{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-a597819ab08870b0", "name": "React Flow <Controls> without dark theming \u2014 assets/src/js/lib/player/Player.jsx:455", "shortDescription": {"text": "React Flow <Controls> without dark theming \u2014 assets/src/js/lib/player/Player.jsx:455"}, "fullDescription": {"text": "`<Controls>` ships with white buttons. Override `.react-flow__controls` and `.react-flow__controls-button` in your stylesheet or pass a styled wrapper.\n\nWhy: P1 in CHECKLIST.md \u2014 vendor defaults bleed light through.\nRule id: fq.controls.no-bg"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d63da3583b14afc0", "name": "Dockerfile runs as root: Dockerfile", "shortDescription": {"text": "Dockerfile runs as root: Dockerfile"}, "fullDescription": {"text": "No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-33d1d1cc6ee6ad3c", "name": "Docker base image is tag-pinned but not digest-pinned: alpine:3.21", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: alpine:3.21"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-dbd8a7472041c35c", "name": "Docker base image is tag-pinned but not digest-pinned: node:22", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: node:22"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-efeae1827c6c9bc3", "name": "Docker base image is tag-pinned but not digest-pinned: golang:1.26-alpine", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: golang:1.26-alpine"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-aa5acaa49eb8315b", "name": "Containers defined but no K8s/orchestration manifest found", "shortDescription": {"text": "Containers defined but no K8s/orchestration manifest found"}, "fullDescription": {"text": "Repo has Dockerfiles/compose but no Kubernetes/Nomad manifests. If the target deployment is K8s, the manifests may live in a separate ops repo."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9710c8d059e53154", "name": "No frontend routes/components detected", "shortDescription": {"text": "No frontend routes/components detected"}, "fullDescription": {"text": "No React/Vue/Next routes were found. This is fine for backend-only repos."}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-cd495e94f468a896", "name": "Insecure pattern 'direct_innerhtml_assignment' in assets/src/js/app/discover-ribbon.js:25", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in assets/src/js/app/discover-ribbon.js:25"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-5d1ee66a37c228dc", "name": "Insecure pattern 'direct_innerhtml_assignment' in assets/src/js/app/layout.js:41", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in assets/src/js/app/layout.js:41"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2f7d7103e23465aa", "name": "Insecure pattern 'direct_innerhtml_assignment' in assets/src/js/app/vault/progress.js:128", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in assets/src/js/app/vault/progress.js:128"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9f9acd885895d05c", "name": "Insecure pattern 'direct_innerhtml_assignment' in assets/src/js/app/resource/status.js:56", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in assets/src/js/app/resource/status.js:56"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-fc5519d499ec276d", "name": "Insecure pattern 'direct_innerhtml_assignment' in assets/src/js/app/profile/addon_urls.js:105", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in assets/src/js/app/profile/addon_urls.js:105"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-05a3f66163916ccf", "name": "Insecure pattern 'direct_innerhtml_assignment' in assets/src/js/lib/ads.js:25", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in assets/src/js/lib/ads.js:25"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e610e2e67c12d6a4", "name": "Insecure pattern 'domparser_html_parse' in assets/src/js/lib/async.js:68", "shortDescription": {"text": "Insecure pattern 'domparser_html_parse' in assets/src/js/lib/async.js:68"}, "fullDescription": {"text": "Found a known-risky pattern (domparser_html_parse). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b6240c6fc728927a", "name": "Insecure pattern 'direct_innerhtml_assignment' in assets/src/js/lib/loadAsyncView.js:24", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in assets/src/js/lib/loadAsyncView.js:24"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4fb1ba0df626261b", "name": "Insecure pattern 'direct_innerhtml_assignment' in assets/src/js/lib/player/Player.jsx:320", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in assets/src/js/lib/player/Player.jsx:320"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-33d8a5a0666991ad", "name": "Insecure pattern 'direct_innerhtml_assignment' in assets/src/js/lib/player/plugins/chromecast.js:19", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in assets/src/js/lib/player/plugins/chromecast.js:19"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3f117f14e41ce7b3", "name": "Insecure pattern 'cors_wildcard' in handlers/resource/status.go:137", "shortDescription": {"text": "Insecure pattern 'cors_wildcard' in handlers/resource/status.go:137"}, "fullDescription": {"text": "Found a known-risky pattern (cors_wildcard). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e72163b6de5c520c", "name": "Insecure pattern 'cors_wildcard' in handlers/discover_ai/handler.go:252", "shortDescription": {"text": "Insecure pattern 'cors_wildcard' in handlers/discover_ai/handler.go:252"}, "fullDescription": {"text": "Found a known-risky pattern (cors_wildcard). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-408d01d261a7f8ac", "name": "Insecure pattern 'cors_wildcard' in handlers/job/handler.go:41", "shortDescription": {"text": "Insecure pattern 'cors_wildcard' in handlers/job/handler.go:41"}, "fullDescription": {"text": "Found a known-risky pattern (cors_wildcard). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-93afed2afb1d3d4a", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cc664eae65d0ef73", "name": "Very large file: assets/src/js/lib/discover/components/DiscoverApp.jsx (1650 lines)", "shortDescription": {"text": "Very large file: assets/src/js/lib/discover/components/DiscoverApp.jsx (1650 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-414725c98a270375", "name": "Very large file: services/enrich/enrich.go (1623 lines)", "shortDescription": {"text": "Very large file: services/enrich/enrich.go (1623 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ea3b5e389d8c9c0f", "name": "Low test-to-source ratio", "shortDescription": {"text": "Low test-to-source ratio"}, "fullDescription": {"text": "39 tests / 370 src (ratio 0.11)."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-72b2a6250083a784", "name": "Placeholder or mock-heavy implementation detected", "shortDescription": {"text": "Placeholder or mock-heavy implementation detected"}, "fullDescription": {"text": "Found 30 placeholder/mock markers across 18 source files. This often means the repo looks complete while core flows still use generated scaffolding or fake data."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-653cb1c4bfcf7e2b", "name": "Commented-code block (5 lines) in webpack.config.js:12", "shortDescription": {"text": "Commented-code block (5 lines) in webpack.config.js:12"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-7daddf28c3d60b82", "name": "Commented-code block (5 lines) in assets/src/js/app/discover.js:12", "shortDescription": {"text": "Commented-code block (5 lines) in assets/src/js/app/discover.js:12"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-a53df8dc9bad6de7", "name": "`fetch()` without try/.catch or AbortSignal \u2014 assets/src/js/app/speedtest.js:93", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 assets/src/js/app/speedtest.js:93"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e13826b090a1eb41", "name": "Commented-code block (6 lines) in assets/src/js/app/layout.js:61", "shortDescription": {"text": "Commented-code block (6 lines) in assets/src/js/app/layout.js:61"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-498de40f22100936", "name": "`fetch()` without try/.catch or AbortSignal \u2014 assets/src/js/app/ext/download.js:17", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 assets/src/js/app/ext/download.js:17"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ac204256e8c895d1", "name": "Commented-code block (5 lines) in assets/src/js/app/resource/get.js:4", "shortDescription": {"text": "Commented-code block (5 lines) in assets/src/js/app/resource/get.js:4"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-2f9bc8cfa0c8c0ac", "name": "Commented-code block (6 lines) in assets/src/js/app/resource/release_subscribe_banner.js:3", "shortDescription": {"text": "Commented-code block (6 lines) in assets/src/js/app/resource/release_subscribe_banner.js:3"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-1984cea8575bfc16", "name": "Commented-code block (6 lines) in assets/src/js/lib/umami.js:266", "shortDescription": {"text": "Commented-code block (6 lines) in assets/src/js/lib/umami.js:266"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-445757946bcf84cb", "name": "Commented-code block (5 lines) in assets/src/js/lib/textClamp.js:5", "shortDescription": {"text": "Commented-code block (5 lines) in assets/src/js/lib/textClamp.js:5"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-6b702095b3c41224", "name": "`fetch()` without try/.catch or AbortSignal \u2014 assets/src/js/lib/async.js:49", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 assets/src/js/lib/async.js:49"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0f13711992afa1a5", "name": "Commented-code block (5 lines) in assets/src/js/lib/loadAsyncView.js:19", "shortDescription": {"text": "Commented-code block (5 lines) in assets/src/js/lib/loadAsyncView.js:19"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-e8193f22e91df947", "name": "Commented-code block (5 lines) in