{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-15d7e1d714b21cd2", "name": "TODO/FIXME marker in shipping code \u2014 packages/admin/app/pages/[entityType]/index.vue:41", "shortDescription": {"text": "TODO/FIXME marker in shipping code \u2014 packages/admin/app/pages/[entityType]/index.vue:41"}, "fullDescription": {"text": "Track in /reviews or /issues, not as a code comment that rots.\n\nWhy: Drift control \u2014 shouldn't be the same as Quality TODO scanner.\nRule id: fq.todo-marker"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-e3687a49068732d8", "name": "Docker base image is tag-pinned but not digest-pinned: php:8.5-fpm-alpine", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: php:8.5-fpm-alpine"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-aa5acaa49eb8315b", "name": "Containers defined but no K8s/orchestration manifest found", "shortDescription": {"text": "Containers defined but no K8s/orchestration manifest found"}, "fullDescription": {"text": "Repo has Dockerfiles/compose but no Kubernetes/Nomad manifests. If the target deployment is K8s, the manifests may live in a separate ops repo."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-48cce420980fc9a3", "name": "Insecure pattern 'weak_hash' in docs/audits/github-issues-open-snapshot.json:1", "shortDescription": {"text": "Insecure pattern 'weak_hash' in docs/audits/github-issues-open-snapshot.json:1"}, "fullDescription": {"text": "Found a known-risky pattern (weak_hash). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-42492d68191d2cb1", "name": "Insecure pattern 'direct_innerhtml_assignment' in packages/workspace/assets/workspace-chat.js:151", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in packages/workspace/assets/workspace-chat.js:151"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1d315ffe9ad23ad4", "name": "Insecure pattern 'direct_innerhtml_assignment' in packages/admin/app/components/widgets/RichText.vue:57", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in packages/admin/app/components/widgets/RichText.vue:57"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c7af6fdf08de9857", "name": "Insecure pattern 'domparser_html_parse' in packages/admin/app/components/widgets/RichText.vue:23", "shortDescription": {"text": "Insecure pattern 'domparser_html_parse' in packages/admin/app/components/widgets/RichText.vue:23"}, "fullDescription": {"text": "Found a known-risky pattern (domparser_html_parse). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-96f59d9c55fb5145", "name": "Insecure pattern 'vue_v_html' in packages/admin/app/components/schema/SchemaView.vue:74", "shortDescription": {"text": "Insecure pattern 'vue_v_html' in packages/admin/app/components/schema/SchemaView.vue:74"}, "fullDescription": {"text": "Found a known-risky pattern (vue_v_html). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4c6be5522a8b7441", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "softprops/action-gh-release@v2 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f68f306f048be6fc", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-10424acfa7ed4501", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6f3df8ce2ef738c9", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/github-script@v9 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-27924aa79fa4a517", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "shivammathur/setup-php@v2 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0ef058f56370da1d", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-db9afbe7bb97409c", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/setup-node@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-82b5a2b52d86d83e", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a61730b262cb15cf", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-46c644c6227e4d4a", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "shivammathur/setup-php@v2 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-bdc18c9ad4a6f18f", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7407dcfdb2b5c014", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/github-script@v9 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-bda6deb11902724f", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-91917120bc38432a", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "softprops/action-gh-release@v2 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e0a6ed5de3d1a587", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-63237b6c0e0fe129", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/setup-node@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1e30a0244e0a5fb7", "name": "package.json defines install-time lifecycle scripts", "shortDescription": {"text": "package.json defines install-time lifecycle scripts"}, "fullDescription": {"text": "preinstall/install/postinstall/prepare scripts execute during dependency installation. Review them carefully for network calls, obfuscation, shell execution, or credential access."