{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "GHSA-mh29-5h37-fv8m", "name": "js-yaml: GHSA-mh29-5h37-fv8m", "shortDescription": {"text": "js-yaml: GHSA-mh29-5h37-fv8m"}, "fullDescription": {"text": "js-yaml has prototype pollution in merge (<<)"}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "medium", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "GHSA-f886-m6hf-6m8v", "name": "brace-expansion: GHSA-f886-m6hf-6m8v", "shortDescription": {"text": "brace-expansion: GHSA-f886-m6hf-6m8v"}, "fullDescription": {"text": "brace-expansion: Zero-step sequence causes process hang and memory exhaustion"}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "medium", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "GHSA-2g4f-4pwh-qvx6", "name": "ajv: GHSA-2g4f-4pwh-qvx6", "shortDescription": {"text": "ajv: GHSA-2g4f-4pwh-qvx6"}, "fullDescription": {"text": "ajv has ReDoS when using `$data` option"}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "medium", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "ERR002", "name": "[ERR002] Empty Catch Block: Empty catch blocks hide errors.", "shortDescription": {"text": "[ERR002] Empty Catch Block: Empty catch blocks hide errors."}, "fullDescription": {"text": "Log the error or rethrow it. Use console.error() at minimum."}, "properties": {"scanner": "repobility-threat-engine", "category": "error_handling", "severity": "medium", "confidence": 1.0, "cwe": "", "owasp": ""}}, {"id": "SEC123", "name": "[SEC123] Production stack trace / debug output exposed: Debug mode left on in production exposes stack traces, environme", "shortDescription": {"text": "[SEC123] Production stack trace / debug output exposed: Debug mode left on in production exposes stack traces, environment variables, framework internals \u2014 sometimes triggers RCE (Django debug page with arbitrary template eval)."}, "fullDescription": {"text": "Set DEBUG=False / APP_DEBUG=false in production. Provide a generic 500 handler that logs to backend but returns a sanitized page to clients."}, "properties": {"scanner": "repobility-threat-engine", "category": "quality", "severity": "medium", "confidence": 1.0, "cwe": "", "owasp": ""}}, {"id": "SEC041", "name": "[SEC041] Tabnabbing \u2014 target=\"_blank\" without rel=\"noopener noreferrer\": <a target=\"_blank\"> without rel=\"noopener noref", "shortDescription": {"text": "[SEC041] Tabnabbing \u2014 target=\"_blank\" without rel=\"noopener noreferrer\": <a target=\"_blank\"> without rel=\"noopener noreferrer\" leaks window.opener to the opened page. The opened page can then run window.opener.location = 'phishing-site' and"}, "fullDescription": {"text": "Add rel=\"noopener noreferrer\" to every <a target=\"_blank\">:\n  <a href=\"...\" target=\"_blank\" rel=\"noopener noreferrer\">link</a>\nFor dynamically generated links from JS, set rel on the element before appending. Even safe-looking subdomains should harden \u2014 costs nothing."}, "properties": {"scanner": "repobility-threat-engine", "category": "security", "severity": "medium", "confidence": 1.0, "cwe": "", "owasp": ""}}, {"id": "SEC087", "name": "[SEC087] JS: weak Math.random for crypto: Math.random() is not cryptographically secure; using it for tokens/keys/nonces", "shortDescription": {"text": "[SEC087] JS: weak Math.random for crypto: Math.random() is not cryptographically secure; using it for tokens/keys/nonces is predictable. Ported from gosec G404 / eslint detect-pseudoRandomBytes concept (Apache-2.0)."}, "fullDescription": {"text": "Use `crypto.randomBytes(32).toString('hex')` (Node) or `crypto.getRandomValues()` (browser)."}, "properties": {"scanner": "repobility-threat-engine", "category": "quality", "severity": "medium", "confidence": 1.0, "cwe": "", "owasp": ""}}, {"id": "SEC045", "name": "[SEC045] eval()/exec() on stored or user-supplied data: eval() and exec() on data \u2014 even admin-stored data \u2014 is a latera", "shortDescription": {"text": "[SEC045] eval()/exec() on stored or user-supplied data: eval() and exec() on data \u2014 even admin-stored data \u2014 is a lateral-movement vector after any one credential compromise. Sandboxes (__builtins__ cleared) are escapable: attackers use obj"}, "fullDescription": {"text": "For literal data structures: use ast.literal_eval(text) \u2014 only parses literals, raises on code.\nFor formula evaluation: use asteval or simpleeval (purpose-built sandboxes with allow-lists).\nFor Odoo: use odoo.tools.safe_eval(expr, locals_dict, mode='exec').\nIf you genuinely need to execute admin-stored code: require explicit super-admin permission AND log every execution with a stack trace."}, "properties": {"scanner": "repobility-threat-engine", "category": "injection", "severity": "medium", "confidence": 1.0, "cwe": "", "owasp": ""}}, {"id": "DEPCUR-NPM", "name": "npm package `globals` is 3 major version(s) behind (14.0.0 -> 17.6.0)", "shortDescription": {"text": "npm package `globals` is 3 major version(s) behind (14.0.0 -> 17.6.0)"}, "fullDescription": {"text": "`globals` is pinned/resolved at 14.0.0 but the latest stable release on the npm registry is 17.6.0 (3 major version(s) behind). Outdated dependencies accumulate unpatched bugs and make future security upgrades harder. This is the version-currency signal Dependabot version-update PRs raise."}, "properties": {"scanner": "repobility-dependency-currency", "category": "dependency", "severity": "medium", "confidence": 0.9, "cwe": "", "owasp": ""}}, {"id": "CORE_LARGE_FILES", "name": "Average file size is 544 lines (recommend <300)", "shortDescription": {"text": "Average file size is 544 lines (recommend <300)"}, "fullDescription": {"text": "Refactor large files by extracting related functions into separate modules. Target files with 300+ lines first. Use the Single Responsibility Principle \u2014 each module should have one clear purpose."}, "properties": {"scanner": "repobility-core", "category": "quality", "severity": "medium", "confidence": null, "cwe": "", "owasp": ""}}, {"id": "AIC003", "name": "Duplicated implementation block across source files", "shortDescription": {"text": "Duplicated implementation block across source files"}, "fullDescription": {"text": "Duplicated blocks are a common artifact when generated code is pasted or recreated instead of reused. They increase maintenance cost because every future bug fix must be found in multiple locations."}, "properties": {"scanner": "repobility-ai-code-hygiene", "category": "quality", "severity": "low", "confidence": 0.86, "cwe": "", "owasp": ""}}, {"id": "AIC007", "name": "Generated build artifact directory is present at repository root", "shortDescription": {"text": "Generated build artifact directory is present at repository root"}, "fullDescription": {"text": "Committed build outputs and caches make scans slower, confuse duplicate-code checks, and give AI agents stale generated code to imitate."}, "properties": {"scanner": "repobility-ai-code-hygiene", "category": "quality", "severity": "low", "confidence": 0.7, "cwe": "", "owasp": ""}}, {"id": "MINED055", "name": "[MINED055] Npm Install No Lockfile: Production image runs npm install (resolves new versions on every build) instead of ", "shortDescription": {"text": "[MINED055] Npm Install No Lockfile: Production image runs npm install (resolves new versions on every build) instead of npm ci."}, "fullDescription": {"text": "Review and fix per the pattern semantics. See CWE-1357 / A06:2021 for context."}, "properties": {"scanner": "repobility-threat-engine", "category": "quality", "severity": "info", "confidence": 1.0, "cwe": "", "owasp": ""}}, {"id": "SEC027", "name": "[SEC027] XML External Entity (XXE) \u2014 Node.js xml parsers (and 1 more): Same pattern found in 1 additional files. Review ", "shortDescription": {"text": "[SEC027] XML External Entity (XXE) \u2014 Node.js xml parsers (and 1 more): Same pattern found in 1 additional files. Review if needed."}, "fullDescription": {"text": "Pass `noent: false` to libxmljs. Avoid xml2js or pass explicit secure config. Prefer parsers that don't expand external entities at all."}, "properties": {"scanner": "repobility-threat-engine", "category": "xxe", "severity": "info", "confidence": 0.2, "cwe": "", "owasp": ""}}, {"id": "SEC084", "name": "[SEC084] JS: require() with non-literal: require(<variable>) loads arbitrary modules \u2014 equivalent to eval at module scop", "shortDescription": {"text": "[SEC084] JS: require() with non-literal: require(<variable>) loads arbitrary modules \u2014 equivalent to eval at module scope. Ported from eslint-plugin-security detect-non-literal-require (Apache-2.0)."}, "fullDescription": {"text": "Use static imports or a static mapping `const modules = { foo: require('./foo') }`."}, "properties": {"scanner": "repobility-threat-engine", "category": "quality", "severity": "info", "confidence": 0.1, "cwe": "", "owasp": ""}}, {"id": "SEC083", "name": "[SEC083] JS: new RegExp() with non-literal (and 10 more): Same pattern found in 10 additional files. Review if needed.", "shortDescription": {"text": "[SEC083] JS: new RegExp() with non-literal (and 10 more): Same pattern found in 10 additional files. Review if needed."}, "fullDescription": {"text": "Use a literal RegExp or whitelist-validate user input before constructing patterns."}, "properties": {"scanner": "repobility-threat-engine", "category": "quality", "severity": "info", "confidence": 0.2, "cwe": "", "owasp": ""}}, {"id": "SEC029", "name": "[SEC029] Server-Side Request Forgery (SSRF) \u2014 outbound HTTP from user input (and 26 more): Same pattern found in 26 addi", "shortDescription": {"text": "[SEC029] Server-Side Request Forgery (SSRF) \u2014 outbound HTTP from user input (and 26 more): Same pattern found in 26 additional files. Review if needed."}, "fullDescription": {"text": "Validate the URL against an allowlist BEFORE fetching:\n  ALLOWED = {'images.example.com', 'cdn.example.com'}\n  host = urlparse(url).hostname\n  if host not in ALLOWED: abort(400)\nOr use a server-side proxy (Imgproxy / serve-files-only-from-S3) that isolates outbound network access from the request handler.\nBlock private CIDRs explicitly: 10/8, 172.16/12, 192.168/16, 169.254/16."}, "properties": {"scanner": "repobility-threat-engine", "category": "ssrf", "severity": "info", "confidence": 0.2, "cwe": "", "owasp": ""}}, {"id": "SEC085", "name": "[SEC085] JS: child_process.exec with non-literal (and 23 more): Same pattern found in 23 additional files. Review if nee", "shortDescription": {"text": "[SEC085] JS: child_process.exec with non-literal (and 23 more): Same pattern found in 23 additional files. Review if needed."}, "fullDescription": {"text": "Use execFile / spawn with separate args array; never pass shell strings."}, "properties": {"scanner": "repobility-threat-engine", "category": "quality", "severity": "info", "confidence": 0.2, "cwe": "", "owasp": ""}}, {"id": "MINED098", "name": "[MINED098] Global Scope Pollution (and 5 more): Same pattern found in 5 additional files. Review if needed.", "shortDescription": {"text": "[MINED098] Global Scope Pollution (and 5 more): Same pattern found in 5 additional files. Review if needed."}, "fullDescription": {"text": "Import the library where you need it instead of attaching to window. For legitimate global registries, use a namespaced object (e.g., `window.__myApp.axios`)."}, "properties": {"scanner": "repobility-threat-engine", "category": "quality", "severity": "info", "confidence": 0.2, "cwe": "", "owasp": ""}}, {"id": "SEC128", "name": "[SEC128] Async function without await \u2014 fire-and-forget Promise (AI mistake) (and 16 more): Same pattern found in 16 add", "shortDescription": {"text": "[SEC128] Async function without await \u2014 fire-and-forget Promise (AI mistake) (and 16 more): Same pattern found in 16 additional files. Review if needed."}, "fullDescription": {"text": "Add `await` before each async call, or chain with `.then`. If you intentionally want fire-and-forget, prefix with `void` (TS) or assign to `_` (Python with `asyncio.create_task`) to make the intent explicit and survive lint."}, "properties": {"scanner": "repobility-threat-engine", "category": "quality", "severity": "info", "confidence": 0.2, "cwe": "", "owasp": ""}}, {"id": "MINED044", "name": "[MINED044] Js Console Log Prod (and 11 more): Same pattern found in 11 additional files. Review if needed.", "shortDescription": {"text": "[MINED044] Js Console Log Prod (and 11 more): Same pattern found in 11 additional files. Review if needed."}, "fullDescription": {"text": "Review and fix per the pattern semantics. See CWE-532 /  for context."}, "properties": {"scanner": "repobility-threat-engine", "category": "quality", "severity": "info", "confidence": 0.2, "cwe": "", "owasp": ""}}, {"id": "MINED043", "name": "[MINED043] Http Not Https (and 176 more): Same pattern found in 176 additional files. Review if needed.", "shortDescription": {"text": "[MINED043] Http Not Https (and 176 more): Same pattern found in 176 additional files. Review if needed."}, "fullDescription": {"text": "Review and fix per the pattern semantics. See CWE-319 / A02:2021 for context."