assets/src/js/lib/adultReveal.js:3", "shortDescription": {"text": "Commented-code block (5 lines) in assets/src/js/lib/adultReveal.js:3"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-023c76c70eda04b1", "name": "Commented-code block (7 lines) in assets/src/js/lib/i18n.js:9", "shortDescription": {"text": "Commented-code block (7 lines) in assets/src/js/lib/i18n.js:9"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-5450854af7af3036", "name": "Commented-code block (5 lines) in assets/src/js/lib/player/Player.jsx:138", "shortDescription": {"text": "Commented-code block (5 lines) in assets/src/js/lib/player/Player.jsx:138"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-8105a9ca2d0ad8ec", "name": "`fetch()` without try/.catch or AbortSignal \u2014 assets/src/js/lib/player/Player.jsx:778", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 assets/src/js/lib/player/Player.jsx:778"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-5814412ff5fe89ea", "name": "`fetch()` without try/.catch or AbortSignal \u2014 assets/src/js/lib/player/session-seek.js:61", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 assets/src/js/lib/player/session-seek.js:61"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6442dea7b5a8314b", "name": "`fetch()` without try/.catch or AbortSignal \u2014 assets/src/js/lib/player/hooks/useWatchHistory.js:35", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 assets/src/js/lib/player/hooks/useWatchHistory.js:35"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-600032ee8feb0cca", "name": "Commented-code block (6 lines) in assets/src/js/lib/discover/ids.js:3", "shortDescription": {"text": "Commented-code block (6 lines) in assets/src/js/lib/discover/ids.js:3"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-52491e572bbd01d6", "name": "Commented-code block (6 lines) in assets/src/js/lib/discover/lang.js:53", "shortDescription": {"text": "Commented-code block (6 lines) in assets/src/js/lib/discover/lang.js:53"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-a6cfc0266236efad", "name": "Commented-code block (6 lines) in assets/src/js/lib/discover/i18n.js:4", "shortDescription": {"text": "Commented-code block (6 lines) in assets/src/js/lib/discover/i18n.js:4"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-3c3b8714cb0ec275", "name": "Commented-code block (5 lines) in assets/src/js/lib/discover/client.js:57", "shortDescription": {"text": "Commented-code block (5 lines) in assets/src/js/lib/discover/client.js:57"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-9cf8c6741b6c2658", "name": "`fetch()` without try/.catch or AbortSignal \u2014 assets/src/js/lib/discover/client.js:26", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 assets/src/js/lib/discover/client.js:26"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-36df35641d57e023", "name": "Commented-code block (5 lines) in assets/src/js/lib/discover/reviewsClient.js:5", "shortDescription": {"text": "Commented-code block (5 lines) in assets/src/js/lib/discover/reviewsClient.js:5"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-d509ffd42d5b4c74", "name": "Commented-code block (6 lines) in assets/src/js/lib/discover/watchlistClient.js:5", "shortDescription": {"text": "Commented-code block (6 lines) in assets/src/js/lib/discover/watchlistClient.js:5"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-e33ca6dd472a6ad2", "name": "Commented-code block (6 lines) in assets/src/js/lib/discover/aiClient.js:4", "shortDescription": {"text": "Commented-code block (6 lines) in assets/src/js/lib/discover/aiClient.js:4"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-9db52d934f061e1d", "name": "Commented-code block (5 lines) in assets/src/js/lib/discover/localizeClient.js:1", "shortDescription": {"text": "Commented-code block (5 lines) in assets/src/js/lib/discover/localizeClient.js:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-3752698114911cd1", "name": "`fetch()` without try/.catch or AbortSignal \u2014 assets/src/js/lib/discover/localizeClient.js:57", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 assets/src/js/lib/discover/localizeClient.js:57"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2fcd7a99642b3b08", "name": "Commented-code block (7 lines) in assets/src/js/lib/discover/components/ItemGrid.jsx:5", "shortDescription": {"text": "Commented-code block (7 lines) in assets/src/js/lib/discover/components/ItemGrid.jsx:5"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-9562e825e9517ea4", "name": "Commented-code block (6 lines) in assets/src/js/lib/discover/components/CalendarView.jsx:127", "shortDescription": {"text": "Commented-code block (6 lines) in assets/src/js/lib/discover/components/CalendarView.jsx:127"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-8a6e7930692d53f2", "name": "Commented-code block (6 lines) in assets/src/js/lib/discover/components/discoverUtils.js:23", "shortDescription": {"text": "Commented-code block (6 lines) in