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 6 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-72b2a6250083a784", "name": "Placeholder or mock-heavy implementation detected", "shortDescription": {"text": "Placeholder or mock-heavy implementation detected"}, "fullDescription": {"text": "Found 44 placeholder/mock markers across 17 source files. This often means the repo looks complete while core flows still use generated scaffolding or fake data."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-17d866d91a7c451e", "name": "Agent instruction/config may expose a secret: CLAUDE.md", "shortDescription": {"text": "Agent instruction/config may expose a secret: CLAUDE.md"}, "fullDescription": {"text": "Agent-facing files are routinely pasted into LLM/tool contexts. Move literal tokens, keys, and passwords into a secret manager or document them as placeholders only."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-f1776c1e41863032", "name": "Agent authority lacks a verifier contract: packages/foundation/.claude/rules/waaseyaa-shell-compat.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: packages/foundation/.claude/rules/waaseyaa-shell-compat.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-122f91b7f2906dc4", "name": "Agent authority lacks a verifier contract: .claude/settings.json", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/settings.json"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-fd15f7c85bd23882", "name": "Agent authority lacks a verifier contract: .claude/rules/shell-compatibility.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/rules/shell-compatibility.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-837ac888bc1542c1", "name": "Agent instruction/config may expose a secret: .claude/rules/entity-storage-invariant.md", "shortDescription": {"text": "Agent instruction/config may expose a secret: .claude/rules/entity-storage-invariant.md"}, "fullDescription": {"text": "Agent-facing files are routinely pasted into LLM/tool contexts. Move literal tokens, keys, and passwords into a secret manager or document them as placeholders only."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-b0d93c8b260cfce5", "name": "Agent authority lacks a verifier contract: .claude/rules/entity-storage-invariant.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/rules/entity-storage-invariant.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-57e72b2c4fd9be18", "name": "Agent instruction/config may expose a secret: skills/waaseyaa/api-layer/SKILL.md", "shortDescription": {"text": "Agent instruction/config may expose a secret: skills/waaseyaa/api-layer/SKILL.md"}, "fullDescription": {"text": "Agent-facing files are routinely pasted into LLM/tool contexts. Move literal tokens, keys, and passwords into a secret manager or document them as placeholders only."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-d4b1a7bccca2bb6c", "name": "Agent instruction/config may expose a secret: skills/waaseyaa/entity-system/SKILL.md", "shortDescription": {"text": "Agent instruction/config may expose a secret: skills/waaseyaa/entity-system/SKILL.md"}, "fullDescription": {"text": "Agent-facing files are routinely pasted into LLM/tool contexts. Move literal tokens, keys, and passwords into a secret manager or document them as placeholders only."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-3edf121f510f5016", "name": "Agent instruction/config may expose a secret: skills/waaseyaa/middleware-pipeline/SKILL.md", "shortDescription": {"text": "Agent instruction/config may expose a secret: skills/waaseyaa/middleware-pipeline/SKILL.md"}, "fullDescription": {"text": "Agent-facing files are routinely pasted into LLM/tool contexts. Move literal tokens, keys, and passwords into a secret manager or document them as placeholders only."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-f919983f6590ec87", "name": "Agent authority lacks a verifier contract: skills/waaseyaa/spec-maintenance/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: skills/waaseyaa/spec-maintenance/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-840a51e57b385e5f", "name": "Agent instruction/config may expose a secret: skills/waaseyaa/access-control/SKILL.md", "shortDescription": {"text": "Agent instruction/config may expose a secret: skills/waaseyaa/access-control/SKILL.md"}, "fullDescription": {"text": "Agent-facing files are routinely pasted into LLM/tool contexts. Move literal tokens, keys, and passwords into a secret manager or document them as placeholders only."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-6ebae8caf3c5781e", "name": "Agent instruction/config may expose a secret: skills/waaseyaa/infrastructure/SKILL.md", "shortDescription": {"text": "Agent instruction/config may expose a secret: skills/waaseyaa/infrastructure/SKILL.md"}, "fullDescription": {"text": "Agent-facing files are routinely pasted into LLM/tool contexts. Move literal tokens, keys, and passwords into a secret manager or document them as placeholders only."