{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-e41ae8bfc08efaf7", "name": "Icon-only button without accessible name \u2014 js/schedule.js:1124", "shortDescription": {"text": "Icon-only button without accessible name \u2014 js/schedule.js:1124"}, "fullDescription": {"text": "A `<button>` whose only child is a single glyph or symbol needs `title=` or `aria-label=` so screen readers (and tooltips on hover) work.\n\nWhy: P3 in CHECKLIST.md \u2014 icon-only buttons skipped a title.\nRule id: fq.button.no-label"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f91df792e9b1e234", "name": "Stray `console.log` in TS/JS \u2014 agents/mcp/src/index.ts:19", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 agents/mcp/src/index.ts:19"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9710c8d059e53154", "name": "No frontend routes/components detected", "shortDescription": {"text": "No frontend routes/components detected"}, "fullDescription": {"text": "No React/Vue/Next routes were found. This is fine for backend-only repos."}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-a415f777e464bc08", "name": "Insecure pattern 'document_write' in js/instructors.js:1164", "shortDescription": {"text": "Insecure pattern 'document_write' in js/instructors.js:1164"}, "fullDescription": {"text": "Found a known-risky pattern (document_write). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2b2306c41852f999", "name": "Insecure pattern 'document_write' in js/dashboard.js:853", "shortDescription": {"text": "Insecure pattern 'document_write' in js/dashboard.js:853"}, "fullDescription": {"text": "Found a known-risky pattern (document_write). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ca9a17dc17a4ffbb", "name": "Insecure pattern 'document_write' in js/coverage.js:92", "shortDescription": {"text": "Insecure pattern 'document_write' in js/coverage.js:92"}, "fullDescription": {"text": "Found a known-risky pattern (document_write). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-61e60714b926f740", "name": "Insecure pattern 'document_write' in js/reports.js:129", "shortDescription": {"text": "Insecure pattern 'document_write' in js/reports.js:129"}, "fullDescription": {"text": "Found a known-risky pattern (document_write). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b6074db75ac96ad4", "name": "Insecure pattern 'local_storage_auth_token' in js/app.js:61", "shortDescription": {"text": "Insecure pattern 'local_storage_auth_token' in js/app.js:61"}, "fullDescription": {"text": "Found a known-risky pattern (local_storage_auth_token). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6855823c26e1198f", "name": "Insecure pattern 'document_write' in js/schedule.js:1343", "shortDescription": {"text": "Insecure pattern 'document_write' in js/schedule.js:1343"}, "fullDescription": {"text": "Found a known-risky pattern (document_write). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-388876379699a8ae", "name": "Insecure pattern 'document_write' in js/poolbatch.js:197", "shortDescription": {"text": "Insecure pattern 'document_write' in js/poolbatch.js:197"}, "fullDescription": {"text": "Found a known-risky pattern (document_write). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-242c8dfec54667af", "name": "Possible secret in js/constants.js", "shortDescription": {"text": "Possible secret in js/constants.js"}, "fullDescription": {"text": "Detected pattern matching password_literal. Rotate the credential and move to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-c7e521d5f09cfed0", "name": "Insecure pattern 'cors_wildcard' in supabase/functions/login/index.ts:27", "shortDescription": {"text": "Insecure pattern 'cors_wildcard' in supabase/functions/login/index.ts:27"}, "fullDescription": {"text": "Found a known-risky pattern (cors_wildcard). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7efbda965f283c17", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-43e1a2b018ae1ef8", "name": "Very large file: js/instructors.js (1418 lines)", "shortDescription": {"text": "Very large file: js/instructors.js (1418 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-42d25bee4a66cfda", "name": "Very large file: js/admin.js (885 lines)", "shortDescription": {"text": "Very large file: js/admin.js (885 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8a631646a7cd5215", "name": "Very large file: js/ai.js (1198 lines)", "shortDescription": {"text": "Very large file: js/ai.js (1198 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-48c5fa2a11d80256", "name": "Very large file: js/dashboard.js (1563 lines)", "shortDescription": {"text": "Very large file: js/dashboard.js (1563 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fd9322fbf272ee24", "name": "Very large file: js/coverage.js (1046 lines)", "shortDescription": {"text": "Very large file: js/coverage.js (1046 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f9cfa2ce55ab441f", "name": "Very