{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-d74c4193d436ff48", "name": "Stray `console.log` in TS/JS \u2014 server.js:320", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 server.js:320"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7667f9164f668ad8", "name": "Stray `console.log` in TS/JS \u2014 lib/migrate.js:307", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 lib/migrate.js:307"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0c48cc4b9a9e9880", "name": "Stray `console.log` in TS/JS \u2014 lib/mine.js:102", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 lib/mine.js:102"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-17c8b4a63a0f1e60", "name": "Stray `console.log` in TS/JS \u2014 lib/translate.js:68", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 lib/translate.js:68"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-eeadfce6784f885c", "name": "Stray `console.log` in TS/JS \u2014 lib/portal.js:111", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 lib/portal.js:111"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-faf856361f7d9aa8", "name": "Stray `console.log` in TS/JS \u2014 lib/sync.js:331", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 lib/sync.js:331"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a94598845058e279", "name": "Stray `console.log` in TS/JS \u2014 lib/lorehook.js:106", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 lib/lorehook.js:106"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0d0070851adc8a26", "name": "Stray `console.log` in TS/JS \u2014 lib/note.js:65", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 lib/note.js:65"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-dab748ea93fb9462", "name": "Stray `console.log` in TS/JS \u2014 lib/manifest.js:189", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 lib/manifest.js:189"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7d101704dc5784a2", "name": "Stray `console.log` in TS/JS \u2014 lib/serve.js:230", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 lib/serve.js:230"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-20abfae1e20b535f", "name": "Stray `console.log` in TS/JS \u2014 lib/lint.js:184", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 lib/lint.js:184"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3834e6cb07d59fb9", "name": "Stray `console.log` in TS/JS \u2014 lib/ask.js:62", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 lib/ask.js:62"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-35c11b557c75e5d9", "name": "Stray `console.log` in TS/JS \u2014 lib/init.js:240", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 lib/init.js:240"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9d0421b678e01584", "name": "Stray `console.log` in TS/JS \u2014 lib/runner.js:245", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 lib/runner.js:245"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-36a6ab54ed3fcc86", "name": "Insecure pattern 'node_child_process' in server.js:7", "shortDescription": {"text": "Insecure pattern 'node_child_process' in server.js:7"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3f3573857f123a7d", "name": "Insecure pattern 'direct_innerhtml_assignment' in docs/superpowers/specs/2026-05-31-lore-serve-mockup.html:318", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in docs/superpowers/specs/2026-05-31-lore-serve-mockup.html:318"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b3cf9da50712c44a", "name": "Insecure pattern 'node_child_process' in lib/hook.js:2", "shortDescription": {"text": "Insecure pattern 'node_child_process' in lib/hook.js:2"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a85642a41a90f5da", "name": "Insecure pattern 'node_child_process' in lib/migrate.js:7", "shortDescription": {"text": "Insecure pattern 'node_child_process' in lib/migrate.js:7"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6ff593921e8fc5c3", "name": "Insecure pattern 'node_child_process' in lib/mine.js:1", "shortDescription": {"text": "Insecure pattern 'node_child_process' in lib/mine.js:1"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f55e93e65042979c", "name": "Insecure pattern 'node_child_process' in lib/portal.js:4", "shortDescription": {"text": "Insecure pattern 'node_child_process' in lib/portal.js:4"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-385c69389add8030", "name": "Insecure pattern 'node_child_process' in lib/sync.js:3", "shortDescription": {"text": "Insecure pattern 'node_child_process' in lib/sync.js:3"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f854cd1839ad5ef0", "name": "Insecure pattern 'node_child_process' in lib/note.js:5", "shortDescription": {"text": "Insecure pattern 'node_child_process' in lib/note.js:5"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-55f0103c3d3d1500", "name": "Insecure pattern 'node_child_process' in lib/manifest.js:4", "shortDescription": {"text": "Insecure pattern 'node_child_process' in lib/manifest.js:4"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0a7ef005be8df440", "name": "Insecure pattern 'node_child_process' in lib/serve.js:5", "shortDescription": {"text": "Insecure pattern 'node_child_process' in lib/serve.js:5"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d719a6f984b315a1", "name": "Insecure pattern 'node_child_process' in lib/runner.js:5", "shortDescription": {"text": "Insecure pattern 'node_child_process' in lib/runner.js:5"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-669f7b135dc7bc25", "name": "Insecure pattern 'direct_innerhtml_assignment' in site/index.html:299", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in site/index.html:299"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6372cebde0220094", "name": "No auth library detected", "shortDescription": {"text": "No auth library detected"}, "fullDescription": {"text": "The scanner did not find any standard auth library (JWT, OAuth, NextAuth, Auth0, etc.). The repo has auth/admin/session surface indicators, so auth may live in custom code, in a separate service, or be missing."