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-636181104745dd91", "name": "Agent authority lacks a verifier contract: skills/waaseyaa/infrastructure/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: skills/waaseyaa/infrastructure/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-45b80abea63b424b", "name": "Agent authority lacks a verifier contract: skeleton/CLAUDE.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: skeleton/CLAUDE.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-fd2990b2fa039dd7", "name": "Agent authority lacks a verifier contract: skeleton/.claude/rules/waaseyaa-shell-compat.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: skeleton/.claude/rules/waaseyaa-shell-compat.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-111a970287762aa7", "name": "`fetch()` without try/.catch or AbortSignal \u2014 packages/workspace/assets/workspace-chat.js:7", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 packages/workspace/assets/workspace-chat.js:7"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e11352ad6bbaabc6", "name": "Commented-code block (5 lines) in packages/admin/tests/components/layout/NavBuilder.test.ts:79", "shortDescription": {"text": "Commented-code block (5 lines) in packages/admin/tests/components/layout/NavBuilder.test.ts:79"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-9043629bc04e3328", "name": "`fetch()` without try/.catch or AbortSignal \u2014 packages/admin/app/adapters/AdminSurfaceTransportAdapter.ts:25", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 packages/admin/app/adapters/AdminSurfaceTransportAdapter.ts:25"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea7a7ecccf84ae2e", "name": "Commented-code block (5 lines) in packages/admin/app/composables/useQueueJobs.ts:3", "shortDescription": {"text": "Commented-code block (5 lines) in packages/admin/app/composables/useQueueJobs.ts:3"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-14890244c4dcacd1", "name": "Commented-code block (5 lines) in packages/admin/app/composables/useSchema.ts:15", "shortDescription": {"text": "Commented-code block (5 lines) in packages/admin/app/composables/useSchema.ts:15"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-d34fa9907df9a8b0", "name": "`fetch()` without try/.catch or AbortSignal \u2014 packages/admin/app/composables/useSchema.ts:24", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 packages/admin/app/composables/useSchema.ts:24"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-acaa88b5b18b0061", "name": "Commented-code block (8 lines) in packages/admin/app/composables/useRetentionPolicies.ts:4", "shortDescription": {"text": "Commented-code block (8 lines) in packages/admin/app/composables/useRetentionPolicies.ts:4"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-2d65307f3d88e0bc", "name": "Network/subprocess call without timeout or try/except \u2014 tools/github-issue-backlog-enrich.py:93", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 tools/github-issue-backlog-enrich.py:93"}, "fullDescription": {"text": "`subprocess.check_output(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-af022f937dd5b7fd", "name": "9 env vars used in code but missing from .env.example", "shortDescription": {"text": "9 env vars used in code but missing from .env.example"}, "fullDescription": {"text": "Drift between code and config docs. The first few: `CI`, `NODE_ENV`, `NUXT_BACKEND_URL`, `NUXT_PUBLIC_APP_NAME`, `NUXT_PUBLIC_AUTH_REGISTRATION`, `NUXT_PUBLIC_AUTH_REQUIRE_VERIFIED_EMAIL`, `NUXT_PUBLIC_BASE_URL`, `NUXT_PUBLIC_DOCS_URL` + 1 more. Add them (with a placeholder/comment) to .env.example so onboarding doesn't break."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/22562"}, "properties": {"repository": "waaseyaa/framework", "repoUrl": "https://github.com/waaseyaa/framework", "branch": "main"}, "results": [{"ruleId": "scanner-15d7e1d714b21cd2", "level": "none", "message": {"text": "TODO/FIXME marker in shipping code \u2014 packages/admin/app/pages/[entityType]/index.vue:41"}, "properties": {"repobilityId": "ea53de9efef3d8d5", "scanner": "scanner-primary", "fingerprint": "15d7e1d714b21cd2", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.todo-marker"]}}, {"ruleId": "scanner-e3687a49068732d8", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: php:8.5-fpm-alpine"}, "properties": {"repobilityId": "6b6e9de313d59045", "scanner": "scanner-primary", "fingerprint": "e3687a49068732d8", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skeleton/Dockerfile"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-aa5acaa49eb8315b", "level": "note", "message": {"text": "Containers defined but no K8s/orchestration manifest found"}, "properties": {"repobilityId": "b230ea9b68736081", "scanner": "scanner-primary", "fingerprint": "aa5acaa49eb8315b", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["coverage", "deployment"]}}, {"ruleId": "scanner-48cce420980fc9a3", "level": "warning", "message": {"text": "Insecure pattern 'weak_hash' in docs/audits/github-issues-open-snapshot.json:1"}, "properties": {"repobilityId": "2457ee5f7c94674f", "scanner": "scanner-primary", "fingerprint": "48cce420980fc9a3", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "weak_hash"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docs/audits/github-issues-open-snapshot.