{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-db7d7970f13fa01e", "name": "Insecure pattern 'vue_v_html' in src/components/TextValue.vue:9", "shortDescription": {"text": "Insecure pattern 'vue_v_html' in src/components/TextValue.vue:9"}, "fullDescription": {"text": "Found a known-risky pattern (vue_v_html). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-fe0f861694a6592a", "name": "Insecure pattern 'vue_v_html' in src/components/TermCard.vue:77", "shortDescription": {"text": "Insecure pattern 'vue_v_html' in src/components/TermCard.vue:77"}, "fullDescription": {"text": "Found a known-risky pattern (vue_v_html). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3ce8e4843212b768", "name": "Insecure pattern 'vue_v_html' in src/components/LatexSpan.vue:2", "shortDescription": {"text": "Insecure pattern 'vue_v_html' in src/components/LatexSpan.vue:2"}, "fullDescription": {"text": "Found a known-risky pattern (vue_v_html). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6af5f2bd5b9754be", "name": "Insecure pattern 'vue_v_html' in src/components/ObjectCard.vue:75", "shortDescription": {"text": "Insecure pattern 'vue_v_html' in src/components/ObjectCard.vue:75"}, "fullDescription": {"text": "Found a known-risky pattern (vue_v_html). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6372cebde0220094", "name": "No auth library detected", "shortDescription": {"text": "No auth library detected"}, "fullDescription": {"text": "The scanner did not find any standard auth library (JWT, OAuth, NextAuth, Auth0, etc.). The repo has auth/admin/session surface indicators, so auth may live in custom code, in a separate service, or be missing."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4601e3ad3bb28677", "name": "No CI/CD pipelines detected", "shortDescription": {"text": "No CI/CD pipelines detected"}, "fullDescription": {"text": "No GitHub Actions, GitLab CI, or CircleCI configs found. Without CI you can't gate deploys on tests/lints."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6893a6c8b0861585", "name": "Very low test-to-source ratio", "shortDescription": {"text": "Very low test-to-source ratio"}, "fullDescription": {"text": "0 test file(s) for 25 source file(s) (ratio 0.00). Consider adding integration or unit tests for critical paths."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b9088664ace7f748", "name": "Composite production-readiness gap", "shortDescription": {"text": "Composite production-readiness gap"}, "fullDescription": {"text": "Multiple low-cost hardening controls are missing together: ci, tests. Opus verification showed these co-occurring gaps are a better readiness signal than reading each flag in isolation."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-18e3662a297c94ac", "name": "Commented-code block (14 lines) in src/stores/dictionary.js:35", "shortDescription": {"text": "Commented-code block (14 lines) in src/stores/dictionary.js:35"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-8cd6d977e8587c5f", "name": "Commented-code block (10 lines) in src/i18n/ui-strings.js:3", "shortDescription": {"text": "Commented-code block (10 lines) in src/i18n/ui-strings.js:3"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-7ddc88b3ea1f16a3", "name": "Commented-code block (7 lines) in src/composables/useScrollPosition.js:9", "shortDescription": {"text": "Commented-code block (7 lines) in src/composables/useScrollPosition.js:9"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-c44c4f4d345676d3", "name": "Commented-code block (5 lines) in src/composables/useLang.js:9", "shortDescription": {"text": "Commented-code block (5 lines) in src/composables/useLang.js:9"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-763ea610bc3bbec9", "name": "Commented-code block (6 lines) in src/composables/useDisplayPreset.js:3", "shortDescription": {"text": "Commented-code block (6 lines) in src/composables/useDisplayPreset.js:3"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-f78da160f39c9e5d", "name": "Commented-code block (5 lines) in src/composables/useUiText.js:6", "shortDescription": {"text": "Commented-code block (5 lines) in src/composables/useUiText.js:6"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-6ce188dde19d5c93", "name": "Commented-code block (5 lines) in src/composables/useDataChunkViewer.js:10", "shortDescription": {"text": "Commented-code block (5 lines) in src/composables/useDataChunkViewer.js:10"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-41b1cddf89221e9a", "name": "Commented-code block (6 lines) in src/composables/useEffectiveZone.js:7", "shortDescription": {"text": "Commented-code block (6 lines) in src/composables/useEffectiveZone.js:7"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-566b1dbcd29a9fdb", "name": "Commented-code block (6 lines) in src/utils/buildKeyedRows.js:17", "shortDescription": {"text": "Commented-code block (6 lines) in