}, "properties": {"scanner": "repobility-threat-engine", "category": "quality", "severity": "info", "confidence": 0.2, "cwe": "", "owasp": ""}}, {"id": "GHSA-7r86-cg39-jmmj", "name": "minimatch: GHSA-7r86-cg39-jmmj", "shortDescription": {"text": "minimatch: GHSA-7r86-cg39-jmmj"}, "fullDescription": {"text": "minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments"}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "high", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "GHSA-3ppc-4f35-3m26", "name": "minimatch: GHSA-3ppc-4f35-3m26", "shortDescription": {"text": "minimatch: GHSA-3ppc-4f35-3m26"}, "fullDescription": {"text": "minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern"}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "high", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "GHSA-23c5-xmqv-rm74", "name": "minimatch: GHSA-23c5-xmqv-rm74", "shortDescription": {"text": "minimatch: GHSA-23c5-xmqv-rm74"}, "fullDescription": {"text": "minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions"}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "high", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "GHSA-rf6f-7fwh-wjgh", "name": "flatted: GHSA-rf6f-7fwh-wjgh", "shortDescription": {"text": "flatted: GHSA-rf6f-7fwh-wjgh"}, "fullDescription": {"text": "Prototype Pollution via parse() in NodeJS flatted"}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "high", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "GHSA-25h7-pfq9-p65f", "name": "flatted: GHSA-25h7-pfq9-p65f", "shortDescription": {"text": "flatted: GHSA-25h7-pfq9-p65f"}, "fullDescription": {"text": "flatted vulnerable to unbounded recursion DoS in parse() revive phase"}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "high", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "SEC103", "name": "[SEC103] LDAP injection \u2014 non-constant search filter: User input concatenated into an LDAP search filter. Attackers inje", "shortDescription": {"text": "[SEC103] LDAP injection \u2014 non-constant search filter: User input concatenated into an LDAP search filter. Attackers inject `*)(uid=*` style payloads to bypass auth or enumerate accounts."}, "fullDescription": {"text": "Escape with javax.naming.ldap.Rdn.escapeValue or equivalent. For python-ldap, use ldap.filter.escape_filter_chars. Better: use parameterized search APIs (Spring LdapTemplate filter encoders)."}, "properties": {"scanner": "repobility-threat-engine", "category": "injection", "severity": "high", "confidence": 1.0, "cwe": "", "owasp": ""}}, {"id": "SEC040", "name": "[SEC040] innerHTML XSS \u2014 template literal with server-supplied data: Setting .innerHTML with a template literal that int", "shortDescription": {"text": "[SEC040] innerHTML XSS \u2014 template literal with server-supplied data: Setting .innerHTML with a template literal that interpolates server-supplied or user-supplied data is the canonical stored/reflected XSS vector. The browser parses the HTM"}, "fullDescription": {"text": "For plain text: use el.textContent = data.value (auto-escapes).\nFor HTML you need to render: el.innerHTML = DOMPurify.sanitize(html).\nFor React/Vue/Svelte: stop using innerHTML; use the framework's binding.\nWhen data comes from CV/PDF parsers, sanitize at the parser boundary too."}, "properties": {"scanner": "repobility-threat-engine", "category": "xss", "severity": "high", "confidence": 1.0, "cwe": "", "owasp": ""}}, {"id": "MINED115", "name": "Action `softprops/action-gh-release` pinned to mutable ref `@v2`", "shortDescription": {"text": "Action `softprops/action-gh-release` pinned to mutable ref `@v2`"}, "fullDescription": {"text": "`uses: softprops/action-gh-release@v2` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-actions/changed-files compromise (2025) instantly affect ~23K repos. Pin to a 40-char commit SHA + lock with Dependabot or renovate."}, "properties": {"scanner": "repobility-supply-chain", "category": "dependency", "severity": "high", "confidence": 0.9, "cwe": "", "owasp": ""}}, {"id": "MINED122", "name": "package.json dep `scaling-palm-tree` pulled from URL/Git", "shortDescription": {"text": "package.json dep `scaling-palm-tree` pulled from URL/Git"}, "fullDescription": {"text": "`devDependencies.scaling-palm-tree` = `github:mjethani/scaling-palm-tree#15cf1ab` bypasses the npm registry. No integrity hash, no version locking, no registry-side scanning. If the URL or git host is compromised, every `npm install` pulls the new payload."}, "properties": {"scanner": "repobility-supply-chain", "category": "dependency", "severity": "high", "confidence": 0.9, "cwe": "", "owasp": ""}}, {"id": "generic-api-key", "name": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", "shortDescription": {"text": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations."}, "fullDescription": {"text": "Gitleaks detected a committed secret or credential pattern."}, "properties": {"scanner": "gitleaks", "category": "credential_exposure", "severity": "critical", "confidence": 0.95, "cwe": "", "owasp": ""}}]}}, "automationDetails": {"id": "repobility/854"}, "properties": {"repository": "gorhill/uBlock", "repoUrl": "https://github.com/gorhill/uBlock", "branch": "master"}, "results": [{"ruleId": "GHSA-mh29-5h37-fv8m", "level": "warning", "message": {"text": "js-yaml: GHSA-mh29-5h37-fv8m"}, "properties": {"repobilityId": 77058, "scanner": "osv-scanner", "fingerprint": "28d729fc1155c54fc66f4fb51841604d700ad2e22c31e413765f6dd36f601211", "category": "dependency", "severity": "medium", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["CVE-2025-64718"], "package": "js-yaml", "rule_id": "GHSA-mh29-5h37-fv8m", "scanner": "osv-scanner", "correlation_key": "vuln|js-yaml|CVE-2025-64718|package-lock.json"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "GHSA-f886-m6hf-6m8v", "level": "warning", "message": {"text": "brace-expansion: GHSA-f886-m6hf-6m8v"}, "properties": {"repobilityId": 77055, "scanner": "osv-scanner", "fingerprint": "e8eb0ab1ffbb15b3b127c7436af364aa04d69dbc42fb22d21fcb4f304d428269", "category": "dependency", "severity": "medium", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["CVE-2026-33750"], "package": "brace-expansion", "rule_id": "GHSA-f886-m6hf-6m8v", "scanner": "osv-scanner", "correlation_key": "vuln|brace-expansion|CVE-2026-33750|package-lock.json"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "GHSA-2g4f-4pwh-qvx6", "level": "warning", "message": {"text": "ajv: GHSA-2g4f-4pwh-qvx6"}, "properties": {"repobilityId": 77054, "scanner": "osv-scanner", "fingerprint": "b6e4ab66cc3522d009fa9b7b4cb49ad3d9a60843a6d25559c80bbc6b5b65b8d7", "category": "dependency", "severity": "medium", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["CVE-2025-69873"], "package": "ajv", "rule_id": "GHSA-2g4f-4pwh-qvx6", "scanner": "osv-scanner", "correlation_key": "vuln|ajv|CVE-2025-69873|package-lock.json"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "ERR002", "level": "warning", "message": {"text": "[ERR002] Empty Catch Block: Empty catch blocks hide errors."}, "properties": {"repobilityId": 77044, "scanner": "repobility-threat-engine", "fingerprint": "4a707a56332f41d3dac55755188002586d21fc936cbc04ccf4ab092d6aa60df0", "category": "error_handling", "severity": "medium", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": "catch (ex) {\n        }", "reason": "Pattern matched with no mitigating context found", "rule_id": "ERR002", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "fp|4a707a56332f41d3dac55755188002586d21fc936cbc04ccf4ab092d6aa60df0"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/web_accessible_resources/googletagservices_gpt.js"}, "region": {"startLine": 133}}}]}, {"ruleId": "ERR002", "level": "warning", "message": {"text": "[ERR002] Empty Catch Block: Empty catch blocks hide errors."}, "properties": {"repobilityId": 77043, "scanner": "repobility-threat-engine", "fingerprint": "637db76784f3a69eebe0a7f3eb0fb441101b7c5c22675bf746c42009777c21d4", "category": "error_handling", "severity": "medium", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": "catch(ex) {\n            }", "reason": "Pattern matched with no mitigating context found", "rule_id": "ERR002", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "fp|637db76784f3a69eebe0a7f3eb0fb441101b7c5c22675bf746c42009777c21d4"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/web_accessible_resources/google-analytics_ga.js"}, "region": {"startLine": 51}}}]}, {"ruleId": "ERR002", "level": "warning", "message": {"text": "[ERR002] Empty Catch Block: Empty catch blocks hide errors."}, "properties": {"repobilityId": 77042, "scanner": "repobility-threat-engine", "fingerprint": "f5bf6c598f5607f88de87f2445db0ba2d3c8e1734a8798b7a37a63496261c50e", "category": "error_handling", "severity": "medium", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": "catch (ex) {\n        }", "reason": "Pattern matched with no mitigating context found", "rule_id": "ERR002", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "fp|f5bf6c598f5607f88de87f2445db0ba2d3c8e1734a8798b7a37a63496261c50e"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/web_accessible_resources/google-analytics_analytics.js"}, "region": {"startLine": 58}}}]}, {"ruleId": "SEC123", "level": "warning", "message": {"text": "[SEC123] Production stack trace / debug output exposed: Debug mode left on in production exposes stack traces, environment variables, framework internals \u2014 sometimes triggers RCE (Django debug page with arbitrary template eval)."}, "properties": {"repobilityId": 77041, "scanner": "repobility-threat-engine", "fingerprint": "da554b85fbb3361380f358d330f92692bc4b8eb47ecd2357b39ab03d9e595da9", "category": "quality", "severity": "medium", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": "Debug = true", "reason": "Pattern matched with no mitigating context found", "rule_id": "SEC123", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "fp|da554b85fbb3361380f358d330f92692bc4b8eb47ecd2357b39ab03d9e595da9"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/js/scriptlet-filtering-core.js"}, "region": {"startLine": 278}}}]}, {"ruleId": "SEC041", "level": "warning", "message": {"text": "[SEC041] Tabnabbing \u2014 target=\"_blank\" without rel=\"noopener noreferrer\": <a target=\"_blank\"> without rel=\"noopener noreferrer\" leaks window.opener to the opened page. The opened page can then run window.opener.location = 'phishing-site' and the parent tab quietly navigates to attacker-controlled content (reverse tabnabbing). OWASP-classic; modern browsers default rel='noopener' for new windows but explicit attribute is still required for compatibility."}, "properties": {"repobilityId": 77022, "scanner": "repobility-threat-engine", "fingerprint": "e70613630e32557617a79c6fad01bfa0419ca58fdc6ee6cdd53881d85840198d", "category": "security", "severity": "medium", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": "window.open('', '_self')", "reason": "Pattern matched with no mitigating context found", "rule_id": "SEC041", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "code|security|token|236|sec041"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "platform/common/vapi-common.js"}, "region": {"startLine": 236}}}]}, {"ruleId": "SEC087", "level": "warning", "message": {"text": "[SEC087] JS: weak Math.random for crypto: Math.random() is not cryptographically secure; using it for tokens/keys/nonces is predictable. Ported from gosec G404 / eslint detect-pseudoRandomBytes concept (Apache-2.0)."}, "properties": {"repobilityId": 77017, "scanner": "repobility-threat-engine", "fingerprint": "1a232549d923f5f9119dba220a93a5f6cd66c661c30f79513e39cb7b251bc4ea", "category": "quality", "severity": "medium", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": "Token = <redacted> {\n    const n = Math.random(", "reason": "Pattern matched with no mitigating context found", "rule_id": "SEC087", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "fp|1a232549d923f5f9119dba220a93a5f6cd66c661c30f79513e39cb7b251bc4ea"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "platform/common/vapi-client.js"}, "region": {"startLine": 39}}}]}, {"ruleId": "SEC045", "level": "warning", "message": {"text": "[SEC045] eval()/exec() on stored or user-supplied data: eval() and exec() on data \u2014 even admin-stored data \u2014 is a lateral-movement vector after any one credential compromise. Sandboxes (__builtins__ cleared) are escapable: attackers use object introspection (().__class__.__mro__[-1].__subclasses__()) to reach os.system. CWE-95 (eval injection)."}, "properties": {"repobilityId": 77015, "scanner": "repobility-threat-engine", "fingerprint": "f73050499cda04519d3748514c71980840c6ab4cc4de1245afa332733b93f70b", "category": "injection", "severity": "medium", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": ".exec(", "reason": "Pattern matched with no mitigating context found", "rule_id": "SEC045", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "code|injection|token|111|sec045"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "platform/mv3/extension/js/mode-parser.js"}, "region": {"startLine": 111}}}]}, {"ruleId": "SEC045", "level": "warning", "message": {"text": "[SEC045] eval()/exec() on stored or user-supplied data: eval() and exec() on data \u2014 even admin-stored data \u2014 is a lateral-movement vector after any one credential compromise. Sandboxes (__builtins__ cleared) are escapable: attackers use object introspection (().