large file: js/reports.js (3082 lines)", "shortDescription": {"text": "Very large file: js/reports.js (3082 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5c9a0c4d0fd35173", "name": "Very large file: js/config.js (1570 lines)", "shortDescription": {"text": "Very large file: js/config.js (1570 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b58db71507cb148d", "name": "Very large file: js/app.js (886 lines)", "shortDescription": {"text": "Very large file: js/app.js (886 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c169a33138a5b2f9", "name": "Very large file: js/communication.js (981 lines)", "shortDescription": {"text": "Very large file: js/communication.js (981 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d746def67d588de5", "name": "Very large file: js/instructor.js (1065 lines)", "shortDescription": {"text": "Very large file: js/instructor.js (1065 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-60b630fc8347cab7", "name": "Very large file: js/schedule.js (2321 lines)", "shortDescription": {"text": "Very large file: js/schedule.js (2321 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-dc47dccd94b5b849", "name": "Very large file: js/trainings.js (1203 lines)", "shortDescription": {"text": "Very large file: js/trainings.js (1203 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b412abce48a9ab49", "name": "Very large file: js/poolbatch.js (1190 lines)", "shortDescription": {"text": "Very large file: js/poolbatch.js (1190 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ea3b5e389d8c9c0f", "name": "Low test-to-source ratio", "shortDescription": {"text": "Low test-to-source ratio"}, "fullDescription": {"text": "4 tests / 37 src (ratio 0.11)."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-141b30a41e03817b", "name": "No license file detected", "shortDescription": {"text": "No license file detected"}, "fullDescription": {"text": "No LICENSE/COPYING/NOTICE file was found. Generated repositories often omit licensing, which blocks reuse and automated intake."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-faccb9061e9b52a0", "name": "No README detected", "shortDescription": {"text": "No README detected"}, "fullDescription": {"text": "No README file was found. Generated repos without README context are hard to operate, validate, or safely hand off."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 30 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-72b2a6250083a784", "name": "Placeholder or mock-heavy implementation detected", "shortDescription": {"text": "Placeholder or mock-heavy implementation detected"}, "fullDescription": {"text": "Found 115 placeholder/mock markers across 16 source files. This often means the repo looks complete while core flows still use generated scaffolding or fake data."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b9088664ace7f748", "name": "Composite production-readiness gap", "shortDescription": {"text": "Composite production-readiness gap"}, "fullDescription": {"text": "Multiple low-cost hardening controls are missing together: license, operator-readme. Opus verification showed these co-occurring gaps are a better readiness signal than reading each flag in isolation."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-9eb743b23b41af05", "name": "Commented-code block (6 lines) in sw.js:1", "shortDescription": {"text": "Commented-code block (6 lines) in sw.js:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-e0e5fa0089564289", "name": "`fetch()` without try/.catch or AbortSignal \u2014 sw.js:89", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 sw.js:89"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0f2b4f15b29a33c2", "name": "Commented-code block (6 lines) in build.mjs:7", "shortDescription": {"text": "Commented-code block (6 lines) in build.mjs:7"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-66a38c1a2acafe3a", "name": "Commented-code block (5 lines) in tests/schedule.test.js:99", "shortDescription": {"text": "Commented-code block (5 lines) in tests/schedule.test.js:99"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-c712437b5fb6153a", "name": "Commented-code block (5 lines) in js/core.cjs:22", "shortDescription": {"text": "Commented-code block (5 lines) in js/core.cjs:22"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-81ca3b2b091cdb9c", "name": "Commented-code block (10 lines) in js/ai.js:1", "shortDescription": {"text": "Commented-code block (10 lines) in js/ai.js:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-eb5824f2c7c9795b", "name": "Commented-code block (5 lines) in js/dashboard.js:374", "shortDescription": {"text": "Commented-code block (5 lines) in js/dashboard.js:374"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-fca0b816aa8c2a1d", "name": "Commented-code block (6 lines) in js/auth.js:60", "shortDescription": {"text": "Commented-code block (6 lines) in