "JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases"}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "medium", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "GHSA-45c6-75p6-83cc", "name": "fast-xml-builder: GHSA-45c6-75p6-83cc", "shortDescription": {"text": "fast-xml-builder: GHSA-45c6-75p6-83cc"}, "fullDescription": {"text": "fast-xml-builder Comment Value regex can be bypassed"}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "medium", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "SEC045", "name": "[SEC045] eval()/exec() on stored or user-supplied data: eval() and exec() on data \u2014 even admin-stored data \u2014 is a latera", "shortDescription": {"text": "[SEC045] eval()/exec() on stored or user-supplied data: eval() and exec() on data \u2014 even admin-stored data \u2014 is a lateral-movement vector after any one credential compromise. Sandboxes (__builtins__ cleared) are escapable: attackers use obj"}, "fullDescription": {"text": "For literal data structures: use ast.literal_eval(text) \u2014 only parses literals, raises on code.\nFor formula evaluation: use asteval or simpleeval (purpose-built sandboxes with allow-lists).\nFor Odoo: use odoo.tools.safe_eval(expr, locals_dict, mode='exec').\nIf you genuinely need to execute admin-stored code: require explicit super-admin permission AND log every execution with a stack trace."}, "properties": {"scanner": "repobility-threat-engine", "category": "injection", "severity": "medium", "confidence": 1.0, "cwe": "", "owasp": ""}}, {"id": "DEPCUR-NPM", "name": "npm package `@types/react-dom` is 1 major version(s) behind (^18.3.1 -> 19.2.3)", "shortDescription": {"text": "npm package `@types/react-dom` is 1 major version(s) behind (^18.3.1 -> 19.2.3)"}, "fullDescription": {"text": "`@types/react-dom` is pinned/resolved at ^18.3.1 but the latest stable release on the npm registry is 19.2.3 (1 major version(s) behind). Outdated dependencies accumulate unpatched bugs and make future security upgrades harder. This is the version-currency signal Dependabot version-update PRs raise."}, "properties": {"scanner": "repobility-dependency-currency", "category": "dependency", "severity": "medium", "confidence": 0.9, "cwe": "", "owasp": ""}}, {"id": "MINED115", "name": "Action `pnpm/action-setup` pinned to mutable ref `@v4`", "shortDescription": {"text": "Action `pnpm/action-setup` pinned to mutable ref `@v4`"}, "fullDescription": {"text": "`uses: pnpm/action-setup@v4` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-actions/changed-files compromise (2025) instantly affect many repos. Treat official first-party action tags as lower risk, but pin security-sensitive third-party actions to a 40-char commit SHA + lock with Dependabot or renovate."}, "properties": {"scanner": "repobility-supply-chain", "category": "dependency", "severity": "medium", "confidence": 0.9, "cwe": "", "owasp": ""}}, {"id": "GHSA-g7r4-m6w7-qqqr", "name": "esbuild: GHSA-g7r4-m6w7-qqqr", "shortDescription": {"text": "esbuild: GHSA-g7r4-m6w7-qqqr"}, "fullDescription": {"text": "esbuild allows arbitrary file read when running the development server on Windows"}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "low", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "GHSA-4x5r-pxfx-6jf8", "name": "@babel/core: GHSA-4x5r-pxfx-6jf8", "shortDescription": {"text": "@babel/core: GHSA-4x5r-pxfx-6jf8"}, "fullDescription": {"text": "@babel/core: Arbitrary File Read via sourceMappingURL Comment"}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "low", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "MINED116", "name": "Workflow references `secrets.LHCI_GITHUB_APP_TOKEN` in a `pull_request` workflow", "shortDescription": {"text": "Workflow references `secrets.LHCI_GITHUB_APP_TOKEN` in a `pull_request` workflow"}, "fullDescription": {"text": "`pull_request` workflows from forks do not receive normal repository secrets, so `${ secrets.LHCI_GITHUB_APP_TOKEN }` is usually empty for untrusted fork PRs. This is a reliability/intent signal, not direct fork-secret exfiltration. Keep high severity for pull_request_target or trusted-context jobs that run untrusted PR code with secrets."}, "properties": {"scanner": "repobility-supply-chain", "category": "dependency", "severity": "low", "confidence": 0.9, "cwe": "", "owasp": ""}}, {"id": "AIC003", "name": "Duplicated implementation block across source files", "shortDescription": {"text": "Duplicated implementation block across source files"}, "fullDescription": {"text": "Duplicated blocks are a common artifact when generated code is pasted or recreated instead of reused. They increase maintenance cost because every future bug fix must be found in multiple locations."}, "properties": {"scanner": "repobility-ai-code-hygiene", "category": "quality", "severity": "low", "confidence": 0.86, "cwe": "", "owasp": ""}}, {"id": "CORE_NO_LICENSE", "name": "No LICENSE file", "shortDescription": {"text": "No LICENSE file"}, "fullDescription": {"text": "Add a LICENSE file to your repository. Use choosealicense.com to pick the right license (MIT for permissive, Apache 2.0 for patent protection, GPL for copyleft)."}, "properties": {"scanner": "repobility-core", "category": "documentation", "severity": "low", "confidence": null, "cwe": "", "owasp": ""}}, {"id": "MINED043", "name": "[MINED043] Http Not Https (and 2 more): Same pattern found in 2 additional files. Review if needed.", "shortDescription": {"text": "[MINED043] Http Not Https (and 2 more): Same pattern found in 2 additional files. Review if needed."}, "fullDescription": {"text": "Review and fix per the pattern semantics. See CWE-319 / A02:2021 for context."}, "properties": {"scanner": "repobility-threat-engine", "category": "quality", "severity": "info", "confidence": 0.2, "cwe": "", "owasp": ""}}, {"id": "MINED045", "name": "[MINED045] Ts Non Null Assertion (and 3 more): Same pattern found in 3 additional files. Review if needed.", "shortDescription": {"text": "[MINED045] Ts Non Null Assertion (and 3 more): Same pattern found in 3 additional files. Review if needed."}, "fullDescription": {"text": "Review and fix per the pattern semantics. See CWE-476 /  for context."}, "properties": {"scanner": "repobility-threat-engine", "category": "quality", "severity": "info", "confidence": 0.2, "cwe": "", "owasp": ""}}, {"id": "MINED049", "name": "[MINED049] Print Pii: Logging password/token/email/ssn directly to stdout.", "shortDescription": {"text": "[MINED049] Print Pii: Logging password/token/email/ssn directly to stdout."}, "fullDescription": {"text": "Review and fix per the pattern semantics. See CWE-532 / A09:2021 for context."}, "properties": {"scanner": "repobility-threat-engine", "category": "quality", "severity": "info", "confidence": 1.0, "cwe": "", "owasp": ""}}, {"id": "SEC020", "name": "[SEC020] Secret Printed to Logs: Debug or diagnostic code appears to print a credential-bearing value. This is a frequen", "shortDescription": {"text": "[SEC020] Secret Printed to Logs: Debug or diagnostic code appears to print a credential-bearing value. This is a frequent AI-assisted coding failure: the helper exposes the exact value needed for troubleshooting."}, "fullDescription": {"text": "Log only redacted, hashed, or last-four-style metadata. Rotate any secret that may have reached logs."}, "properties": {"scanner": "repobility-threat-engine", "category": "credential_exposure", "severity": "info", "confidence": 0.15, "cwe": "", "owasp": ""}}, {"id": "SEC040", "name": "[SEC040] innerHTML XSS \u2014 template literal with server-supplied data (and 4 more): Same pattern found in 4 additional fil", "shortDescription": {"text": "[SEC040] innerHTML XSS \u2014 template literal with server-supplied data (and 4 more): Same pattern found in 4 additional files. Review if needed."}, "fullDescription": {"text": "For plain text: use el.textContent = data.value (auto-escapes).\nFor HTML you need to render: el.innerHTML = DOMPurify.sanitize(html).\nFor React/Vue/Svelte: stop using innerHTML; use the framework's binding.\nWhen data comes from CV/PDF parsers, sanitize at the parser boundary too."}, "properties": {"scanner": "repobility-threat-engine", "category": "xss", "severity": "info", "confidence": 0.2, "cwe": "", "owasp": ""}}, {"id": "MINED044", "name": "[MINED044] Js Console Log Prod (and 24 more): Same pattern found in 24 additional files. Review if needed.", "shortDescription": {"text": "[MINED044] Js Console Log Prod (and 24 more): Same pattern found in 24 additional files. Review if needed."}, "fullDescription": {"text": "Review and fix per the pattern semantics. See CWE-532 /  for context."}, "properties": {"scanner": "repobility-threat-engine", "category": "quality", "severity": "info", "confidence": 0.2, "cwe": "", "owasp": ""}}, {"id": "SEC029", "name": "[SEC029] Server-Side Request Forgery (SSRF) \u2014 outbound HTTP from user input (and 1 more): Same pattern found in 1 additi", "shortDescription": {"text": "[SEC029] Server-Side Request Forgery (SSRF) \u2014 outbound HTTP from user input (and 1 more): Same pattern found in 1 additional files. Review if needed."}, "fullDescription": {"text": "Validate the URL against an allowlist BEFORE fetching:\n  ALLOWED = {'images.example.com', 'cdn.example.com'}\n  host = urlparse(url).hostname\n  if host not in ALLOWED: abort(400)\nOr use a server-side proxy (Imgproxy / serve-files-only-from-S3) that isolates outbound network access from the request handler.\nBlock private CIDRs explicitly: 10/8, 172.16/12, 192.168/16, 169.254/16."}, "properties": {"scanner": "repobility-threat-engine", "category": "ssrf", "severity": "info", "confidence": 0.2, "cwe": "", "owasp": ""}}, {"id": "GHSA-96hv-2xvq-fx4p", "name": "ws: GHSA-96hv-2xvq-fx4p", "shortDescription": {"text": "ws: GHSA-96hv-2xvq-fx4p"}, "fullDescription": {"text": "ws: Memory exhaustion DoS from tiny fragments and data chunks"}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "high", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "GHSA-fx2h-pf6j-xcff", "name": "vite: GHSA-fx2h-pf6j-xcff", "shortDescription": {"text": "vite: GHSA-fx2h-pf6j-xcff"}, "fullDescription": {"text": "vite: `server.fs.deny` bypass on Windows alternate paths"}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "high", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "GHSA-5wm8-gmm8-39j9", "name": "fast-xml-builder: GHSA-5wm8-gmm8-39j9", "shortDescription": {"text": "fast-xml-builder: GHSA-5wm8-gmm8-39j9"}, "fullDescription": {"text": "fast-xml-builder allows attribute values with unwanted quotes to bypass malicious or unwanted attributes"}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "high", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "GHSA-gv7w-rqvm-qjhr", "name": "esbuild: GHSA-gv7w-rqvm-qjhr", "shortDescription": {"text": "esbuild: GHSA-gv7w-rqvm-qjhr"}, "fullDescription": {"text": "esbuild: Missing binary integrity verification in Deno module enables remote code execution via NPM_CONFIG_REGISTRY"}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "high", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "GHSA-77vg-94rm-hx3p", "name": "devalue: GHSA-77vg-94rm-hx3p", "shortDescription": {"text": "devalue: GHSA-77vg-94rm-hx3p"}, "fullDescription": {"text": "Svelte devalue: DoS via sparse array deserialization"}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "high", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "SEC100", "name": "[SEC100] CORS permissive Access-Control-Allow-Origin: *: Permissive CORS policy (`*` origin) allows any website to make ", "shortDescription": {"text": "[SEC100] CORS permissive Access-Control-Allow-Origin: *: Permissive CORS policy (`*` origin) allows any website to make authenticated cross-origin requests. Especially dangerous when combined with `Access-Control-Allow-Credentials: true`."}, "fullDescription": {"text": "Allowlist specific origins. For dynamic per-request validation, validate against a known list and echo the origin back. Never combine wildcard origin with credentials."