__class__.__mro__[-1].__subclasses__()) to reach os.system. CWE-95 (eval injection)."}, "properties": {"repobilityId": 77014, "scanner": "repobility-threat-engine", "fingerprint": "043239ccdfba2a7eb359a66651d8121cdcb16da48ebd01edb17d08dd1a3a899d", "category": "injection", "severity": "medium", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": ".exec(", "reason": "Pattern matched with no mitigating context found", "rule_id": "SEC045", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "code|injection|token|191|sec045"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "platform/common/vapi-common.js"}, "region": {"startLine": 191}}}]}, {"ruleId": "SEC045", "level": "warning", "message": {"text": "[SEC045] eval()/exec() on stored or user-supplied data: eval() and exec() on data \u2014 even admin-stored data \u2014 is a lateral-movement vector after any one credential compromise. Sandboxes (__builtins__ cleared) are escapable: attackers use object introspection (().__class__.__mro__[-1].__subclasses__()) to reach os.system. CWE-95 (eval injection)."}, "properties": {"repobilityId": 77013, "scanner": "repobility-threat-engine", "fingerprint": "1e771cefa133eac7ebb8e8d15c9d72482a3195cd907d31e081535075ea71fb79", "category": "injection", "severity": "medium", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": ".exec(", "reason": "Pattern matched with no mitigating context found", "rule_id": "SEC045", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "code|injection|token|100|sec045"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "platform/common/vapi-client.js"}, "region": {"startLine": 100}}}]}, {"ruleId": "DEPCUR-NPM", "level": "warning", "message": {"text": "npm package `globals` is 3 major version(s) behind (14.0.0 -> 17.6.0)"}, "properties": {"repobilityId": 77000, "scanner": "repobility-dependency-currency", "fingerprint": "598c68d1f54ad8f540c697ed6457e280c969a02b3194a7b90ec5e84fffb1f0e1", "category": "dependency", "severity": "medium", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"gap": "3 major version(s) behind", "signal": "currency", "cwe_ids": [], "package": "globals", "scanner": "repobility-dependency-currency", "ecosystem": "npm", "languages": ["javascript"], "latest_version": "17.6.0", "correlation_key": "fp|598c68d1f54ad8f540c697ed6457e280c969a02b3194a7b90ec5e84fffb1f0e1", "current_version": "14.0.0"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "DEPCUR-NPM", "level": "warning", "message": {"text": "npm package `eslint-formatter-compact` is 1 major version(s) behind (8.40.0 -> 9.0.1)"}, "properties": {"repobilityId": 76999, "scanner": "repobility-dependency-currency", "fingerprint": "cba98b5d1fad74cd6f8f36388b093617c790b4d249cd7090af0c78fb36c2bed6", "category": "dependency", "severity": "medium", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"gap": "1 major version(s) behind", "signal": "currency", "cwe_ids": [], "package": "eslint-formatter-compact", "scanner": "repobility-dependency-currency", "ecosystem": "npm", "languages": ["javascript"], "latest_version": "9.0.1", "correlation_key": "fp|cba98b5d1fad74cd6f8f36388b093617c790b4d249cd7090af0c78fb36c2bed6", "current_version": "8.40.0"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "DEPCUR-NPM", "level": "warning", "message": {"text": "npm package `@eslint/json` is 2 major version(s) behind (0.13.2 -> 2.0.0)"}, "properties": {"repobilityId": 76998, "scanner": "repobility-dependency-currency", "fingerprint": "f187113150d90128345a09ef719f819e886c851d583211eb2942af4db179bb0c", "category": "dependency", "severity": "medium", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"gap": "2 major version(s) behind", "signal": "currency", "cwe_ids": [], "package": "@eslint/json", "scanner": "repobility-dependency-currency", "ecosystem": "npm", "languages": ["javascript"], "latest_version": "2.0.0", "correlation_key": "fp|f187113150d90128345a09ef719f819e886c851d583211eb2942af4db179bb0c", "current_version": "0.13.2"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "DEPCUR-NPM", "level": "warning", "message": {"text": "npm package `@eslint/js` is 1 major version(s) behind (9.34.0 -> 10.0.1)"}, "properties": {"repobilityId": 76997, "scanner": "repobility-dependency-currency", "fingerprint": "9435d7ffd78d770aa28c9d83c238b32f5fb84f90f4457d8f39934a813a31d212", "category": "dependency", "severity": "medium", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"gap": "1 major version(s) behind", "signal": "currency", "cwe_ids": [], "package": "@eslint/js", "scanner": "repobility-dependency-currency", "ecosystem": "npm", "languages": ["javascript"], "latest_version": "10.0.1", "correlation_key": "fp|9435d7ffd78d770aa28c9d83c238b32f5fb84f90f4457d8f39934a813a31d212", "current_version": "9.34.0"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "DEPCUR-NPM", "level": "warning", "message": {"text": "npm package `@eslint/compat` is 1 major version(s) behind (1.3.2 -> 2.1.0)"}, "properties": {"repobilityId": 76996, "scanner": "repobility-dependency-currency", "fingerprint": "1ce21f3ea82b9b75ff3e4ea631d4a071b5a3ac4fbe2764d251fd48e6d0446b2e", "category": "dependency", "severity": "medium", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"gap": "1 major version(s) behind", "signal": "currency", "cwe_ids": [], "package": "@eslint/compat", "scanner": "repobility-dependency-currency", "ecosystem": "npm", "languages": ["javascript"], "latest_version": "2.1.0", "correlation_key": "fp|1ce21f3ea82b9b75ff3e4ea631d4a071b5a3ac4fbe2764d251fd48e6d0446b2e", "current_version": "1.3.2"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "CORE_LARGE_FILES", "level": "warning", "message": {"text": "Average file size is 544 lines (recommend <300)"}, "properties": {"repobilityId": 76961, "scanner": "repobility-core", "fingerprint": "4fddf0012d6aa86866b006f655bb025be1cd0dfb3f80c708e9052ab1ffa8c9f4", "category": "quality", "severity": "medium", "confidence": null, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"rule_id": "CORE_LARGE_FILES", "scanner": "repobility-core", "correlation_key": "fp|4fddf0012d6aa86866b006f655bb025be1cd0dfb3f80c708e9052ab1ffa8c9f4"}}}, {"ruleId": "AIC003", "level": "note", "message": {"text": "Duplicated implementation block across source files"}, "properties": {"repobilityId": 76992, "scanner": "repobility-ai-code-hygiene", "fingerprint": "f61c8a15a9e94126fc3756e900dcb78803d71285c3b8c9fb1103bacd72bdaa07", "category": "quality", "severity": "low", "confidence": 0.86, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "A normalized source-code window appears in two different non-test files.", "evidence": {"lines": 12, "rule_id": "AIC003", "scanner": "repobility-ai-code-hygiene", "references": ["https://jscpd.dev/"], "duplicate_file": "platform/common/vapi-client.js", "duplicate_line": 3, "correlation_key": "fp|f61c8a15a9e94126fc3756e900dcb78803d71285c3b8c9fb1103bacd72bdaa07"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "platform/mv3/extension/js/filter-lists.js"}, "region": {"startLine": 2}}}]}, {"ruleId": "AIC003", "level": "note", "message": {"text": "Duplicated implementation block across source files"}, "properties": {"repobilityId": 76991, "scanner": "repobility-ai-code-hygiene", "fingerprint": "059465ab0936651599bbd86daf27a2827be4fa906f064e131b0530e7f1ea3712", "category": "quality", "severity": "low", "confidence": 0.86, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "A normalized source-code window appears in two different non-test files.", "evidence": {"lines": 12, "rule_id": "AIC003", "scanner": "repobility-ai-code-hygiene", "references": ["https://jscpd.dev/"], "duplicate_file": "platform/mv3/extension/js/dashboard.js", "duplicate_line": 1, "correlation_key": "fp|059465ab0936651599bbd86daf27a2827be4fa906f064e131b0530e7f1ea3712"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "platform/mv3/extension/js/filter-lists.js"}, "region": {"startLine": 1}}}]}, {"ruleId": "AIC003", "level": "note", "message": {"text": "Duplicated implementation block across source files"}, "properties": {"repobilityId": 76990, "scanner": "repobility-ai-code-hygiene", "fingerprint": "b2b1fc90ed908ea621ce11aaedb42af18d2d681ef88e287f0af6c3beaa38ce01", "category": "quality", "severity": "low", "confidence": 0.86, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "A normalized source-code window appears in two different non-test files.", "evidence": {"lines": 12, "rule_id": "AIC003", "scanner": "repobility-ai-code-hygiene", "references": ["https://jscpd.dev/"], "duplicate_file": "platform/mv3/edge/patch-extension.js", "duplicate_line": 1, "correlation_key": "fp|b2b1fc90ed908ea621ce11aaedb42af18d2d681ef88e287f0af6c3beaa38ce01"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "platform/mv3/extension/js/fetch.js"}, "region": {"startLine": 1}}}]}, {"ruleId": "AIC003", "level": "note", "message": {"text": "Duplicated implementation block across source files"}, "properties": {"repobilityId": 76989, "scanner": "repobility-ai-code-hygiene", "fingerprint": "e8e0841ef4e83a7d75bed1ef6485585c99678544b9d74cdd5967ac5806f53853", "category": "quality", "severity": "low", "confidence": 0.86, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "A normalized source-code window appears in two different non-test files.", "evidence": {"lines": 12, "rule_id": "AIC003", "scanner": "repobility-ai-code-hygiene", "references": ["https://jscpd.dev/"], "duplicate_file": "platform/mv3/edge/patch-extension.js", "duplicate_line": 1, "correlation_key": "fp|e8e0841ef4e83a7d75bed1ef6485585c99678544b9d74cdd5967ac5806f53853"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "platform/mv3/extension/js/ext.js"}, "region": {"startLine": 1}}}]}, {"ruleId": "AIC003", "level": "note", "message": {"text": "Duplicated implementation block across source files"}, "properties": {"repobilityId": 76988, "scanner": "repobility-ai-code-hygiene", "fingerprint": "fadca1887456f73ffc1743fee500723b82860a779886553a30f77e05ad012194", "category": "quality", "severity": "low", "confidence": 0.86, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "A normalized source-code window appears in two different non-test files.", "evidence": {"lines": 12, "rule_id": "AIC003", "scanner": "repobility-ai-code-hygiene", "references": ["https://jscpd.dev/"], "duplicate_file": "platform/firefox/vapi-background-ext.js", "duplicate_line": 3, "correlation_key": "fp|fadca1887456f73ffc1743fee500723b82860a779886553a30f77e05ad012194"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "platform/mv3/extension/js/ext-utils.js"}, "region": {"startLine": 3}}}]}, {"ruleId": "AIC003", "level": "note", "message": {"text": "Duplicated implementation block across source files"}, "properties": {"repobilityId": 76987, "scanner": "repobility-ai-code-hygiene", "fingerprint": "7d573d0a6a713ab518a4e039288df085241763510a9128dd88583f627cf3cec8", "category": "quality", "severity": "low", "confidence": 0.86, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "A normalized source-code window appears in two different non-test files.", "evidence": {"lines": 12, "rule_id": "AIC003", "scanner": "repobility-ai-code-hygiene", "references": ["https://jscpd.dev/"], "duplicate_file": "platform/mv3/edge/patch-extension.js", "duplicate_line": 1, "correlation_key": "fp|7d573d0a6a713ab518a4e039288df085241763510a9128dd88583f627cf3cec8"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "platform/mv3/extension/js/ext-utils.js"}, "region": {"startLine": 1}}}]}, {"ruleId": "AIC003", "level": "note", "message": {"text": "Duplicated implementation block across source files"}, "properties": {"repobilityId": 76986, "scanner": "repobility-ai-code-hygiene", "fingerprint": "f118aff7fc388c9b3748df20982934a94966c354c32282f9bc73bc840e709e65", "category": "quality", "severity": "low", "confidence": 0.86, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "A normalized source-code window appears in two different non-test files.", "evidence": {"lines": 12, "rule_id": "AIC003", "scanner": "repobility-ai-code-hygiene", "references": ["https://jscpd.dev/"], "duplicate_file": "platform/mv3/edge/patch-extension.js", "duplicate_line": 1, "correlation_key": "fp|f118aff7fc388c9b3748df20982934a94966c354c32282f9bc73bc840e709e65"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "platform/mv3/extension/js/ext-compat.js"}, "region": {"startLine": 1}}}]}, {"ruleId": "AIC003", "level": "note", "message": {"text": "Duplicated implementation block across source files"}, "properties": {"repobilityId": 76985, "scanner": "repobility-ai-code-hygiene", "fingerprint": "04e57145e99f8c8fd7400b91ef21b8d183a27da63a204d889812876baaf34f7e", "category": "quality", "severity": "low", "confidence": 0.86, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "A normalized source-code window appears in two different non-test files.", "evidence": {"lines": 