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-42492d68191d2cb1", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in packages/workspace/assets/workspace-chat.js:151"}, "properties": {"repobilityId": "46d137033075c4c2", "scanner": "scanner-primary", "fingerprint": "42492d68191d2cb1", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/workspace/assets/workspace-chat.js"}, "region": {"startLine": 151}}}]}, {"ruleId": "scanner-1d315ffe9ad23ad4", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in packages/admin/app/components/widgets/RichText.vue:57"}, "properties": {"repobilityId": "b01d1ec027162702", "scanner": "scanner-primary", "fingerprint": "1d315ffe9ad23ad4", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/admin/app/components/widgets/RichText.vue"}, "region": {"startLine": 57}}}]}, {"ruleId": "scanner-c7af6fdf08de9857", "level": "warning", "message": {"text": "Insecure pattern 'domparser_html_parse' in packages/admin/app/components/widgets/RichText.vue:23"}, "properties": {"repobilityId": "e2aada18abf5928d", "scanner": "scanner-primary", "fingerprint": "c7af6fdf08de9857", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "domparser_html_parse"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/admin/app/components/widgets/RichText.vue"}, "region": {"startLine": 23}}}]}, {"ruleId": "scanner-96f59d9c55fb5145", "level": "warning", "message": {"text": "Insecure pattern 'vue_v_html' in packages/admin/app/components/schema/SchemaView.vue:74"}, "properties": {"repobilityId": "9764323c4b73df7a", "scanner": "scanner-primary", "fingerprint": "96f59d9c55fb5145", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "vue_v_html"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/admin/app/components/schema/SchemaView.vue"}, "region": {"startLine": 74}}}]}, {"ruleId": "scanner-4c6be5522a8b7441", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "a9ca6ca45f5adbeb", "scanner": "scanner-primary", "fingerprint": "4c6be5522a8b7441", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/split.yml"}, "region": {"startLine": 229}}}]}, {"ruleId": "scanner-f68f306f048be6fc", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "e0c76626b6cdaf5b", "scanner": "scanner-primary", "fingerprint": "f68f306f048be6fc", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/split.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-10424acfa7ed4501", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "ddb9dfabe3c90aeb", "scanner": "scanner-primary", "fingerprint": "10424acfa7ed4501", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/surface-parity.yml"}, "region": {"startLine": 36}}}]}, {"ruleId": "scanner-10424acfa7ed4501", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "0bc7de23fb2a9d35", "scanner": "scanner-primary", "fingerprint": "10424acfa7ed4501", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/surface-parity.yml"}, "region": {"startLine": 41}}}]}, {"ruleId": "scanner-6f3df8ce2ef738c9", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "1c13395243ed2b5d", "scanner": "scanner-primary", "fingerprint": "6f3df8ce2ef738c9", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/discord-release.yml"}, "region": {"startLine": 16}}}]}, {"ruleId": "scanner-6f3df8ce2ef738c9", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "1c13395243ed2b5d", "scanner": "scanner-primary", "fingerprint": "6f3df8ce2ef738c9", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/discord-release.yml"}, "region": {"startLine": 100}}}]}, {"ruleId": "scanner-27924aa79fa4a517", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "9df8e08a95a059d9", "scanner": "scanner-primary", "fingerprint": "27924aa79fa4a517", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 38}}}]}, {"ruleId": "scanner-27924aa79fa4a517", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "a22664b58dca3181", "scanner": "scanner-primary", "fingerprint": "27924aa79fa4a517", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 44}}}]}, {"ruleId": "scanner-27924aa79fa4a517", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "9df8e08a95a059d9", "scanner": "scanner-primary", "fingerprint": "27924aa79fa4a517", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 78}}}]}, {"ruleId": "scanner-27924aa79fa4a517", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "a22664b58dca3181", "scanner": "scanner-primary", "fingerprint": "27924aa79fa4a517", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 84}}}]}, {"ruleId": "scanner-27924aa79fa4a517", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "4b1852c0624da805", "scanner": "scanner-primary", "fingerprint": "27924aa79fa4a517", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 108}}}]}, {"ruleId": "scanner-27924aa79fa4a517", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "3d643d433b61cb02", "scanner": "scanner-primary", "fingerprint": "27924aa79fa4a517", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 