assets/src/js/lib/discover/components/discoverUtils.js:23"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-c8f78d1ac2cbeefd", "name": "`fetch()` without try/.catch or AbortSignal \u2014 assets/src/js/lib/discover/components/discoverUtils.js:110", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 assets/src/js/lib/discover/components/discoverUtils.js:110"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3a70d84fc4ae4316", "name": "Commented-code block (5 lines) in assets/src/js/lib/discover/components/DiscoverApp.jsx:230", "shortDescription": {"text": "Commented-code block (5 lines) in assets/src/js/lib/discover/components/DiscoverApp.jsx:230"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-90b7e54ffa3f12c0", "name": "`fetch()` without try/.catch or AbortSignal \u2014 assets/src/js/lib/discover/components/DiscoverApp.jsx:628", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 assets/src/js/lib/discover/components/DiscoverApp.jsx:628"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-cb5986e62843eaaf", "name": "`fetch()` without try/.catch or AbortSignal \u2014 assets/src/js/lib/discover/components/AddonWizard.jsx:17", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 assets/src/js/lib/discover/components/AddonWizard.jsx:17"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9406a71e9cc9d91e", "name": "Commented-code block (5 lines) in assets/src/js/lib/discover/components/discoverReducer.js:16", "shortDescription": {"text": "Commented-code block (5 lines) in assets/src/js/lib/discover/components/discoverReducer.js:16"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-6f63980ef64ee4d1", "name": "Commented-code block (5 lines) in assets/src/js/lib/discover/components/ExpandableText.jsx:8", "shortDescription": {"text": "Commented-code block (5 lines) in assets/src/js/lib/discover/components/ExpandableText.jsx:8"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-287808e9d2239c16", "name": "Commented-code block (6 lines) in assets/src/js/lib/discover/components/ai/AISection.jsx:16", "shortDescription": {"text": "Commented-code block (6 lines) in assets/src/js/lib/discover/components/ai/AISection.jsx:16"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-907a7891dadbf841", "name": "Commented-code block (5 lines) in assets/src/js/lib/discover/components/ai/AIChipsRow.jsx:7", "shortDescription": {"text": "Commented-code block (5 lines) in assets/src/js/lib/discover/components/ai/AIChipsRow.jsx:7"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/22632"}, "properties": {"repository": "webtor-io/web-ui", "repoUrl": "https://github.com/webtor-io/web-ui", "branch": "main"}, "results": [{"ruleId": "scanner-a597819ab08870b0", "level": "note", "message": {"text": "React Flow <Controls> without dark theming \u2014 assets/src/js/lib/player/Player.jsx:455"}, "properties": {"repobilityId": "b26d946b72450fd1", "scanner": "scanner-primary", "fingerprint": "a597819ab08870b0", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.controls.no-bg"]}}, {"ruleId": "scanner-d63da3583b14afc0", "level": "warning", "message": {"text": "Dockerfile runs as root: Dockerfile"}, "properties": {"repobilityId": "a2ed1bd120e507db", "scanner": "scanner-primary", "fingerprint": "d63da3583b14afc0", "layer": "hardware", "severity": "medium", "confidence": 1.0, "tags": ["security", "container"]}}, {"ruleId": "scanner-33d1d1cc6ee6ad3c", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: alpine:3.21"}, "properties": {"repobilityId": "c8ef5d1b44e990dd", "scanner": "scanner-primary", "fingerprint": "33d1d1cc6ee6ad3c", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Dockerfile"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-dbd8a7472041c35c", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: node:22"}, "properties": {"repobilityId": "13c71381bba27241", "scanner": "scanner-primary", "fingerprint": "dbd8a7472041c35c", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Dockerfile"}, "region": {"startLine": 5}}}]}, {"ruleId": "scanner-efeae1827c6c9bc3", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: golang:1.26-alpine"}, "properties": {"repobilityId": "71603e4250af0a36", "scanner": "scanner-primary", "fingerprint": "efeae1827c6c9bc3", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Dockerfile"}, "region": {"startLine": 15}}}]}, {"ruleId": "scanner-33d1d1cc6ee6ad3c", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: alpine:3.21"}, "properties": {"repobilityId": "55dff28d3d3ff8f6", "scanner": "scanner-primary", "fingerprint": "33d1d1cc6ee6ad3c", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Dockerfile"}, "region": {"startLine": 32}}}]}, {"ruleId": "scanner-aa5acaa49eb8315b", "level": "note", "message": {"text": "Containers defined but no K8s/orchestration manifest found"}, "properties": {"repobilityId": "b230ea9b68736081", "scanner": "scanner-primary", "fingerprint": "aa5acaa49eb8315b", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["coverage", "deployment"]}}, {"ruleId": "scanner-9710c8d059e53154", "level": "none", "message": {"text": "No frontend