{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-919ef047e2412d10", "name": "TODO/FIXME marker in shipping code \u2014 app.js:337", "shortDescription": {"text": "TODO/FIXME marker in shipping code \u2014 app.js:337"}, "fullDescription": {"text": "Track in /reviews or /issues, not as a code comment that rots.\n\nWhy: Drift control \u2014 shouldn't be the same as Quality TODO scanner.\nRule id: fq.todo-marker"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-9710c8d059e53154", "name": "No frontend routes/components detected", "shortDescription": {"text": "No frontend routes/components detected"}, "fullDescription": {"text": "No React/Vue/Next routes were found. This is fine for backend-only repos."}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-b2306d91aaadbde3", "name": "Insecure pattern 'direct_innerhtml_assignment' in design/reference-spc.html:286", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in design/reference-spc.html:286"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-276647d552454f7b", "name": "Insecure pattern 'direct_innerhtml_assignment' in modules/aps.js:362", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in modules/aps.js:362"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1aec274f60102aa2", "name": "Insecure pattern 'direct_innerhtml_assignment' in modules/scm.js:656", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in modules/scm.js:656"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2e436bc14fd25bd1", "name": "Insecure pattern 'direct_innerhtml_assignment' in modules/recipe.js:492", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in modules/recipe.js:492"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3d4234413a52dbb4", "name": "Insecure pattern 'direct_innerhtml_assignment' in modules/spc.js:356", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in modules/spc.js:356"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-73438039136ec73b", "name": "Insecure pattern 'direct_innerhtml_assignment' in modules/yield.js:485", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in modules/yield.js:485"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-87f7d8de1bde78c7", "name": "Insecure pattern 'direct_innerhtml_assignment' in modules/wip.js:622", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in modules/wip.js:622"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2953341385a0d117", "name": "Insecure pattern 'direct_innerhtml_assignment' in shell/event-river.js:227", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in shell/event-river.js:227"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6372cebde0220094", "name": "No auth library detected", "shortDescription": {"text": "No auth library detected"}, "fullDescription": {"text": "The scanner did not find any standard auth library (JWT, OAuth, NextAuth, Auth0, etc.). The repo has auth/admin/session surface indicators, so auth may live in custom code, in a separate service, or be missing."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4601e3ad3bb28677", "name": "No CI/CD pipelines detected", "shortDescription": {"text": "No CI/CD pipelines detected"}, "fullDescription": {"text": "No GitHub Actions, GitLab CI, or CircleCI configs found. Without CI you can't gate deploys on tests/lints."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6893a6c8b0861585", "name": "Very low test-to-source ratio", "shortDescription": {"text": "Very low test-to-source ratio"}, "fullDescription": {"text": "0 test file(s) for 39 source file(s) (ratio 0.00). Consider adding integration or unit tests for critical paths."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-141b30a41e03817b", "name": "No license file detected", "shortDescription": {"text": "No license file detected"}, "fullDescription": {"text": "No LICENSE/COPYING/NOTICE file was found. Generated repositories often omit licensing, which blocks reuse and automated intake."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-faccb9061e9b52a0", "name": "No README detected", "shortDescription": {"text": "No README detected"}, "fullDescription": {"text": "No README file was found. Generated repos without README context are hard to operate, validate, or safely hand off."