12, "rule_id": "AIC003", "scanner": "repobility-ai-code-hygiene", "references": ["https://jscpd.dev/"], "duplicate_file": "platform/mv3/extension/js/dnr-editor.js", "duplicate_line": 146, "correlation_key": "fp|04e57145e99f8c8fd7400b91ef21b8d183a27da63a204d889812876baaf34f7e"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "platform/mv3/extension/js/dnr-parser.js"}, "region": {"startLine": 47}}}]}, {"ruleId": "AIC003", "level": "note", "message": {"text": "Duplicated implementation block across source files"}, "properties": {"repobilityId": 76984, "scanner": "repobility-ai-code-hygiene", "fingerprint": "35e692d1e32525a9a386f4c680e17a3ccd87e9fed51e8fb7087eba2482e1352e", "category": "quality", "severity": "low", "confidence": 0.86, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "A normalized source-code window appears in two different non-test files.", "evidence": {"lines": 12, "rule_id": "AIC003", "scanner": "repobility-ai-code-hygiene", "references": ["https://jscpd.dev/"], "duplicate_file": "platform/common/vapi-client.js", "duplicate_line": 3, "correlation_key": "fp|35e692d1e32525a9a386f4c680e17a3ccd87e9fed51e8fb7087eba2482e1352e"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "platform/mv3/extension/js/dnr-parser.js"}, "region": {"startLine": 2}}}]}, {"ruleId": "AIC003", "level": "note", "message": {"text": "Duplicated implementation block across source files"}, "properties": {"repobilityId": 76983, "scanner": "repobility-ai-code-hygiene", "fingerprint": "13e937c4f3c9654cfd8182ee848b1c40d1b6b55a8f5cf6f967fc976d7c79cdab", "category": "quality", "severity": "low", "confidence": 0.86, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "A normalized source-code window appears in two different non-test files.", "evidence": {"lines": 12, "rule_id": "AIC003", "scanner": "repobility-ai-code-hygiene", "references": ["https://jscpd.dev/"], "duplicate_file": "platform/mv3/extension/js/dashboard.js", "duplicate_line": 1, "correlation_key": "fp|13e937c4f3c9654cfd8182ee848b1c40d1b6b55a8f5cf6f967fc976d7c79cdab"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "platform/mv3/extension/js/dnr-parser.js"}, "region": {"startLine": 1}}}]}, {"ruleId": "AIC003", "level": "note", "message": {"text": "Duplicated implementation block across source files"}, "properties": {"repobilityId": 76982, "scanner": "repobility-ai-code-hygiene", "fingerprint": "d54335cea60e32334dce35f3ceee971b5cd74885baca82bb8facc7637db900a5", "category": "quality", "severity": "low", "confidence": 0.86, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "A normalized source-code window appears in two different non-test files.", "evidence": {"lines": 12, "rule_id": "AIC003", "scanner": "repobility-ai-code-hygiene", "references": ["https://jscpd.dev/"], "duplicate_file": "platform/common/vapi-client.js", "duplicate_line": 3, "correlation_key": "fp|d54335cea60e32334dce35f3ceee971b5cd74885baca82bb8facc7637db900a5"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "platform/mv3/extension/js/dnr-editor.js"}, "region": {"startLine": 2}}}]}, {"ruleId": "AIC003", "level": "note", "message": {"text": "Duplicated implementation block across source files"}, "properties": {"repobilityId": 76981, "scanner": "repobility-ai-code-hygiene", "fingerprint": "faf4af0cf2ef67b6a69c69b6ae405ad38217ba521fb2bed138fc8d2f7f69bc1f", "category": "quality", "severity": "low", "confidence": 0.86, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "A normalized source-code window appears in two different non-test files.", "evidence": {"lines": 12, "rule_id": "AIC003", "scanner": "repobility-ai-code-hygiene", "references": ["https://jscpd.dev/"], "duplicate_file": "platform/mv3/extension/js/dashboard.js", "duplicate_line": 1, "correlation_key": "fp|faf4af0cf2ef67b6a69c69b6ae405ad38217ba521fb2bed138fc8d2f7f69bc1f"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "platform/mv3/extension/js/dnr-editor.js"}, "region": {"startLine": 1}}}]}, {"ruleId": "AIC003", "level": "note", "message": {"text": "Duplicated implementation block across source files"}, "properties": {"repobilityId": 76980, "scanner": "repobility-ai-code-hygiene", "fingerprint": "06daff200d79a1614a0e39970ca82d2f294bc6b7ad97a65b860e3ea3aaa488b3", "category": "quality", "severity": "low", "confidence": 0.86, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "A normalized source-code window appears in two different non-test files.", "evidence": {"lines": 12, "rule_id": "AIC003", "scanner": "repobility-ai-code-hygiene", "references": ["https://jscpd.dev/"], "duplicate_file": "platform/common/vapi-client.js", "duplicate_line": 3, "correlation_key": "fp|06daff200d79a1614a0e39970ca82d2f294bc6b7ad97a65b860e3ea3aaa488b3"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "platform/mv3/extension/js/develop.js"}, "region": {"startLine": 2}}}]}, {"ruleId": "AIC003", "level": "note", "message": {"text": "Duplicated implementation block across source files"}, "properties": {"repobilityId": 76979, "scanner": "repobility-ai-code-hygiene", "fingerprint": "7b4a0cff47840459ea88f0f87482f9e67b719813d2673e435ae36236e721405a", "category": "quality", "severity": "low", "confidence": 0.86, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "A normalized source-code window appears in two different non-test files.", "evidence": {"lines": 12, "rule_id": "AIC003", "scanner": "repobility-ai-code-hygiene", "references": ["https://jscpd.dev/"], "duplicate_file": "platform/mv3/extension/js/dashboard.js", "duplicate_line": 1, "correlation_key": "fp|7b4a0cff47840459ea88f0f87482f9e67b719813d2673e435ae36236e721405a"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "platform/mv3/extension/js/develop.js"}, "region": {"startLine": 1}}}]}, {"ruleId": "AIC003", "level": "note", "message": {"text": "Duplicated implementation block across source files"}, "properties": {"repobilityId": 76978, "scanner": "repobility-ai-code-hygiene", "fingerprint": "52880362717714f892ab8a846947fcdefa230d886b67b199b12fbd577e94cf0b", "category": "quality", "severity": "low", "confidence": 0.86, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "A normalized source-code window appears in two different non-test files.", "evidence": {"lines": 12, "rule_id": "AIC003", "scanner": "repobility-ai-code-hygiene", "references": ["https://jscpd.dev/"], "duplicate_file": "platform/firefox/vapi-background-ext.js", "duplicate_line": 3, "correlation_key": "fp|52880362717714f892ab8a846947fcdefa230d886b67b199b12fbd577e94cf0b"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "platform/mv3/extension/js/debug.js"}, "region": {"startLine": 3}}}]}, {"ruleId": "AIC003", "level": "note", "message": {"text": "Duplicated implementation block across source files"}, "properties": {"repobilityId": 76977, "scanner": "repobility-ai-code-hygiene", "fingerprint": "e3936a71a96bced2f4162fb11d884bb22b8e354d29a8753dcb7ac87aab4075ba", "category": "quality", "severity": "low", "confidence": 0.86, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "A normalized source-code window appears in two different non-test files.", "evidence": {"lines": 12, "rule_id": "AIC003", "scanner": "repobility-ai-code-hygiene", "references": ["https://jscpd.dev/"], "duplicate_file": "platform/common/vapi-client.js", "duplicate_line": 3, "correlation_key": "fp|e3936a71a96bced2f4162fb11d884bb22b8e354d29a8753dcb7ac87aab4075ba"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "platform/mv3/extension/js/dashboard.js"}, "region": {"startLine": 2}}}]}, {"ruleId": "AIC003", "level": "note", "message": {"text": "Duplicated implementation block across source files"}, "properties": {"repobilityId": 76976, "scanner": "repobility-ai-code-hygiene", "fingerprint": "be39f6cb6c432bdcad9b39deade751e984d4d2f1678cf8c150085a7e2f9cd1f0", "category": "quality", "severity": "low", "confidence": 0.86, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "A normalized source-code window appears in two different non-test files.", "evidence": {"lines": 12, "rule_id": "AIC003", "scanner": "repobility-ai-code-hygiene", "references": ["https://jscpd.dev/"], "duplicate_file": "platform/firefox/vapi-background-ext.js", "duplicate_line": 3, "correlation_key": "fp|be39f6cb6c432bdcad9b39deade751e984d4d2f1678cf8c150085a7e2f9cd1f0"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "platform/mv3/extension/js/config.js"}, "region": {"startLine": 3}}}]}, {"ruleId": "AIC003", "level": "note", "message": {"text": "Duplicated implementation block across source files"}, "properties": {"repobilityId": 76975, "scanner": "repobility-ai-code-hygiene", "fingerprint": "3d2e8ddd3596d4dd94994f009dee16f82bc96075dd7516ddf81f1b6b042ae371", "category": "quality", "severity": "low", "confidence": 0.86, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "A normalized source-code window appears in two different non-test files.", "evidence": {"lines": 12, "rule_id": "AIC003", "scanner": "repobility-ai-code-hygiene", "references": ["https://jscpd.dev/"], "duplicate_file": "platform/mv3/edge/patch-extension.js", "duplicate_line": 1, "correlation_key": "fp|3d2e8ddd3596d4dd94994f009dee16f82bc96075dd7516ddf81f1b6b042ae371"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "platform/mv3/extension/js/config.js"}, "region": {"startLine": 1}}}]}, {"ruleId": "AIC003", "level": "note", "message": {"text": "Duplicated implementation block across source files"}, "properties": {"repobilityId": 76974, "scanner": "repobility-ai-code-hygiene", "fingerprint": "e0bc9567571840f0a64487f20a01a36c722ddc280e0fe5ceb318279278cabc56", "category": "quality", "severity": "low", "confidence": 0.86, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "A normalized source-code window appears in two different non-test files.", "evidence": {"lines": 12, "rule_id": "AIC003", "scanner": "repobility-ai-code-hygiene", "references": ["https://jscpd.dev/"], "duplicate_file": "platform/firefox/vapi-background-ext.js", "duplicate_line": 3, "correlation_key": "fp|e0bc9567571840f0a64487f20a01a36c722ddc280e0fe5ceb318279278cabc56"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "platform/mv3/extension/js/backup-restore.js"}, "region": {"startLine": 3}}}]}, {"ruleId": "AIC003", "level": "note", "message": {"text": "Duplicated implementation block across source files"}, "properties": {"repobilityId": 76973, "scanner": "repobility-ai-code-hygiene", "fingerprint": "d217d106db4add1b04559297ec25f68e0c6e58d379eb187b1f42f5c4a091de58", "category": "quality", "severity": "low", "confidence": 0.86, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "A normalized source-code window appears in two different non-test files.", "evidence": {"lines": 12, "rule_id": "AIC003", "scanner": "repobility-ai-code-hygiene", "references": ["https://jscpd.dev/"], "duplicate_file": "platform/mv3/edge/patch-extension.js", "duplicate_line": 1, "correlation_key": "fp|d217d106db4add1b04559297ec25f68e0c6e58d379eb187b1f42f5c4a091de58"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "platform/mv3/extension/js/backup-restore.js"}, "region": {"startLine": 1}}}]}, {"ruleId": "AIC003", "level": "note", "message": {"text": "Duplicated implementation block across source files"}, "properties": {"repobilityId": 76972, "scanner": "repobility-ai-code-hygiene", "fingerprint": "4d87a1f80ff615b41902e40d906d2d20e05e8c90a9058ff2513870500071a4bd", "category": "quality", "severity": "low", "confidence": 0.86, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "A normalized source-code window appears in two different non-test files.", "evidence": {"lines": 12, "rule_id": "AIC003", "scanner": "repobility-ai-code-hygiene", "references": ["https://jscpd.dev/"], "duplicate_file": "platform/mv3/edge/patch-extension.js", "duplicate_line": 1, "correlation_key": "fp|4d87a1f80ff615b41902e40d906d2d20e05e8c90a9058ff2513870500071a4bd"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "platform/mv3/extension/js/background.js"}, "region": {"startLine": 1}}}]}, {"ruleId": "AIC003", "level": "note", "message": {"text": "Duplicated implementation block across source files"}, "properties": {"repobilityId": 76971, "scanner": "repobility-ai-code-hygiene", "fingerprint": "addbb571a388eab836e2a939dcd7042fe0cf9768af7b57c990415e22419c98b7", "category": "quality", "severity": "low", "confidence": 0.86, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "A normalized source-code window appears in two different non-test files.", "evidence": {"lines": 12, "rule_id": "AIC003", "scanner": "repobility-ai-code-hygiene", "references": ["https://jscpd.dev/"], "duplicate_file": "platform/firefox/vapi-background-ext.js", "duplicate_line": 3, "correlation_key": "fp|addbb571a388eab836e2a939dcd7042fe0cf9768af7b57c990415e22419c98b7"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "platform/mv3/extension/js/admin.js"}, "region": {"startLine": 3}}}]}, {"ruleId": "AIC003", "level": "note", "message": {"text": "Duplicated implementation block across source files"}, "properties": {"repobilityId": 76970, "scanner": "repobility-ai-code-hygiene", "fingerprint": "7f4bf00d8f370f0ecd1f7f76c1c6ca1109e3d618a683f69946be2c558d71f1aa", "category": "quality", "severity": "low", "confidence": 