{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-38b7246a17279f2c", "name": "Stray `console.log` in TS/JS \u2014 src/cli.ts:74", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 src/cli.ts:74"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3c8710366a9951ee", "name": "Stray `console.log` in TS/JS \u2014 src/config.ts:170", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 src/config.ts:170"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a18e4a8ea10f60a6", "name": "Stray `console.log` in TS/JS \u2014 src/commands/logs.ts:32", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 src/commands/logs.ts:32"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-989f4e6e980cda64", "name": "Stray `console.log` in TS/JS \u2014 src/commands/prompts.ts:21", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 src/commands/prompts.ts:21"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ef7cc22ecde04bf9", "name": "Stray `console.log` in TS/JS \u2014 src/commands/attach.ts:75", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 src/commands/attach.ts:75"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-960769f36317d095", "name": "Stray `console.log` in TS/JS \u2014 src/commands/sessions.ts:29", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 src/commands/sessions.ts:29"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-627d020b3b08be28", "name": "Stray `console.log` in TS/JS \u2014 src/commands/watch.ts:40", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 src/commands/watch.ts:40"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-87946a4372e4312b", "name": "Possible secret in tests/skillsAuditRules.test.ts", "shortDescription": {"text": "Possible secret in tests/skillsAuditRules.test.ts"}, "fullDescription": {"text": "Detected pattern matching openai_or_anthropic_key. Rotate the credential and move to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-41a6dbf503a4bc15", "name": "Insecure pattern 'node_child_process' in src/codexDriver.ts:1", "shortDescription": {"text": "Insecure pattern 'node_child_process' in src/codexDriver.ts:1"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3c508ff3d0276222", "name": "Insecure pattern 'exec_used' in src/agents/deploy.ts:41", "shortDescription": {"text": "Insecure pattern 'exec_used' in src/agents/deploy.ts:41"}, "fullDescription": {"text": "Found a known-risky pattern (exec_used). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-ac9d1d8235b9d313", "name": "Insecure pattern 'node_child_process' in src/agents/deploy.ts:1", "shortDescription": {"text": "Insecure pattern 'node_child_process' in src/agents/deploy.ts:1"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d53094a09ad39f3b", "name": "Insecure pattern 'exec_used' in src/tools/executor.ts:33", "shortDescription": {"text": "Insecure pattern 'exec_used' in src/tools/executor.ts:33"}, "fullDescription": {"text": "Found a known-risky pattern (exec_used). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-407a6257c65ff221", "name": "Insecure pattern 'node_child_process' in src/tools/executor.ts:1", "shortDescription": {"text": "Insecure pattern 'node_child_process' in src/tools/executor.ts:1"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2bd9de2d035bf289", "name": "Insecure pattern 'node_child_process' in src/commands/attach.ts:3", "shortDescription": {"text": "Insecure pattern 'node_child_process' in src/commands/attach.ts:3"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-bbf8bde89ce387fd", "name": "Insecure pattern 'node_child_process' in src/skills/cli.ts:1", "shortDescription": {"text": "Insecure pattern 'node_child_process' in src/skills/cli.ts:1"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-46c644c6227e4d4a", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1838a141491ce38c", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7efbda965f283c17", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/setup-node@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 47 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/25306"}, "properties": {"repository": "Ddundee/forge", "repoUrl": "https://github.com/Ddundee/forge", "branch": "main"}, "results": [{"ruleId": "scanner-38b7246a17279f2c", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 src/cli.ts:74"}, "properties": {"repobilityId": "435b83b5315abc65", "scanner": "scanner-primary", "fingerprint": "38b7246a17279f2c", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-3c8710366a9951ee", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 src/config.ts:170"}, "properties": {"repobilityId": "7402aee6675cc335", "scanner": "scanner-primary", "fingerprint": "3c8710366a9951ee", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-a18e4a8ea10f60a6", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 