{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-5401600e30c8011a", "name": "Stray `console.log` in TS/JS \u2014 serve.js:46", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 serve.js:46"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5095545662049005", "name": "Stray `console.log` in TS/JS \u2014 build.js:61", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 build.js:61"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-011c98f9f4986bae", "name": "Stray `console.log` in TS/JS \u2014 samples/_gen_dummies.js:248", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 samples/_gen_dummies.js:248"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d69b503fd6a85780", "name": "Stray `console.log` in TS/JS \u2014 src/app/40-imgplace-10-lines.js:712", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 src/app/40-imgplace-10-lines.js:712"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-edb7bc957bd880d7", "name": "Stray `console.log` in TS/JS \u2014 src/app/30-pdfedit.js:561", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 src/app/30-pdfedit.js:561"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-bc62223b05ed120f", "name": "Icon-only button without accessible name \u2014 src/app/00-core-20-shared.js:210", "shortDescription": {"text": "Icon-only button without accessible name \u2014 src/app/00-core-20-shared.js:210"}, "fullDescription": {"text": "A `<button>` whose only child is a single glyph or symbol needs `title=` or `aria-label=` so screen readers (and tooltips on hover) work.\n\nWhy: P3 in CHECKLIST.md \u2014 icon-only buttons skipped a title.\nRule id: fq.button.no-label"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9710c8d059e53154", "name": "No frontend routes/components detected", "shortDescription": {"text": "No frontend routes/components detected"}, "fullDescription": {"text": "No React/Vue/Next routes were found. This is fine for backend-only repos."}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-49f9e263b8258140", "name": "Insecure pattern 'direct_innerhtml_assignment' in pdf_compact_bundle.html:9312", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in pdf_compact_bundle.html:9312"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d0f66af452c374a5", "name": "Insecure pattern 'direct_innerhtml_assignment' in src/app/20-convert.js:343", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in src/app/20-convert.js:343"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-5e69ed99bed50314", "name": "Insecure pattern 'direct_innerhtml_assignment' in src/app/50-redact.js:120", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in src/app/50-redact.js:120"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f44d9c05a4635ea3", "name": "Insecure pattern 'direct_innerhtml_assignment' in src/app/40-imgplace-00-head.js:173", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in src/app/40-imgplace-00-head.js:173"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-5c591d0e5312d074", "name": "Insecure pattern 'direct_innerhtml_assignment' in src/app/10-img2pdf.js:285", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in src/app/10-img2pdf.js:285"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-5db0cbab802481e0", "name": "Insecure pattern 'direct_innerhtml_assignment' in src/app/40-imgplace-10-lines.js:303", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in src/app/40-imgplace-10-lines.js:303"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-866f5cd9136c035f", "name": "Insecure pattern 'direct_innerhtml_assignment' in src/app/30-pdfedit.js:206", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in src/app/30-pdfedit.js:206"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-862819ed04a4f04b", "name": "Insecure pattern 'direct_innerhtml_assignment' in src/app/40-imgplace-40-library.js:2", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in src/app/40-imgplace-40-library.js:2"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a4614d354764c306", "name": "Insecure pattern 'direct_innerhtml_assignment' in src/app/40-imgplace-30-placement.js:259", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in src/app/40-imgplace-30-placement.js:259"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9170e04cf4523dc8", "name": "Insecure pattern 'direct_innerhtml_assignment' in src/app/00-core-20-shared.js:8", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in src/app/00-core-20-shared.js:8"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6372cebde0220094", "name": "No auth library detected", "shortDescription": {"text": "No auth library detected"}, "fullDescription": {"text": "The scanner did not find any standard auth library (JWT, OAuth, NextAuth, Auth0, etc.). The repo has auth/admin/session surface indicators, so auth may live in custom code, in a separate service, or be missing."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4601e3ad3bb28677", "name": "No CI/CD pipelines detected", "shortDescription": {"text": "No CI/CD pipelines detected"}, "fullDescription": {"text": "No GitHub Actions, GitLab CI, or CircleCI configs found. Without CI you can't gate deploys on tests/lints."