119}}}]}, {"ruleId": "scanner-27924aa79fa4a517", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "9df8e08a95a059d9", "scanner": "scanner-primary", "fingerprint": "27924aa79fa4a517", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 132}}}]}, {"ruleId": "scanner-27924aa79fa4a517", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "a22664b58dca3181", "scanner": "scanner-primary", "fingerprint": "27924aa79fa4a517", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 138}}}]}, {"ruleId": "scanner-27924aa79fa4a517", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "4b1852c0624da805", "scanner": "scanner-primary", "fingerprint": "27924aa79fa4a517", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 148}}}]}, {"ruleId": "scanner-27924aa79fa4a517", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "3d643d433b61cb02", "scanner": "scanner-primary", "fingerprint": "27924aa79fa4a517", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 163}}}]}, {"ruleId": "scanner-27924aa79fa4a517", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "9df8e08a95a059d9", "scanner": "scanner-primary", "fingerprint": "27924aa79fa4a517", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 176}}}]}, {"ruleId": "scanner-27924aa79fa4a517", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "a22664b58dca3181", "scanner": "scanner-primary", "fingerprint": "27924aa79fa4a517", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 183}}}]}, {"ruleId": "scanner-27924aa79fa4a517", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "90dca2b9a9fbfb28", "scanner": "scanner-primary", "fingerprint": "27924aa79fa4a517", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 199}}}]}, {"ruleId": "scanner-27924aa79fa4a517", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "9df8e08a95a059d9", "scanner": "scanner-primary", "fingerprint": "27924aa79fa4a517", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 216}}}]}, {"ruleId": "scanner-27924aa79fa4a517", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "9df8e08a95a059d9", "scanner": "scanner-primary", "fingerprint": "27924aa79fa4a517", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 241}}}]}, {"ruleId": "scanner-27924aa79fa4a517", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "a22664b58dca3181", "scanner": "scanner-primary", "fingerprint": "27924aa79fa4a517", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 248}}}]}, {"ruleId": "scanner-27924aa79fa4a517", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "9df8e08a95a059d9", "scanner": "scanner-primary", "fingerprint": "27924aa79fa4a517", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 273}}}]}, {"ruleId": "scanner-27924aa79fa4a517", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "9df8e08a95a059d9", "scanner": "scanner-primary", "fingerprint": "27924aa79fa4a517", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 319}}}]}, {"ruleId": "scanner-27924aa79fa4a517", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "4a63b1fd6887cae9", "scanner": "scanner-primary", "fingerprint": "27924aa79fa4a517", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 326}}}]}, {"ruleId": "scanner-27924aa79fa4a517", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "a22664b58dca3181", "scanner": "scanner-primary", "fingerprint": "27924aa79fa4a517", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 331}}}]}, {"ruleId": "scanner-0ef058f56370da1d", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "c94d38280fd8439c", "scanner": "scanner-primary", "fingerprint": "0ef058f56370da1d", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/sync-skeleton.yml"}, "region": {"startLine": 13}}}]}, {"ruleId": "scanner-0ef058f56370da1d", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "c94d38280fd8439c", "scanner": "scanner-primary", "fingerprint": "0ef058f56370da1d", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/sync-skeleton.yml"}, "region": {"startLine": 18}}}]}, {"ruleId": "scanner-db9afbe7bb97409c", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "ce67069a37b05ba6", "scanner": "scanner-primary", "fingerprint": "db9afbe7bb97409c", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/admin-dist.yml"}, "region": {"startLine": 30}}}]}, {"ruleId": "scanner-82b5a2b52d86d83e", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "dcea03a24f96f809", "scanner": "scanner-primary", "fingerprint": "82b5a2b52d86d83e", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/admin-dist.