js/auth.js:60"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-692cf6bbb5111127", "name": "Commented-code block (6 lines) in js/logic.js:68", "shortDescription": {"text": "Commented-code block (6 lines) in js/logic.js:68"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-86cf78d79cd30147", "name": "Commented-code block (7 lines) in js/config.js:14", "shortDescription": {"text": "Commented-code block (7 lines) in js/config.js:14"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-a962835c6eef2585", "name": "Commented-code block (6 lines) in js/offshore.js:1", "shortDescription": {"text": "Commented-code block (6 lines) in js/offshore.js:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-e97a8f9a24b0cb92", "name": "Commented-code block (8 lines) in js/app.js:24", "shortDescription": {"text": "Commented-code block (8 lines) in js/app.js:24"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-d604fd860acb9e80", "name": "Commented-code block (5 lines) in js/instructor.js:379", "shortDescription": {"text": "Commented-code block (5 lines) in js/instructor.js:379"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-732b6fbbff86f25b", "name": "Commented-code block (5 lines) in js/schedule.js:65", "shortDescription": {"text": "Commented-code block (5 lines) in js/schedule.js:65"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-0da967a9bd8e6d61", "name": "Commented-code block (5 lines) in js/trainings.js:109", "shortDescription": {"text": "Commented-code block (5 lines) in js/trainings.js:109"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-10d0d1e34d768315", "name": "Commented-code block (10 lines) in js/poolbatch.js:1", "shortDescription": {"text": "Commented-code block (10 lines) in js/poolbatch.js:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-7883068c6442c50c", "name": "Commented-code block (6 lines) in js/constants.js:1", "shortDescription": {"text": "Commented-code block (6 lines) in js/constants.js:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-83b507dbfc729220", "name": "Commented-code block (5 lines) in agents/mcp/scripts/run-batch.mjs:23", "shortDescription": {"text": "Commented-code block (5 lines) in agents/mcp/scripts/run-batch.mjs:23"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-af70d4fcec7231b8", "name": "Commented-code block (6 lines) in agents/mcp/src/mcpHandler.ts:89", "shortDescription": {"text": "Commented-code block (6 lines) in agents/mcp/src/mcpHandler.ts:89"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-896441a2c668115c", "name": "Commented-code block (6 lines) in agents/mcp/src/planner.ts:132", "shortDescription": {"text": "Commented-code block (6 lines) in agents/mcp/src/planner.ts:132"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-f586045c4fa6dc1a", "name": "Commented-code block (8 lines) in agents/mcp/src/types.ts:1", "shortDescription": {"text": "Commented-code block (8 lines) in agents/mcp/src/types.ts:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/18009"}, "properties": {"repository": "relyon360mfrc/relyon360", "repoUrl": "https://github.com/relyon360mfrc/relyon360", "branch": "main"}, "results": [{"ruleId": "scanner-e41ae8bfc08efaf7", "level": "note", "message": {"text": "Icon-only button without accessible name \u2014 js/schedule.js:1124"}, "properties": {"repobilityId": "8a758d1769603de2", "scanner": "scanner-primary", "fingerprint": "e41ae8bfc08efaf7", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.button.no-label"]}}, {"ruleId": "scanner-f91df792e9b1e234", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 agents/mcp/src/index.ts:19"}, "properties": {"repobilityId": "7b704807eee6c2a1", "scanner": "scanner-primary", "fingerprint": "f91df792e9b1e234", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-9710c8d059e53154", "level": "none", "message": {"text": "No frontend routes/components detected"}, "properties": {"repobilityId": "44ca61485762e494", "scanner": "scanner-primary", "fingerprint": "9710c8d059e53154", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-a415f777e464bc08", "level": "note", "message": {"text": "Insecure pattern 'document_write' in js/instructors.js:1164"}, "properties": {"repobilityId": "fc533f8ddd017a02", "scanner": "scanner-primary", "fingerprint": "a415f777e464bc08", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["owasp", "document_write"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "js/instructors.js"}, "region": {"startLine": 1164}}}]}, {"ruleId": "scanner-2b2306c41852f999", "level": "note", "message": {"text": "Insecure pattern 'document_write' in js/dashboard.js:853"}, "properties": {"repobilityId": "41ef9b067fc07cfb", "scanner": "scanner-primary", "fingerprint": "2b2306c41852f999", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["owasp", "document_write"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "js/dashboard.js"}, "region": {"startLine": 853}}}]}, {"ruleId": "scanner-ca9a17dc17a4ffbb", "level": "note", "message": {"text": "Insecure