0.86, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "A normalized source-code window appears in two different non-test files.", "evidence": {"lines": 12, "rule_id": "AIC003", "scanner": "repobility-ai-code-hygiene", "references": ["https://jscpd.dev/"], "duplicate_file": "platform/mv3/edge/patch-extension.js", "duplicate_line": 1, "correlation_key": "fp|7f4bf00d8f370f0ecd1f7f76c1c6ca1109e3d618a683f69946be2c558d71f1aa"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "platform/mv3/extension/js/admin.js"}, "region": {"startLine": 1}}}]}, {"ruleId": "AIC003", "level": "note", "message": {"text": "Duplicated implementation block across source files"}, "properties": {"repobilityId": 76969, "scanner": "repobility-ai-code-hygiene", "fingerprint": "0f7bc68e3906ddeabc467488470c21a72ebcdb48d2300ff01517bb3b6f8ab814", "category": "quality", "severity": "low", "confidence": 0.86, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "A normalized source-code window appears in two different non-test files.", "evidence": {"lines": 12, "rule_id": "AIC003", "scanner": "repobility-ai-code-hygiene", "references": ["https://jscpd.dev/"], "duplicate_file": "platform/mv3/edge/patch-extension.js", "duplicate_line": 1, "correlation_key": "fp|0f7bc68e3906ddeabc467488470c21a72ebcdb48d2300ff01517bb3b6f8ab814"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "platform/mv3/extension/js/action.js"}, "region": {"startLine": 1}}}]}, {"ruleId": "AIC003", "level": "note", "message": {"text": "Duplicated implementation block across source files"}, "properties": {"repobilityId": 76968, "scanner": "repobility-ai-code-hygiene", "fingerprint": "f4b660526f7386ccd4506d20691c4280aaa7637b70ea32f8f06a096d1423ecca", "category": "quality", "severity": "low", "confidence": 0.86, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "A normalized source-code window appears in two different non-test files.", "evidence": {"lines": 12, "rule_id": "AIC003", "scanner": "repobility-ai-code-hygiene", "references": ["https://jscpd.dev/"], "duplicate_file": "platform/chromium/webext.js", "duplicate_line": 1, "correlation_key": "fp|f4b660526f7386ccd4506d20691c4280aaa7637b70ea32f8f06a096d1423ecca"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "platform/firefox/webext.js"}, "region": {"startLine": 1}}}]}, {"ruleId": "AIC003", "level": "note", "message": {"text": "Duplicated implementation block across source files"}, "properties": {"repobilityId": 76967, "scanner": "repobility-ai-code-hygiene", "fingerprint": "2d2101a1895a7c2a4ede9473547ba5fb80da64d51646334e34f18624ffcfb459", "category": "quality", "severity": "low", "confidence": 0.86, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "A normalized source-code window appears in two different non-test files.", "evidence": {"lines": 12, "rule_id": "AIC003", "scanner": "repobility-ai-code-hygiene", "references": ["https://jscpd.dev/"], "duplicate_file": "platform/chromium/vapi-background-ext.js", "duplicate_line": 1, "correlation_key": "fp|2d2101a1895a7c2a4ede9473547ba5fb80da64d51646334e34f18624ffcfb459"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "platform/firefox/vapi-background-ext.js"}, "region": {"startLine": 1}}}]}, {"ruleId": "AIC003", "level": "note", "message": {"text": "Duplicated implementation block across source files"}, "properties": {"repobilityId": 76966, "scanner": "repobility-ai-code-hygiene", "fingerprint": "61b3cf4e381c79782488949912092449b16144f52f7931a130a2eb808fbf2e80", "category": "quality", "severity": "low", "confidence": 0.86, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "A normalized source-code window appears in two different non-test files.", "evidence": {"lines": 12, "rule_id": "AIC003", "scanner": "repobility-ai-code-hygiene", "references": ["https://jscpd.dev/"], "duplicate_file": "platform/common/vapi-client.js", "duplicate_line": 3, "correlation_key": "fp|61b3cf4e381c79782488949912092449b16144f52f7931a130a2eb808fbf2e80"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "platform/dig/snfe.js"}, "region": {"startLine": 2}}}]}, {"ruleId": "AIC003", "level": "note", "message": {"text": "Duplicated implementation block across source files"}, "properties": {"repobilityId": 76965, "scanner": "repobility-ai-code-hygiene", "fingerprint": "8ffa4936dbbcc14f498eec9e4c92973c29d59b530c7887851b01e279714dde8e", "category": "quality", "severity": "low", "confidence": 0.86, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "A normalized source-code window appears in two different non-test files.", "evidence": {"lines": 12, "rule_id": "AIC003", "scanner": "repobility-ai-code-hygiene", "references": ["https://jscpd.dev/"], "duplicate_file": "platform/common/vapi-client.js", "duplicate_line": 4, "correlation_key": "fp|8ffa4936dbbcc14f498eec9e4c92973c29d59b530c7887851b01e279714dde8e"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "platform/common/vapi.js"}, "region": {"startLine": 3}}}]}, {"ruleId": "AIC003", "level": "note", "message": {"text": "Duplicated implementation block across source files"}, "properties": {"repobilityId": 76964, "scanner": "repobility-ai-code-hygiene", "fingerprint": "5e6552f405b9393c4b931a1b41524a33225cd8a407167db92087943cec82b92b", "category": "quality", "severity": "low", "confidence": 0.86, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "A normalized source-code window appears in two different non-test files.", "evidence": {"lines": 12, "rule_id": "AIC003", "scanner": "repobility-ai-code-hygiene", "references": ["https://jscpd.dev/"], "duplicate_file": "platform/chromium/vapi-background-ext.js", "duplicate_line": 1, "correlation_key": "fp|5e6552f405b9393c4b931a1b41524a33225cd8a407167db92087943cec82b92b"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "platform/common/vapi.js"}, "region": {"startLine": 1}}}]}, {"ruleId": "AIC003", "level": "note", "message": {"text": "Duplicated implementation block across source files"}, "properties": {"repobilityId": 76963, "scanner": "repobility-ai-code-hygiene", "fingerprint": "fe644d6e0051d3f490b9d58623ac71ccc303db722c97396d9a49a7e50c23818f", "category": "quality", "severity": "low", "confidence": 0.86, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "A normalized source-code window appears in two different non-test files.", "evidence": {"lines": 12, "rule_id": "AIC003", "scanner": "repobility-ai-code-hygiene", "references": ["https://jscpd.dev/"], "duplicate_file": "platform/common/vapi-client.js", "duplicate_line": 1, "correlation_key": "fp|fe644d6e0051d3f490b9d58623ac71ccc303db722c97396d9a49a7e50c23818f"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "platform/common/vapi-common.js"}, "region": {"startLine": 1}}}]}, {"ruleId": "AIC007", "level": "note", "message": {"text": "Generated build artifact directory is present at repository root"}, "properties": {"repobilityId": 76962, "scanner": "repobility-ai-code-hygiene", "fingerprint": "6069b1ec53cf974ec6e25b94b13d24116a19565dae3d82ce5bcc320c773215fd", "category": "quality", "severity": "low", "confidence": 0.7, "triageState": "open", "verdict": "likely", "isResolved": false, "reason": "Repository root contains a common generated artifact directory.", "evidence": {"rule_id": "AIC007", "scanner": "repobility-ai-code-hygiene", "directory": "dist", "references": ["https://git-scm.com/docs/gitignore", "https://arxiv.org/abs/2601.15195"], "correlation_key": "fp|6069b1ec53cf974ec6e25b94b13d24116a19565dae3d82ce5bcc320c773215fd"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "dist"}, "region": {"startLine": 1}}}]}, {"ruleId": "MINED055", "level": "none", "message": {"text": "[MINED055] Npm Install No Lockfile: Production image runs npm install (resolves new versions on every build) instead of npm ci."}, "properties": {"repobilityId": 77046, "scanner": "repobility-threat-engine", "fingerprint": "3365ce7e1ae974a81744ead956ba6d1f496f24e287179fcda0a1592548608b56", "category": "quality", "severity": "info", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "npm-install-no-lockfile", "owasp": "A06:2021", "cwe_ids": ["CWE-1357"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.348030+00:00", "triaged_in_corpus": 12, "observations_count": 317602, "ai_coder_pattern_id": 42}, "scanner": "repobility-threat-engine", "correlation_key": "fp|3365ce7e1ae974a81744ead956ba6d1f496f24e287179fcda0a1592548608b56"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/make-npm.sh"}, "region": {"startLine": 39}}}]}, {"ruleId": "SEC027", "level": "none", "message": {"text": "[SEC027] XML External Entity (XXE) \u2014 Node.js xml parsers (and 1 more): Same pattern found in 1 additional files. Review if needed."}, "properties": {"repobilityId": 77039, "scanner": "repobility-threat-engine", "fingerprint": "e36994aa64d72d276dc58a2181b9babaeb5f8b49a9d920f484486b634d28d0cf", "category": "xxe", "severity": "info", "confidence": 0.2, "triageState": "false_positive", "verdict": "likely_fp", "isResolved": true, "reason": "Deduplicated summary only: 1 additional occurrences found. The top occurrences remain visible as actionable findings.", "evidence": {"reason": "Deduplicated summary only: 1 additional occurrences found. The top occurrences remain visible as actionable findings.", "rule_id": "SEC027", "scanner": "repobility-threat-engine", "confidence": 0.2, "correlation_key": "fp|e36994aa64d72d276dc58a2181b9babaeb5f8b49a9d920f484486b634d28d0cf"}}}, {"ruleId": "SEC084", "level": "none", "message": {"text": "[SEC084] JS: require() with non-literal: require(<variable>) loads arbitrary modules \u2014 equivalent to eval at module scope. Ported from eslint-plugin-security detect-non-literal-require (Apache-2.0)."}, "properties": {"repobilityId": 77035, "scanner": "repobility-threat-engine", "fingerprint": "c6c6f2327a891ac6a8ff2093a63ce49d46bfcca6a0c81e624d0d23ad2e6183c9", "category": "quality", "severity": "info", "confidence": 0.1, "triageState": "false_positive", "verdict": "likely_fp", "isResolved": true, "reason": "Safe pattern '\\.json' detected on same line", "evidence": {"match": "require(`${", "reason": "Safe pattern '\\.json' detected on same line", "rule_id": "SEC084", "scanner": "repobility-threat-engine", "confidence": 0.1, "correlation_key": "fp|c6c6f2327a891ac6a8ff2093a63ce49d46bfcca6a0c81e624d0d23ad2e6183c9"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "platform/nodejs/index.js"}, "region": {"startLine": 70}}}]}, {"ruleId": "SEC083", "level": "none", "message": {"text": "[SEC083] JS: new RegExp() with non-literal (and 10 more): Same pattern found in 10 additional files. Review if needed."}, "properties": {"repobilityId": 77034, "scanner": "repobility-threat-engine", "fingerprint": "6ce850ea8e49f21db92f7fc4d528eb187f8109de9185a491fb1d9bfb5a39bb43", "category": "quality", "severity": "info", "confidence": 0.2, "triageState": "false_positive", "verdict": "likely_fp", "isResolved": true, "reason": "Deduplicated summary only: 10 additional occurrences found. The top occurrences remain visible as actionable findings.", "evidence": {"reason": "Deduplicated summary only: 10 additional occurrences found. The top occurrences remain visible as actionable findings.", "rule_id": "SEC083", "scanner": "repobility-threat-engine", "confidence": 0.2, "correlation_key": "fp|6ce850ea8e49f21db92f7fc4d528eb187f8109de9185a491fb1d9bfb5a39bb43"}}}, {"ruleId": "SEC029", "level": "none", "message": {"text": "[SEC029] Server-Side Request Forgery (SSRF) \u2014 outbound HTTP from user input (and 26 more): Same pattern found in 26 additional files. Review if needed."}, "properties": {"repobilityId": 77030, "scanner": "repobility-threat-engine", "fingerprint": "03167f5ecff39d939f08b149b84bf4446e9369cd2c6afa17da160bcd3ba6bc8d", "category": "ssrf", "severity": "info", "confidence": 0.2, "triageState": "false_positive", "verdict": "likely_fp", "isResolved": true, "reason": "Deduplicated summary only: 26 additional occurrences found. The top occurrences remain visible as actionable findings.", "evidence": {"reason": "Deduplicated summary only: 26 additional occurrences found. The top occurrences remain visible as actionable findings.", "rule_id": "SEC029", "scanner": "repobility-threat-engine", "confidence": 0.2, "correlation_key": "fp|03167f5ecff39d939f08b149b84bf4446e9369cd2c6afa17da160bcd3ba6bc8d"}}}, {"ruleId": "SEC085", "level": "none", "message": {"text": "[SEC085] JS: child_process.exec with non-literal (and 23 more): Same pattern found in 23 additional files. Review if needed."}, "properties": {"repobilityId": 77026, "scanner": "repobility-threat-engine", "fingerprint": "27ffb42f327a1b5982a8c553a44bda2677da986041c2d2ce41ad2cdb3c73665f", "category": "quality", "severity": "info", "confidence": 0.2, "triageState": "false_positive", "verdict": "likely_fp", "isResolved": true, "reason": "Deduplicated summary only: 23 additional occurrences found. The top occurrences remain visible as actionable findings.", "evidence": {"reason": "Deduplicated summary only: 23 additional occurrences found. The top occurrences remain visible as actionable findings.", "rule_id": "SEC085", "scanner": "repobility-threat-engine", "confidence": 0.2, "correlation_key": "fp|27ffb42f327a1b5982a8c553a44bda2677da986041c2d2ce41ad2cdb3c73665f"}}}, {"ruleId": "MINED098", "level": "none", "message": {"text": "[MINED098] Global Scope Pollution (and 5 more): Same pattern found in 5 additional files. Review if needed."