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b9088664ace7f748", "name": "Composite production-readiness gap", "shortDescription": {"text": "Composite production-readiness gap"}, "fullDescription": {"text": "Multiple low-cost hardening controls are missing together: license, ci, tests, operator-readme. Opus verification showed these co-occurring gaps are a better readiness signal than reading each flag in isolation."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-749d4bc1bd66df5f", "name": "Agent instructions exist but release-hardening basics are missing", "shortDescription": {"text": "Agent instructions exist but release-hardening basics are missing"}, "fullDescription": {"text": "AI-coder instruction files were found, but the repo is missing license, ci, tests, operator-readme. Treat this as a contract gap: the agent is guided, but the generated output is not yet guarded by the controls that make it repeatable."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-8a91dfd09a8f8721", "name": "Commented-code block (5 lines) in app.js:1", "shortDescription": {"text": "Commented-code block (5 lines) in app.js:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-529f687794aaabed", "name": "Commented-code block (6 lines) in components/dialog.js:8", "shortDescription": {"text": "Commented-code block (6 lines) in components/dialog.js:8"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-32e346c4c46f3e55", "name": "Commented-code block (5 lines) in components/toast.js:1", "shortDescription": {"text": "Commented-code block (5 lines) in components/toast.js:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-79c93375995734ad", "name": "Commented-code block (5 lines) in components/chart-kit.js:5", "shortDescription": {"text": "Commented-code block (5 lines) in components/chart-kit.js:5"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-105462b0f8a4da1e", "name": "Commented-code block (5 lines) in components/spotlight.js:3", "shortDescription": {"text": "Commented-code block (5 lines) in components/spotlight.js:3"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-66eccac5c3cf2fb6", "name": "Commented-code block (6 lines) in modules/aps.js:19", "shortDescription": {"text": "Commented-code block (6 lines) in modules/aps.js:19"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-9fc7674594f3b2aa", "name": "Commented-code block (7 lines) in modules/erp.js:6", "shortDescription": {"text": "Commented-code block (7 lines) in modules/erp.js:6"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-7d0b9cdae9cacc91", "name": "Commented-code block (6 lines) in modules/hero-story.js:3", "shortDescription": {"text": "Commented-code block (6 lines) in modules/hero-story.js:3"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-f3f27b4935785bf0", "name": "Commented-code block (5 lines) in modules/scm.js:6", "shortDescription": {"text": "Commented-code block (5 lines) in modules/scm.js:6"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-db03908d024d4aef", "name": "Commented-code block (8 lines) in modules/apc.js:6", "shortDescription": {"text": "Commented-code block (8 lines) in modules/apc.js:6"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-195590e43ab7b735", "name": "Commented-code block (6 lines) in modules/recipe.js:6", "shortDescription": {"text": "Commented-code block (6 lines) in modules/recipe.js:6"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-817e2162b4c17b2b", "name": "Commented-code block (5 lines) in modules/spc.js:1", "shortDescription": {"text": "Commented-code block (5 lines) in modules/spc.js:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-2a8ed1afc870d887", "name": "Commented-code block (7 lines) in modules/yield.js:5", "shortDescription": {"text": "Commented-code block (7 lines) in modules/yield.js:5"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-218d85f469c7d89f", "name": "Commented-code block (6 lines) in modules/mes.js:6", "shortDescription": {"text": "Commented-code block (6 lines) in modules/mes.js:6"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-c0ed21f091cc03f0", "name": "Commented-code block (12 lines) in modules/wip.js:6", "shortDescription": {"text": "Commented-code block (12 lines) in modules/wip.js:6"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-5643a47dfec949d9", "name": "Commented-code block (8 lines) in tools/check-i18n-parity.mjs:1", "shortDescription": {"text": "Commented-code block (8 lines) in tools/check-i18n-parity.mjs:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-408e914400a44805", "name": "Commented-code