pattern 'document_write' in js/coverage.js:92"}, "properties": {"repobilityId": "128b59923b12ed0c", "scanner": "scanner-primary", "fingerprint": "ca9a17dc17a4ffbb", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["owasp", "document_write"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "js/coverage.js"}, "region": {"startLine": 92}}}]}, {"ruleId": "scanner-61e60714b926f740", "level": "note", "message": {"text": "Insecure pattern 'document_write' in js/reports.js:129"}, "properties": {"repobilityId": "834849dfbf0108dd", "scanner": "scanner-primary", "fingerprint": "61e60714b926f740", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["owasp", "document_write"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "js/reports.js"}, "region": {"startLine": 129}}}]}, {"ruleId": "scanner-b6074db75ac96ad4", "level": "warning", "message": {"text": "Insecure pattern 'local_storage_auth_token' in js/app.js:61"}, "properties": {"repobilityId": "72445ac0428135a0", "scanner": "scanner-primary", "fingerprint": "b6074db75ac96ad4", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "local_storage_auth_token"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "js/app.js"}, "region": {"startLine": 61}}}]}, {"ruleId": "scanner-6855823c26e1198f", "level": "note", "message": {"text": "Insecure pattern 'document_write' in js/schedule.js:1343"}, "properties": {"repobilityId": "1fcff34e2bfb7373", "scanner": "scanner-primary", "fingerprint": "6855823c26e1198f", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["owasp", "document_write"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "js/schedule.js"}, "region": {"startLine": 1343}}}]}, {"ruleId": "scanner-388876379699a8ae", "level": "note", "message": {"text": "Insecure pattern 'document_write' in js/poolbatch.js:197"}, "properties": {"repobilityId": "b7cb827d236e959d", "scanner": "scanner-primary", "fingerprint": "388876379699a8ae", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["owasp", "document_write"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "js/poolbatch.js"}, "region": {"startLine": 197}}}]}, {"ruleId": "scanner-242c8dfec54667af", "level": "error", "message": {"text": "Possible secret in js/constants.js"}, "properties": {"repobilityId": "81b74e00276adde9", "scanner": "scanner-primary", "fingerprint": "242c8dfec54667af", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "js/constants.js"}, "region": {"startLine": 10}}}]}, {"ruleId": "scanner-c7e521d5f09cfed0", "level": "warning", "message": {"text": "Insecure pattern 'cors_wildcard' in supabase/functions/login/index.ts:27"}, "properties": {"repobilityId": "2d76b11ef793d692", "scanner": "scanner-primary", "fingerprint": "c7e521d5f09cfed0", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "cors_wildcard"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "supabase/functions/login/index.ts"}, "region": {"startLine": 27}}}]}, {"ruleId": "scanner-7efbda965f283c17", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "56929525eac9a554", "scanner": "scanner-primary", "fingerprint": "7efbda965f283c17", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/test.yml"}, "region": {"startLine": 21}}}]}, {"ruleId": "scanner-7efbda965f283c17", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "edb2bb8632e63196", "scanner": "scanner-primary", "fingerprint": "7efbda965f283c17", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/test.yml"}, "region": {"startLine": 24}}}]}, {"ruleId": "scanner-43e1a2b018ae1ef8", "level": "note", "message": {"text": "Very large file: js/instructors.js (1418 lines)"}, "properties": {"repobilityId": "6186b0d74b86df42", "scanner": "scanner-primary", "fingerprint": "43e1a2b018ae1ef8", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-42d25bee4a66cfda", "level": "note", "message": {"text": "Very large file: js/admin.js (885 lines)"}, "properties": {"repobilityId": "9fdcc953197b99ed", "scanner": "scanner-primary", "fingerprint": "42d25bee4a66cfda", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-8a631646a7cd5215", "level": "note", "message": {"text": "Very large file: js/ai.js (1198 lines)"}, "properties": {"repobilityId": "b0a0a6d38ee3f6fb", "scanner": "scanner-primary", "fingerprint": "8a631646a7cd5215", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-48c5fa2a11d80256", "level": "note", "message": {"text": "Very large file: js/dashboard.js (1563 lines)"}, "properties": {"repobilityId": "444be2b65276d912", "scanner": "scanner-primary", "fingerprint": "48c5fa2a11d80256", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-fd9322fbf272ee24", "level": "note", "message": {"text": "Very large file: js/coverage.js (1046 lines)"}, "properties": {"repobilityId": "580ed57852c480bc", "scanner": "scanner-primary", "fingerprint": "fd9322fbf272ee24", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-f9cfa2ce55ab441f", "level": "note", "message": {"text": "Very large file: js/reports.js (3082 