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-141b30a41e03817b", "name": "No license file detected", "shortDescription": {"text": "No license file detected"}, "fullDescription": {"text": "No LICENSE/COPYING/NOTICE file was found. Generated repositories often omit licensing, which blocks reuse and automated intake."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-01f96f71d9907a8c", "name": "README lacks setup or run instructions", "shortDescription": {"text": "README lacks setup or run instructions"}, "fullDescription": {"text": "A README exists, but it does not contain common install/setup/run markers. This matches a frequent generated-code pattern: UI is present, operational handoff is thin."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 18 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b9088664ace7f748", "name": "Composite production-readiness gap", "shortDescription": {"text": "Composite production-readiness gap"}, "fullDescription": {"text": "Multiple low-cost hardening controls are missing together: license, ci, operator-readme. Opus verification showed these co-occurring gaps are a better readiness signal than reading each flag in isolation."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-ab4fd0cbfee6525b", "name": "Commented-code block (8 lines) in build.js:1", "shortDescription": {"text": "Commented-code block (8 lines) in build.js:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-17bd7f61f1a73824", "name": "Legacy-named symbol `pdfc_settings_v1` in tests/helpers.js:16", "shortDescription": {"text": "Legacy-named symbol `pdfc_settings_v1` in tests/helpers.js:16"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c4672be9ebc5aabe", "name": "Legacy-named symbol `pdfc_settings_v1` in tests/sanitize.spec.js:33", "shortDescription": {"text": "Legacy-named symbol `pdfc_settings_v1` in tests/sanitize.spec.js:33"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4f6e7a6092a6b06f", "name": "Legacy-named symbol `pdfc_settings_v1` in src/app/00-core-00-sanitize.js:46", "shortDescription": {"text": "Legacy-named symbol `pdfc_settings_v1` in src/app/00-core-00-sanitize.js:46"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cb809f21de1ac327", "name": "Commented-code block (16 lines) in src/app/00-core-00-sanitize.js:1", "shortDescription": {"text": "Commented-code block (16 lines) in src/app/00-core-00-sanitize.js:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-ede159798cfedb54", "name": "Legacy-named symbol `pdfc_settings_v1` in src/app/90-settings.js:2", "shortDescription": {"text": "Legacy-named symbol `pdfc_settings_v1` in src/app/90-settings.js:2"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4572527542c3378a", "name": "Commented-code block (7 lines) in src/app/50-redact.js:308", "shortDescription": {"text": "Commented-code block (7 lines) in src/app/50-redact.js:308"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-5ea4d54ecd1c1806", "name": "Commented-code block (5 lines) in src/app/40-imgplace-00-head.js:392", "shortDescription": {"text": "Commented-code block (5 lines) in src/app/40-imgplace-00-head.js:392"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-5a7e68ea0cd57d8a", "name": "Commented-code block (7 lines) in src/app/10-img2pdf.js:456", "shortDescription": {"text": "Commented-code block (7 lines) in src/app/10-img2pdf.js:456"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-f650d40ec1ced242", "name": "Commented-code block (8 lines) in src/app/40-imgplace-10-lines.js:117", "shortDescription": {"text": "Commented-code block (8 lines) in src/app/40-imgplace-10-lines.js:117"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-c317e7a2462f4b12", "name": "Commented-code block (5 lines) in src/app/30-pdfedit.js:155", "shortDescription": {"text": "Commented-code block (5 lines) in src/app/30-pdfedit.js:155"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-7b71731d50487a4f", "name": "Commented-code block (7 lines) in src/app/00-core-20-shared.js:329", "shortDescription": {"text": "Commented-code block (7 lines) in src/app/00-core-20-shared.js:329"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/19161"}, "properties": {"repository": "sEARCHcOMP/PdfCompact", "repoUrl": "https://github.com/sEARCHcOMP/PdfCompact", "branch": "main"}, "results": [{"ruleId": "scanner-5401600e30c8011a", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 serve.js:46"}, "properties": {"repobilityId": "91d7655131484c15", "scanner": "scanner-primary", "fingerprint": "5401600e30c8011a", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-5095545662049005", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 build.js:61"}, "properties": {"repobilityId": "65fc767e33ca1445", "scanner": "scanner-primary", "fingerprint": "5095545662049005", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-011c98f9f4986bae", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 