routes/components detected"}, "properties": {"repobilityId": "44ca61485762e494", "scanner": "scanner-primary", "fingerprint": "9710c8d059e53154", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-cd495e94f468a896", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in assets/src/js/app/discover-ribbon.js:25"}, "properties": {"repobilityId": "c72b4854205f86c5", "scanner": "scanner-primary", "fingerprint": "cd495e94f468a896", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "assets/src/js/app/discover-ribbon.js"}, "region": {"startLine": 25}}}]}, {"ruleId": "scanner-5d1ee66a37c228dc", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in assets/src/js/app/layout.js:41"}, "properties": {"repobilityId": "a458b630f52cb732", "scanner": "scanner-primary", "fingerprint": "5d1ee66a37c228dc", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "assets/src/js/app/layout.js"}, "region": {"startLine": 41}}}]}, {"ruleId": "scanner-2f7d7103e23465aa", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in assets/src/js/app/vault/progress.js:128"}, "properties": {"repobilityId": "596180de60613e20", "scanner": "scanner-primary", "fingerprint": "2f7d7103e23465aa", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "assets/src/js/app/vault/progress.js"}, "region": {"startLine": 128}}}]}, {"ruleId": "scanner-9f9acd885895d05c", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in assets/src/js/app/resource/status.js:56"}, "properties": {"repobilityId": "8b3e0a21f3148a09", "scanner": "scanner-primary", "fingerprint": "9f9acd885895d05c", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "assets/src/js/app/resource/status.js"}, "region": {"startLine": 56}}}]}, {"ruleId": "scanner-fc5519d499ec276d", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in assets/src/js/app/profile/addon_urls.js:105"}, "properties": {"repobilityId": "b61a02329d4e279e", "scanner": "scanner-primary", "fingerprint": "fc5519d499ec276d", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "assets/src/js/app/profile/addon_urls.js"}, "region": {"startLine": 105}}}]}, {"ruleId": "scanner-05a3f66163916ccf", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in assets/src/js/lib/ads.js:25"}, "properties": {"repobilityId": "5d463315eb6240f5", "scanner": "scanner-primary", "fingerprint": "05a3f66163916ccf", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "assets/src/js/lib/ads.js"}, "region": {"startLine": 25}}}]}, {"ruleId": "scanner-e610e2e67c12d6a4", "level": "warning", "message": {"text": "Insecure pattern 'domparser_html_parse' in assets/src/js/lib/async.js:68"}, "properties": {"repobilityId": "3b5b732f2e2f813f", "scanner": "scanner-primary", "fingerprint": "e610e2e67c12d6a4", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "domparser_html_parse"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "assets/src/js/lib/async.js"}, "region": {"startLine": 68}}}]}, {"ruleId": "scanner-b6240c6fc728927a", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in assets/src/js/lib/loadAsyncView.js:24"}, "properties": {"repobilityId": "3e9d5c65acf60d50", "scanner": "scanner-primary", "fingerprint": "b6240c6fc728927a", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "assets/src/js/lib/loadAsyncView.js"}, "region": {"startLine": 24}}}]}, {"ruleId": "scanner-4fb1ba0df626261b", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in assets/src/js/lib/player/Player.jsx:320"}, "properties": {"repobilityId": "3f9106a73b233a63", "scanner": "scanner-primary", "fingerprint": "4fb1ba0df626261b", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "assets/src/js/lib/player/Player.jsx"}, "region": {"startLine": 320}}}]}, {"ruleId": "scanner-33d8a5a0666991ad", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in assets/src/js/lib/player/plugins/chromecast.js:19"}, "properties": {"repobilityId": "0e69b05e74cd7da6", "scanner": "scanner-primary", "fingerprint": "33d8a5a0666991ad", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "assets/src/js/lib/player/plugins/chromecast.js"}, "region": {"startLine": 19}}}]}, {"ruleId": "scanner-3f117f14e41ce7b3", "level": "warning", "message": {"text": "Insecure pattern 'cors_wildcard' in handlers/resource/status.go:137"}, "properties": {"repobilityId": "8c899359d9d94308", "scanner": "scanner-primary", "fingerprint": "3f117f14e41ce7b3", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "cors_wildcard"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "handlers/resource/status.go"}, "region": {"startLine": 137}}}]}, {"ruleId": "scanner-e72163b6de5c520c", "level": "warning", "message": {"text": "Insecure pattern 'cors_wildcard' in handlers/discover_ai/handler.go:252"}, "properties": {"repobilityId": "15dd339a515b68da", "scanner": "scanner-primary", "fingerprint": "e72163b6de5c520c", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "cors_wildcard"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "handlers/discover_ai/handler.go"}, "region": {"startLine": 252}}}]}, {"ruleId": "scanner-408d01d261a7f8ac", "level": "warning", "message": {"text": "Insecure