lines)"}, "properties": {"repobilityId": "b041ceeb5f667cf2", "scanner": "scanner-primary", "fingerprint": "f9cfa2ce55ab441f", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-5c9a0c4d0fd35173", "level": "note", "message": {"text": "Very large file: js/config.js (1570 lines)"}, "properties": {"repobilityId": "fb77e27fbf7fd87a", "scanner": "scanner-primary", "fingerprint": "5c9a0c4d0fd35173", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-b58db71507cb148d", "level": "note", "message": {"text": "Very large file: js/app.js (886 lines)"}, "properties": {"repobilityId": "c38eec27975b7a83", "scanner": "scanner-primary", "fingerprint": "b58db71507cb148d", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-c169a33138a5b2f9", "level": "note", "message": {"text": "Very large file: js/communication.js (981 lines)"}, "properties": {"repobilityId": "39fbb3179ea985f5", "scanner": "scanner-primary", "fingerprint": "c169a33138a5b2f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-d746def67d588de5", "level": "note", "message": {"text": "Very large file: js/instructor.js (1065 lines)"}, "properties": {"repobilityId": "e025f72ab089a999", "scanner": "scanner-primary", "fingerprint": "d746def67d588de5", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-60b630fc8347cab7", "level": "note", "message": {"text": "Very large file: js/schedule.js (2321 lines)"}, "properties": {"repobilityId": "5b6123d1e9d0147d", "scanner": "scanner-primary", "fingerprint": "60b630fc8347cab7", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-dc47dccd94b5b849", "level": "note", "message": {"text": "Very large file: js/trainings.js (1203 lines)"}, "properties": {"repobilityId": "aa6b8cc4e614b802", "scanner": "scanner-primary", "fingerprint": "dc47dccd94b5b849", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-b412abce48a9ab49", "level": "note", "message": {"text": "Very large file: js/poolbatch.js (1190 lines)"}, "properties": {"repobilityId": "a9957237657fa134", "scanner": "scanner-primary", "fingerprint": "b412abce48a9ab49", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-ea3b5e389d8c9c0f", "level": "note", "message": {"text": "Low test-to-source ratio"}, "properties": {"repobilityId": "ef7b2552cc00a375", "scanner": "scanner-primary", "fingerprint": "ea3b5e389d8c9c0f", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["tests"]}}, {"ruleId": "scanner-141b30a41e03817b", "level": "note", "message": {"text": "No license file detected"}, "properties": {"repobilityId": "7a3cc75995a916b4", "scanner": "scanner-primary", "fingerprint": "141b30a41e03817b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["license", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-faccb9061e9b52a0", "level": "note", "message": {"text": "No README detected"}, "properties": {"repobilityId": "6f919341bfd846a1", "scanner": "scanner-primary", "fingerprint": "faccb9061e9b52a0", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["docs", "readme", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "aa447047068e1dbe", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-72b2a6250083a784", "level": "warning", "message": {"text": "Placeholder or mock-heavy implementation detected"}, "properties": {"repobilityId": "47afe05fd8d7df6f", "scanner": "scanner-primary", "fingerprint": "72b2a6250083a784", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "incomplete", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "9615208600ad00bd", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-b9088664ace7f748", "level": "note", "message": {"text": "Composite production-readiness gap"}, "properties": {"repobilityId": "2ea8f3f00d9fdf23", "scanner": "scanner-primary", "fingerprint": "b9088664ace7f748", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["production-readiness", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "f75adb6acc52a9dc", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "09985bfd34b70f7e", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-9eb743b23b41af05", "level": "none", "message": {"text": "Commented-code block (6 lines) in sw.js:1"}, "properties": {"repobilityId": "d051e88f2cdf12ce", "scanner": "scanner-primary", "fingerprint": "9eb743b23b41af05", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-e0e5fa0089564289", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 sw.js:89"}, "properties": {"repobilityId": "83d5c30a4d0359ca", "scanner": "scanner-primary", "fingerprint": "e0e5fa0089564289", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-0f2b4f15b29a33c2", "level": "none", "message": {"text": "Commented-code block (6 lines) in build.mjs:7"}, "properties": {"repobilityId": "c86079b4114a1123", "scanner": "scanner-primary", "fingerprint": "0f2b4f15b29a33c2", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-66a38c1a2acafe3a", "level": "none", "message": {"text": "Commented-code block (5 lines) in