samples/_gen_dummies.js:248"}, "properties": {"repobilityId": "86fb818f333508dd", "scanner": "scanner-primary", "fingerprint": "011c98f9f4986bae", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-d69b503fd6a85780", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 src/app/40-imgplace-10-lines.js:712"}, "properties": {"repobilityId": "070403fc66582047", "scanner": "scanner-primary", "fingerprint": "d69b503fd6a85780", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-edb7bc957bd880d7", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 src/app/30-pdfedit.js:561"}, "properties": {"repobilityId": "637be103421f27c6", "scanner": "scanner-primary", "fingerprint": "edb7bc957bd880d7", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-bc62223b05ed120f", "level": "note", "message": {"text": "Icon-only button without accessible name \u2014 src/app/00-core-20-shared.js:210"}, "properties": {"repobilityId": "af63078d8569f32b", "scanner": "scanner-primary", "fingerprint": "bc62223b05ed120f", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.button.no-label"]}}, {"ruleId": "scanner-9710c8d059e53154", "level": "none", "message": {"text": "No frontend routes/components detected"}, "properties": {"repobilityId": "44ca61485762e494", "scanner": "scanner-primary", "fingerprint": "9710c8d059e53154", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-49f9e263b8258140", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in pdf_compact_bundle.html:9312"}, "properties": {"repobilityId": "6e994594f24a79e8", "scanner": "scanner-primary", "fingerprint": "49f9e263b8258140", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pdf_compact_bundle.html"}, "region": {"startLine": 9312}}}]}, {"ruleId": "scanner-d0f66af452c374a5", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in src/app/20-convert.js:343"}, "properties": {"repobilityId": "85f0ba93f3642b43", "scanner": "scanner-primary", "fingerprint": "d0f66af452c374a5", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/app/20-convert.js"}, "region": {"startLine": 343}}}]}, {"ruleId": "scanner-5e69ed99bed50314", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in src/app/50-redact.js:120"}, "properties": {"repobilityId": "085f92bc75718cea", "scanner": "scanner-primary", "fingerprint": "5e69ed99bed50314", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/app/50-redact.js"}, "region": {"startLine": 120}}}]}, {"ruleId": "scanner-f44d9c05a4635ea3", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in src/app/40-imgplace-00-head.js:173"}, "properties": {"repobilityId": "2c77acd933a9047a", "scanner": "scanner-primary", "fingerprint": "f44d9c05a4635ea3", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/app/40-imgplace-00-head.js"}, "region": {"startLine": 173}}}]}, {"ruleId": "scanner-5c591d0e5312d074", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in src/app/10-img2pdf.js:285"}, "properties": {"repobilityId": "cc23b2993489405d", "scanner": "scanner-primary", "fingerprint": "5c591d0e5312d074", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/app/10-img2pdf.js"}, "region": {"startLine": 285}}}]}, {"ruleId": "scanner-5db0cbab802481e0", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in src/app/40-imgplace-10-lines.js:303"}, "properties": {"repobilityId": "b141b09def433b16", "scanner": "scanner-primary", "fingerprint": "5db0cbab802481e0", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/app/40-imgplace-10-lines.js"}, "region": {"startLine": 303}}}]}, {"ruleId": "scanner-866f5cd9136c035f", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in src/app/30-pdfedit.js:206"}, "properties": {"repobilityId": "223b5901a62dbc51", "scanner": "scanner-primary", "fingerprint": "866f5cd9136c035f", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/app/30-pdfedit.js"}, "region": {"startLine": 206}}}]}, {"ruleId": "scanner-862819ed04a4f04b", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in src/app/40-imgplace-40-library.js:2"}, "properties": {"repobilityId": "ed61956822ff5a5e", "scanner": "scanner-primary", "fingerprint": "862819ed04a4f04b", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/app/40-imgplace-40-library.js"}, "region": {"startLine": 2}}}]}, {"ruleId": "scanner-a4614d354764c306", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in src/app/40-imgplace-30-placement.js:259"}, "properties": {"repobilityId": "e3c4ea9288a11e6e", "scanner": "scanner-primary", "fingerprint": "a4614d354764c306", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/app/40-imgplace-30-placement.js"}, "region": {"startLine": 259}}}]}, {"ruleId": "scanner-9170e04cf4523dc8", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in src/app/00-core-20-shared.js:8"}, "properties": {"repobilityId": "c7d1f63f081f2af9", "scanner": "scanner-primary", "fingerprint": "9170e04cf4523dc8", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/app/00-core-20-shared.js"}, "region": {"startLine": 8}}}]}, {"ruleId": "scanner-6372cebde0220094", "level": "warning", "message": {"text": "No auth library