src/commands/logs.ts:32"}, "properties": {"repobilityId": "925ab754f9be344a", "scanner": "scanner-primary", "fingerprint": "a18e4a8ea10f60a6", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-989f4e6e980cda64", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 src/commands/prompts.ts:21"}, "properties": {"repobilityId": "e088d3e50f8cf807", "scanner": "scanner-primary", "fingerprint": "989f4e6e980cda64", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-ef7cc22ecde04bf9", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 src/commands/attach.ts:75"}, "properties": {"repobilityId": "8a99225ddddd1dd2", "scanner": "scanner-primary", "fingerprint": "ef7cc22ecde04bf9", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-960769f36317d095", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 src/commands/sessions.ts:29"}, "properties": {"repobilityId": "44c3e7afe4224d8a", "scanner": "scanner-primary", "fingerprint": "960769f36317d095", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-627d020b3b08be28", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 src/commands/watch.ts:40"}, "properties": {"repobilityId": "71336f3c87e12bd3", "scanner": "scanner-primary", "fingerprint": "627d020b3b08be28", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-87946a4372e4312b", "level": "error", "message": {"text": "Possible secret in tests/skillsAuditRules.test.ts"}, "properties": {"repobilityId": "93b4b2634e39d377", "scanner": "scanner-primary", "fingerprint": "87946a4372e4312b", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/skillsAuditRules.test.ts"}, "region": {"startLine": 96}}}]}, {"ruleId": "scanner-41a6dbf503a4bc15", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in src/codexDriver.ts:1"}, "properties": {"repobilityId": "1763915407343c53", "scanner": "scanner-primary", "fingerprint": "41a6dbf503a4bc15", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/codexDriver.ts"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3c508ff3d0276222", "level": "error", "message": {"text": "Insecure pattern 'exec_used' in src/agents/deploy.ts:41"}, "properties": {"repobilityId": "c01cd2e35a601c0c", "scanner": "scanner-primary", "fingerprint": "3c508ff3d0276222", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "exec_used"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/agents/deploy.ts"}, "region": {"startLine": 41}}}]}, {"ruleId": "scanner-ac9d1d8235b9d313", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in src/agents/deploy.ts:1"}, "properties": {"repobilityId": "a9778e7bc3c5da9d", "scanner": "scanner-primary", "fingerprint": "ac9d1d8235b9d313", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/agents/deploy.ts"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d53094a09ad39f3b", "level": "error", "message": {"text": "Insecure pattern 'exec_used' in src/tools/executor.ts:33"}, "properties": {"repobilityId": "3fa44bf98156b317", "scanner": "scanner-primary", "fingerprint": "d53094a09ad39f3b", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "exec_used"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/tools/executor.ts"}, "region": {"startLine": 33}}}]}, {"ruleId": "scanner-407a6257c65ff221", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in src/tools/executor.ts:1"}, "properties": {"repobilityId": "0c00e3ffc93b759b", "scanner": "scanner-primary", "fingerprint": "407a6257c65ff221", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/tools/executor.ts"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-2bd9de2d035bf289", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in src/commands/attach.ts:3"}, "properties": {"repobilityId": "0d6071d3f1f8d003", "scanner": "scanner-primary", "fingerprint": "2bd9de2d035bf289", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/commands/attach.ts"}, "region": {"startLine": 3}}}]}, {"ruleId": "scanner-bbf8bde89ce387fd", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in src/skills/cli.ts:1"}, "properties": {"repobilityId": "4b338d0564d6d12a", "scanner": "scanner-primary", "fingerprint": "bbf8bde89ce387fd", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/skills/cli.ts"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "2644034c718fb80d", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 16}}}]}, {"ruleId": "scanner-1838a141491ce38c", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "b8fd4f5048f96576", "scanner": "scanner-primary", "fingerprint": "1838a141491ce38c", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-7efbda965f283c17", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "edb2bb8632e63196", "scanner": "scanner-primary", "fingerprint": "7efbda965f283c17", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/test.yml"}, "region": {"startLine": 16}}}]}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "5649ebc1b09c0a24", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}]}]}