tests/schedule.test.js:99"}, "properties": {"repobilityId": "7f22f66a0c150b29", "scanner": "scanner-primary", "fingerprint": "66a38c1a2acafe3a", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-c712437b5fb6153a", "level": "none", "message": {"text": "Commented-code block (5 lines) in js/core.cjs:22"}, "properties": {"repobilityId": "9959154de7d19150", "scanner": "scanner-primary", "fingerprint": "c712437b5fb6153a", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-81ca3b2b091cdb9c", "level": "none", "message": {"text": "Commented-code block (10 lines) in js/ai.js:1"}, "properties": {"repobilityId": "3722d1154606203f", "scanner": "scanner-primary", "fingerprint": "81ca3b2b091cdb9c", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-eb5824f2c7c9795b", "level": "none", "message": {"text": "Commented-code block (5 lines) in js/dashboard.js:374"}, "properties": {"repobilityId": "b4ad9cbcd0b6d214", "scanner": "scanner-primary", "fingerprint": "eb5824f2c7c9795b", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-fca0b816aa8c2a1d", "level": "none", "message": {"text": "Commented-code block (6 lines) in js/auth.js:60"}, "properties": {"repobilityId": "18aba15f330165de", "scanner": "scanner-primary", "fingerprint": "fca0b816aa8c2a1d", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-692cf6bbb5111127", "level": "none", "message": {"text": "Commented-code block (6 lines) in js/logic.js:68"}, "properties": {"repobilityId": "cfe1907cd1efc251", "scanner": "scanner-primary", "fingerprint": "692cf6bbb5111127", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-86cf78d79cd30147", "level": "none", "message": {"text": "Commented-code block (7 lines) in js/config.js:14"}, "properties": {"repobilityId": "154595d0938ee801", "scanner": "scanner-primary", "fingerprint": "86cf78d79cd30147", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-a962835c6eef2585", "level": "none", "message": {"text": "Commented-code block (6 lines) in js/offshore.js:1"}, "properties": {"repobilityId": "b39fd001cf5e4357", "scanner": "scanner-primary", "fingerprint": "a962835c6eef2585", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-e97a8f9a24b0cb92", "level": "none", "message": {"text": "Commented-code block (8 lines) in js/app.js:24"}, "properties": {"repobilityId": "60b422c2f4d0e542", "scanner": "scanner-primary", "fingerprint": "e97a8f9a24b0cb92", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-d604fd860acb9e80", "level": "none", "message": {"text": "Commented-code block (5 lines) in js/instructor.js:379"}, "properties": {"repobilityId": "4116289c289a0265", "scanner": "scanner-primary", "fingerprint": "d604fd860acb9e80", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-732b6fbbff86f25b", "level": "none", "message": {"text": "Commented-code block (5 lines) in js/schedule.js:65"}, "properties": {"repobilityId": "61a6ac2a03ddb70b", "scanner": "scanner-primary", "fingerprint": "732b6fbbff86f25b", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-0da967a9bd8e6d61", "level": "none", "message": {"text": "Commented-code block (5 lines) in js/trainings.js:109"}, "properties": {"repobilityId": "ac834ea13eba6040", "scanner": "scanner-primary", "fingerprint": "0da967a9bd8e6d61", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-10d0d1e34d768315", "level": "none", "message": {"text": "Commented-code block (10 lines) in js/poolbatch.js:1"}, "properties": {"repobilityId": "52b51c09c3a335e7", "scanner": "scanner-primary", "fingerprint": "10d0d1e34d768315", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-7883068c6442c50c", "level": "none", "message": {"text": "Commented-code block (6 lines) in js/constants.js:1"}, "properties": {"repobilityId": "fb8120245cabfde5", "scanner": "scanner-primary", "fingerprint": "7883068c6442c50c", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-83b507dbfc729220", "level": "none", "message": {"text": "Commented-code block (5 lines) in agents/mcp/scripts/run-batch.mjs:23"}, "properties": {"repobilityId": "44d921b5c21a301f", "scanner": "scanner-primary", "fingerprint": "83b507dbfc729220", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-af70d4fcec7231b8", "level": "none", "message": {"text": "Commented-code block (6 lines) in agents/mcp/src/mcpHandler.ts:89"}, "properties": {"repobilityId": "8f128db5f7c4398c", "scanner": "scanner-primary", "fingerprint": "af70d4fcec7231b8", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-896441a2c668115c", "level": "none", "message": {"text": "Commented-code block (6 lines) in agents/mcp/src/planner.ts:132"}, "properties": {"repobilityId": "2d80e94f8cc37b09", "scanner": "scanner-primary", "fingerprint": "896441a2c668115c", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-f586045c4fa6dc1a", "level": "none", "message": {"text": "Commented-code block (8 lines) in agents/mcp/src/types.ts:1"}, "properties": {"repobilityId": "f1236d8a670aeb15", "scanner": "scanner-primary", "fingerprint": "f586045c4fa6dc1a", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}]}]}