}, "properties": {"scanner": "repobility-threat-engine", "category": "quality", "severity": "high", "confidence": 1.0, "cwe": "", "owasp": ""}}, {"id": "SEC085", "name": "[SEC085] JS: child_process.exec with non-literal: child_process.exec with user-derived input enables command injection. ", "shortDescription": {"text": "[SEC085] JS: child_process.exec with non-literal: child_process.exec with user-derived input enables command injection. Ported from eslint-plugin-security detect-child-process (Apache-2.0)."}, "fullDescription": {"text": "Use execFile / spawn with separate args array; never pass shell strings."}, "properties": {"scanner": "repobility-threat-engine", "category": "quality", "severity": "high", "confidence": 1.0, "cwe": "", "owasp": ""}}, {"id": "generic-api-key", "name": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", "shortDescription": {"text": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations."}, "fullDescription": {"text": "Gitleaks detected a committed secret or credential pattern."}, "properties": {"scanner": "gitleaks", "category": "credential_exposure", "severity": "critical", "confidence": 0.95, "cwe": "", "owasp": ""}}, {"id": "scanner-fabc09dcbcef9fd2", "name": "Privileged port 3 in use", "shortDescription": {"text": "Privileged port 3 in use"}, "fullDescription": {"text": "Port 3 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-221446745989ac8b", "name": "Privileged port 18 in use", "shortDescription": {"text": "Privileged port 18 in use"}, "fullDescription": {"text": "Port 18 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0394e7b09b8d03d1", "name": "Privileged port 21 in use", "shortDescription": {"text": "Privileged port 21 in use"}, "fullDescription": {"text": "Port 21 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-40df70f73dde0793", "name": "Privileged port 15 in use", "shortDescription": {"text": "Privileged port 15 in use"}, "fullDescription": {"text": "Port 15 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4f5f990dfc1dd3b6", "name": "Privileged port 12 in use", "shortDescription": {"text": "Privileged port 12 in use"}, "fullDescription": {"text": "Port 12 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-80c5edd21ea3ab97", "name": "Insecure pattern 'node_child_process' in scripts/install-hooks.mjs:14", "shortDescription": {"text": "Insecure pattern 'node_child_process' in scripts/install-hooks.mjs:14"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8cd5a1cf217e3468", "name": "Insecure pattern 'node_child_process' in scripts/secrets-scan.mjs:13", "shortDescription": {"text": "Insecure pattern 'node_child_process' in scripts/secrets-scan.mjs:13"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f644036668e14873", "name": "Insecure pattern 'node_child_process' in scripts/setup-env.mjs:15", "shortDescription": {"text": "Insecure pattern 'node_child_process' in scripts/setup-env.mjs:15"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4f9a71c176284e58", "name": "Insecure pattern 'node_child_process' in scripts/audit/distribute-published-dates.mjs:23", "shortDescription": {"text": "Insecure pattern 'node_child_process' in scripts/audit/distribute-published-dates.mjs:23"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-079cae9a8ea89610", "name": "Insecure pattern 'node_child_process' in scripts/audit/backfill-published-dates.mjs:28", "shortDescription": {"text": "Insecure pattern 'node_child_process' in scripts/audit/backfill-published-dates.mjs:28"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0ef941a54cb6b4ab", "name": "Insecure pattern 'cors_wildcard' in src/pages/api/qa.json.ts:70", "shortDescription": {"text": "Insecure pattern 'cors_wildcard' in src/pages/api/qa.json.ts:70"}, "fullDescription": {"text": "Found a known-risky pattern (cors_wildcard). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2b7767a3dea5ca72", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-5f1367acd3721aef", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/github-script@v7 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c24e64f26f76d038", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "gitleaks/gitleaks-action@v2 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-908c78a196adf4ea", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/upload-artifact@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b16e8a8e1d5bc448", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/github-script@v7 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5723c5883d55fc2c", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-27924aa79fa4a517", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/upload-artifact@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-bda6deb11902724f", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-cb639d9a10a47b23", "name": "package.json defines install-time lifecycle scripts", "shortDescription": {"text": "package.json defines install-time lifecycle scripts"}, "fullDescription": {"text": "preinstall/install/postinstall/prepare scripts execute during dependency installation. Review them carefully for network calls, obfuscation, shell execution, or credential access."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ea3b5e389d8c9c0f", "name": "Low test-to-source ratio", "shortDescription": {"text": "Low test-to-source ratio"}, "fullDescription": {"text": "13 tests / 55 src (ratio 0.24)."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-141b30a41e03817b", "name": "No license file detected", "shortDescription": {"text": "No license file detected"}, "fullDescription": {"text": "No LICENSE/COPYING/NOTICE file was found. Generated repositories often omit licensing, which blocks reuse and automated intake."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-01f96f71d9907a8c", "name": "README lacks setup or run instructions", "shortDescription": {"text": "README lacks setup or run instructions"}, "fullDescription": {"text": "A README exists, but it does not contain common install/setup/run markers. This matches a frequent generated-code pattern: UI is present, operational handoff is thin."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 226 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b9088664ace7f748", "name": "Composite production-readiness gap", "shortDescription": {"text": "Composite production-readiness gap"}, "fullDescription": {"text": "Multiple low-cost hardening controls are missing together: license, operator-readme. Opus verification showed these co-occurring gaps are a better readiness signal than reading each flag in isolation."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-749d4bc1bd66df5f", "name": "Agent instructions exist but release-hardening basics are missing", "shortDescription": {"text": "Agent instructions exist but release-hardening basics are missing"}, "fullDescription": {"text": "AI-coder instruction files were found, but the repo is missing license, operator-readme. Treat this as a contract gap: the agent is guided, but the generated output is not yet guarded by the controls that make it repeatable."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-bea357a6497a2d5d", "name": "Agent authority lacks a verifier contract: CLAUDE.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: CLAUDE.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6f5d3a0283fa6eff", "name": "Agent authority lacks a verifier contract: .claude/agents/rss-agent.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/agents/rss-agent.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-de8f96782473eb50", "name": "Commented-code block (14 lines) in scripts/audit/revenue-pull.mjs:6", "shortDescription": {"text": "Commented-code block (14 lines) in scripts/audit/revenue-pull.mjs:6"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-c94f262b2656210f", "name": "`fetch()` without try/.catch or AbortSignal \u2014 scripts/audit/revenue-pull.mjs:94", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 scripts/audit/revenue-pull.mjs:94"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8d5834e5f0bd9e86", "name": "Commented-code block (6 lines) in scripts/audit/gsc-opportunities.mjs:10", "shortDescription": {"text": "Commented-code block (6 lines) in scripts/audit/gsc-opportunities.mjs:10"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-e1dcfc6db708c17f", "name": "`fetch()` without try/.catch or AbortSignal \u2014 scripts/audit/gsc-opportunities.mjs:52", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 scripts/audit/gsc-opportunities.mjs:52"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1362c3dbf62ad11b", "name": "Commented-code block (5 lines) in src/lib/ads-lazy.ts:1", "shortDescription": {"text": "Commented-code block (5 lines) in src/lib/ads-lazy.ts:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-b334d875f2339fa1", "name": "5 env vars used in code but missing from .env.example", "shortDescription": {"text": "5 env vars used in code but missing from .env.example"}, "fullDescription": {"text": "Drift between code and config docs. The first few: `CF_PAGES_COMMIT_SHA`, `CI`, `DRY_RUN`, `FAIL_ON_WARN`, `PUBLIC_SENTRY_SAMPLE_RATE`. Add them (with a placeholder/comment) to .env.example so onboarding doesn't break."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/23762"}, "properties": {"repository": "0gam24/moneylook", "repoUrl": "https://github.com/0gam24/moneylook", "branch": "main"}, "results": [{"ruleId": "GHSA-58qx-3vcg-4xpx", "level": "warning", "message": {"text": "ws: GHSA-58qx-3vcg-4xpx"}, "properties": {"repobilityId": 223477, "scanner": "osv-scanner", "fingerprint": "d698c0969dae25e950d4f8b65b021df28bdeb91476dcc255cdcc9ca9ba3ee73e", "category": "dependency", "severity": "medium", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["CVE-2026-45736"], "package": "ws", "rule_id": "GHSA-58qx-3vcg-4xpx", "scanner": "osv-scanner", "correlation_key": "vuln|ws|CVE-2026-45736|pnpm-lock.yaml"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pnpm-lock.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "GHSA-v6wh-96g9-6wx3", "level": "warning", "message": {"text": "vite: GHSA-v6wh-96g9-6wx3"}, "properties": {"repobilityId": 223454, "scanner": "osv-scanner", "fingerprint": "f6b184f7eec0865804e9d8c218e014c364cab884f56cd601768bcd126d110168", "category": "dependency", "severity": "medium", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["CVE-2026-53632"], "package": "vite", "rule_id": "GHSA-v6wh-96g9-6wx3", "scanner": "osv-scanner", "correlation_key": "vuln|vite|CVE-2026-53632|pnpm-lock.yaml"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pnpm-lock.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "GHSA-h67p-54hq-rp68", "level": "warning", "message": {"text": "js-yaml: GHSA-h67p-54hq-rp68"}, "properties": {"repobilityId": 223448, "scanner": "osv-scanner", "fingerprint": "63f0ea25c68b9a69ea942144a267e08da7bba509f52d9409c45e86f70e8b7d57", "category": "dependency", "severity": "medium", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["CVE-2026-53550"], "package": "js-yaml", "rule_id": "GHSA-h67p-54hq-rp68", "scanner": "osv-scanner", "correlation_key": "vuln|js-yaml|CVE-2026-53550|pnpm-lock.yaml"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pnpm-lock.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "GHSA-45c6-75p6-83cc", "level": "warning", "message": {"text": "fast-xml-builder: GHSA-45c6-75p6-83cc"}, "properties": {"repobilityId": 223444, "scanner": "osv-scanner", "fingerprint": "86e8b92c00ec99f8fbbcee253a2dbc50e7a977c0fb97911a0849fa7fd90ff688", "category": "dependency", "severity": "medium", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["CVE-2026-44664"], "package": "fast-xml-builder", "rule_id": "GHSA-45c6-75p6-83cc", "scanner": "osv-scanner", "correlation_key": "vuln|fast-xml-builder|CVE-2026-44664|pnpm-lock.yaml"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pnpm-lock.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "SEC045", "level": "warning", "message": {"text": "[SEC045] eval()/exec() on stored or user-supplied data: eval() and exec() on data \u2014 even admin-stored data \u2014 is a lateral-movement vector after any one credential compromise. Sandboxes (__builtins__ cleared) are escapable: attackers use object introspection (().