src/utils/buildKeyedRows.js:17"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-fd0fed0ef817fe72", "name": "Commented-code block (7 lines) in src/utils/buildObjectsRows.js:8", "shortDescription": {"text": "Commented-code block (7 lines) in src/utils/buildObjectsRows.js:8"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-4b0d585de552d0e2", "name": "Commented-code block (5 lines) in src/utils/displayModes.js:8", "shortDescription": {"text": "Commented-code block (5 lines) in src/utils/displayModes.js:8"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-e080b372a85c6eb7", "name": "Commented-code block (6 lines) in src/utils/customRenderers.js:3", "shortDescription": {"text": "Commented-code block (6 lines) in src/utils/customRenderers.js:3"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-fe5b6468931d068b", "name": "Commented-code block (6 lines) in src/utils/buildDictRows.js:11", "shortDescription": {"text": "Commented-code block (6 lines) in src/utils/buildDictRows.js:11"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-59d8889309d104c7", "name": "Commented-code block (5 lines) in src/utils/timeFormat.js:3", "shortDescription": {"text": "Commented-code block (5 lines) in src/utils/timeFormat.js:3"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-2eafc3188c36bb02", "name": "3 env vars used in code but missing from .env.example", "shortDescription": {"text": "3 env vars used in code but missing from .env.example"}, "fullDescription": {"text": "Drift between code and config docs. The first few: `SERVER`, `VUE_ROUTER_BASE`, `VUE_ROUTER_MODE`. Add them (with a placeholder/comment) to .env.example so onboarding doesn't break."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-b8526f47210e42dd", "name": "Unused endpoint: POST /term/bulk", "shortDescription": {"text": "Unused endpoint: POST /term/bulk"}, "fullDescription": {"text": "`src/stores/dictionary.js` declares `POST /term/bulk` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/19798"}, "properties": {"repository": "skofic/metadata-store-interface", "repoUrl": "https://github.com/skofic/metadata-store-interface", "branch": "main"}, "results": [{"ruleId": "scanner-db7d7970f13fa01e", "level": "warning", "message": {"text": "Insecure pattern 'vue_v_html' in src/components/TextValue.vue:9"}, "properties": {"repobilityId": "f531544bd8b040b3", "scanner": "scanner-primary", "fingerprint": "db7d7970f13fa01e", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "vue_v_html"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/components/TextValue.vue"}, "region": {"startLine": 9}}}]}, {"ruleId": "scanner-fe0f861694a6592a", "level": "warning", "message": {"text": "Insecure pattern 'vue_v_html' in src/components/TermCard.vue:77"}, "properties": {"repobilityId": "2bf6570b865a6221", "scanner": "scanner-primary", "fingerprint": "fe0f861694a6592a", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "vue_v_html"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/components/TermCard.vue"}, "region": {"startLine": 77}}}]}, {"ruleId": "scanner-3ce8e4843212b768", "level": "warning", "message": {"text": "Insecure pattern 'vue_v_html' in src/components/LatexSpan.vue:2"}, "properties": {"repobilityId": "8d82e0bfe80475fd", "scanner": "scanner-primary", "fingerprint": "3ce8e4843212b768", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "vue_v_html"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/components/LatexSpan.vue"}, "region": {"startLine": 2}}}]}, {"ruleId": "scanner-6af5f2bd5b9754be", "level": "warning", "message": {"text": "Insecure pattern 'vue_v_html' in src/components/ObjectCard.vue:75"}, "properties": {"repobilityId": "73b3ce1b91b9adda", "scanner": "scanner-primary", "fingerprint": "6af5f2bd5b9754be", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "vue_v_html"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/components/ObjectCard.vue"}, "region": {"startLine": 75}}}]}, {"ruleId": "scanner-6372cebde0220094", "level": "warning", "message": {"text": "No auth library detected"}, "properties": {"repobilityId": "a5b6035a5bbf8054", "scanner": "scanner-primary", "fingerprint": "6372cebde0220094", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["coverage", "auth"]}}, {"ruleId": "scanner-4601e3ad3bb28677", "level": "warning", "message": {"text": "No CI/CD pipelines detected"}, "properties": {"repobilityId": "c3ee439bce2bc51e", "scanner": "scanner-primary", "fingerprint": "4601e3ad3bb28677", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-6893a6c8b0861585", "level": "warning", "message": {"text": "Very low test-to-source ratio"}, "properties": {"repobilityId": "54a7de3f06314bf0", "scanner": "scanner-primary", "fingerprint": "6893a6c8b0861585", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["tests", "coverage"]}}, {"ruleId": "scanner-b9088664ace7f748", "level": "note", "message": {"text": "Composite production-readiness