block (7 lines) in engine/dispatcher.js:84", "shortDescription": {"text": "Commented-code block (7 lines) in engine/dispatcher.js:84"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-eaabdb2490c7f965", "name": "Commented-code block (5 lines) in engine/factory.js:1", "shortDescription": {"text": "Commented-code block (5 lines) in engine/factory.js:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-c28e4be7a9327ea4", "name": "Commented-code block (6 lines) in engine/skeleton.js:4", "shortDescription": {"text": "Commented-code block (6 lines) in engine/skeleton.js:4"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-ed8793742e6a938e", "name": "Commented-code block (5 lines) in engine/d3-loader.js:3", "shortDescription": {"text": "Commented-code block (5 lines) in engine/d3-loader.js:3"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-6f00b829ed401cd6", "name": "Commented-code block (5 lines) in engine/tour-engine.js:3", "shortDescription": {"text": "Commented-code block (5 lines) in engine/tour-engine.js:3"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-187759dacd1109ad", "name": "Commented-code block (5 lines) in engine/state.js:1", "shortDescription": {"text": "Commented-code block (5 lines) in engine/state.js:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-bd82e807f39c077c", "name": "Commented-code block (5 lines) in engine/event-gate.js:4", "shortDescription": {"text": "Commented-code block (5 lines) in engine/event-gate.js:4"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-e811ecdebc4a7691", "name": "Commented-code block (7 lines) in shell/guide-hub.js:3", "shortDescription": {"text": "Commented-code block (7 lines) in shell/guide-hub.js:3"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-191af6d470f03662", "name": "Commented-code block (7 lines) in shell/nav.js:1", "shortDescription": {"text": "Commented-code block (7 lines) in shell/nav.js:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-2e60d11d29335956", "name": "Commented-code block (12 lines) in shell/event-river.js:6", "shortDescription": {"text": "Commented-code block (12 lines) in shell/event-river.js:6"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-ced891a927874a01", "name": "Commented-code block (5 lines) in shell/tour-invite.js:3", "shortDescription": {"text": "Commented-code block (5 lines) in shell/tour-invite.js:3"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-aeff2f007271e932", "name": "Commented-code block (5 lines) in shell/router.js:1", "shortDescription": {"text": "Commented-code block (5 lines) in shell/router.js:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-b0e94e8af18ff0b0", "name": "Commented-code block (10 lines) in shell/kpi-strip.js:1", "shortDescription": {"text": "Commented-code block (10 lines) in shell/kpi-strip.js:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-012a7d38b2927c3c", "name": "Commented-code block (13 lines) in scenarios/tours.js:6", "shortDescription": {"text": "Commented-code block (13 lines) in scenarios/tours.js:6"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/18289"}, "properties": {"repository": "robertoshiu/mom-fab", "repoUrl": "https://github.com/robertoshiu/mom-fab", "branch": "main"}, "results": [{"ruleId": "scanner-919ef047e2412d10", "level": "none", "message": {"text": "TODO/FIXME marker in shipping code \u2014 app.js:337"}, "properties": {"repobilityId": "3049bbd13a258dde", "scanner": "scanner-primary", "fingerprint": "919ef047e2412d10", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.todo-marker"]}}, {"ruleId": "scanner-9710c8d059e53154", "level": "none", "message": {"text": "No frontend routes/components detected"}, "properties": {"repobilityId": "44ca61485762e494", "scanner": "scanner-primary", "fingerprint": "9710c8d059e53154", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-b2306d91aaadbde3", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in design/reference-spc.html:286"}, "properties": {"repobilityId": "148e4867d4b5b05b", "scanner": "scanner-primary", "fingerprint": "b2306d91aaadbde3", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "design/reference-spc.html"}, "region": {"startLine": 286}}}]}, {"ruleId": "scanner-276647d552454f7b", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in