__class__.__mro__[-1].__subclasses__()) to reach os.system. CWE-95 (eval injection)."}, "properties": {"repobilityId": 223351, "scanner": "repobility-threat-engine", "fingerprint": "e79ca5e750148583fd4f6e13c4f27bb73c37ac439d8656684a83a21a374fffd6", "category": "injection", "severity": "medium", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": ".exec(", "reason": "Pattern matched with no mitigating context found", "rule_id": "SEC045", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "code|injection|token|226|sec045"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/audit/linkify-plain-references.mjs"}, "region": {"startLine": 226}}}]}, {"ruleId": "SEC045", "level": "warning", "message": {"text": "[SEC045] eval()/exec() on stored or user-supplied data: eval() and exec() on data \u2014 even admin-stored data \u2014 is a lateral-movement vector after any one credential compromise. Sandboxes (__builtins__ cleared) are escapable: attackers use object introspection (().__class__.__mro__[-1].__subclasses__()) to reach os.system. CWE-95 (eval injection)."}, "properties": {"repobilityId": 223350, "scanner": "repobility-threat-engine", "fingerprint": "20423330d0585be58b449d505a3a82e95597777e7bcb78f8bf9dd1f1e9395c8d", "category": "injection", "severity": "medium", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": ".exec(", "reason": "Pattern matched with no mitigating context found", "rule_id": "SEC045", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "code|injection|token|98|sec045"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/audit/auto-registration.mjs"}, "region": {"startLine": 98}}}]}, {"ruleId": "DEPCUR-NPM", "level": "warning", "message": {"text": "npm package `@types/react-dom` is 1 major version(s) behind (^18.3.1 -> 19.2.3)"}, "properties": {"repobilityId": 223331, "scanner": "repobility-dependency-currency", "fingerprint": "8b1925b03f2422d3ad7ad6f69b0e8c5c15d7d2c36abb22e36cc37bfeeadba277", "category": "dependency", "severity": "medium", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"gap": "1 major version(s) behind", "signal": "currency", "cwe_ids": [], "package": "@types/react-dom", "scanner": "repobility-dependency-currency", "ecosystem": "npm", "languages": ["javascript"], "latest_version": "19.2.3", "correlation_key": "fp|8b1925b03f2422d3ad7ad6f69b0e8c5c15d7d2c36abb22e36cc37bfeeadba277", "current_version": "^18.3.1"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "DEPCUR-NPM", "level": "warning", "message": {"text": "npm package `@astrojs/mdx` is 1 major version(s) behind (^5.0.4 -> 6.0.3)"}, "properties": {"repobilityId": 223327, "scanner": "repobility-dependency-currency", "fingerprint": "d0edee3ab2bbe0677ee9d0556056897cc3708cc1fc09378102a02906427d8eb5", "category": "dependency", "severity": "medium", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"gap": "1 major version(s) behind", "signal": "currency", "cwe_ids": [], "package": "@astrojs/mdx", "scanner": "repobility-dependency-currency", "ecosystem": "npm", "languages": ["javascript"], "latest_version": "6.0.3", "correlation_key": "fp|d0edee3ab2bbe0677ee9d0556056897cc3708cc1fc09378102a02906427d8eb5", "current_version": "^5.0.4"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "MINED115", "level": "warning", "message": {"text": "Action `pnpm/action-setup` pinned to mutable ref `@v4`"}, "properties": {"repobilityId": 223295, "scanner": "repobility-supply-chain", "fingerprint": "2135b3ca750610875e93b0cf1dd9428128b101580d90aa8576cd009fa08e4083", "category": "dependency", "severity": "medium", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "gha-mutable-ref", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|2135b3ca750610875e93b0cf1dd9428128b101580d90aa8576cd009fa08e4083"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/go-live-check.yml"}, "region": {"startLine": 36}}}]}, {"ruleId": "MINED115", "level": "warning", "message": {"text": "Action `pnpm/action-setup` pinned to mutable ref `@v4`"}, "properties": {"repobilityId": 223283, "scanner": "repobility-supply-chain", "fingerprint": "dbc4d627e4ff09f4cdca9812ab492c699f2c13a44c2186c8a67a08ffa994745c", "category": "dependency", "severity": "medium", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "gha-mutable-ref", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|dbc4d627e4ff09f4cdca9812ab492c699f2c13a44c2186c8a67a08ffa994745c"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/secrets-scan.yml"}, "region": {"startLine": 52}}}]}, {"ruleId": "MINED115", "level": "warning", "message": {"text": "Action `gitleaks/gitleaks-action` pinned to mutable ref `@v2`"}, "properties": {"repobilityId": 223281, "scanner": "repobility-supply-chain", "fingerprint": "1458c2893121af3d34e266f8a7e258a9e20a18c26f4deeefc8202aaacc2e1943", "category": "dependency", "severity": "medium", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "gha-mutable-ref", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|1458c2893121af3d34e266f8a7e258a9e20a18c26f4deeefc8202aaacc2e1943"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/secrets-scan.yml"}, "region": {"startLine": 40}}}]}, {"ruleId": "MINED115", "level": "warning", "message": {"text": "Action `pnpm/action-setup` pinned to mutable ref `@v4`"}, "properties": {"repobilityId": 223274, "scanner": "repobility-supply-chain", "fingerprint": "6649c6dfe4780f32b969e189b3d15e1d6237ff5c5cb3652810c461278667a161", "category": "dependency", "severity": "medium", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "gha-mutable-ref", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|6649c6dfe4780f32b969e189b3d15e1d6237ff5c5cb3652810c461278667a161"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/security-audit.yml"}, "region": {"startLine": 27}}}]}, {"ruleId": "MINED115", "level": "warning", "message": {"text": "Action `pnpm/action-setup` pinned to mutable ref `@v4`"}, "properties": {"repobilityId": 223237, "scanner": "repobility-supply-chain", "fingerprint": "27ee394d4b74e91b5dc4f2726af4327d65d44aa35fcddb317f588c7d561535d4", "category": "dependency", "severity": "medium", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "gha-mutable-ref", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|27ee394d4b74e91b5dc4f2726af4327d65d44aa35fcddb317f588c7d561535d4"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/lighthouse-ci.yml"}, "region": {"startLine": 50}}}]}, {"ruleId": "MINED115", "level": "warning", "message": {"text": "Action `pnpm/action-setup` pinned to mutable ref `@v4`"}, "properties": {"repobilityId": 223230, "scanner": "repobility-supply-chain", "fingerprint": "904264fa8051f357c3cdef378483f8eeee0cbd1e519e76dc2fb28dc7288f69d1", "category": "dependency", "severity": "medium", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "gha-mutable-ref", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|904264fa8051f357c3cdef378483f8eeee0cbd1e519e76dc2fb28dc7288f69d1"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/lighthouse-ci.yml"}, "region": {"startLine": 24}}}]}, {"ruleId": "GHSA-g7r4-m6w7-qqqr", "level": "note", "message": {"text": "esbuild: GHSA-g7r4-m6w7-qqqr"}, "properties": {"repobilityId": 223439, "scanner": "osv-scanner", "fingerprint": "507f69e94e13314e44adb43577d98561b4e3e47da59eb14cf5066dceb0eba911", "category": "dependency", "severity": "low", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "package": "esbuild", "rule_id": "GHSA-g7r4-m6w7-qqqr", "scanner": "osv-scanner", "correlation_key": "vuln|esbuild|GHSA-G7R4-M6W7-QQQR|pnpm-lock.yaml"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pnpm-lock.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "GHSA-4x5r-pxfx-6jf8", "level": "note", "message": {"text": "@babel/core: GHSA-4x5r-pxfx-6jf8"}, "properties": {"repobilityId": 223414, "scanner": "osv-scanner", "fingerprint": "4e4715f00ebfad070b78f6aecc8ad8714c6be17d7c27376ee9c197705f854a92", "category": "dependency", "severity": "low", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["CVE-2026-49356"], "package": "@babel/core", "rule_id": "GHSA-4x5r-pxfx-6jf8", "scanner": "osv-scanner", "correlation_key": "vuln|babel/core|CVE-2026-49356|pnpm-lock.yaml"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pnpm-lock.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "DEPCUR-NPM", "level": "note", "message": {"text": "npm package `pagefind` is minor version(s) behind (^1.4.0 -> 1.5.2)"}, "properties": {"repobilityId": 223341, "scanner": "repobility-dependency-currency", "fingerprint": "a75f49bc2444d3f1d8a373f3f6abafa3067fb889ddf9a7711f9846c0950889f8", "category": "dependency", "severity": "low", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"gap": "minor version(s) behind", "signal": "currency", "cwe_ids": [], "package": "pagefind", "scanner": "repobility-dependency-currency", "ecosystem": "npm", "languages": ["javascript"], "latest_version": "1.5.2", "correlation_key": "fp|a75f49bc2444d3f1d8a373f3f6abafa3067fb889ddf9a7711f9846c0950889f8", "current_version": "^1.4.0"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "DEPCUR-NPM", "level": "note", "message": {"text": "npm package `web-vitals` is minor version(s) behind (^5.2.0 -> 5.3.0)"}, "properties": {"repobilityId": 223330, "scanner": "repobility-dependency-currency", "fingerprint": "3910c280eef1f11817fcfdd349063c2424d392a689135ff3e6b63d2247ffd3c4", "category": "dependency", "severity": "low", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"gap": "minor version(s) behind", "signal": "currency", "cwe_ids": [], "package": "web-vitals", "scanner": "repobility-dependency-currency", "ecosystem": "npm", "languages": ["javascript"], "latest_version": "5.3.0", "correlation_key": "fp|3910c280eef1f11817fcfdd349063c2424d392a689135ff3e6b63d2247ffd3c4", "current_version": "^5.2.0"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "MINED115", "level": "note", "message": {"text": "Action `actions/github-script` pinned to mutable ref `@v7`"}, "properties": {"repobilityId": 223325, "scanner": "repobility-supply-chain", "fingerprint": "e1c2267592a2909a628d6d98b66144bf0f8ea5466d796d7e4fea500a99c68382", "category": "dependency", "severity": "low", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "gha-mutable-ref", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|e1c2267592a2909a628d6d98b66144bf0f8ea5466d796d7e4fea500a99c68382"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/stale-content-check.yml"}, "region": {"startLine": 46}}}]}, {"ruleId": "MINED115", "level": "note", "message": {"text": "Action `actions/setup-node` pinned to mutable ref `@v4`"}, "properties": {"repobilityId": 223315, "scanner": "repobility-supply-chain", "fingerprint": "beaa6e9759adae6507744dfcee295ed8c44d1c2d23c996cced1e82558ea3854a", "category": "dependency", "severity": "low", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "gha-mutable-ref", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|beaa6e9759adae6507744dfcee295ed8c44d1c2d23c996cced1e82558ea3854a"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/stale-content-check.yml"}, "region": {"startLine": 22}}}]}, {"ruleId": "MINED115", "level": "note", "message": {"text": "Action `actions/checkout` pinned to mutable ref `@v4`"}, "properties": {"repobilityId": 223313, "scanner": "repobility-supply-chain", "fingerprint": "a1f34a5e90286131c0efe840b232a4fe01f47e0eddb6e6aa803249bcde10c4a5", "category": "dependency", "severity": "low", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "gha-mutable-ref", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|a1f34a5e90286131c0efe840b232a4fe01f47e0eddb6e6aa803249bcde10c4a5"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/stale-content-check.yml"}, "region": {"startLine": 21}}}]}, {"ruleId": "MINED115", "level": "note", "message": {"text": "Action `actions/upload-artifact` pinned to mutable ref `@v4`"}, "properties": {"repobilityId": 