gap"}, "properties": {"repobilityId": "8088c72ed654ff25", "scanner": "scanner-primary", "fingerprint": "b9088664ace7f748", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["production-readiness", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "c8fdcd2cb7c09f0c", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "87b3d17da61debb3", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-18e3662a297c94ac", "level": "none", "message": {"text": "Commented-code block (14 lines) in src/stores/dictionary.js:35"}, "properties": {"repobilityId": "6c15f211ec297804", "scanner": "scanner-primary", "fingerprint": "18e3662a297c94ac", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-8cd6d977e8587c5f", "level": "none", "message": {"text": "Commented-code block (10 lines) in src/i18n/ui-strings.js:3"}, "properties": {"repobilityId": "039d8608125fbe39", "scanner": "scanner-primary", "fingerprint": "8cd6d977e8587c5f", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-7ddc88b3ea1f16a3", "level": "none", "message": {"text": "Commented-code block (7 lines) in src/composables/useScrollPosition.js:9"}, "properties": {"repobilityId": "3b072448e1946056", "scanner": "scanner-primary", "fingerprint": "7ddc88b3ea1f16a3", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-c44c4f4d345676d3", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/composables/useLang.js:9"}, "properties": {"repobilityId": "f45628cd9ee9a4b6", "scanner": "scanner-primary", "fingerprint": "c44c4f4d345676d3", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-763ea610bc3bbec9", "level": "none", "message": {"text": "Commented-code block (6 lines) in src/composables/useDisplayPreset.js:3"}, "properties": {"repobilityId": "64ff9044dd9dad71", "scanner": "scanner-primary", "fingerprint": "763ea610bc3bbec9", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-f78da160f39c9e5d", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/composables/useUiText.js:6"}, "properties": {"repobilityId": "c492958529570015", "scanner": "scanner-primary", "fingerprint": "f78da160f39c9e5d", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-6ce188dde19d5c93", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/composables/useDataChunkViewer.js:10"}, "properties": {"repobilityId": "cb86b7c651f4db6c", "scanner": "scanner-primary", "fingerprint": "6ce188dde19d5c93", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-41b1cddf89221e9a", "level": "none", "message": {"text": "Commented-code block (6 lines) in src/composables/useEffectiveZone.js:7"}, "properties": {"repobilityId": "0ded95ab51f892e8", "scanner": "scanner-primary", "fingerprint": "41b1cddf89221e9a", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-566b1dbcd29a9fdb", "level": "none", "message": {"text": "Commented-code block (6 lines) in src/utils/buildKeyedRows.js:17"}, "properties": {"repobilityId": "8f2fbbe4e0610cdd", "scanner": "scanner-primary", "fingerprint": "566b1dbcd29a9fdb", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-fd0fed0ef817fe72", "level": "none", "message": {"text": "Commented-code block (7 lines) in src/utils/buildObjectsRows.js:8"}, "properties": {"repobilityId": "b0ee67214c059223", "scanner": "scanner-primary", "fingerprint": "fd0fed0ef817fe72", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-4b0d585de552d0e2", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/utils/displayModes.js:8"}, "properties": {"repobilityId": "18b8e45ef989323d", "scanner": "scanner-primary", "fingerprint": "4b0d585de552d0e2", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-e080b372a85c6eb7", "level": "none", "message": {"text": "Commented-code block (6 lines) in src/utils/customRenderers.js:3"}, "properties": {"repobilityId": "4404a974af00ed17", "scanner": "scanner-primary", "fingerprint": "e080b372a85c6eb7", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-fe5b6468931d068b", "level": "none", "message": {"text": "Commented-code block (6 lines) in src/utils/buildDictRows.js:11"}, "properties": {"repobilityId": "d1ac56a31ebad876", "scanner": "scanner-primary", "fingerprint": "fe5b6468931d068b", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-59d8889309d104c7", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/utils/timeFormat.js:3"}, "properties": {"repobilityId": "9f74e5b9a0ca43e0", "scanner": "scanner-primary", "fingerprint": "59d8889309d104c7", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-2eafc3188c36bb02", "level": "none", "message": {"text": "3 env vars used in code but missing from .env.example"}, "properties": {"repobilityId": "bd934ba112b02ffa", "scanner": "scanner-primary", "fingerprint": "2eafc3188c36bb02", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "config-drift"]}}, {"ruleId": "scanner-b8526f47210e42dd", "level": "note", "message": {"text": "Unused endpoint: POST /term/bulk"}, "properties": {"repobilityId": "0de0543b8aec8f88", "scanner": "scanner-primary", "fingerprint": "b8526f47210e42dd", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}]}]}