modules/aps.js:362"}, "properties": {"repobilityId": "97e66b576b98d2b8", "scanner": "scanner-primary", "fingerprint": "276647d552454f7b", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "modules/aps.js"}, "region": {"startLine": 362}}}]}, {"ruleId": "scanner-1aec274f60102aa2", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in modules/scm.js:656"}, "properties": {"repobilityId": "31e81bc9a416cc95", "scanner": "scanner-primary", "fingerprint": "1aec274f60102aa2", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "modules/scm.js"}, "region": {"startLine": 656}}}]}, {"ruleId": "scanner-2e436bc14fd25bd1", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in modules/recipe.js:492"}, "properties": {"repobilityId": "b40e3b68e3c12d4e", "scanner": "scanner-primary", "fingerprint": "2e436bc14fd25bd1", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "modules/recipe.js"}, "region": {"startLine": 492}}}]}, {"ruleId": "scanner-3d4234413a52dbb4", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in modules/spc.js:356"}, "properties": {"repobilityId": "2c2c32c627074a91", "scanner": "scanner-primary", "fingerprint": "3d4234413a52dbb4", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "modules/spc.js"}, "region": {"startLine": 356}}}]}, {"ruleId": "scanner-73438039136ec73b", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in modules/yield.js:485"}, "properties": {"repobilityId": "6671e11c7d605ea4", "scanner": "scanner-primary", "fingerprint": "73438039136ec73b", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "modules/yield.js"}, "region": {"startLine": 485}}}]}, {"ruleId": "scanner-87f7d8de1bde78c7", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in modules/wip.js:622"}, "properties": {"repobilityId": "62c1229b60ed1d08", "scanner": "scanner-primary", "fingerprint": "87f7d8de1bde78c7", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "modules/wip.js"}, "region": {"startLine": 622}}}]}, {"ruleId": "scanner-2953341385a0d117", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in shell/event-river.js:227"}, "properties": {"repobilityId": "f892d28949cbb7a0", "scanner": "scanner-primary", "fingerprint": "2953341385a0d117", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "shell/event-river.js"}, "region": {"startLine": 227}}}]}, {"ruleId": "scanner-6372cebde0220094", "level": "warning", "message": {"text": "No auth library detected"}, "properties": {"repobilityId": "a5b6035a5bbf8054", "scanner": "scanner-primary", "fingerprint": "6372cebde0220094", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["coverage", "auth"]}}, {"ruleId": "scanner-4601e3ad3bb28677", "level": "warning", "message": {"text": "No CI/CD pipelines detected"}, "properties": {"repobilityId": "c3ee439bce2bc51e", "scanner": "scanner-primary", "fingerprint": "4601e3ad3bb28677", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-6893a6c8b0861585", "level": "warning", "message": {"text": "Very low test-to-source ratio"}, "properties": {"repobilityId": "54a7de3f06314bf0", "scanner": "scanner-primary", "fingerprint": "6893a6c8b0861585", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["tests", "coverage"]}}, {"ruleId": "scanner-141b30a41e03817b", "level": "note", "message": {"text": "No license file detected"}, "properties": {"repobilityId": "e7024627fe5ad009", "scanner": "scanner-primary", "fingerprint": "141b30a41e03817b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["license", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-faccb9061e9b52a0", "level": "note", "message": {"text": "No README detected"}, "properties": {"repobilityId": "885c33b891ce54f6", "scanner": "scanner-primary", "fingerprint": "faccb9061e9b52a0", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["docs", "readme", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "52290d5b54fa8351", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-b9088664ace7f748", "level": "warning", "message": {"text": "Composite production-readiness gap"}, "properties": {"repobilityId": "3d04d91f90198172", "scanner": "scanner-primary", "fingerprint": "b9088664ace7f748", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["production-readiness", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-749d4bc1bd66df5f", "level": "warning", "message": {"text": "Agent instructions exist but release-hardening basics are