pattern 'cors_wildcard' in handlers/job/handler.go:41"}, "properties": {"repobilityId": "953a9b7c1664e1ce", "scanner": "scanner-primary", "fingerprint": "408d01d261a7f8ac", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "cors_wildcard"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "handlers/job/handler.go"}, "region": {"startLine": 41}}}]}, {"ruleId": "scanner-93afed2afb1d3d4a", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "e4fe1b94683db6d9", "scanner": "scanner-primary", "fingerprint": "93afed2afb1d3d4a", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/docker-image.yml"}, "region": {"startLine": 18}}}]}, {"ruleId": "scanner-93afed2afb1d3d4a", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "829a7d31acb0bf60", "scanner": "scanner-primary", "fingerprint": "93afed2afb1d3d4a", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/docker-image.yml"}, "region": {"startLine": 21}}}]}, {"ruleId": "scanner-93afed2afb1d3d4a", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "31446094243ca9b7", "scanner": "scanner-primary", "fingerprint": "93afed2afb1d3d4a", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/docker-image.yml"}, "region": {"startLine": 26}}}]}, {"ruleId": "scanner-93afed2afb1d3d4a", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "5b143b42596fc8cf", "scanner": "scanner-primary", "fingerprint": "93afed2afb1d3d4a", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/docker-image.yml"}, "region": {"startLine": 41}}}]}, {"ruleId": "scanner-93afed2afb1d3d4a", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "2c1f7886bb3cd3b6", "scanner": "scanner-primary", "fingerprint": "93afed2afb1d3d4a", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/docker-image.yml"}, "region": {"startLine": 53}}}]}, {"ruleId": "scanner-93afed2afb1d3d4a", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "af7fe08ff7c30976", "scanner": "scanner-primary", "fingerprint": "93afed2afb1d3d4a", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/docker-image.yml"}, "region": {"startLine": 60}}}]}, {"ruleId": "scanner-cc664eae65d0ef73", "level": "note", "message": {"text": "Very large file: assets/src/js/lib/discover/components/DiscoverApp.jsx (1650 lines)"}, "properties": {"repobilityId": "3ed29b390f34949c", "scanner": "scanner-primary", "fingerprint": "cc664eae65d0ef73", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-414725c98a270375", "level": "note", "message": {"text": "Very large file: services/enrich/enrich.go (1623 lines)"}, "properties": {"repobilityId": "432ff01d7cc6b390", "scanner": "scanner-primary", "fingerprint": "414725c98a270375", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-ea3b5e389d8c9c0f", "level": "note", "message": {"text": "Low test-to-source ratio"}, "properties": {"repobilityId": "ef7b2552cc00a375", "scanner": "scanner-primary", "fingerprint": "ea3b5e389d8c9c0f", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["tests"]}}, {"ruleId": "scanner-72b2a6250083a784", "level": "warning", "message": {"text": "Placeholder or mock-heavy implementation detected"}, "properties": {"repobilityId": "8ac307f107bb297b", "scanner": "scanner-primary", "fingerprint": "72b2a6250083a784", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "incomplete", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "2afd3692f5c8eb0d", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "d7d477655072f621", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "41dd97866dc8bf57", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-653cb1c4bfcf7e2b", "level": "none", "message": {"text": "Commented-code block (5 lines) in webpack.config.js:12"}, "properties": {"repobilityId": "6d894ee3844111dc", "scanner": "scanner-primary", "fingerprint": "653cb1c4bfcf7e2b", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-7daddf28c3d60b82", "level": "none", "message": {"text": "Commented-code block (5 lines) in assets/src/js/app/discover.js:12"}, "properties": {"repobilityId": "d1f390e6b3c95ce1", "scanner": "scanner-primary", "fingerprint": "7daddf28c3d60b82", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-a53df8dc9bad6de7", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 assets/src/js/app/speedtest.js:93"}, "properties": {"repobilityId": "6499a13363c21fec", "scanner": "scanner-primary", "fingerprint": "a53df8dc9bad6de7", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-e13826b090a1eb41", "level": "none", "message": {"text": "Commented-code block (6 lines) in assets/src/js/app/layout.js:61"}, "properties": {"repobilityId": "b7c9213d407bb395", "scanner": "scanner-primary", "fingerprint": "e13826b090a1eb41", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-498de40f22100936", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 assets/src/js/app/ext/download.js:17"}, "properties": {"repobilityId": "a6878139dfb40b51", "scanner": "scanner-primary", "fingerprint": "498de40f22100936", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-ac204256e8c895d1", "level": "none", "message": {"text": "Commented-code