223305, "scanner": "repobility-supply-chain", "fingerprint": "a2eae0c3410dd19822b04920dd49a985ea142b1dd48dece2bb5aae923d337b17", "category": "dependency", "severity": "low", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "gha-mutable-ref", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|a2eae0c3410dd19822b04920dd49a985ea142b1dd48dece2bb5aae923d337b17"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/go-live-check.yml"}, "region": {"startLine": 143}}}]}, {"ruleId": "MINED115", "level": "note", "message": {"text": "Action `actions/setup-node` pinned to mutable ref `@v4`"}, "properties": {"repobilityId": 223300, "scanner": "repobility-supply-chain", "fingerprint": "3365f14b9a9456f697a6ffcf70510ab2629a6000d756700947007fa229777822", "category": "dependency", "severity": "low", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "gha-mutable-ref", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|3365f14b9a9456f697a6ffcf70510ab2629a6000d756700947007fa229777822"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/go-live-check.yml"}, "region": {"startLine": 40}}}]}, {"ruleId": "MINED115", "level": "note", "message": {"text": "Action `actions/checkout` pinned to mutable ref `@v4`"}, "properties": {"repobilityId": 223291, "scanner": "repobility-supply-chain", "fingerprint": "5539c2354293c22f2716836244916a25a8d1c26c41b77c324713a5612eb2f23f", "category": "dependency", "severity": "low", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "gha-mutable-ref", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|5539c2354293c22f2716836244916a25a8d1c26c41b77c324713a5612eb2f23f"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/go-live-check.yml"}, "region": {"startLine": 35}}}]}, {"ruleId": "MINED115", "level": "note", "message": {"text": "Action `actions/checkout` pinned to mutable ref `@v4`"}, "properties": {"repobilityId": 223289, "scanner": "repobility-supply-chain", "fingerprint": "fb4f1e7ebf14e7a7a1721bb120ad793ff757ac78685c151fc74710684058532d", "category": "dependency", "severity": "low", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "gha-mutable-ref", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|fb4f1e7ebf14e7a7a1721bb120ad793ff757ac78685c151fc74710684058532d"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/secrets-scan.yml"}, "region": {"startLine": 69}}}]}, {"ruleId": "MINED115", "level": "note", "message": {"text": "Action `actions/setup-node` pinned to mutable ref `@v4`"}, "properties": {"repobilityId": 223288, "scanner": "repobility-supply-chain", "fingerprint": "baa1095a58fc435f2d77bdcb4f7c291f36d4736d24a02783dda6bf49982ef754", "category": "dependency", "severity": "low", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "gha-mutable-ref", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|baa1095a58fc435f2d77bdcb4f7c291f36d4736d24a02783dda6bf49982ef754"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/secrets-scan.yml"}, "region": {"startLine": 56}}}]}, {"ruleId": "MINED115", "level": "note", "message": {"text": "Action `actions/checkout` pinned to mutable ref `@v4`"}, "properties": {"repobilityId": 223282, "scanner": "repobility-supply-chain", "fingerprint": "86fdacaa0c663e8fcef76d3b72703631d546efe421493fbc2b0393998d8f2668", "category": "dependency", "severity": "low", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "gha-mutable-ref", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|86fdacaa0c663e8fcef76d3b72703631d546efe421493fbc2b0393998d8f2668"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/secrets-scan.yml"}, "region": {"startLine": 51}}}]}, {"ruleId": "MINED115", "level": "note", "message": {"text": "Action `actions/checkout` pinned to mutable ref `@v4`"}, "properties": {"repobilityId": 223279, "scanner": "repobility-supply-chain", "fingerprint": "f3d66e9ea9f0773b0598bbb25559475240a6c781b8e2593d56910b115941779c", "category": "dependency", "severity": "low", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "gha-mutable-ref", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|f3d66e9ea9f0773b0598bbb25559475240a6c781b8e2593d56910b115941779c"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/secrets-scan.yml"}, "region": {"startLine": 35}}}]}, {"ruleId": "MINED115", "level": "note", "message": {"text": "Action `actions/upload-artifact` pinned to mutable ref `@v4`"}, "properties": {"repobilityId": 223277, "scanner": "repobility-supply-chain", "fingerprint": "e833700afd3858d6e83a3aee6d6cf074cca20af482301a173aad347b8128e81b", "category": "dependency", "severity": "low", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "gha-mutable-ref", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|e833700afd3858d6e83a3aee6d6cf074cca20af482301a173aad347b8128e81b"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/security-audit.yml"}, "region": {"startLine": 122}}}]}, {"ruleId": "MINED115", "level": "note", "message": {"text": "Action `actions/github-script` pinned to mutable ref `@v7`"}, "properties": {"repobilityId": 223276, "scanner": "repobility-supply-chain", "fingerprint": "3cf01bfdc29a4f4eb467720184f4900ed43448d4602c22e1ccccb3867d3d8fc4", "category": "dependency", "severity": "low", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "gha-mutable-ref", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|3cf01bfdc29a4f4eb467720184f4900ed43448d4602c22e1ccccb3867d3d8fc4"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/security-audit.yml"}, "region": {"startLine": 59}}}]}, {"ruleId": "MINED115", "level": "note", "message": {"text": "Action `actions/setup-node` pinned to mutable ref `@v4`"}, "properties": {"repobilityId": 223275, "scanner": "repobility-supply-chain", "fingerprint": "4d42777c854bc3fa39809ad047e4b7326271d5f466e0e6e9d19bc515702f4a8c", "category": "dependency", "severity": "low", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "gha-mutable-ref", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|4d42777c854bc3fa39809ad047e4b7326271d5f466e0e6e9d19bc515702f4a8c"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/security-audit.yml"}, "region": {"startLine": 31}}}]}, {"ruleId": "MINED115", "level": "note", "message": {"text": "Action `actions/checkout` pinned to mutable ref `@v4`"}, "properties": {"repobilityId": 223272, "scanner": "repobility-supply-chain", "fingerprint": "db0af8cd7183c237146a9df530edb004594fcccde2ca778840400f4aa93a6af4", "category": "dependency", "severity": "low", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "gha-mutable-ref", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|db0af8cd7183c237146a9df530edb004594fcccde2ca778840400f4aa93a6af4"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/security-audit.yml"}, "region": {"startLine": 26}}}]}, {"ruleId": "MINED116", "level": "note", "message": {"text": "Workflow references `secrets.LHCI_GITHUB_APP_TOKEN` in a `pull_request` workflow"}, "properties": {"repobilityId": 223271, "scanner": "repobility-supply-chain", "fingerprint": "26f43ceb564db6056623edee9f0df5dab668f4d3024bc1ce7ec4edbb3cb11136", "category": "dependency", "severity": "low", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "gha-pull-request-secrets", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|26f43ceb564db6056623edee9f0df5dab668f4d3024bc1ce7ec4edbb3cb11136"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/lighthouse-ci.yml"}, "region": {"startLine": 68}}}]}, {"ruleId": "MINED116", "level": "note", "message": {"text": "Workflow references `secrets.LHCI_GITHUB_APP_TOKEN` in a `pull_request` workflow"}, "properties": {"repobilityId": 223245, "scanner": "repobility-supply-chain", "fingerprint": "adb30f3d5997f5cbcecbb386f76d8d21515e7d0d6b05b6b154365d74a22ef81e", "category": "dependency", "severity": "low", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "gha-pull-request-secrets", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|adb30f3d5997f5cbcecbb386f76d8d21515e7d0d6b05b6b154365d74a22ef81e"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/lighthouse-ci.yml"}, "region": {"startLine": 42}}}]}, {"ruleId": "MINED115", "level": "note", "message": {"text": "Action `actions/setup-node` pinned to mutable ref `@v4`"}, "properties": {"repobilityId": 223242, "scanner": "repobility-supply-chain", "fingerprint": "8deb90d6e77dbf83ec5a3fcae3c77aab224ffa5610a118175efacf842d7130da", "category": "dependency", "severity": "low", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "gha-mutable-ref", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|8deb90d6e77dbf83ec5a3fcae3c77aab224ffa5610a118175efacf842d7130da"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/lighthouse-ci.yml"}, "region": {"startLine": 54}}}]}, {"ruleId": "MINED115", "level": "note", "message": {"text": "Action `actions/checkout` pinned to mutable ref `@v4`"}, "properties": {"repobilityId": 223236, "scanner": "repobility-supply-chain", "fingerprint": "089aafc6b9864ea3a6d3e13c4a704c996e04c9f6fc3c90778588bc381856f4bb", "category": "dependency", "severity": "low", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "gha-mutable-ref", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|089aafc6b9864ea3a6d3e13c4a704c996e04c9f6fc3c90778588bc381856f4bb"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/lighthouse-ci.yml"}, "region": {"startLine": 49}}}]}, {"ruleId": "MINED115", "level": "note", "message": {"text": "Action `actions/setup-node` pinned to mutable ref `@v4`"}, "properties": {"repobilityId": 223233, "scanner": "repobility-supply-chain", "fingerprint": "659967eac5522810ac6abf2095c72b0c538045071e9d637d8003a2d082aea1df", "category": "dependency", "severity": "low", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "gha-mutable-ref", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|659967eac5522810ac6abf2095c72b0c538045071e9d637d8003a2d082aea1df"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/lighthouse-ci.yml"}, "region": {"startLine": 28}}}]}, {"ruleId": "MINED115", "level": "note", "message": {"text": "Action `actions/checkout` pinned to mutable ref `@v4`"}, "properties": {"repobilityId": 223229, "scanner": "repobility-supply-chain", "fingerprint": "1045e7762a81c8f8c6fb60de443db88fd807bfccac6a8a59a6aa604432358f3c", "category": "dependency", "severity": "low", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "gha-mutable-ref", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|1045e7762a81c8f8c6fb60de443db88fd807bfccac6a8a59a6aa604432358f3c"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/lighthouse-ci.yml"}, "region": {"startLine": 23}}}]}, {"ruleId": "MINED115", "level": "note", "message": {"text": "Action `actions/checkout` pinned to mutable ref `@v4`"}, "properties": {"repobilityId": 223228, "scanner": "repobility-supply-chain", "fingerprint": "cfaa2c2ee2f7c32d65403b79e396ff2038b4b6480a2cd51fae35018b677d56dc", "category": "dependency", "severity": "low", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "gha-mutable-ref", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|cfaa2c2ee2f7c32d65403b79e396ff2038b4b6480a2cd51fae35018b677d56dc"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/auto-create-pr.yml"}, "region": {"startLine": 34}}}]}, {"ruleId": "AIC003", "level": "note", "message": {"text": "Duplicated implementation block across source files"}, "properties": {"repobilityId": 223225, "scanner": "repobility-ai-code-hygiene", "fingerprint": "72cfa8af891826b1daeee68099ab1ed73cbf473acf120ecadcadf6f76b713a16", "category": "quality", "severity": "low", "confidence": 0.86, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "A normalized source-code window appears in two different non-test files.", "evidence": {"lines": 12, "rule_id": "AIC003", "scanner": "repobility-ai-code-hygiene", "references": ["https://jscpd.dev/"], "duplicate_file": "src/pages/atom.xml.ts", "duplicate_line": 4, "correlation_key": "fp|72cfa8af891826b1daeee68099ab1ed73cbf473acf120ecadcadf6f76b713a16"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/pages/sitemap-news.xml.ts"}, "region": {"startLine": 3}}}]}, {"ruleId": "AIC003", "level": "note", "message": {"text": "Duplicated implementation block across source files"}, "properties": {"repobilityId": 223221, "scanner": "repobility-ai-code-hygiene", "fingerprint": "639f74a8509b210d601ebe7286e97c05eff6e49bbb3de156624fade120dfd657", "category": "quality", "severity": "low", "confidence": 0.86, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "A normalized source-code window appears in two different non-test files.", "evidence": {"lines": 12, "rule_id": "AIC003", "scanner": "repobility-ai-code-hygiene", "references": ["https://jscpd.dev/"], "duplicate_file": "src/pages/sitemap-images.xml.ts", "duplicate_line": 1, "correlation_key": "fp|639f74a8509b210d601ebe7286e97c05eff6e49bbb3de156624fade120dfd657"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/pages/sitemap-news.xml.ts"}, "region": {"startLine": 1}}}]}, {"ruleId": "AIC003", "level": "note", "message": {"text": "Duplicated implementation block across source files"}, "properties": {"repobilityId": 223215, "scanner": "repobility-ai-code-hygiene", "fingerprint": "554b183f6cee429a3484bf0397fcbc570450afcc116b14c7895106bb323a7071", "category": "quality", "severity": "low", "confidence": 0.86, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "A normalized source-code window appears in two different non-test files.", "evidence": {"lines": 12, "rule_id": "AIC003", "scanner": "repobility-ai-code-hygiene", "references": ["https://jscpd.dev/"], "duplicate_file": "src/pages/atom.xml.ts", "duplicate_line": 4, "correlation_key": "fp|554b183f6cee429a3484bf0397fcbc570450afcc116b14c7895106bb323a7071"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/pages/sitemap-images.xml.ts"}, "region": {"startLine": 3}}}]}, {"ruleId": "AIC003", "level": "note", "message": {"text": "Duplicated implementation block across source files"}, "properties": {"repobilityId": 223214, "scanner": "repobility-ai-code-hygiene", "fingerprint": "a15ed41ec29df8a6acf16bf27fed90a8dd9672602989cf6a07c38de2ec9e01a6", "category": "quality", "severity": "low", "confidence": 0.86, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "A normalized source-code window appears in two different non-test files.", "evidence": {"lines": 12, "rule_id": "AIC003", "scanner": "repobility-ai-code-hygiene", "references": ["https://jscpd.dev/"], "duplicate_file": "src/pages/[cluster]/[slug].md.ts", "duplicate_line": 4, "correlation_key": "fp|a15ed41ec29df8a6acf16bf27fed90a8dd9672602989cf6a07c38de2ec9e01a6"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/pages/og/[cluster]/[slug].svg.ts"}, "region": {"startLine": 5}}}]}, {"ruleId": "AIC003", "level": "note", "message": {"text": "Duplicated implementation block across source files"}, "properties": {"repobilityId": 223211, "scanner": "repobility-ai-code-hygiene", "fingerprint": "e30e04fe65235b634a23dbd77846e2b6a2b4196ffc389029bc367c901ab5ed68", "category": "quality", "severity": "low", "confidence": 0.86, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "A normalized source-code window appears in two different non-test files.", "evidence": {"lines": 12, "rule_id": "AIC003", "scanner": "repobility-ai-code-hygiene", "references": ["https://jscpd.dev/"], "duplicate_file": "src/pages/og-square/[cluster]/[slug].svg.ts", "duplicate_line": 1, "correlation_key": "fp|e30e04fe65235b634a23dbd77846e2b6a2b4196ffc389029bc367c901ab5ed68"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/pages/og/[cluster]/[slug].svg.ts"}, "region": {"startLine": 1}}}]}, {"ruleId": "AIC003", "level": "note", "message": {"text": "Duplicated implementation block across source files"}, "properties": {"repobilityId": 223207, "scanner": "repobility-ai-code-hygiene", "fingerprint": "ae8c8a0a60da004beb205c71beb6a347d6fb4558608a25d555d1bbe987f22211", "category": "quality", "severity": "low", "confidence": 0.86, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "A normalized source-code window appears in two different non-test files.", "evidence": {"lines": 12, "rule_id": "AIC003", "scanner": "repobility-ai-code-hygiene", "references": ["https://jscpd.dev/"], "duplicate_file": "src/pages/[cluster]/[slug].md.ts", "duplicate_line": 4, "correlation_key": "fp|ae8c8a0a60da004beb205c71beb6a347d6fb4558608a25d555d1bbe987f22211"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/pages/og-square/[cluster]/[slug].svg.ts"}, "region": {"startLine": 5}}}]}, {"ruleId": "AIC003", "level": "note", "message": {"text": "Duplicated implementation block across source files"}, "properties": {"repobilityId": 223206, "scanner": "repobility-ai-code-hygiene", "fingerprint": "869854159ca857ed84121cdc626bb72abebc55b651ce34184d4b8f6a99e97349", "category": "quality", "severity": "low", "confidence": 0.86, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "A normalized source-code window appears in two different non-test files.", "evidence": {"lines": 12, "rule_id": "AIC003", "scanner": "repobility-ai-code-hygiene", "references": ["https://jscpd.dev/"], "duplicate_file": "src/pages/api/qa.json.ts", "duplicate_line": 3, "correlation_key": "fp|869854159ca857ed84121cdc626bb72abebc55b651ce34184d4b8f6a99e97349"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/pages/feed.json.ts"}, "region": {"startLine": 4}}}]}, {"ruleId": "AIC003", "level": "note", "message": {"text": "Duplicated implementation block across source files"}, "properties": {"repobilityId": 223201, "scanner": "repobility-ai-code-hygiene", "fingerprint": "90f6bf60a4b2e3667ae5a4cc7a5c109d76b52ba1bf265283065acaad372ccf13", "category": "quality", "severity": "low", "confidence": 0.86, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "A normalized source-code window appears in two different non-test files.", "evidence": {"lines": 12, "rule_id": "AIC003", "scanner": "repobility-ai-code-hygiene", "references": ["https://jscpd.dev/"], "duplicate_file": "src/pages/api/qa.json.ts", "duplicate_line": 3, "correlation_key": "fp|90f6bf60a4b2e3667ae5a4cc7a5c109d76b52ba1bf265283065acaad372ccf13"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/pages/atom.xml.ts"}, "region": {"startLine": 11}}}]}, {"ruleId": "CORE_NO_LICENSE", "level": "note", "message": {"text": "No LICENSE file"}, "properties": {"repobilityId": 223196, "scanner": "repobility-core", "fingerprint": "9314e9238cd99885865b92490d1aaa96ca62b1390c9377878d5f3d99227e1c3c", "category": "documentation", "severity": "low", "confidence": null, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"rule_id": "CORE_NO_LICENSE", "scanner": "repobility-core", "correlation_key": "repo|documentation|core_no_license"}}}, {"ruleId": "MINED043", "level": "none", "message": {"text": "[MINED043] Http Not Https (and 2 more): Same pattern found in 2 additional files. Review if needed."}, "properties": {"repobilityId": 223404, "scanner": "repobility-threat-engine", "fingerprint": "62ff231053d16ded91f5d63a99a8b7f9a8d879f1bee1b23442cfa6701d92f730", "category": "quality", "severity": "info", "confidence": 0.2, "triageState": "false_positive", "verdict": "likely_fp", "isResolved": true, "reason": "Deduplicated summary only: 2 additional occurrences found. The top occurrences remain visible as actionable findings.", "evidence": {"mined": true, "mining": {"slug": "http-not-https", "owasp": "A02:2021", "cwe_ids": ["CWE-319"], "precision": 0.917, "promoted_at": "2026-05-18T14:01:32.347999+00:00", "triaged_in_corpus": 12, "observations_count": 4113831, "ai_coder_pattern_id": 15}, "scanner": "repobility-threat-engine", "aggregated": true, "correlation_key": "fp|62ff231053d16ded91f5d63a99a8b7f9a8d879f1bee1b23442cfa6701d92f730", "aggregated_count": 2}}}, {"ruleId": "MINED043", "level": "none", "message": {"text": "[MINED043] Http Not Https: Hardcoded http:// (not localhost) for endpoints that handle credentials or data."}, "properties": {"repobilityId": 223402, "scanner": "repobility-threat-engine", "fingerprint": "524874b12e869553bc160b83d0734285b9b6f0af405298da5b340184eb675048", "category": "quality", "severity": "info", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "http-not-https", "owasp": "A02:2021", "cwe_ids": ["CWE-319"], "precision": 0.917, "promoted_at": "2026-05-18T14:01:32.347999+00:00", "triaged_in_corpus": 12, "observations_count": 4113831, "ai_coder_pattern_id": 15}, "scanner": "repobility-threat-engine", "correlation_key": "fp|524874b12e869553bc160b83d0734285b9b6f0af405298da5b340184eb675048"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/pages/rss/[cluster].xml.ts"}, "region": {"startLine": 39}}}]}, {"ruleId": "MINED043", "level": "none", "message": {"text": "[MINED043] Http Not Https: Hardcoded http:// (not localhost) for endpoints that handle credentials or data."}, "properties": {"repobilityId": 223401, "scanner": "repobility-threat-engine", "fingerprint": "6005aff6676071f38921033a0ecde28dff3c069bf12da19b4a964a9828a8a838", "category": "quality", "severity": "info", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "http-not-https", "owasp": "A02:2021", "cwe_ids": ["CWE-319"], "precision": 0.917, "promoted_at": "2026-05-18T14:01:32.347999+00:00", "triaged_in_corpus": 12, "observations_count": 4113831, "ai_coder_pattern_id": 15}, "scanner": "repobility-threat-engine", "correlation_key": "fp|6005aff6676071f38921033a0ecde28dff3c069bf12da19b4a964a9828a8a838"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/pages/rss.xml.ts"}, "region": {"startLine": 30}}}]}, {"ruleId": "MINED043", "level": "none", "message": {"text": "[MINED043] Http Not Https: Hardcoded http:// (not localhost) for endpoints that handle credentials or data."}, "properties": {"repobilityId": 223399, "scanner": "repobility-threat-engine", "fingerprint": "6f38905b989476aacfa4b4e91fab16ac5089b71f4aa4f696c699f447e18bca6b", "category": "quality", "severity": "info", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "http-not-https", "owasp": "A02:2021", "cwe_ids": ["CWE-319"], "precision": 0.917, "promoted_at": "2026-05-18T14:01:32.347999+00:00", "triaged_in_corpus": 12, "observations_count": 4113831, "ai_coder_pattern_id": 15}, "scanner": "repobility-threat-engine", "correlation_key": "fp|6f38905b989476aacfa4b4e91fab16ac5089b71f4aa4f696c699f447e18bca6b"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/pages/atom.xml.ts"}, "region": {"startLine": 64}}}]}, {"ruleId": "MINED045", "level": "none", "message": {"text": "[MINED045] Ts Non Null Assertion (and 3 more): Same pattern found in 3 additional files. Review if needed."}, "properties": {"repobilityId": 223397, "scanner": "repobility-threat-engine", "fingerprint": "7eac65c6d729ce731cf7f1b0d32d88551e2714b6a555982628995e228d42ee93", "category": "quality", "severity": "info", "confidence": 0.2, "triageState": "false_positive", "verdict": "likely_fp", "isResolved": true, "reason": "Deduplicated summary only: 3 additional occurrences found. The top occurrences remain visible as actionable findings.", "evidence": {"mined": true, "mining": {"slug": "ts-non-null-assertion", "owasp": null, "cwe_ids": ["CWE-476"], "languages": ["typescript", "tsx"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.348005+00:00", "triaged_in_corpus": 12, "observations_count": 1810954, "ai_coder_pattern_id": 105}, "scanner": "repobility-threat-engine", "aggregated": true, "correlation_key": "fp|7eac65c6d729ce731cf7f1b0d32d88551e2714b6a555982628995e228d42ee93", "aggregated_count": 3}}}, {"ruleId": "MINED045", "level": "none", "message": {"text": "[MINED045] Ts Non Null Assertion: x! asserts not null - bypasses null checks - TypeError if wrong."}, "properties": {"repobilityId": 223396, "scanner": "repobility-threat-engine", "fingerprint": "414305783fb19d78ccfb86c1672db3b599bb827dbbc0695667075672468f73db", "category": "quality", "severity": "info", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "ts-non-null-assertion", "owasp": null, "cwe_ids": ["CWE-476"], "languages": ["typescript", "tsx"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.348005+00:00", "triaged_in_corpus": 12, "observations_count": 1810954, "ai_coder_pattern_id": 105}, "scanner": "repobility-threat-engine", "correlation_key": "fp|414305783fb19d78ccfb86c1672db3b599bb827dbbc0695667075672468f73db"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/pages/feed.json.ts"}, "region": {"startLine": 24}}}]}, {"ruleId": "MINED045", "level": "none", "message": {"text": "[MINED045] Ts Non Null Assertion: x! asserts not null - bypasses null checks - TypeError if wrong."