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4601e3ad3bb28677", "name": "No CI/CD pipelines detected", "shortDescription": {"text": "No CI/CD pipelines detected"}, "fullDescription": {"text": "No GitHub Actions, GitLab CI, or CircleCI configs found. Without CI you can't gate deploys on tests/lints."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-141b30a41e03817b", "name": "No license file detected", "shortDescription": {"text": "No license file detected"}, "fullDescription": {"text": "No LICENSE/COPYING/NOTICE file was found. Generated repositories often omit licensing, which blocks reuse and automated intake."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 49 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b9088664ace7f748", "name": "Composite production-readiness gap", "shortDescription": {"text": "Composite production-readiness gap"}, "fullDescription": {"text": "Multiple low-cost hardening controls are missing together: license, ci. Opus verification showed these co-occurring gaps are a better readiness signal than reading each flag in isolation."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-749d4bc1bd66df5f", "name": "Agent instructions exist but release-hardening basics are missing", "shortDescription": {"text": "Agent instructions exist but release-hardening basics are missing"}, "fullDescription": {"text": "AI-coder instruction files were found, but the repo is missing license, ci. Treat this as a contract gap: the agent is guided, but the generated output is not yet guarded by the controls that make it repeatable."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-cc55229a7a3c078d", "name": "Agent authority lacks a verifier contract: .mcp.json", "shortDescription": {"text": "Agent authority lacks a verifier contract: .mcp.json"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a38a9a6e1450b452", "name": "`fetch()` without try/.catch or AbortSignal \u2014 test/server.test.js:238", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 test/server.test.js:238"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-027e459475c8b7b4", "name": "`fetch()` without try/.catch or AbortSignal \u2014 test/portal.test.js:74", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 test/portal.test.js:74"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-cf4f720cf1514654", "name": "`fetch()` without try/.catch or AbortSignal \u2014 test/server-api.test.js:41", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 test/server-api.test.js:41"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-068b68c8bc3a8238", "name": "Commented-code block (7 lines) in test/serve.test.js:129", "shortDescription": {"text": "Commented-code block (7 lines) in test/serve.test.js:129"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-65cb444574a82036", "name": "`fetch()` without try/.catch or AbortSignal \u2014 test/serve.test.js:102", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 test/serve.test.js:102"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4163e788862767d5", "name": "`fetch()` without try/.catch or AbortSignal \u2014 test/sync.test.js:204", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 test/sync.test.js:204"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-cc8eb675bd7b8359", "name": "`fetch()` without try/.catch or AbortSignal \u2014 test/integration.test.js:43", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 test/integration.test.js:43"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a72846a39a826326", "name": "Commented-code block (5 lines) in lib/serve.js:136", "shortDescription": {"text": "Commented-code block (5 lines) in lib/serve.js:136"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-e40f5862749d85ae", "name": "Commented-code block (5 lines) in lib/lint.js:52", "shortDescription": {"text": "Commented-code block (5 lines) in lib/lint.js:52"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-857cbef4abcc98ff", "name": "Commented-code block (5 lines) in site/shell.mjs:11", "shortDescription": {"text": "Commented-code block (5 lines) in site/shell.mjs:11"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/19459"}, "properties": {"repository": "shenhuanageshei/lore", "repoUrl": "https://github.com/shenhuanageshei/lore", "branch": "main"}, "results": [{"ruleId": "scanner-d74c4193d436ff48", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 server.js:320"}, "properties": {"repobilityId": "a9deebb5fdc93edc", "scanner": "scanner-primary", "fingerprint": "d74c4193d436ff48", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-7667f9164f668ad8", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 lib/migrate.js:307"}, "properties": {"repobilityId": "8405fc9d0d41014c", "scanner": "scanner-primary", "fingerprint": "7667f9164f668ad8", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-0c48cc4b9a9e9880", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 lib/mine.js:102"}, "properties": {"repobilityId": "143f5060983bf7a2", "scanner": "scanner-primary", "fingerprint": "0c48cc4b9a9e9880", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-17c8b4a63a0f1e60", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 