}, "properties": {"repobilityId": 77021, "scanner": "repobility-threat-engine", "fingerprint": "d836843504e3fae6e5d7f7724208c205cb00bad4100d1636a439c245e57f7cf1", "category": "quality", "severity": "info", "confidence": 0.2, "triageState": "false_positive", "verdict": "likely_fp", "isResolved": true, "reason": "Deduplicated summary only: 5 additional occurrences found. The top occurrences remain visible as actionable findings.", "evidence": {"mined": true, "mining": {"slug": "global-scope-pollution", "owasp": null, "cwe_ids": [], "languages": ["javascript"], "precision": 1.0, "promoted_at": "2026-05-18T15:01:13.611213+00:00", "triaged_in_corpus": 12, "observations_count": 173528, "ai_coder_pattern_id": 55}, "scanner": "repobility-threat-engine", "aggregated": true, "correlation_key": "fp|d836843504e3fae6e5d7f7724208c205cb00bad4100d1636a439c245e57f7cf1", "aggregated_count": 5}}}, {"ruleId": "MINED098", "level": "none", "message": {"text": "[MINED098] Global Scope Pollution: Attaching libraries/objects directly to the global window scope (e.g., `window.axios = axios;`) makes the code harder to test and increases the risk of naming collisions."}, "properties": {"repobilityId": 77020, "scanner": "repobility-threat-engine", "fingerprint": "8f7cdad52b29a024c12f120f2d89ac6db20d378b56f36a3039636f8f67e2b64e", "category": "quality", "severity": "info", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "global-scope-pollution", "owasp": null, "cwe_ids": [], "languages": ["javascript"], "precision": 1.0, "promoted_at": "2026-05-18T15:01:13.611213+00:00", "triaged_in_corpus": 12, "observations_count": 173528, "ai_coder_pattern_id": 55}, "scanner": "repobility-threat-engine", "correlation_key": "fp|8f7cdad52b29a024c12f120f2d89ac6db20d378b56f36a3039636f8f67e2b64e"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/web_accessible_resources/google-analytics_ga.js"}, "region": {"startLine": 118}}}]}, {"ruleId": "MINED098", "level": "none", "message": {"text": "[MINED098] Global Scope Pollution: Attaching libraries/objects directly to the global window scope (e.g., `window.axios = axios;`) makes the code harder to test and increases the risk of naming collisions."}, "properties": {"repobilityId": 77019, "scanner": "repobility-threat-engine", "fingerprint": "4cd62476c719baf07d48d251f7918ccffbfe51379f06bdc84186bdea229e7375", "category": "quality", "severity": "info", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "global-scope-pollution", "owasp": null, "cwe_ids": [], "languages": ["javascript"], "precision": 1.0, "promoted_at": "2026-05-18T15:01:13.611213+00:00", "triaged_in_corpus": 12, "observations_count": 173528, "ai_coder_pattern_id": 55}, "scanner": "repobility-threat-engine", "correlation_key": "fp|4cd62476c719baf07d48d251f7918ccffbfe51379f06bdc84186bdea229e7375"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/web_accessible_resources/fingerprint3.js"}, "region": {"startLine": 44}}}]}, {"ruleId": "MINED098", "level": "none", "message": {"text": "[MINED098] Global Scope Pollution: Attaching libraries/objects directly to the global window scope (e.g., `window.axios = axios;`) makes the code harder to test and increases the risk of naming collisions."}, "properties": {"repobilityId": 77018, "scanner": "repobility-threat-engine", "fingerprint": "8ed404bb073d2b810b302d561df174c0e9bb03639b5216c3b87b67c0c01d690f", "category": "quality", "severity": "info", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "global-scope-pollution", "owasp": null, "cwe_ids": [], "languages": ["javascript"], "precision": 1.0, "promoted_at": "2026-05-18T15:01:13.611213+00:00", "triaged_in_corpus": 12, "observations_count": 173528, "ai_coder_pattern_id": 55}, "scanner": "repobility-threat-engine", "correlation_key": "fp|8ed404bb073d2b810b302d561df174c0e9bb03639b5216c3b87b67c0c01d690f"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "platform/common/vapi-client.js"}, "region": {"startLine": 221}}}]}, {"ruleId": "SEC045", "level": "none", "message": {"text": "[SEC045] eval()/exec() on stored or user-supplied data (and 26 more): Same pattern found in 26 additional files. Review if needed."}, "properties": {"repobilityId": 77016, "scanner": "repobility-threat-engine", "fingerprint": "935ca1bcfb4d5d281bd63348c3a3354eb0a4b201cfe472375901be41ecd40841", "category": "injection", "severity": "info", "confidence": 0.2, "triageState": "false_positive", "verdict": "likely_fp", "isResolved": true, "reason": "Deduplicated summary only: 26 additional occurrences found. The top occurrences remain visible as actionable findings.", "evidence": {"reason": "Deduplicated summary only: 26 additional occurrences found. The top occurrences remain visible as actionable findings.", "rule_id": "SEC045", "scanner": "repobility-threat-engine", "confidence": 0.2, "correlation_key": "fp|935ca1bcfb4d5d281bd63348c3a3354eb0a4b201cfe472375901be41ecd40841"}}}, {"ruleId": "SEC128", "level": "none", "message": {"text": "[SEC128] Async function without await \u2014 fire-and-forget Promise (AI mistake) (and 16 more): Same pattern found in 16 additional files. Review if needed."}, "properties": {"repobilityId": 77012, "scanner": "repobility-threat-engine", "fingerprint": "8e1eba7fa867ff7498b2ea9a585b6900e4d928baa557d7b985b5e1fa147dd7d6", "category": "quality", "severity": "info", "confidence": 0.2, "triageState": "false_positive", "verdict": "likely_fp", "isResolved": true, "reason": "Deduplicated summary only: 16 additional occurrences found. The top occurrences remain visible as actionable findings.", "evidence": {"reason": "Deduplicated summary only: 16 additional occurrences found. The top occurrences remain visible as actionable findings.", "rule_id": "SEC128", "scanner": "repobility-threat-engine", "confidence": 0.2, "correlation_key": "fp|8e1eba7fa867ff7498b2ea9a585b6900e4d928baa557d7b985b5e1fa147dd7d6"}}}, {"ruleId": "MINED044", "level": "none", "message": {"text": "[MINED044] Js Console Log Prod (and 11 more): Same pattern found in 11 additional files. Review if needed."}, "properties": {"repobilityId": 77008, "scanner": "repobility-threat-engine", "fingerprint": "8323284e71c0a31a05bed90ab17738fa73ec0ef9ce708f2be963d66c42fd127f", "category": "quality", "severity": "info", "confidence": 0.2, "triageState": "false_positive", "verdict": "likely_fp", "isResolved": true, "reason": "Deduplicated summary only: 11 additional occurrences found. The top occurrences remain visible as actionable findings.", "evidence": {"mined": true, "mining": {"slug": "js-console-log-prod", "owasp": null, "cwe_ids": ["CWE-532"], "languages": ["javascript", "typescript", "tsx", "jsx"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.348003+00:00", "triaged_in_corpus": 10, "observations_count": 1940833, "ai_coder_pattern_id": 102}, "scanner": "repobility-threat-engine", "aggregated": true, "correlation_key": "fp|8323284e71c0a31a05bed90ab17738fa73ec0ef9ce708f2be963d66c42fd127f", "aggregated_count": 11}}}, {"ruleId": "MINED044", "level": "none", "message": {"text": "[MINED044] Js Console Log Prod: console.log left in code. Should be replaced with logger or removed."}, "properties": {"repobilityId": 77007, "scanner": "repobility-threat-engine", "fingerprint": "e8d112e9173af24035d4d781d9e95c7794973358ce9fa22fd10b3f18dff2757b", "category": "quality", "severity": "info", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "js-console-log-prod", "owasp": null, "cwe_ids": ["CWE-532"], "languages": ["javascript", "typescript", "tsx", "jsx"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.348003+00:00", "triaged_in_corpus": 10, "observations_count": 1940833, "ai_coder_pattern_id": 102}, "scanner": "repobility-threat-engine", "correlation_key": "fp|e8d112e9173af24035d4d781d9e95c7794973358ce9fa22fd10b3f18dff2757b"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "platform/mv3/edge/patch-ruleset.js"}, "region": {"startLine": 35}}}]}, {"ruleId": "MINED044", "level": "none", "message": {"text": "[MINED044] Js Console Log Prod: console.log left in code. Should be replaced with logger or removed."}, "properties": {"repobilityId": 77006, "scanner": "repobility-threat-engine", "fingerprint": "cc6e7a1c9332ca9976fc802ff06d6a1c730e1a1e112d184037f4f80e746a0538", "category": "quality", "severity": "info", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "js-console-log-prod", "owasp": null, "cwe_ids": ["CWE-532"], "languages": ["javascript", "typescript", "tsx", "jsx"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.348003+00:00", "triaged_in_corpus": 10, "observations_count": 1940833, "ai_coder_pattern_id": 102}, "scanner": "repobility-threat-engine", "correlation_key": "fp|cc6e7a1c9332ca9976fc802ff06d6a1c730e1a1e112d184037f4f80e746a0538"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "platform/chromium/webext.js"}, "region": {"startLine": 35}}}]}, {"ruleId": "MINED044", "level": "none", "message": {"text": "[MINED044] Js Console Log Prod: console.log left in code. Should be replaced with logger or removed."}, "properties": {"repobilityId": 77005, "scanner": "repobility-threat-engine", "fingerprint": "5f6aa033262dbf42852e7c9ce875b33376b835c79598d63ea53c8014ed199052", "category": "quality", "severity": "info", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "js-console-log-prod", "owasp": null, "cwe_ids": ["CWE-532"], "languages": ["javascript", "typescript", "tsx", "jsx"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.348003+00:00", "triaged_in_corpus": 10, "observations_count": 1940833, "ai_coder_pattern_id": 102}, "scanner": "repobility-threat-engine", "correlation_key": "fp|5f6aa033262dbf42852e7c9ce875b33376b835c79598d63ea53c8014ed199052"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "platform/chromium/is-webrtc-supported.js"}, "region": {"startLine": 40}}}]}, {"ruleId": "MINED043", "level": "none", "message": {"text": "[MINED043] Http Not Https (and 176 more): Same pattern found in 176 additional files. Review if needed."}, "properties": {"repobilityId": 77004, "scanner": "repobility-threat-engine", "fingerprint": "3d53c5110d3337dddab0a18b989d596b526fca276f8d1584c8a3914fa67472fc", "category": "quality", "severity": "info", "confidence": 0.2, "triageState": "false_positive", "verdict": "likely_fp", "isResolved": true, "reason": "Deduplicated summary only: 176 additional occurrences found. The top occurrences remain visible as actionable findings.", "evidence": {"mined": true, "mining": {"slug": "http-not-https", "owasp": "A02:2021", "cwe_ids": ["CWE-319"], "precision": 0.917, "promoted_at": "2026-05-18T14:01:32.347999+00:00", "triaged_in_corpus": 12, "observations_count": 4113831, "ai_coder_pattern_id": 15}, "scanner": "repobility-threat-engine", "aggregated": true, "correlation_key": "fp|3d53c5110d3337dddab0a18b989d596b526fca276f8d1584c8a3914fa67472fc", "aggregated_count": 176}}}, {"ruleId": "MINED043", "level": "none", "message": {"text": "[MINED043] Http Not Https: Hardcoded http:// (not localhost) for endpoints that handle credentials or data."}, "properties": {"repobilityId": 77003, "scanner": "repobility-threat-engine", "fingerprint": "3c1c61d92bc40de9ddf2390445b37d091f9040b250c9eb2f68c8834b8dc5f5ac", "category": "quality", "severity": "info", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "http-not-https", "owasp": "A02:2021", "cwe_ids": ["CWE-319"], "precision": 0.917, "promoted_at": "2026-05-18T14:01:32.347999+00:00", "triaged_in_corpus": 12, "observations_count": 4113831, "ai_coder_pattern_id": 15}, "scanner": "repobility-threat-engine", "correlation_key": "fp|3c1c61d92bc40de9ddf2390445b37d091f9040b250c9eb2f68c8834b8dc5f5ac"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "platform/chromium/webext.js"}, "region": {"startLine": 17}}}]}, {"ruleId": "MINED043", "level": "none", "message": {"text": "[MINED043] Http Not Https: Hardcoded http:// (not localhost) for endpoints that handle credentials or data."}, "properties": {"repobilityId": 77002, "scanner": "repobility-threat-engine", "fingerprint": "49ec84dd9898bd1ae766215c98810bb76c584a4796d982843854ade5c6467627", "category": "quality", "severity": "info", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "http-not-https", "owasp": "A02:2021", "cwe_ids": ["CWE-319"], "precision": 0.917, "promoted_at": "2026-05-18T14:01:32.347999+00:00", "triaged_in_corpus": 12, "observations_count": 4113831, "ai_coder_pattern_id": 15}, "scanner": "repobility-threat-engine", "correlation_key": "fp|49ec84dd9898bd1ae766215c98810bb76c584a4796d982843854ade5c6467627"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "platform/chromium/vapi-background-ext.js"}, "region": {"startLine": 17}}}]}, {"ruleId": "MINED043", "level": "none", "message": {"text": "[MINED043] Http Not Https: Hardcoded http:// (not localhost) for endpoints that handle credentials or data."