}, "properties": {"repobilityId": 223395, "scanner": "repobility-threat-engine", "fingerprint": "ff7070ddf22c49e9a941593e4407e153ed0e5f951d844bc427fc7b4c70598509", "category": "quality", "severity": "info", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "ts-non-null-assertion", "owasp": null, "cwe_ids": ["CWE-476"], "languages": ["typescript", "tsx"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.348005+00:00", "triaged_in_corpus": 12, "observations_count": 1810954, "ai_coder_pattern_id": 105}, "scanner": "repobility-threat-engine", "correlation_key": "fp|ff7070ddf22c49e9a941593e4407e153ed0e5f951d844bc427fc7b4c70598509"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/pages/atom.xml.ts"}, "region": {"startLine": 32}}}]}, {"ruleId": "MINED045", "level": "none", "message": {"text": "[MINED045] Ts Non Null Assertion: x! asserts not null - bypasses null checks - TypeError if wrong."}, "properties": {"repobilityId": 223390, "scanner": "repobility-threat-engine", "fingerprint": "76b2c286f23a95e5017daf97c7952e4345270dc8d17822f5d3e2b6bb9ac69a3c", "category": "quality", "severity": "info", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "ts-non-null-assertion", "owasp": null, "cwe_ids": ["CWE-476"], "languages": ["typescript", "tsx"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.348005+00:00", "triaged_in_corpus": 12, "observations_count": 1810954, "ai_coder_pattern_id": 105}, "scanner": "repobility-threat-engine", "correlation_key": "fp|76b2c286f23a95e5017daf97c7952e4345270dc8d17822f5d3e2b6bb9ac69a3c"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/pages/api/qa.json.ts"}, "region": {"startLine": 26}}}]}, {"ruleId": "MINED049", "level": "none", "message": {"text": "[MINED049] Print Pii: Logging password/token/email/ssn directly to stdout."}, "properties": {"repobilityId": 223377, "scanner": "repobility-threat-engine", "fingerprint": "90b4a59755f786d15f61fd762201379f8dbd837b8b9314c624c61ba96d250209", "category": "quality", "severity": "info", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "print-pii", "owasp": "A09:2021", "cwe_ids": ["CWE-532"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.348015+00:00", "triaged_in_corpus": 12, "observations_count": 676566, "ai_coder_pattern_id": 26}, "scanner": "repobility-threat-engine", "correlation_key": "fp|90b4a59755f786d15f61fd762201379f8dbd837b8b9314c624c61ba96d250209"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/setup-env.mjs"}, "region": {"startLine": 131}}}]}, {"ruleId": "SEC020", "level": "none", "message": {"text": "[SEC020] Secret Printed to Logs: Debug or diagnostic code appears to print a credential-bearing value. This is a frequent AI-assisted coding failure: the helper exposes the exact value needed for troubleshooting."}, "properties": {"repobilityId": 223371, "scanner": "repobility-threat-engine", "fingerprint": "d8f6b476e2fddf1fafc64176b231495cca878c05003ade4780422043b47831ae", "category": "credential_exposure", "severity": "info", "confidence": 0.15, "triageState": "false_positive", "verdict": "likely_fp", "isResolved": true, "reason": "Log message mentions credential-related metadata but does not print a credential-bearing value", "evidence": {"match": "console.log(`     ${C.yellow}dash.cloudflare.com \u2192 moneylook \u2192 Settings \u2192 Variables and Secrets${C.r", "reason": "Log message mentions credential-related metadata but does not print a credential-bearing value", "rule_id": "SEC020", "scanner": "repobility-threat-engine", "confidence": 0.15, "correlation_key": "secret|scripts/setup-env.mjs|13|console.log c.yellow dash.cloudflare.com moneylook settings variables and secrets c.r"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/setup-env.mjs"}, "region": {"startLine": 131}}}]}, {"ruleId": "SEC040", "level": "none", "message": {"text": "[SEC040] innerHTML XSS \u2014 template literal with server-supplied data (and 4 more): Same pattern found in 4 additional files. Review if needed."}, "properties": {"repobilityId": 223370, "scanner": "repobility-threat-engine", "fingerprint": "588cbe6635e9107e3f4226ff395bb9d3b8dbc57f8977957784281db9e5f71589", "category": "xss", "severity": "info", "confidence": 0.2, "triageState": "false_positive", "verdict": "likely_fp", "isResolved": true, "reason": "Deduplicated summary only: 4 additional occurrences found. The top occurrences remain visible as actionable findings.", "evidence": {"reason": "Deduplicated summary only: 4 additional occurrences found. The top occurrences remain visible as actionable findings.", "rule_id": "SEC040", "scanner": "repobility-threat-engine", "confidence": 0.2, "correlation_key": "fp|588cbe6635e9107e3f4226ff395bb9d3b8dbc57f8977957784281db9e5f71589"}}}, {"ruleId": "MINED044", "level": "none", "message": {"text": "[MINED044] Js Console Log Prod (and 24 more): Same pattern found in 24 additional files. Review if needed."}, "properties": {"repobilityId": 223362, "scanner": "repobility-threat-engine", "fingerprint": "611a3b5d0fdc0116906e1532f1881f82eb6e833296cc6aefa3f08bcec084668a", "category": "quality", "severity": "info", "confidence": 0.2, "triageState": "false_positive", "verdict": "likely_fp", "isResolved": true, "reason": "Deduplicated summary only: 24 additional occurrences found. The top occurrences remain visible as actionable findings.", "evidence": {"mined": true, "mining": {"slug": "js-console-log-prod", "owasp": null, "cwe_ids": ["CWE-532"], "languages": ["javascript", "typescript", "tsx", "jsx"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.348003+00:00", "triaged_in_corpus": 10, "observations_count": 1940833, "ai_coder_pattern_id": 102}, "scanner": "repobility-threat-engine", "aggregated": true, "correlation_key": "fp|611a3b5d0fdc0116906e1532f1881f82eb6e833296cc6aefa3f08bcec084668a", "aggregated_count": 24}}}, {"ruleId": "MINED044", "level": "none", "message": {"text": "[MINED044] Js Console Log Prod: console.log left in code. Should be replaced with logger or removed."}, "properties": {"repobilityId": 223361, "scanner": "repobility-threat-engine", "fingerprint": "327298b3765190d63cbd40da0e49af88eb7234a9728792da015f9c3ff9728937", "category": "quality", "severity": "info", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "js-console-log-prod", "owasp": null, "cwe_ids": ["CWE-532"], "languages": ["javascript", "typescript", "tsx", "jsx"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.348003+00:00", "triaged_in_corpus": 10, "observations_count": 1940833, "ai_coder_pattern_id": 102}, "scanner": "repobility-threat-engine", "correlation_key": "fp|327298b3765190d63cbd40da0e49af88eb7234a9728792da015f9c3ff9728937"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/audit/bundle-size.mjs"}, "region": {"startLine": 38}}}]}, {"ruleId": "MINED044", "level": "none", "message": {"text": "[MINED044] Js Console Log Prod: console.log left in code. Should be replaced with logger or removed."}, "properties": {"repobilityId": 223360, "scanner": "repobility-threat-engine", "fingerprint": "f8303f67a75b301ebbcf28b012cf4fe9ba139febe8dafe0383fd5488d82657ad", "category": "quality", "severity": "info", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "js-console-log-prod", "owasp": null, "cwe_ids": ["CWE-532"], "languages": ["javascript", "typescript", "tsx", "jsx"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.348003+00:00", "triaged_in_corpus": 10, "observations_count": 1940833, "ai_coder_pattern_id": 102}, "scanner": "repobility-threat-engine", "correlation_key": "fp|f8303f67a75b301ebbcf28b012cf4fe9ba139febe8dafe0383fd5488d82657ad"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/audit/backfill-published-dates.mjs"}, "region": {"startLine": 80}}}]}, {"ruleId": "MINED044", "level": "none", "message": {"text": "[MINED044] Js Console Log Prod: console.log left in code. Should be replaced with logger or removed."}, "properties": {"repobilityId": 223359, "scanner": "repobility-threat-engine", "fingerprint": "12622c3e455ed764b9882a1bbcb7f8f0bfe1d0ec74a8edaf4e646dce434ec680", "category": "quality", "severity": "info", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "js-console-log-prod", "owasp": null, "cwe_ids": ["CWE-532"], "languages": ["javascript", "typescript", "tsx", "jsx"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.348003+00:00", "triaged_in_corpus": 10, "observations_count": 1940833, "ai_coder_pattern_id": 102}, "scanner": "repobility-threat-engine", "correlation_key": "fp|12622c3e455ed764b9882a1bbcb7f8f0bfe1d0ec74a8edaf4e646dce434ec680"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/audit/auto-registration.mjs"}, "region": {"startLine": 295}}}]}, {"ruleId": "SEC029", "level": "none", "message": {"text": "[SEC029] Server-Side Request Forgery (SSRF) \u2014 outbound HTTP from user input (and 1 more): Same pattern found in 1 additional files. Review if needed."}, "properties": {"repobilityId": 223348, "scanner": "repobility-threat-engine", "fingerprint": "8f4ed64e85e23651a781f801f20cbe7cf192b517efa4818df0dde258906a2c2b", "category": "ssrf", "severity": "info", "confidence": 0.2, "triageState": "false_positive", "verdict": "likely_fp", "isResolved": true, "reason": "Deduplicated summary only: 1 additional occurrences found. The top occurrences remain visible as actionable findings.", "evidence": {"reason": "Deduplicated summary only: 1 additional occurrences found. The top occurrences remain visible as actionable findings.", "rule_id": "SEC029", "scanner": "repobility-threat-engine", "confidence": 0.2, "correlation_key": "fp|8f4ed64e85e23651a781f801f20cbe7cf192b517efa4818df0dde258906a2c2b"}}}, {"ruleId": "DEPCUR-NPM", "level": "none", "message": {"text": "npm package `@vitest/coverage-v8` is patch version(s) behind (^4.1.5 -> 4.1.9)"}, "properties": {"repobilityId": 223334, "scanner": "repobility-dependency-currency", "fingerprint": "01836ff92d7bb35389b4c05650738c2ac31c8811038dbada96d6cb5be1a97e46", "category": "dependency", "severity": "info", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"gap": "patch version(s) behind", "signal": "currency", "cwe_ids": [], "package": "@vitest/coverage-v8", "scanner": "repobility-dependency-currency", "ecosystem": "npm", "languages": ["javascript"], "latest_version": "4.1.9", "correlation_key": "fp|01836ff92d7bb35389b4c05650738c2ac31c8811038dbada96d6cb5be1a97e46", "current_version": "^4.1.5"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "DEPCUR-NPM", "level": "none", "message": {"text": "npm package `@astrojs/sitemap` is patch version(s) behind (^3.7.2 -> 3.7.3)"}, "properties": {"repobilityId": 223329, "scanner": "repobility-dependency-currency", "fingerprint": "bff3102e07fd2d54f31dab1c10630f30f05bf51f6056ff0ef84a45b4eb713c91", "category": "dependency", "severity": "info", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"gap": "patch version(s) behind", "signal": "currency", "cwe_ids": [], "package": "@astrojs/sitemap", "scanner": "repobility-dependency-currency", "ecosystem": "npm", "languages": ["javascript"], "latest_version": "3.7.3", "correlation_key": "fp|bff3102e07fd2d54f31dab1c10630f30f05bf51f6056ff0ef84a45b4eb713c91", "current_version": "^3.7.2"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "DEPCUR-NPM", "level": "none", "message": {"text": "npm package `@astrojs/react` is patch version(s) behind (^5.0.4 -> 5.0.7)"}, "properties": {"repobilityId": 223328, "scanner": "repobility-dependency-currency", "fingerprint": "a9d7e2507767579d41625550bc903967e7e71e12bce0d8656f75c5c787728c24", "category": "dependency", "severity": "info", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"gap": "patch version(s) behind", "signal": "currency", "cwe_ids": [], "package": "@astrojs/react", "scanner": "repobility-dependency-currency", "ecosystem": "npm", "languages": ["javascript"], "latest_version": "5.0.7", "correlation_key": "fp|a9d7e2507767579d41625550bc903967e7e71e12bce0d8656f75c5c787728c24", "current_version": "^5.0.4"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "GHSA-96hv-2xvq-fx4p", "level": "error", "message": {"text": "ws: GHSA-96hv-2xvq-fx4p"}, "properties": {"repobilityId": 223478, "scanner": "osv-scanner", "fingerprint": "3b355713e3791cbcf217dbe879b25c8b5f111e2a452e7d73d42f1f2ea389c695", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["CVE-2026-48779"], "package": "ws", "rule_id": "GHSA-96hv-2xvq-fx4p", "scanner": "osv-scanner", "correlation_key": "vuln|ws|CVE-2026-48779|pnpm-lock.yaml"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pnpm-lock.