block (5 lines) in assets/src/js/app/resource/get.js:4"}, "properties": {"repobilityId": "e41843bcae63f0b8", "scanner": "scanner-primary", "fingerprint": "ac204256e8c895d1", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-2f9bc8cfa0c8c0ac", "level": "none", "message": {"text": "Commented-code block (6 lines) in assets/src/js/app/resource/release_subscribe_banner.js:3"}, "properties": {"repobilityId": "3a3a80343f362245", "scanner": "scanner-primary", "fingerprint": "2f9bc8cfa0c8c0ac", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-1984cea8575bfc16", "level": "none", "message": {"text": "Commented-code block (6 lines) in assets/src/js/lib/umami.js:266"}, "properties": {"repobilityId": "b9d205045502c37f", "scanner": "scanner-primary", "fingerprint": "1984cea8575bfc16", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-445757946bcf84cb", "level": "none", "message": {"text": "Commented-code block (5 lines) in assets/src/js/lib/textClamp.js:5"}, "properties": {"repobilityId": "101c8dd81f89be9a", "scanner": "scanner-primary", "fingerprint": "445757946bcf84cb", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-6b702095b3c41224", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 assets/src/js/lib/async.js:49"}, "properties": {"repobilityId": "1776886fcb38625a", "scanner": "scanner-primary", "fingerprint": "6b702095b3c41224", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-0f13711992afa1a5", "level": "none", "message": {"text": "Commented-code block (5 lines) in assets/src/js/lib/loadAsyncView.js:19"}, "properties": {"repobilityId": "5f2afa2874ef4011", "scanner": "scanner-primary", "fingerprint": "0f13711992afa1a5", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-e8193f22e91df947", "level": "none", "message": {"text": "Commented-code block (5 lines) in assets/src/js/lib/adultReveal.js:3"}, "properties": {"repobilityId": "d47aac6a991cafc0", "scanner": "scanner-primary", "fingerprint": "e8193f22e91df947", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-023c76c70eda04b1", "level": "none", "message": {"text": "Commented-code block (7 lines) in assets/src/js/lib/i18n.js:9"}, "properties": {"repobilityId": "d004e7d3f5c8c2a8", "scanner": "scanner-primary", "fingerprint": "023c76c70eda04b1", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-5450854af7af3036", "level": "none", "message": {"text": "Commented-code block (5 lines) in assets/src/js/lib/player/Player.jsx:138"}, "properties": {"repobilityId": "615ac9cd373b3791", "scanner": "scanner-primary", "fingerprint": "5450854af7af3036", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-8105a9ca2d0ad8ec", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 assets/src/js/lib/player/Player.jsx:778"}, "properties": {"repobilityId": "40a0b4aed408febf", "scanner": "scanner-primary", "fingerprint": "8105a9ca2d0ad8ec", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-5814412ff5fe89ea", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 assets/src/js/lib/player/session-seek.js:61"}, "properties": {"repobilityId": "25a3731fde99b46a", "scanner": "scanner-primary", "fingerprint": "5814412ff5fe89ea", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-6442dea7b5a8314b", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 assets/src/js/lib/player/hooks/useWatchHistory.js:35"}, "properties": {"repobilityId": "5dffbdc74d8837e2", "scanner": "scanner-primary", "fingerprint": "6442dea7b5a8314b", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-600032ee8feb0cca", "level": "none", "message": {"text": "Commented-code block (6 lines) in assets/src/js/lib/discover/ids.js:3"}, "properties": {"repobilityId": "3694ed0912607ff5", "scanner": "scanner-primary", "fingerprint": "600032ee8feb0cca", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-52491e572bbd01d6", "level": "none", "message": {"text": "Commented-code block (6 lines) in assets/src/js/lib/discover/lang.js:53"}, "properties": {"repobilityId": "a14b11798840e718", "scanner": "scanner-primary", "fingerprint": "52491e572bbd01d6", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-a6cfc0266236efad", "level": "none", "message": {"text": "Commented-code block (6 lines) in assets/src/js/lib/discover/i18n.js:4"}, "properties": {"repobilityId": "ed8c0929421085ca", "scanner": "scanner-primary", "fingerprint": "a6cfc0266236efad", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-3c3b8714cb0ec275", "level": "none", "message": {"text": "Commented-code block (5 lines) in assets/src/js/lib/discover/client.js:57"}, "properties": {"repobilityId": "2661d574b3428495", "scanner": "scanner-primary", "fingerprint": "3c3b8714cb0ec275", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-9cf8c6741b6c2658", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 assets/src/js/lib/discover/client.js:26"}, "properties": {"repobilityId": "ab718fcf43788a58", "scanner": "scanner-primary", "fingerprint": "9cf8c6741b6c2658", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-36df35641d57e023", "level": "none", "message": {"text": "Commented-code