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a61730b262cb15cf", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "289c17550a8cf4c5", "scanner": "scanner-primary", "fingerprint": "a61730b262cb15cf", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/skeleton-smoke.yml"}, "region": {"startLine": 60}}}]}, {"ruleId": "scanner-a61730b262cb15cf", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "39d8098b82e671cb", "scanner": "scanner-primary", "fingerprint": "a61730b262cb15cf", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/skeleton-smoke.yml"}, "region": {"startLine": 65}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "f33a4b0f16414418", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 25}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "40de0ea74eab3ee8", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 56}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "f33a4b0f16414418", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 70}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "b28f2eb9ce3eea56", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 80}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "40de0ea74eab3ee8", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 101}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "40de0ea74eab3ee8", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 111}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "f33a4b0f16414418", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 131}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "40de0ea74eab3ee8", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 162}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "f33a4b0f16414418", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 176}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "b28f2eb9ce3eea56", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 186}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "40de0ea74eab3ee8", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 207}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "604950f032a8619d", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 230}}}]}, {"ruleId": "scanner-bdc18c9ad4a6f18f", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "3b927dd0e23d4db1", "scanner": "scanner-primary", "fingerprint": "bdc18c9ad4a6f18f", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/changelog-discipline.yml"}, "region": {"startLine": 22}}}]}, {"ruleId": "scanner-7407dcfdb2b5c014", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "e77655228d01cd1f", "scanner": "scanner-primary", "fingerprint": "7407dcfdb2b5c014", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/auto-merge.yml"}, "region": {"startLine": 31}}}]}, {"ruleId": "scanner-7407dcfdb2b5c014", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "e77655228d01cd1f", "scanner": "scanner-primary", "fingerprint": "7407dcfdb2b5c014", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/auto-merge.yml"}, "region": {"startLine": 52}}}]}, {"ruleId": "scanner-bda6deb11902724f", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "52fa6a3933670e49", "scanner": "scanner-primary", "fingerprint": "bda6deb11902724f", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/auto-merge.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-91917120bc38432a", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "451f252113141616", "scanner": "scanner-primary", "fingerprint": "91917120bc38432a", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/github-release.yml"}, "region": {"startLine": 38}}}]}, {"ruleId": "scanner-e0a6ed5de3d1a587", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "1911d46da2d7fe46", "scanner": "scanner-primary", "fingerprint": "e0a6ed5de3d1a587", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/github-release.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-63237b6c0e0fe129", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "e5b15f6064123a9f", "scanner": "scanner-primary", "fingerprint": "63237b6c0e0fe129", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/admin.yml"}, "region": {"startLine": 31}}}]}, {"ruleId": "scanner-63237b6c0e0fe129", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "c8c47d88291fa1fd", "scanner": "scanner-primary", "fingerprint": "63237b6c0e0fe129", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/admin.yml"}, "region": {"startLine": 72}}}]}, {"ruleId": "scanner-63237b6c0e0fe129", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "e5b15f6064123a9f", "scanner": "scanner-primary", "fingerprint": "63237b6c0e0fe129", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/admin.yml"}, "region": {"startLine": 89}}}]}, {"ruleId": "scanner-63237b6c0e0fe129", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "c8c47d88291fa1fd", "scanner": "scanner-primary", "fingerprint": "63237b6c0e0fe129", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/admin.yml"}, "region": {"startLine": 102}}}]}, {"ruleId": "scanner-63237b6c0e0fe129", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "e5b15f6064123a9f", "scanner": "scanner-primary", "fingerprint": "63237b6c0e0fe129", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/admin.yml"}, "region": {"startLine": 117}}}]}, {"ruleId": "scanner-63237b6c0e0fe129", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "e5b15f6064123a9f", "scanner": "scanner-primary", "fingerprint": "63237b6c0e0fe129", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/admin.yml"}, "region": {"startLine": 139}}}]}, {"ruleId": "scanner-63237b6c0e0fe129", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "e5b15f6064123a9f", "scanner": "scanner-primary", "fingerprint": "63237b6c0e0fe129", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/admin.yml"}, "region": {"startLine": 