missing"}, "properties": {"repobilityId": "31df875bf381151a", "scanner": "scanner-primary", "fingerprint": "749d4bc1bd66df5f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "76b16ac63c507211", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "9981817f9b305dd4", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8a91dfd09a8f8721", "level": "none", "message": {"text": "Commented-code block (5 lines) in app.js:1"}, "properties": {"repobilityId": "4441679f52b01606", "scanner": "scanner-primary", "fingerprint": "8a91dfd09a8f8721", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-529f687794aaabed", "level": "none", "message": {"text": "Commented-code block (6 lines) in components/dialog.js:8"}, "properties": {"repobilityId": "6ec248ef02ecd69b", "scanner": "scanner-primary", "fingerprint": "529f687794aaabed", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-32e346c4c46f3e55", "level": "none", "message": {"text": "Commented-code block (5 lines) in components/toast.js:1"}, "properties": {"repobilityId": "c7ec5bf128f5b827", "scanner": "scanner-primary", "fingerprint": "32e346c4c46f3e55", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-79c93375995734ad", "level": "none", "message": {"text": "Commented-code block (5 lines) in components/chart-kit.js:5"}, "properties": {"repobilityId": "b513986ac11f0b63", "scanner": "scanner-primary", "fingerprint": "79c93375995734ad", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-105462b0f8a4da1e", "level": "none", "message": {"text": "Commented-code block (5 lines) in components/spotlight.js:3"}, "properties": {"repobilityId": "877c89c5010e5b9b", "scanner": "scanner-primary", "fingerprint": "105462b0f8a4da1e", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-66eccac5c3cf2fb6", "level": "none", "message": {"text": "Commented-code block (6 lines) in modules/aps.js:19"}, "properties": {"repobilityId": "3c1b812e54b07e60", "scanner": "scanner-primary", "fingerprint": "66eccac5c3cf2fb6", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-9fc7674594f3b2aa", "level": "none", "message": {"text": "Commented-code block (7 lines) in modules/erp.js:6"}, "properties": {"repobilityId": "c2c88bf175d0b46d", "scanner": "scanner-primary", "fingerprint": "9fc7674594f3b2aa", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-7d0b9cdae9cacc91", "level": "none", "message": {"text": "Commented-code block (6 lines) in modules/hero-story.js:3"}, "properties": {"repobilityId": "3afcc00b03f1f422", "scanner": "scanner-primary", "fingerprint": "7d0b9cdae9cacc91", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-f3f27b4935785bf0", "level": "none", "message": {"text": "Commented-code block (5 lines) in modules/scm.js:6"}, "properties": {"repobilityId": "da7497b58a18af5a", "scanner": "scanner-primary", "fingerprint": "f3f27b4935785bf0", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-db03908d024d4aef", "level": "none", "message": {"text": "Commented-code block (8 lines) in modules/apc.js:6"}, "properties": {"repobilityId": "636458393abd5c7d", "scanner": "scanner-primary", "fingerprint": "db03908d024d4aef", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-195590e43ab7b735", "level": "none", "message": {"text": "Commented-code block (6 lines) in modules/recipe.js:6"}, "properties": {"repobilityId": "a5de9667fb6077fd", "scanner": "scanner-primary", "fingerprint": "195590e43ab7b735", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-817e2162b4c17b2b", "level": "none", "message": {"text": "Commented-code block (5 lines) in modules/spc.js:1"}, "properties": {"repobilityId": "573ba9f047d69436", "scanner": "scanner-primary", "fingerprint": "817e2162b4c17b2b", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-2a8ed1afc870d887", "level": "none", "message": {"text": "Commented-code block (7 lines) in modules/yield.js:5"}, "properties": {"repobilityId": "d2a428d3c8fd5066", "scanner": "scanner-primary", "fingerprint": "2a8ed1afc870d887", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-218d85f469c7d89f", "level": "none", "message": {"text": "Commented-code block (6 lines) in modules/mes.js:6"}, "properties": {"repobilityId": "aa32c4379f2ef1c1", "scanner": "scanner-primary", "fingerprint": "218d85f469c7d89f", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-c0ed21f091cc03f0", "level": "none", "message": {"text": "Commented-code block (12 lines) in