detected"}, "properties": {"repobilityId": "a5b6035a5bbf8054", "scanner": "scanner-primary", "fingerprint": "6372cebde0220094", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["coverage", "auth"]}}, {"ruleId": "scanner-4601e3ad3bb28677", "level": "warning", "message": {"text": "No CI/CD pipelines detected"}, "properties": {"repobilityId": "c3ee439bce2bc51e", "scanner": "scanner-primary", "fingerprint": "4601e3ad3bb28677", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-141b30a41e03817b", "level": "note", "message": {"text": "No license file detected"}, "properties": {"repobilityId": "a31102163dee8b77", "scanner": "scanner-primary", "fingerprint": "141b30a41e03817b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["license", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-01f96f71d9907a8c", "level": "note", "message": {"text": "README lacks setup or run instructions"}, "properties": {"repobilityId": "1b225fae8cf1929b", "scanner": "scanner-primary", "fingerprint": "01f96f71d9907a8c", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["docs", "readme", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "a96e8a32fed359bd", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-b9088664ace7f748", "level": "warning", "message": {"text": "Composite production-readiness gap"}, "properties": {"repobilityId": "6dfe52b9bea0139b", "scanner": "scanner-primary", "fingerprint": "b9088664ace7f748", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["production-readiness", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "1c45ed9450d625c2", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "31934963ee328b85", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-ab4fd0cbfee6525b", "level": "none", "message": {"text": "Commented-code block (8 lines) in build.js:1"}, "properties": {"repobilityId": "66ea03a486a16fa2", "scanner": "scanner-primary", "fingerprint": "ab4fd0cbfee6525b", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-17bd7f61f1a73824", "level": "note", "message": {"text": "Legacy-named symbol `pdfc_settings_v1` in tests/helpers.js:16"}, "properties": {"repobilityId": "bf0529765b6fdca3", "scanner": "scanner-primary", "fingerprint": "17bd7f61f1a73824", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-c4672be9ebc5aabe", "level": "note", "message": {"text": "Legacy-named symbol `pdfc_settings_v1` in tests/sanitize.spec.js:33"}, "properties": {"repobilityId": "b8fe75d10e761350", "scanner": "scanner-primary", "fingerprint": "c4672be9ebc5aabe", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-4f6e7a6092a6b06f", "level": "note", "message": {"text": "Legacy-named symbol `pdfc_settings_v1` in src/app/00-core-00-sanitize.js:46"}, "properties": {"repobilityId": "3260043c429bbfd4", "scanner": "scanner-primary", "fingerprint": "4f6e7a6092a6b06f", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-cb809f21de1ac327", "level": "none", "message": {"text": "Commented-code block (16 lines) in src/app/00-core-00-sanitize.js:1"}, "properties": {"repobilityId": "5e36742a44debc87", "scanner": "scanner-primary", "fingerprint": "cb809f21de1ac327", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-ede159798cfedb54", "level": "note", "message": {"text": "Legacy-named symbol `pdfc_settings_v1` in src/app/90-settings.js:2"}, "properties": {"repobilityId": "26d908d1c2f9752f", "scanner": "scanner-primary", "fingerprint": "ede159798cfedb54", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-4572527542c3378a", "level": "none", "message": {"text": "Commented-code block (7 lines) in src/app/50-redact.js:308"}, "properties": {"repobilityId": "f13861e00149f6b9", "scanner": "scanner-primary", "fingerprint": "4572527542c3378a", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-5ea4d54ecd1c1806", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/app/40-imgplace-00-head.js:392"}, "properties": {"repobilityId": "ee87133ca3fd42cb", "scanner": "scanner-primary", "fingerprint": "5ea4d54ecd1c1806", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-5a7e68ea0cd57d8a", "level": "none", "message": {"text": "Commented-code block (7 lines) in src/app/10-img2pdf.js:456"}, "properties": {"repobilityId": "f66293988e25b7fd", "scanner": "scanner-primary", "fingerprint": "5a7e68ea0cd57d8a", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-f650d40ec1ced242", "level": "none", "message": {"text": "Commented-code block (8 lines) in src/app/40-imgplace-10-lines.js:117"}, "properties": {"repobilityId": "ba7f6735a121b504", "scanner": "scanner-primary", "fingerprint": "f650d40ec1ced242", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-c317e7a2462f4b12", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/app/30-pdfedit.js:155"}, "properties": {"repobilityId": "5e79a3c21aed9d89", "scanner": "scanner-primary", "fingerprint": "c317e7a2462f4b12", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-7b71731d50487a4f", "level": "none", "message": {"text": "Commented-code block (7 lines) in src/app/00-core-20-shared.js:329"}, "properties": {"repobilityId": "bcd8c73fdc0d0891", "scanner": "scanner-primary", "fingerprint": "7b71731d50487a4f", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}]}]}