163}}}]}, {"ruleId": "scanner-1e30a0244e0a5fb7", "level": "note", "message": {"text": "package.json defines install-time lifecycle scripts"}, "properties": {"repobilityId": "94de61ce2559f924", "scanner": "scanner-primary", "fingerprint": "1e30a0244e0a5fb7", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "npm", "install-scripts"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/admin/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "28952e32d8ad946b", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-72b2a6250083a784", "level": "warning", "message": {"text": "Placeholder or mock-heavy implementation detected"}, "properties": {"repobilityId": "641ee20371083860", "scanner": "scanner-primary", "fingerprint": "72b2a6250083a784", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "incomplete", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "96c5b426951bca49", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "105c56d0c0ae19e3", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "4fbbf2a6e03e03ff", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-17d866d91a7c451e", "level": "error", "message": {"text": "Agent instruction/config may expose a secret: CLAUDE.md"}, "properties": {"repobilityId": "ccce5984e58a48f0", "scanner": "scanner-primary", "fingerprint": "17d866d91a7c451e", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["agent-instructions", "secrets", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "CLAUDE.md"}, "region": {"startLine": 128}}}]}, {"ruleId": "scanner-f1776c1e41863032", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: packages/foundation/.claude/rules/waaseyaa-shell-compat.md"}, "properties": {"repobilityId": "8832ced31a1d78db", "scanner": "scanner-primary", "fingerprint": "f1776c1e41863032", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/foundation/.claude/rules/waaseyaa-shell-compat.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-122f91b7f2906dc4", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/settings.json"}, "properties": {"repobilityId": "a2967269048b6a9d", "scanner": "scanner-primary", "fingerprint": "122f91b7f2906dc4", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/settings.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-fd15f7c85bd23882", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/rules/shell-compatibility.md"}, "properties": {"repobilityId": "6e03a1d5fbfd945d", "scanner": "scanner-primary", "fingerprint": "fd15f7c85bd23882", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/rules/shell-compatibility.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-837ac888bc1542c1", "level": "error", "message": {"text": "Agent instruction/config may expose a secret: .claude/rules/entity-storage-invariant.md"}, "properties": {"repobilityId": "ad7ef2385b9bf80a", "scanner": "scanner-primary", "fingerprint": "837ac888bc1542c1", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["agent-instructions", "secrets", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/rules/entity-storage-invariant.md"}, "region": {"startLine": 73}}}]}, {"ruleId": "scanner-b0d93c8b260cfce5", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/rules/entity-storage-invariant.md"}, "properties": {"repobilityId": "9718575b2a402ddb", "scanner": "scanner-primary", "fingerprint": "b0d93c8b260cfce5", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/rules/entity-storage-invariant.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-57e72b2c4fd9be18", "level": "error", "message": {"text": "Agent instruction/config may expose a secret: skills/waaseyaa/api-layer/SKILL.md"}, "properties": {"repobilityId": "b67d31860413d511", "scanner": "scanner-primary", "fingerprint": "57e72b2c4fd9be18", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["agent-instructions", "secrets", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/waaseyaa/api-layer/SKILL.md"}, "region": {"startLine": 286}}}]}, {"ruleId": "scanner-d4b1a7bccca2bb6c", "level": "error", "message": {"text": "Agent instruction/config may expose a secret: skills/waaseyaa/entity-system/SKILL.md"}, "properties": {"repobilityId": "73897b738600fe3b", "scanner": "scanner-primary", "fingerprint": "d4b1a7bccca2bb6c", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["agent-instructions", "secrets", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/waaseyaa/entity-system/SKILL.md"}, "region": {"startLine": 194}}}]}, {"ruleId": "scanner-3edf121f510f5016", "level": "error", "message": {"text": "Agent instruction/config may expose a secret: skills/waaseyaa/middleware-pipeline/SKILL.md"}, "properties": {"repobilityId": "89c296b87345b1e8", "scanner": "scanner-primary", "fingerprint": "3edf121f510f5016", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["agent-instructions", "secrets", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/waaseyaa/middleware-pipeline/SKILL.md"}, "region": {"startLine": 237}}}]}, {"ruleId": "scanner-f919983f6590ec87", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: skills/waaseyaa/spec-maintenance/SKILL.md"}, "properties": {"repobilityId": "8ec0d3c3cbc2aabb", "scanner": "scanner-primary", "fingerprint": "f919983f6590ec87", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/waaseyaa/spec-maintenance/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-840a51e57b385e5f", "level": "error", "message": {"text": "Agent instruction/config may expose a secret: skills/waaseyaa/access-control/SKILL.md"}, "properties": {"repobilityId": "e97cd6dfe9f7e533", "scanner": "scanner-primary", "fingerprint": "840a51e57b385e5f", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["agent-instructions", "secrets", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/waaseyaa/access-control/SKILL.md"}, "region": {"startLine": 283}}}]}, {"ruleId": "scanner-6ebae8caf3c5781e", "level": "error", "message": {"text": "Agent instruction/config may expose a secret: skills/waaseyaa/infrastructure/SKILL.md"}, "properties": {"repobilityId": "4e0388104fc872ed", "scanner": "scanner-primary", "fingerprint": "6ebae8caf3c5781e", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["agent-instructions", "secrets", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/waaseyaa/infrastructure/SKILL.md"}, "region": {"startLine": 329}}}]}, {"ruleId": "scanner-636181104745dd91", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: skills/waaseyaa/infrastructure/SKILL.md"}, "properties": {"repobilityId": "fe6f347cc63c7614", "scanner": "scanner-primary", "fingerprint": "636181104745dd91", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/waaseyaa/infrastructure/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-45b80abea63b424b", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: skeleton/CLAUDE.md"}, "properties": {"repobilityId": "7c5d6ea3bd3e21e1", "scanner": "scanner-primary", "fingerprint": "45b80abea63b424b", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skeleton/CLAUDE.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-fd2990b2fa039dd7", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: skeleton/.claude/rules/waaseyaa-shell-compat.md"}, "properties": {"repobilityId": "b91b7071eaf04eba", "scanner": "scanner-primary", "fingerprint": "fd2990b2fa039dd7", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skeleton/.claude/rules/waaseyaa-shell-compat.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-111a970287762aa7", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 packages/workspace/assets/workspace-chat.js:7"}, "properties": {"repobilityId": "95cbfaccb2208083", "scanner": "scanner-primary", "fingerprint": "111a970287762aa7", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-e11352ad6bbaabc6", "level": "none", "message": {"text": "Commented-code block (5 lines) in packages/admin/tests/components/layout/NavBuilder.test.ts:79"}, "properties": {"repobilityId": "16e712110496694e", "scanner": "scanner-primary", "fingerprint": "e11352ad6bbaabc6", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-9043629bc04e3328", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 packages/admin/app/adapters/AdminSurfaceTransportAdapter.ts:25"}, "properties": {"repobilityId": "cd07b0274c983f90", "scanner": "scanner-primary", "fingerprint": "9043629bc04e3328", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-ea7a7ecccf84ae2e", "level": "none", "message": {"text": "Commented-code block (5 lines) in packages/admin/app/composables/useQueueJobs.ts:3"}, "properties": {"repobilityId": "cfe88358ee5786d4", "scanner": "scanner-primary", "fingerprint": "ea7a7ecccf84ae2e", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-14890244c4dcacd1", "level": "none", "message": {"text": "Commented-code block (5 lines) in packages/admin/app/composables/useSchema.ts:15"}, "properties": {"repobilityId": "c6cbeace0848c789", "scanner": "scanner-primary", "fingerprint": "14890244c4dcacd1", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-d34fa9907df9a8b0", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 packages/admin/app/composables/useSchema.ts:24"}, "properties": {"repobilityId": "017d6e57be071154", "scanner": "scanner-primary", "fingerprint": "d34fa9907df9a8b0", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-acaa88b5b18b0061", "level": "none", "message": {"text": "Commented-code block (8 lines) in packages/admin/app/composables/useRetentionPolicies.ts:4"}, "properties": {"repobilityId": "79276a34016b66b8", "scanner": "scanner-primary", "fingerprint": "acaa88b5b18b0061", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-2d65307f3d88e0bc", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 tools/github-issue-backlog-enrich.py:93"}, "properties": {"repobilityId": "4c780646c21fd3a7", "scanner": "scanner-primary", "fingerprint": "2d65307f3d88e0bc", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-af022f937dd5b7fd", "level": "note", "message": {"text": "9 env vars used in code but missing from .env.example"}, "properties": {"repobilityId": "5597384795dea7a4", "scanner": "scanner-primary", "fingerprint": "af022f937dd5b7fd", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "config-drift"]}}]}]}