modules/wip.js:6"}, "properties": {"repobilityId": "060106fe2d72c7a8", "scanner": "scanner-primary", "fingerprint": "c0ed21f091cc03f0", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-5643a47dfec949d9", "level": "none", "message": {"text": "Commented-code block (8 lines) in tools/check-i18n-parity.mjs:1"}, "properties": {"repobilityId": "efccac19d9a47c0b", "scanner": "scanner-primary", "fingerprint": "5643a47dfec949d9", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-408e914400a44805", "level": "none", "message": {"text": "Commented-code block (7 lines) in engine/dispatcher.js:84"}, "properties": {"repobilityId": "362838dc646e462e", "scanner": "scanner-primary", "fingerprint": "408e914400a44805", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-eaabdb2490c7f965", "level": "none", "message": {"text": "Commented-code block (5 lines) in engine/factory.js:1"}, "properties": {"repobilityId": "c2161307f6c2e8dc", "scanner": "scanner-primary", "fingerprint": "eaabdb2490c7f965", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-c28e4be7a9327ea4", "level": "none", "message": {"text": "Commented-code block (6 lines) in engine/skeleton.js:4"}, "properties": {"repobilityId": "cbcd31031e6b8346", "scanner": "scanner-primary", "fingerprint": "c28e4be7a9327ea4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-ed8793742e6a938e", "level": "none", "message": {"text": "Commented-code block (5 lines) in engine/d3-loader.js:3"}, "properties": {"repobilityId": "cfbfacf88ef61116", "scanner": "scanner-primary", "fingerprint": "ed8793742e6a938e", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-6f00b829ed401cd6", "level": "none", "message": {"text": "Commented-code block (5 lines) in engine/tour-engine.js:3"}, "properties": {"repobilityId": "be3511eb35ca680d", "scanner": "scanner-primary", "fingerprint": "6f00b829ed401cd6", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-187759dacd1109ad", "level": "none", "message": {"text": "Commented-code block (5 lines) in engine/state.js:1"}, "properties": {"repobilityId": "a151e8259f54f836", "scanner": "scanner-primary", "fingerprint": "187759dacd1109ad", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-bd82e807f39c077c", "level": "none", "message": {"text": "Commented-code block (5 lines) in engine/event-gate.js:4"}, "properties": {"repobilityId": "e4d93e2d1ef8fb3a", "scanner": "scanner-primary", "fingerprint": "bd82e807f39c077c", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-e811ecdebc4a7691", "level": "none", "message": {"text": "Commented-code block (7 lines) in shell/guide-hub.js:3"}, "properties": {"repobilityId": "3867b0309dfc09d3", "scanner": "scanner-primary", "fingerprint": "e811ecdebc4a7691", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-191af6d470f03662", "level": "none", "message": {"text": "Commented-code block (7 lines) in shell/nav.js:1"}, "properties": {"repobilityId": "9a8dc74b80e488cb", "scanner": "scanner-primary", "fingerprint": "191af6d470f03662", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-2e60d11d29335956", "level": "none", "message": {"text": "Commented-code block (12 lines) in shell/event-river.js:6"}, "properties": {"repobilityId": "1437b298ec015a55", "scanner": "scanner-primary", "fingerprint": "2e60d11d29335956", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-ced891a927874a01", "level": "none", "message": {"text": "Commented-code block (5 lines) in shell/tour-invite.js:3"}, "properties": {"repobilityId": "606bba9690229162", "scanner": "scanner-primary", "fingerprint": "ced891a927874a01", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-aeff2f007271e932", "level": "none", "message": {"text": "Commented-code block (5 lines) in shell/router.js:1"}, "properties": {"repobilityId": "5dc17e140ed13724", "scanner": "scanner-primary", "fingerprint": "aeff2f007271e932", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-b0e94e8af18ff0b0", "level": "none", "message": {"text": "Commented-code block (10 lines) in shell/kpi-strip.js:1"}, "properties": {"repobilityId": "976b932fa96ecf16", "scanner": "scanner-primary", "fingerprint": "b0e94e8af18ff0b0", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-012a7d38b2927c3c", "level": "none", "message": {"text": "Commented-code block (13 lines) in scenarios/tours.js:6"}, "properties": {"repobilityId": "f31e23bdc4369e8b", "scanner": "scanner-primary", "fingerprint": "012a7d38b2927c3c", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}]}]}