}, "properties": {"repobilityId": 77001, "scanner": "repobility-threat-engine", "fingerprint": "ec6744d40940e00260eb6e88736a39fc31194c28234ae6553681b1f9e9645f1a", "category": "quality", "severity": "info", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "http-not-https", "owasp": "A02:2021", "cwe_ids": ["CWE-319"], "precision": 0.917, "promoted_at": "2026-05-18T14:01:32.347999+00:00", "triaged_in_corpus": 12, "observations_count": 4113831, "ai_coder_pattern_id": 15}, "scanner": "repobility-threat-engine", "correlation_key": "fp|ec6744d40940e00260eb6e88736a39fc31194c28234ae6553681b1f9e9645f1a"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "platform/chromium/is-webrtc-supported.js"}, "region": {"startLine": 17}}}]}, {"ruleId": "GHSA-7r86-cg39-jmmj", "level": "error", "message": {"text": "minimatch: GHSA-7r86-cg39-jmmj"}, "properties": {"repobilityId": 77061, "scanner": "osv-scanner", "fingerprint": "eefef250e5a6e239df447b5946f207cdb0dd68151255b2332fb8ba8f476755c1", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["CVE-2026-27903"], "package": "minimatch", "rule_id": "GHSA-7r86-cg39-jmmj", "scanner": "osv-scanner", "correlation_key": "vuln|minimatch|CVE-2026-27903|package-lock.json"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "GHSA-3ppc-4f35-3m26", "level": "error", "message": {"text": "minimatch: GHSA-3ppc-4f35-3m26"}, "properties": {"repobilityId": 77060, "scanner": "osv-scanner", "fingerprint": "51db4fe99f02113d5057e54849a1514660f72202efa765a619a8195e282ff31f", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["CVE-2026-26996"], "package": "minimatch", "rule_id": "GHSA-3ppc-4f35-3m26", "scanner": "osv-scanner", "correlation_key": "vuln|minimatch|CVE-2026-26996|package-lock.json"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "GHSA-23c5-xmqv-rm74", "level": "error", "message": {"text": "minimatch: GHSA-23c5-xmqv-rm74"}, "properties": {"repobilityId": 77059, "scanner": "osv-scanner", "fingerprint": "f4f398661d95064420cba5942b7bc163815b09d09751c05f0247afa0ed407b54", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["CVE-2026-27904"], "package": "minimatch", "rule_id": "GHSA-23c5-xmqv-rm74", "scanner": "osv-scanner", "correlation_key": "vuln|minimatch|CVE-2026-27904|package-lock.json"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "GHSA-rf6f-7fwh-wjgh", "level": "error", "message": {"text": "flatted: GHSA-rf6f-7fwh-wjgh"}, "properties": {"repobilityId": 77057, "scanner": "osv-scanner", "fingerprint": "12f8c13a1500c4e201cd19c15c7415ed765defb1c8c79e0887745cf5d0c7caba", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["CVE-2026-33228"], "package": "flatted", "rule_id": "GHSA-rf6f-7fwh-wjgh", "scanner": "osv-scanner", "correlation_key": "vuln|flatted|CVE-2026-33228|package-lock.json"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "GHSA-25h7-pfq9-p65f", "level": "error", "message": {"text": "flatted: GHSA-25h7-pfq9-p65f"}, "properties": {"repobilityId": 77056, "scanner": "osv-scanner", "fingerprint": "b797beca07deb64b07234792c672e8b741104617529fbd9314dd615ac2f0d51d", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["CVE-2026-32141"], "package": "flatted", "rule_id": "GHSA-25h7-pfq9-p65f", "scanner": "osv-scanner", "correlation_key": "vuln|flatted|CVE-2026-32141|package-lock.json"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "SEC103", "level": "error", "message": {"text": "[SEC103] LDAP injection \u2014 non-constant search filter: User input concatenated into an LDAP search filter. Attackers inject `*)(uid=*` style payloads to bypass auth or enumerate accounts."}, "properties": {"repobilityId": 77045, "scanner": "repobility-threat-engine", "fingerprint": "8a97171ac6f0baaa7e4aac9ad2a5b5f724c368d3e62fd82bfe89f097ec5e6a62", "category": "injection", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": ".search(r'^(\\d+\\.\\d+\\.\\d+)", "reason": "Pattern matched with no mitigating context found", "rule_id": "SEC103", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "code|injection|tools/make-firefox-meta.py|24|sec103"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/make-firefox-meta.py"}, "region": {"startLine": 24}}}]}, {"ruleId": "SEC040", "level": "error", "message": {"text": "[SEC040] innerHTML XSS \u2014 template literal with server-supplied data: Setting .innerHTML with a template literal that interpolates server-supplied or user-supplied data is the canonical stored/reflected XSS vector. The browser parses the HTML and executes any <script> or event-handler attributes in the data. CWE-79. Especially dangerous when the data comes from a CV parser, profile field, or any user-input pipeline."}, "properties": {"repobilityId": 77040, "scanner": "repobility-threat-engine", "fingerprint": "e9cf45ef837867fbcd6f53259a9326893234fbad2abe7bd01d4918b3bc12b525", "category": "xss", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": "reduce((acc, item) => `(${acc}\\\\.)?${item}", "reason": "Pattern matched with no mitigating context found", "rule_id": "SEC040", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "fp|e9cf45ef837867fbcd6f53259a9326893234fbad2abe7bd01d4918b3bc12b525"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/js/reverselookup-worker.js"}, "region": {"startLine": 132}}}]}, {"ruleId": "SEC027", "level": "error", "message": {"text": "[SEC027] XML External Entity (XXE) \u2014 Node.js xml parsers: Node.js XML parsers can expand external entities if not configured. libxmljs in particular has had XXE CVEs."}, "properties": {"repobilityId": 77038, "scanner": "repobility-threat-engine", "fingerprint": "51d713204aa3556a5600e8734c26eebc6554c5792269a03526c80f0a3d4eb5aa", "category": "xxe", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": "new DOMParser()", "reason": "Pattern matched with no mitigating context found", "rule_id": "SEC027", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "fp|51d713204aa3556a5600e8734c26eebc6554c5792269a03526c80f0a3d4eb5aa"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/js/resources/prevent-xhr.js"}, "region": {"startLine": 106}}}]}, {"ruleId": "SEC027", "level": "error", "message": {"text": "[SEC027] XML External Entity (XXE) \u2014 Node.js xml parsers: Node.js XML parsers can expand external entities if not configured. libxmljs in particular has had XXE CVEs."}, "properties": {"repobilityId": 77037, "scanner": "repobility-threat-engine", "fingerprint": "60852fb3d9524510f23d3004af152184da905810345e3c9b0fc83dd6189451c6", "category": "xxe", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": "new DOMParser()", "reason": "Pattern matched with no mitigating context found", "rule_id": "SEC027", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "fp|60852fb3d9524510f23d3004af152184da905810345e3c9b0fc83dd6189451c6"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/js/resources/create-html.js"}, "region": {"startLine": 72}}}]}, {"ruleId": "SEC027", "level": "error", "message": {"text": "[SEC027] XML External Entity (XXE) \u2014 Node.js xml parsers: Node.js XML parsers can expand external entities if not configured. libxmljs in particular has had XXE CVEs."}, "properties": {"repobilityId": 77036, "scanner": "repobility-threat-engine", "fingerprint": "0f6643952f06ba5f1f096d6448a3e86455e2dd8276b66222359b77d4dd517a38", "category": "xxe", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": "new DOMParser()", "reason": "Pattern matched with no mitigating context found", "rule_id": "SEC027", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "fp|0f6643952f06ba5f1f096d6448a3e86455e2dd8276b66222359b77d4dd517a38"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/js/cloud-ui.js"}, "region": {"startLine": 195}}}]}, {"ruleId": "SEC083", "level": "error", "message": {"text": "[SEC083] JS: new RegExp() with non-literal: new RegExp(<variable>) \u2014 variable input can craft a ReDoS pattern. Ported from eslint-plugin-security detect-non-literal-regexp (Apache-2.0)."}, "properties": {"repobilityId": 77033, "scanner": "repobility-threat-engine", "fingerprint": "0b5e0aef5be72c237544f93bbdca8b7915cf6f6c2f748c088ebbd2602078f856", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": "new RegExp($scriptletFromRegexes$", "reason": "Pattern matched with no mitigating context found", "rule_id": "SEC083", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "fp|0b5e0aef5be72c237544f93bbdca8b7915cf6f6c2f748c088ebbd2602078f856"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "platform/mv3/extension/js/offscreen/scriptlet.template.js"}, "region": {"startLine": 158}}}]}, {"ruleId": "SEC083", "level": "error", "message": {"text": "[SEC083] JS: new RegExp() with non-literal: new RegExp(<variable>) \u2014 variable input can craft a ReDoS pattern. Ported from eslint-plugin-security detect-non-literal-regexp (Apache-2.0)."}, "properties": {"repobilityId": 77032, "scanner": "repobility-threat-engine", "fingerprint": "bbf197d985d90bdb1762a856babe318cee466c3e830c1968494f44fc778d5b65", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": "new RegExp(pattern", "reason": "Pattern matched with no mitigating context found", "rule_id": "SEC083", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "fp|bbf197d985d90bdb1762a856babe318cee466c3e830c1968494f44fc778d5b65"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "platform/mv3/extension/js/offscreen/safe-replace.js"}, "region": {"startLine": 24}}}]}, {"ruleId": "SEC083", "level": "error", "message": {"text": "[SEC083] JS: new RegExp() with non-literal: new RegExp(<variable>) \u2014 variable input can craft a ReDoS pattern. Ported from eslint-plugin-security detect-non-literal-regexp (Apache-2.0)."}, "properties": {"repobilityId": 77031, "scanner": "repobility-threat-engine", "fingerprint": "e38e185e4828d8877bc4c6f6229f32a58ed987c5252550b7aadbf65c44a63df2", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": "new RegExp(regexes", "reason": "Pattern matched with no mitigating context found", "rule_id": "SEC083", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "fp|e38e185e4828d8877bc4c6f6229f32a58ed987c5252550b7aadbf65c44a63df2"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "platform/mv3/extension/js/offscreen/css-sandbox.template.js"}, "region": {"startLine": 73}}}]}, {"ruleId": "SEC029", "level": "error", "message": {"text": "[SEC029] Server-Side Request Forgery (SSRF) \u2014 outbound HTTP from user input: Outbound HTTP request to a user-controlled URL without allowlist validation. Attackers can probe internal services (169.254.169.254 metadata, internal Kubernetes endpoints, file:// URIs), exfiltrate data, or pivot through your network. SSRF is OWASP A10:2021 and a frequent foothold in cloud breaches."}, "properties": {"repobilityId": 77029, "scanner": "repobility-threat-engine", "fingerprint": "23fe1bc76f79559a1bb695f0c34be01425de1badc9c72b10a035ade108643c60", "category": "ssrf", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": "URL(r", "reason": "Pattern matched with no mitigating context found", "rule_id": "SEC029", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "fp|23fe1bc76f79559a1bb695f0c34be01425de1badc9c72b10a035ade108643c60"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "platform/mv3/extension/js/popup.js"}, "region": {"startLine": 31}}}]}, {"ruleId": "SEC029", "level": "error", "message": {"text": "[SEC029] Server-Side Request Forgery (SSRF) \u2014 outbound HTTP from user input: Outbound HTTP request to a user-controlled URL without allowlist validation. Attackers can probe internal services (169.254.169.254 metadata, internal Kubernetes endpoints, file:// URIs), exfiltrate data, or pivot through your network. SSRF is OWASP A10:2021 and a frequent foothold in cloud breaches."}, "properties": {"repobilityId": 77028, "scanner": "repobility-threat-engine", "fingerprint": "96d2f041602824aaa269861bee75c5ab33ecbe76e498556fa911142f5fc3efa2", "category": "ssrf", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": "URL(d", "reason": "Pattern matched with no mitigating context found", "rule_id": "SEC029", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "fp|96d2f041602824aaa269861bee75c5ab33ecbe76e498556fa911142f5fc3efa2"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "platform/mv3/extension/js/matched-rules.js"}, "region": {"startLine": 27}}}]}, {"ruleId": "SEC029", "level": "error", "message": {"text": "[SEC029] Server-Side Request Forgery (SSRF) \u2014 outbound HTTP from user input: Outbound HTTP request to a user-controlled URL without allowlist validation. Attackers can probe internal services (169.254.169.254 metadata, internal Kubernetes endpoints, file:// URIs), exfiltrate data, or pivot through your network. SSRF is OWASP A10:2021 and a frequent foothold in cloud breaches."}, "properties": {"repobilityId": 77027, "scanner": "repobility-threat-engine", "fingerprint": "ee31866cc78747b1712559aaf3286d2fdd729cee4acd35937201383cb39bcbcc", "category": "ssrf", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": "URL(u", "reason": "Pattern matched with no mitigating context found", "rule_id": "SEC029", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "fp|ee31866cc78747b1712559aaf3286d2fdd729cee4acd35937201383cb39bcbcc"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "platform/mv3/extension/js/ext-utils.js"}, "region": {"startLine": 42}}}]}, {"ruleId": "SEC085", "level": "error", "message": {"text": "[SEC085] JS: child_process.exec with non-literal: child_process.exec with user-derived input enables command injection. Ported from eslint-plugin-security detect-child-process (Apache-2.0)."