lib/translate.js:68"}, "properties": {"repobilityId": "97f7a574ed0a4908", "scanner": "scanner-primary", "fingerprint": "17c8b4a63a0f1e60", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-eeadfce6784f885c", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 lib/portal.js:111"}, "properties": {"repobilityId": "473f78ec2bb47e73", "scanner": "scanner-primary", "fingerprint": "eeadfce6784f885c", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-faf856361f7d9aa8", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 lib/sync.js:331"}, "properties": {"repobilityId": "6d9368cea2a87f81", "scanner": "scanner-primary", "fingerprint": "faf856361f7d9aa8", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-a94598845058e279", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 lib/lorehook.js:106"}, "properties": {"repobilityId": "5eba2b4503750aad", "scanner": "scanner-primary", "fingerprint": "a94598845058e279", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-0d0070851adc8a26", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 lib/note.js:65"}, "properties": {"repobilityId": "1008eb910aaf13cd", "scanner": "scanner-primary", "fingerprint": "0d0070851adc8a26", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-dab748ea93fb9462", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 lib/manifest.js:189"}, "properties": {"repobilityId": "769b0060290b153b", "scanner": "scanner-primary", "fingerprint": "dab748ea93fb9462", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-7d101704dc5784a2", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 lib/serve.js:230"}, "properties": {"repobilityId": "0a5e36e899e2de3a", "scanner": "scanner-primary", "fingerprint": "7d101704dc5784a2", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-20abfae1e20b535f", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 lib/lint.js:184"}, "properties": {"repobilityId": "dae4af9b2975a58a", "scanner": "scanner-primary", "fingerprint": "20abfae1e20b535f", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-3834e6cb07d59fb9", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 lib/ask.js:62"}, "properties": {"repobilityId": "6efa12ad32794abb", "scanner": "scanner-primary", "fingerprint": "3834e6cb07d59fb9", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-35c11b557c75e5d9", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 lib/init.js:240"}, "properties": {"repobilityId": "818b7837dcbd531a", "scanner": "scanner-primary", "fingerprint": "35c11b557c75e5d9", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-9d0421b678e01584", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 lib/runner.js:245"}, "properties": {"repobilityId": "41a20456e6c6271c", "scanner": "scanner-primary", "fingerprint": "9d0421b678e01584", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-36a6ab54ed3fcc86", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in server.js:7"}, "properties": {"repobilityId": "23f3ba0b6e438ed3", "scanner": "scanner-primary", "fingerprint": "36a6ab54ed3fcc86", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server.js"}, "region": {"startLine": 7}}}]}, {"ruleId": "scanner-3f3573857f123a7d", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in docs/superpowers/specs/2026-05-31-lore-serve-mockup.html:318"}, "properties": {"repobilityId": "059a8b9631caee11", "scanner": "scanner-primary", "fingerprint": "3f3573857f123a7d", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docs/superpowers/specs/2026-05-31-lore-serve-mockup.html"}, "region": {"startLine": 318}}}]}, {"ruleId": "scanner-b3cf9da50712c44a", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in lib/hook.js:2"}, "properties": {"repobilityId": "49241d7f96cb98cb", "scanner": "scanner-primary", "fingerprint": "b3cf9da50712c44a", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "lib/hook.js"}, "region": {"startLine": 2}}}]}, {"ruleId": "scanner-a85642a41a90f5da", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in lib/migrate.js:7"}, "properties": {"repobilityId": "dfa69978c1b0911d", "scanner": "scanner-primary", "fingerprint": "a85642a41a90f5da", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "lib/migrate.js"}, "region": {"startLine": 7}}}]}, {"ruleId": "scanner-6ff593921e8fc5c3", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in lib/mine.js:1"}, "properties": {"repobilityId": "f42255916b17ed6f", "scanner": "scanner-primary", "fingerprint": "6ff593921e8fc5c3", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "lib/mine.js"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f55e93e65042979c", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in lib/portal.js:4"}, "properties": {"repobilityId": "a37b03ea95c4c081", "scanner": "scanner-primary", "fingerprint": "f55e93e65042979c", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "lib/portal.js"}, "region": {"startLine": 4}}}]}, {"ruleId": "scanner-385c69389add8030", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in lib/sync.js:3"}, "properties": {"repobilityId": "d33d2b9ea392d391", "scanner": "scanner-primary", "fingerprint": "385c69389add8030", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "lib/sync.js"}, "region": {"startLine": 3}}}]}, {"ruleId": "scanner-f854cd1839ad5ef0", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in lib/note.js:5"}, "properties": {"repobilityId": "b1c9f7ceadb53cf2", "scanner": "scanner-primary", "fingerprint": "f854cd1839ad5ef0", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "lib/note.js"}, "region": {"startLine": 5}}}]}, {"ruleId": "scanner-55f0103c3d3d1500", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in lib/manifest.js:4"}, "properties": {"repobilityId": "e21ed866233aa559", "scanner": "scanner-primary", "fingerprint": "55f0103c3d3d1500", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "lib/manifest.js"}, "region": {"startLine": 