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "GHSA-fx2h-pf6j-xcff", "level": "error", "message": {"text": "vite: GHSA-fx2h-pf6j-xcff"}, "properties": {"repobilityId": 223452, "scanner": "osv-scanner", "fingerprint": "4f512e07fe93bb592522a9a5369902326a82cc502374bc316ba19d53cb18c1d3", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["CVE-2026-53571"], "package": "vite", "rule_id": "GHSA-fx2h-pf6j-xcff", "scanner": "osv-scanner", "correlation_key": "vuln|vite|CVE-2026-53571|pnpm-lock.yaml"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pnpm-lock.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "GHSA-5wm8-gmm8-39j9", "level": "error", "message": {"text": "fast-xml-builder: GHSA-5wm8-gmm8-39j9"}, "properties": {"repobilityId": 223446, "scanner": "osv-scanner", "fingerprint": "ddf76aac0a5d96374516c81e1aec16f2feda9a9023dd8cb1a67b92bd109d4673", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["CVE-2026-44665"], "package": "fast-xml-builder", "rule_id": "GHSA-5wm8-gmm8-39j9", "scanner": "osv-scanner", "correlation_key": "vuln|fast-xml-builder|CVE-2026-44665|pnpm-lock.yaml"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pnpm-lock.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "GHSA-gv7w-rqvm-qjhr", "level": "error", "message": {"text": "esbuild: GHSA-gv7w-rqvm-qjhr"}, "properties": {"repobilityId": 223441, "scanner": "osv-scanner", "fingerprint": "ae1bae0f6eb78c097c0646b940479ba9f73f03ba1dcab0cf858dd35aa980c65e", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "package": "esbuild", "rule_id": "GHSA-gv7w-rqvm-qjhr", "scanner": "osv-scanner", "correlation_key": "vuln|esbuild|GHSA-GV7W-RQVM-QJHR|pnpm-lock.yaml"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pnpm-lock.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "GHSA-77vg-94rm-hx3p", "level": "error", "message": {"text": "devalue: GHSA-77vg-94rm-hx3p"}, "properties": {"repobilityId": 223415, "scanner": "osv-scanner", "fingerprint": "a60dfe0860d8352f1e32d22ef5503a6ab361743264ac828cdda7e9246d12e7c7", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["CVE-2026-42570"], "package": "devalue", "rule_id": "GHSA-77vg-94rm-hx3p", "scanner": "osv-scanner", "correlation_key": "vuln|devalue|CVE-2026-42570|pnpm-lock.yaml"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pnpm-lock.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "SEC100", "level": "error", "message": {"text": "[SEC100] CORS permissive Access-Control-Allow-Origin: *: Permissive CORS policy (`*` origin) allows any website to make authenticated cross-origin requests. Especially dangerous when combined with `Access-Control-Allow-Credentials: true`."}, "properties": {"repobilityId": 223382, "scanner": "repobility-threat-engine", "fingerprint": "269a1c7ce9de46c47f7bca3695a79574be81c84c4b352afc07341658a539c5d8", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": "'Access-Control-Allow-Origin': '*'", "reason": "Pattern matched with no mitigating context found", "rule_id": "SEC100", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "fp|269a1c7ce9de46c47f7bca3695a79574be81c84c4b352afc07341658a539c5d8"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/pages/api/qa.json.ts"}, "region": {"startLine": 70}}}]}, {"ruleId": "SEC040", "level": "error", "message": {"text": "[SEC040] innerHTML XSS \u2014 template literal with server-supplied data: Setting .innerHTML with a template literal that interpolates server-supplied or user-supplied data is the canonical stored/reflected XSS vector. The browser parses the HTML and executes any <script> or event-handler attributes in the data. CWE-79. Especially dangerous when the data comes from a CV parser, profile field, or any user-input pipeline."}, "properties": {"repobilityId": 223369, "scanner": "repobility-threat-engine", "fingerprint": "8b6c04f38bd5eb1641c2a8c6e42fbdfb4f57c791593bafd6f73af1b2a2e0b864", "category": "xss", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": "map(\n      (e) =>\n        `  <sitemap>\\n    <loc>${e.loc}</loc>\\n    <lastmod>${e.lastmod}", "reason": "Pattern matched with no mitigating context found", "rule_id": "SEC040", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "fp|8b6c04f38bd5eb1641c2a8c6e42fbdfb4f57c791593bafd6f73af1b2a2e0b864"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/post-build/sitemap-index.mjs"}, "region": {"startLine": 67}}}]}, {"ruleId": "SEC040", "level": "error", "message": {"text": "[SEC040] innerHTML XSS \u2014 template literal with server-supplied data: Setting .innerHTML with a template literal that interpolates server-supplied or user-supplied data is the canonical stored/reflected XSS vector. The browser parses the HTML and executes any <script> or event-handler attributes in the data. CWE-79. Especially dangerous when the data comes from a CV parser, profile field, or any user-input pipeline."}, "properties": {"repobilityId": 223368, "scanner": "repobility-threat-engine", "fingerprint": "9192e1f1d38a02e04c5c3391e161b1d001c49959d6d92a992ee60567173cacfd", "category": "xss", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": "map((k) => `${k}=${r[k]}", "reason": "Pattern matched with no mitigating context found", "rule_id": "SEC040", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "fp|9192e1f1d38a02e04c5c3391e161b1d001c49959d6d92a992ee60567173cacfd"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/audit/revenue-pull.mjs"}, "region": {"startLine": 166}}}]}, {"ruleId": "SEC040", "level": "error", "message": {"text": "[SEC040] innerHTML XSS \u2014 template literal with server-supplied data: Setting .innerHTML with a template literal that interpolates server-supplied or user-supplied data is the canonical stored/reflected XSS vector. The browser parses the HTML and executes any <script> or event-handler attributes in the data. CWE-79. Especially dangerous when the data comes from a CV parser, profile field, or any user-input pipeline."}, "properties": {"repobilityId": 223366, "scanner": "repobility-threat-engine", "fingerprint": "33c8d41568434b6a94e97f484966e2457280f06755f4ca3eced0b69d113a4488", "category": "xss", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": "map((p) => `    ${p.position}\uc704 ${p.page} (${p.impressions}", "reason": "Pattern matched with no mitigating context found", "rule_id": "SEC040", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "fp|33c8d41568434b6a94e97f484966e2457280f06755f4ca3eced0b69d113a4488"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/audit/gsc-opportunities.mjs"}, "region": {"startLine": 227}}}]}, {"ruleId": "SEC085", "level": "error", "message": {"text": "[SEC085] JS: child_process.exec with non-literal: child_process.exec with user-derived input enables command injection. Ported from eslint-plugin-security detect-child-process (Apache-2.0)."}, "properties": {"repobilityId": 223358, "scanner": "repobility-threat-engine", "fingerprint": "8b323b66324a5e0ccf0d706eca52432a0faef445e9eb4aee5b0952d9ee1c6ff5", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": "exec(content", "reason": "Pattern matched with no mitigating context found", "rule_id": "SEC085", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "fp|8b323b66324a5e0ccf0d706eca52432a0faef445e9eb4aee5b0952d9ee1c6ff5"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/audit/linkify-plain-references.mjs"}, "region": {"startLine": 226}}}]}, {"ruleId": "SEC085", "level": "error", "message": {"text": "[SEC085] JS: child_process.exec with non-literal: child_process.exec with user-derived input enables command injection. Ported from eslint-plugin-security detect-child-process (Apache-2.0)."}, "properties": {"repobilityId": 223352, "scanner": "repobility-threat-engine", "fingerprint": "9a2c971a4ab90c85918d09612648b5d97546f99f240370df2887583c01585cea", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": "exec(xml", "reason": "Pattern matched with no mitigating context found", "rule_id": "SEC085", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "fp|9a2c971a4ab90c85918d09612648b5d97546f99f240370df2887583c01585cea"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/audit/auto-registration.mjs"}, "region": {"startLine": 98}}}]}, {"ruleId": "SEC029", "level": "error", "message": {"text": "[SEC029] Server-Side Request Forgery (SSRF) \u2014 outbound HTTP from user input: Outbound HTTP request to a user-controlled URL without allowlist validation. Attackers can probe internal services (169.254.169.254 metadata, internal Kubernetes endpoints, file:// URIs), exfiltrate data, or pivot through your network. SSRF is OWASP A10:2021 and a frequent foothold in cloud breaches."}, "properties": {"repobilityId": 223347, "scanner": "repobility-threat-engine", "fingerprint": "d3c24e38e963f78fb7d30c7450beda9e25f05b1c0316975f54c97b00a9f1ca29", "category": "ssrf", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": "new URL(l", "reason": "Pattern matched with no mitigating context found", "rule_id": "SEC029", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "fp|d3c24e38e963f78fb7d30c7450beda9e25f05b1c0316975f54c97b00a9f1ca29"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/post-build/sitemap-lastmod.mjs"}, "region": {"startLine": 84}}}]}, {"ruleId": "SEC029", "level": "error", "message": {"text": "[SEC029] Server-Side Request Forgery (SSRF) \u2014 outbound HTTP from user input: Outbound HTTP request to a user-controlled URL without allowlist validation. Attackers can probe internal services (169.254.169.254 metadata, internal Kubernetes endpoints, file:// URIs), exfiltrate data, or pivot through your network. SSRF is OWASP A10:2021 and a frequent foothold in cloud breaches."}, "properties": {"repobilityId": 223345, "scanner": "repobility-threat-engine", "fingerprint": "e02c09775d3389fe0223fcca0759f2f6511d93b3f20b9668da06385b152689a2", "category": "ssrf", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": "new URL(p", "reason": "Pattern matched with no mitigating context found", "rule_id": "SEC029", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "fp|e02c09775d3389fe0223fcca0759f2f6511d93b3f20b9668da06385b152689a2"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/audit/gsc-opportunities.mjs"}, "region": {"startLine": 92}}}]}, {"ruleId": "SEC029", "level": "error", "message": {"text": "[SEC029] Server-Side Request Forgery (SSRF) \u2014 outbound HTTP from user input: Outbound HTTP request to a user-controlled URL without allowlist validation. Attackers can probe internal services (169.254.169.254 metadata, internal Kubernetes endpoints, file:// URIs), exfiltrate data, or pivot through your network. SSRF is OWASP A10:2021 and a frequent foothold in cloud breaches."}, "properties": {"repobilityId": 223344, "scanner": "repobility-threat-engine", "fingerprint": "f9d614021d29f2b6be90d627649918ca071d32388c4afe4d38232c4b038f76a8", "category": "ssrf", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": "new URL(u", "reason": "Pattern matched with no mitigating context found", "rule_id": "SEC029", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "fp|f9d614021d29f2b6be90d627649918ca071d32388c4afe4d38232c4b038f76a8"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/audit/auto-registration.mjs"}, "region": {"startLine": 159}}}]}, {"ruleId": "generic-api-key", "level": "error", "message": {"text": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations."}, "properties": {"repobilityId": 223413, "scanner": "gitleaks", "fingerprint": "79d8461c0de7e782f253ae662955204ae2029b9fb51f75fdf5b2f0d23951f408", "category": "credential_exposure", "severity": "critical", "confidence": 0.95, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "API_KEY = '<redacted>'", "rule_id": "generic-api-key", "scanner": "gitleaks", "detector": "generic-api-key", "correlation_key": "secret|docs/14-security.md|19|api_key redacted"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docs/14-security.md"}, "region": {"startLine": 194}}}]}, {"ruleId": "generic-api-key", "level": "error", "message": {"text": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations."}, "properties": {"repobilityId": 223405, "scanner": "gitleaks", "fingerprint": "e998e802a56780573e589fc947783d1fd70c254f52720ef7cb4f477604df33de", "category": "credential_exposure", "severity": "critical", "confidence": 0.95, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "INDEXNOW_KEY=REDACTED", "rule_id": "generic-api-key", "scanner": "gitleaks", "detector": "generic-api-key", "correlation_key": "secret|.env.example|1|indexnow_key redacted"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".env.example"}, "region": {"startLine": 20}}}]}, {"ruleId": "scanner-fabc09dcbcef9fd2", "level": "warning", "message": {"text": "Privileged port 3 in use"}, "properties": {"repobilityId": "261b7b1c6a18d412", "scanner": "scanner-primary", "fingerprint": "fabc09dcbcef9fd2", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/secrets-scan.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-221446745989ac8b", "level": "warning", "message": {"text": "Privileged port 18 in use"}, "properties": {"repobilityId": "2d7b5e7d9c158e43", "scanner": "scanner-primary", "fingerprint": "221446745989ac8b", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/secrets-scan.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-0394e7b09b8d03d1", "level": "warning", "message": {"text": "Privileged port 21 in use"}, "properties": {"repobilityId": "d920b7cd1b1a16dc", "scanner": "scanner-primary", "fingerprint": "0394e7b09b8d03d1", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/daily-rebuild.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-40df70f73dde0793", "level": "warning", "message": {"text": "Privileged port 15 in use"}, "properties": {"repobilityId": "3340f9a170f285cd", "scanner": "scanner-primary", "fingerprint": "40df70f73dde0793", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/scheduled-rebuild.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-4f5f990dfc1dd3b6", "level": "warning", "message": {"text": "Privileged port 12 in use"}, "properties": {"repobilityId": "65e7eefa33f2def4", "scanner": "scanner-primary", "fingerprint": "4f5f990dfc1dd3b6", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/scheduled-rebuild.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-80c5edd21ea3ab97", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in scripts/install-hooks.mjs:14"}, "properties": {"repobilityId": "1b84307b611a838b", "scanner": "scanner-primary", "fingerprint": "80c5edd21ea3ab97", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/install-hooks.mjs"}, "region": {"startLine": 14}}}]}, {"ruleId": "scanner-8cd5a1cf217e3468", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in scripts/secrets-scan.mjs:13"}, "properties": {"repobilityId": "301b99733d51c803", "scanner": "scanner-primary", "fingerprint": "8cd5a1cf217e3468", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/secrets-scan.mjs"}, "region": {"startLine": 13}}}]}, {"ruleId": "scanner-f644036668e14873", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in scripts/setup-env.mjs:15"}, "properties": {"repobilityId": "f0ca53a552b356b2", "scanner": "scanner-primary", "fingerprint": "f644036668e14873", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/setup-env.mjs"}, "region": {"startLine": 15}}}]}, {"ruleId": "scanner-4f9a71c176284e58", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in scripts/audit/distribute-published-dates.mjs:23"}, "properties": {"repobilityId": "fa958c485d530a13", "scanner": "scanner-primary", "fingerprint": "4f9a71c176284e58", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/audit/distribute-published-dates.mjs"}, "region": {"startLine": 23}}}]}, {"ruleId": "scanner-079cae9a8ea89610", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in scripts/audit/backfill-published-dates.mjs:28"}, "properties": {"repobilityId": "49e486c8f3f4d7d8", "scanner": "scanner-primary", "fingerprint": "079cae9a8ea89610", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/audit/backfill-published-dates.mjs"}, "region": {"startLine": 28}}}]}, {"ruleId": "scanner-0ef941a54cb6b4ab", "level": "warning", "message": {"text": "Insecure pattern 'cors_wildcard' in src/pages/api/qa.json.ts:70"}, "properties": {"repobilityId": "746f3e8debcd115c", "scanner": "scanner-primary", "fingerprint": "0ef941a54cb6b4ab", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "cors_wildcard"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/pages/api/qa.json.ts"}, "region": {"startLine": 70}}}]}, {"ruleId": "scanner-2b7767a3dea5ca72", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "8ec641b871396f39", "scanner": "scanner-primary", "fingerprint": "2b7767a3dea5ca72", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/auto-create-pr.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-5f1367acd3721aef", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "a705859273517556", "scanner": "scanner-primary", "fingerprint": "5f1367acd3721aef", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/security-audit.yml"}, "region": {"startLine": 59}}}]}, {"ruleId": "scanner-5f1367acd3721aef", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "8c509df32da8f579", "scanner": "scanner-primary", "fingerprint": "5f1367acd3721aef", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/security-audit.yml"}, "region": {"startLine": 122}}}]}, {"ruleId": "scanner-c24e64f26f76d038", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "efa4e3b55a44967c", "scanner": "scanner-primary", "fingerprint": "c24e64f26f76d038", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/secrets-scan.yml"}, "region": {"startLine": 40}}}]}, {"ruleId": "scanner-908c78a196adf4ea", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "1604b1bbe9e3279f", "scanner": "scanner-primary", "fingerprint": "908c78a196adf4ea", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/go-live-check.yml"}, "region": {"startLine": 143}}}]}, {"ruleId": "scanner-b16e8a8e1d5bc448", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "f43310fa3ae3bc1b", "scanner": "scanner-primary", "fingerprint": "b16e8a8e1d5bc448", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/stale-content-check.yml"}, "region": {"startLine": 46}}}]}, {"ruleId": "scanner-5723c5883d55fc2c", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "3a6bea6b1446b632", "scanner": "scanner-primary", "fingerprint": "5723c5883d55fc2c", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/daily-rebuild.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-27924aa79fa4a517", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "bd7f3c1c34d83159", "scanner": "scanner-primary", "fingerprint": "27924aa79fa4a517", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 108}}}]}, {"ruleId": "scanner-27924aa79fa4a517", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "0dc55539758d3645", "scanner": "scanner-primary", "fingerprint": "27924aa79fa4a517", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 133}}}]}, {"ruleId": "scanner-27924aa79fa4a517", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "bd7f3c1c34d83159", "scanner": "scanner-primary", "fingerprint": "27924aa79fa4a517", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 148}}}]}, {"ruleId": "scanner-bda6deb11902724f", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "52fa6a3933670e49", "scanner": "scanner-primary", "fingerprint": "bda6deb11902724f", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/auto-merge.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-cb639d9a10a47b23", "level": "note", "message": {"text": "package.json defines install-time lifecycle scripts"}, "properties": {"repobilityId": "b86179956da3a4a8", "scanner": "scanner-primary", "fingerprint": "cb639d9a10a47b23", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "npm", "install-scripts"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ea3b5e389d8c9c0f", "level": "note", "message": {"text": "Low test-to-source ratio"}, "properties": {"repobilityId": "ef7b2552cc00a375", "scanner": "scanner-primary", "fingerprint": "ea3b5e389d8c9c0f", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["tests"]}}, {"ruleId": "scanner-141b30a41e03817b", "level": "note", "message": {"text": "No license file detected"}, "properties": {"repobilityId": "8487a109b0ed5609", "scanner": "scanner-primary", "fingerprint": "141b30a41e03817b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["license", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-01f96f71d9907a8c", "level": "note", "message": {"text": "README lacks setup or run instructions"}, "properties": {"repobilityId": "27d5448d00b26233", "scanner": "scanner-primary", "fingerprint": "01f96f71d9907a8c", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["docs", "readme", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "d4b000236dcf3091", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-b9088664ace7f748", "level": "note", "message": {"text": "Composite production-readiness gap"}, "properties": {"repobilityId": "d2e55cadf29aa0b8", "scanner": "scanner-primary", "fingerprint": "b9088664ace7f748", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["production-readiness", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-749d4bc1bd66df5f", "level": "warning", "message": {"text": "Agent instructions exist but release-hardening basics are missing"}, "properties": {"repobilityId": "12ab3ea672327823", "scanner": "scanner-primary", "fingerprint": "749d4bc1bd66df5f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "2aa9dc5b83e57a4a", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "db5be5b7109d6448", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-bea357a6497a2d5d", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: CLAUDE.md"}, "properties": {"repobilityId": "aae72df3934829ac", "scanner": "scanner-primary", "fingerprint": "bea357a6497a2d5d", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "CLAUDE.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6f5d3a0283fa6eff", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/agents/rss-agent.md"}, "properties": {"repobilityId": "3fd1f85674e118b2", "scanner": "scanner-primary", "fingerprint": "6f5d3a0283fa6eff", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/agents/rss-agent.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-de8f96782473eb50", "level": "none", "message": {"text": "Commented-code block (14 lines) in scripts/audit/revenue-pull.mjs:6"}, "properties": {"repobilityId": "cb3f7ec94d361530", "scanner": "scanner-primary", "fingerprint": "de8f96782473eb50", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-c94f262b2656210f", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 scripts/audit/revenue-pull.mjs:94"}, "properties": {"repobilityId": "a328a208ccc19c15", "scanner": "scanner-primary", "fingerprint": "c94f262b2656210f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-8d5834e5f0bd9e86", "level": "none", "message": {"text": "Commented-code block (6 lines) in scripts/audit/gsc-opportunities.mjs:10"}, "properties": {"repobilityId": "1af78d875a5dd857", "scanner": "scanner-primary", "fingerprint": "8d5834e5f0bd9e86", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-e1dcfc6db708c17f", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 scripts/audit/gsc-opportunities.mjs:52"}, "properties": {"repobilityId": "a0ff5f389b5aed8f", "scanner": "scanner-primary", "fingerprint": "e1dcfc6db708c17f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-1362c3dbf62ad11b", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/lib/ads-lazy.ts:1"}, "properties": {"repobilityId": "0842c665762dcdc6", "scanner": "scanner-primary", "fingerprint": "1362c3dbf62ad11b", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-b334d875f2339fa1", "level": "note", "message": {"text": "5 env vars used in code but missing from .env.example"}, "properties": {"repobilityId": "faa38682016f5d53", "scanner": "scanner-primary", "fingerprint": "b334d875f2339fa1", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "config-drift"]}}]}]}