}, "properties": {"repobilityId": 77025, "scanner": "repobility-threat-engine", "fingerprint": "4fd41b46ecb34db3d8838a5ccf7c2ef0a05e7117ee2261ab157dfe2dae892287", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": "exec(out", "reason": "Pattern matched with no mitigating context found", "rule_id": "SEC085", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "fp|4fd41b46ecb34db3d8838a5ccf7c2ef0a05e7117ee2261ab157dfe2dae892287"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "platform/mv3/extension/js/offscreen/safe-replace.js"}, "region": {"startLine": 28}}}]}, {"ruleId": "SEC085", "level": "error", "message": {"text": "[SEC085] JS: child_process.exec with non-literal: child_process.exec with user-derived input enables command injection. Ported from eslint-plugin-security detect-child-process (Apache-2.0)."}, "properties": {"repobilityId": 77024, "scanner": "repobility-threat-engine", "fingerprint": "68dcac73948be9cb90aebf18b4c05eb045c11c34accfeda000c73ddb505c1ca7", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": "exec(line", "reason": "Pattern matched with no mitigating context found", "rule_id": "SEC085", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "fp|68dcac73948be9cb90aebf18b4c05eb045c11c34accfeda000c73ddb505c1ca7"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "platform/mv3/extension/js/mode-parser.js"}, "region": {"startLine": 111}}}]}, {"ruleId": "SEC085", "level": "error", "message": {"text": "[SEC085] JS: child_process.exec with non-literal: child_process.exec with user-derived input enables command injection. Ported from eslint-plugin-security detect-child-process (Apache-2.0)."}, "properties": {"repobilityId": 77023, "scanner": "repobility-threat-engine", "fingerprint": "876f08a0c881f3147131f5b3ad06eb582e6f0478bf78d1a8224bfffce93644a2", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": "exec(ua", "reason": "Pattern matched with no mitigating context found", "rule_id": "SEC085", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "fp|876f08a0c881f3147131f5b3ad06eb582e6f0478bf78d1a8224bfffce93644a2"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "platform/common/vapi-common.js"}, "region": {"startLine": 191}}}]}, {"ruleId": "SEC128", "level": "error", "message": {"text": "[SEC128] Async function without await \u2014 fire-and-forget Promise (AI mistake): Async call invoked without `await` returns an unhandled Promise. The outer function resolves before the inner work completes \u2014 DB writes lost, emails not sent, race conditions. This is one of the top-3 errors AI coders make: they understand async-shape but drop the await keyword when chaining multiple ops. Surfaces as flaky tests or silently dropped data in production."}, "properties": {"repobilityId": 77011, "scanner": "repobility-threat-engine", "fingerprint": "676f0ab7c65d8b590ad074b49288875b1d8c4fd201d9f7b9f4c4e2a0a35238bf", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": "adminRulesets.delete('-default');", "reason": "Pattern matched with no mitigating context found", "rule_id": "SEC128", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "fp|676f0ab7c65d8b590ad074b49288875b1d8c4fd201d9f7b9f4c4e2a0a35238bf"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "platform/mv3/extension/js/admin.js"}, "region": {"startLine": 164}}}]}, {"ruleId": "SEC128", "level": "error", "message": {"text": "[SEC128] Async function without await \u2014 fire-and-forget Promise (AI mistake): Async call invoked without `await` returns an unhandled Promise. The outer function resolves before the inner work completes \u2014 DB writes lost, emails not sent, race conditions. This is one of the top-3 errors AI coders make: they understand async-shape but drop the await keyword when chaining multiple ops. Surfaces as flaky tests or silently dropped data in production."}, "properties": {"repobilityId": 77010, "scanner": "repobility-threat-engine", "fingerprint": "b8cda6eb732e0f44f09e2828bc5902abed2d59e66160451b51901823480db2fb", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": "this.pending.delete(details.msgId);", "reason": "Pattern matched with no mitigating context found", "rule_id": "SEC128", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "fp|b8cda6eb732e0f44f09e2828bc5902abed2d59e66160451b51901823480db2fb"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "platform/common/vapi-client.js"}, "region": {"startLine": 118}}}]}, {"ruleId": "SEC128", "level": "error", "message": {"text": "[SEC128] Async function without await \u2014 fire-and-forget Promise (AI mistake): Async call invoked without `await` returns an unhandled Promise. The outer function resolves before the inner work completes \u2014 DB writes lost, emails not sent, race conditions. This is one of the top-3 errors AI coders make: they understand async-shape but drop the await keyword when chaining multiple ops. Surfaces as flaky tests or silently dropped data in production."}, "properties": {"repobilityId": 77009, "scanner": "repobility-threat-engine", "fingerprint": "1053c43ba73c3ef3706cca008b3442da8491dd6aea1929253b620abbc5a7b6d3", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": "this.tabIds.delete(details.tabId);", "reason": "Pattern matched with no mitigating context found", "rule_id": "SEC128", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "fp|1053c43ba73c3ef3706cca008b3442da8491dd6aea1929253b620abbc5a7b6d3"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "platform/chromium/vapi-background-ext.js"}, "region": {"startLine": 49}}}]}, {"ruleId": "MINED115", "level": "error", "message": {"text": "Action `softprops/action-gh-release` pinned to mutable ref `@v2`"}, "properties": {"repobilityId": 76995, "scanner": "repobility-supply-chain", "fingerprint": "47d3c4c54d2a1707c1ab15f6e4964140ef37d3f6b2259c268bcc66fb8f910377", "category": "dependency", "severity": "high", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "gha-mutable-ref", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|47d3c4c54d2a1707c1ab15f6e4964140ef37d3f6b2259c268bcc66fb8f910377"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/main.yml"}, "region": {"startLine": 39}}}]}, {"ruleId": "MINED115", "level": "error", "message": {"text": "Action `actions/checkout` pinned to mutable ref `@v4`"}, "properties": {"repobilityId": 76994, "scanner": "repobility-supply-chain", "fingerprint": "012b9ca036cf3402d38f3839d3a60640616534f3f894a91204417f81a50358e6", "category": "dependency", "severity": "high", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "gha-mutable-ref", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|012b9ca036cf3402d38f3839d3a60640616534f3f894a91204417f81a50358e6"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/main.yml"}, "region": {"startLine": 19}}}]}, {"ruleId": "MINED122", "level": "error", "message": {"text": "package.json dep `scaling-palm-tree` pulled from URL/Git"}, "properties": {"repobilityId": 76993, "scanner": "repobility-supply-chain", "fingerprint": "ba14c013a7b54bae7fdebd37e4cc0f070848a25b37097a6ee587cf4b908e92f2", "category": "dependency", "severity": "high", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "npm-dep-git-or-tarball-url", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["javascript"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|ba14c013a7b54bae7fdebd37e4cc0f070848a25b37097a6ee587cf4b908e92f2"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "platform/dig/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "generic-api-key", "level": "error", "message": {"text": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations."}, "properties": {"repobilityId": 77053, "scanner": "gitleaks", "fingerprint": "9b4cd852415c99780f479f33a04fe282ea009bc53fd2121b105212f6467cdbb9", "category": "credential_exposure", "severity": "critical", "confidence": 0.95, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "us-east-1.profile-api.ads.linkedin.com',\n'REDACTED'", "rule_id": "generic-api-key", "scanner": "gitleaks", "detector": "generic-api-key", "correlation_key": "secret|docs/tests/hostname-pool.js|3793|token redacted"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docs/tests/hostname-pool.js"}, "region": {"startLine": 37939}}}]}, {"ruleId": "generic-api-key", "level": "error", "message": {"text": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations."}, "properties": {"repobilityId": 77052, "scanner": "gitleaks", "fingerprint": "3daf5648b45270e39db10f11f6eb2d8b3a669ed4d242ce592b8d9df2908777cf", "category": "credential_exposure", "severity": "critical", "confidence": 0.95, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "ma728-r.analytics.edgekey.net',\n'REDACTED'", "rule_id": "generic-api-key", "scanner": "gitleaks", "detector": "generic-api-key", "correlation_key": "secret|docs/tests/hostname-pool.js|3105|token redacted"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docs/tests/hostname-pool.js"}, "region": {"startLine": 31053}}}]}, {"ruleId": "generic-api-key", "level": "error", "message": {"text": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations."}, "properties": {"repobilityId": 77051, "scanner": "gitleaks", "fingerprint": "f8ab1600d9c5d072b089585ff4e446b8007ff80a4fcc5aae9b936226f4dc2061", "category": "credential_exposure", "severity": "critical", "confidence": 0.95, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "ad0.api.ero-advertising.com',\n'REDACTED'", "rule_id": "generic-api-key", "scanner": "gitleaks", "detector": "generic-api-key", "correlation_key": "secret|docs/tests/hostname-pool.js|1465|ad0.api.ero-advertising.com redacted"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docs/tests/hostname-pool.js"}, "region": {"startLine": 14653}}}]}, {"ruleId": "generic-api-key", "level": "error", "message": {"text": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations."}, "properties": {"repobilityId": 77050, "scanner": "gitleaks", "fingerprint": "4e863d91f8caac088bc166fa8a267ca6da381b46384d1bc220567272a52cd5f0", "category": "credential_exposure", "severity": "critical", "confidence": 0.95, "triageState": "open", "verdict": "", "isResolved": false, "reason": "Collapsed 1 duplicate scanner signal(s) for the same underlying issue.", "evidence": {"match": "7202.bapi.adsafeprotected.com',\n'REDACTED'", "rule_id": "generic-api-key", "scanner": "gitleaks", "detector": "generic-api-key", "correlation_key": "secret|docs/tests/hostname-pool.js|121|token redacted", "duplicate_count": 1, "duplicate_rule_ids": ["generic-api-key"], "duplicate_scanners": ["gitleaks"], "duplicate_fingerprints": ["4e863d91f8caac088bc166fa8a267ca6da381b46384d1bc220567272a52cd5f0", "7ad8ccfa2ddb86960fe2afb943a4599b4fefe45819fc0db37445b578e4ac38b3"]}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docs/tests/hostname-pool.js"}, "region": {"startLine": 1217}}}]}, {"ruleId": "generic-api-key", "level": "error", "message": {"text": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations."}, "properties": {"repobilityId": 77049, "scanner": "gitleaks", "fingerprint": "58d645043132e00d92c284c7299c9e67dde10eb0086d0897555d15ffdff1e9ce", "category": "credential_exposure", "severity": "critical", "confidence": 0.95, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "707.bapi.adsafeprotected.com',\n'REDACTED'", "rule_id": "generic-api-key", "scanner": "gitleaks", "detector": "generic-api-key", "correlation_key": "secret|docs/tests/hostname-pool.js|120|token redacted"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docs/tests/hostname-pool.js"}, "region": {"startLine": 1209}}}]}, {"ruleId": "generic-api-key", "level": "error", "message": {"text": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations."}, "properties": {"repobilityId": 77048, "scanner": "gitleaks", "fingerprint": "897fbbc36a749cd260c9c2ea61d89dceb7e1e86fcd7b8dedb18ff66df316a5a8", "category": "credential_exposure", "severity": "critical", "confidence": 0.95, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "623.bapi.adsafeprotected.com',\n'REDACTED'", "rule_id": "generic-api-key", "scanner": "gitleaks", "detector": "generic-api-key", "correlation_key": "secret|docs/tests/hostname-pool.js|115|token redacted"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docs/tests/hostname-pool.js"}, "region": {"startLine": 1152}}}]}, {"ruleId": "generic-api-key", "level": "error", "message": {"text": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations."}, "properties": {"repobilityId": 77047, "scanner": "gitleaks", "fingerprint": "03bcfad84c1af6af8fda2e434d3ff3caafb6435d45a6ddfacdb9ac77c4bd0321", "category": "credential_exposure", "severity": "critical", "confidence": 0.95, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "6058.bapi.adsafeprotected.com',\n'REDACTED'", "rule_id": "generic-api-key", "scanner": "gitleaks", "detector": "generic-api-key", "correlation_key": "secret|docs/tests/hostname-pool.js|114|token redacted"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docs/tests/hostname-pool.js"}, "region": {"startLine": 1145}}}]}]}]}