block (5 lines) in assets/src/js/lib/discover/reviewsClient.js:5"}, "properties": {"repobilityId": "325eeb146a0772ed", "scanner": "scanner-primary", "fingerprint": "36df35641d57e023", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-d509ffd42d5b4c74", "level": "none", "message": {"text": "Commented-code block (6 lines) in assets/src/js/lib/discover/watchlistClient.js:5"}, "properties": {"repobilityId": "b3a0652f39df9228", "scanner": "scanner-primary", "fingerprint": "d509ffd42d5b4c74", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-e33ca6dd472a6ad2", "level": "none", "message": {"text": "Commented-code block (6 lines) in assets/src/js/lib/discover/aiClient.js:4"}, "properties": {"repobilityId": "98da47cdef6255d4", "scanner": "scanner-primary", "fingerprint": "e33ca6dd472a6ad2", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-9db52d934f061e1d", "level": "none", "message": {"text": "Commented-code block (5 lines) in assets/src/js/lib/discover/localizeClient.js:1"}, "properties": {"repobilityId": "e5789ac0aa48773c", "scanner": "scanner-primary", "fingerprint": "9db52d934f061e1d", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-3752698114911cd1", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 assets/src/js/lib/discover/localizeClient.js:57"}, "properties": {"repobilityId": "bba64f3192815f27", "scanner": "scanner-primary", "fingerprint": "3752698114911cd1", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-2fcd7a99642b3b08", "level": "none", "message": {"text": "Commented-code block (7 lines) in assets/src/js/lib/discover/components/ItemGrid.jsx:5"}, "properties": {"repobilityId": "30fed1f92b5b9980", "scanner": "scanner-primary", "fingerprint": "2fcd7a99642b3b08", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-9562e825e9517ea4", "level": "none", "message": {"text": "Commented-code block (6 lines) in assets/src/js/lib/discover/components/CalendarView.jsx:127"}, "properties": {"repobilityId": "64ea069030588943", "scanner": "scanner-primary", "fingerprint": "9562e825e9517ea4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-8a6e7930692d53f2", "level": "none", "message": {"text": "Commented-code block (6 lines) in assets/src/js/lib/discover/components/discoverUtils.js:23"}, "properties": {"repobilityId": "2ce74e39a2e59996", "scanner": "scanner-primary", "fingerprint": "8a6e7930692d53f2", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-c8f78d1ac2cbeefd", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 assets/src/js/lib/discover/components/discoverUtils.js:110"}, "properties": {"repobilityId": "2f19536d2259610f", "scanner": "scanner-primary", "fingerprint": "c8f78d1ac2cbeefd", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-3a70d84fc4ae4316", "level": "none", "message": {"text": "Commented-code block (5 lines) in assets/src/js/lib/discover/components/DiscoverApp.jsx:230"}, "properties": {"repobilityId": "229c239d98526abb", "scanner": "scanner-primary", "fingerprint": "3a70d84fc4ae4316", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-90b7e54ffa3f12c0", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 assets/src/js/lib/discover/components/DiscoverApp.jsx:628"}, "properties": {"repobilityId": "5fb0c890fbe14ee7", "scanner": "scanner-primary", "fingerprint": "90b7e54ffa3f12c0", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-cb5986e62843eaaf", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 assets/src/js/lib/discover/components/AddonWizard.jsx:17"}, "properties": {"repobilityId": "41357cd916eb40ce", "scanner": "scanner-primary", "fingerprint": "cb5986e62843eaaf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-9406a71e9cc9d91e", "level": "none", "message": {"text": "Commented-code block (5 lines) in assets/src/js/lib/discover/components/discoverReducer.js:16"}, "properties": {"repobilityId": "8d1af09e9bbeb62e", "scanner": "scanner-primary", "fingerprint": "9406a71e9cc9d91e", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-6f63980ef64ee4d1", "level": "none", "message": {"text": "Commented-code block (5 lines) in assets/src/js/lib/discover/components/ExpandableText.jsx:8"}, "properties": {"repobilityId": "6b225e7e5087ee6f", "scanner": "scanner-primary", "fingerprint": "6f63980ef64ee4d1", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-287808e9d2239c16", "level": "none", "message": {"text": "Commented-code block (6 lines) in assets/src/js/lib/discover/components/ai/AISection.jsx:16"}, "properties": {"repobilityId": "5a7c870c8138bbdc", "scanner": "scanner-primary", "fingerprint": "287808e9d2239c16", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-907a7891dadbf841", "level": "none", "message": {"text": "Commented-code block (5 lines) in assets/src/js/lib/discover/components/ai/AIChipsRow.jsx:7"}, "properties": {"repobilityId": "6505efb5c89bd8ae", "scanner": "scanner-primary", "fingerprint": "907a7891dadbf841", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}]}]}