4}}}]}, {"ruleId": "scanner-0a7ef005be8df440", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in lib/serve.js:5"}, "properties": {"repobilityId": "fc6f4360393d4cdd", "scanner": "scanner-primary", "fingerprint": "0a7ef005be8df440", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "lib/serve.js"}, "region": {"startLine": 5}}}]}, {"ruleId": "scanner-d719a6f984b315a1", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in lib/runner.js:5"}, "properties": {"repobilityId": "6044a2bf2055a0e1", "scanner": "scanner-primary", "fingerprint": "d719a6f984b315a1", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "lib/runner.js"}, "region": {"startLine": 5}}}]}, {"ruleId": "scanner-669f7b135dc7bc25", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in site/index.html:299"}, "properties": {"repobilityId": "91a2a73fe1e89994", "scanner": "scanner-primary", "fingerprint": "669f7b135dc7bc25", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "site/index.html"}, "region": {"startLine": 299}}}]}, {"ruleId": "scanner-6372cebde0220094", "level": "warning", "message": {"text": "No auth library detected"}, "properties": {"repobilityId": "a5b6035a5bbf8054", "scanner": "scanner-primary", "fingerprint": "6372cebde0220094", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["coverage", "auth"]}}, {"ruleId": "scanner-4601e3ad3bb28677", "level": "warning", "message": {"text": "No CI/CD pipelines detected"}, "properties": {"repobilityId": "c3ee439bce2bc51e", "scanner": "scanner-primary", "fingerprint": "4601e3ad3bb28677", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-141b30a41e03817b", "level": "note", "message": {"text": "No license file detected"}, "properties": {"repobilityId": "fb8692986b4920c3", "scanner": "scanner-primary", "fingerprint": "141b30a41e03817b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["license", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "9652a0a79da46c5a", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-b9088664ace7f748", "level": "note", "message": {"text": "Composite production-readiness gap"}, "properties": {"repobilityId": "cbdd0b4b0293a928", "scanner": "scanner-primary", "fingerprint": "b9088664ace7f748", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["production-readiness", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-749d4bc1bd66df5f", "level": "warning", "message": {"text": "Agent instructions exist but release-hardening basics are missing"}, "properties": {"repobilityId": "670fde12020c97f9", "scanner": "scanner-primary", "fingerprint": "749d4bc1bd66df5f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "f32fa30dc453db1e", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "3c24aeb36392f335", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-cc55229a7a3c078d", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .mcp.json"}, "properties": {"repobilityId": "51942fb3d5b8b5b4", "scanner": "scanner-primary", "fingerprint": "cc55229a7a3c078d", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "mcp_config"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".mcp.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a38a9a6e1450b452", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 test/server.test.js:238"}, "properties": {"repobilityId": "69e0d572f80ddfcc", "scanner": "scanner-primary", "fingerprint": "a38a9a6e1450b452", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-027e459475c8b7b4", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 test/portal.test.js:74"}, "properties": {"repobilityId": "eca3dde8156ddb2b", "scanner": "scanner-primary", "fingerprint": "027e459475c8b7b4", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-cf4f720cf1514654", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 test/server-api.test.js:41"}, "properties": {"repobilityId": "b88e6fd198ca0c60", "scanner": "scanner-primary", "fingerprint": "cf4f720cf1514654", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-068b68c8bc3a8238", "level": "none", "message": {"text": "Commented-code block (7 lines) in test/serve.test.js:129"}, "properties": {"repobilityId": "b9aa356bda8b58c0", "scanner": "scanner-primary", "fingerprint": "068b68c8bc3a8238", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-65cb444574a82036", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 test/serve.test.js:102"}, "properties": {"repobilityId": "a210f80297ec1f0c", "scanner": "scanner-primary", "fingerprint": "65cb444574a82036", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-4163e788862767d5", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 test/sync.test.js:204"}, "properties": {"repobilityId": "1526283239aca663", "scanner": "scanner-primary", "fingerprint": "4163e788862767d5", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-cc8eb675bd7b8359", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 test/integration.test.js:43"}, "properties": {"repobilityId": "629b68b8a1622cbd", "scanner": "scanner-primary", "fingerprint": "cc8eb675bd7b8359", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-a72846a39a826326", "level": "none", "message": {"text": "Commented-code block (5 lines) in lib/serve.js:136"}, "properties": {"repobilityId": "b8165dacf27960bc", "scanner": "scanner-primary", "fingerprint": "a72846a39a826326", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-e40f5862749d85ae", "level": "none", "message": {"text": "Commented-code block (5 lines) in lib/lint.js:52"}, "properties": {"repobilityId": "2317857e301ea5cb", "scanner": "scanner-primary", "fingerprint": "e40f5862749d85ae", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-857cbef4abcc98ff", "level": "none", "message": {"text": "Commented-code block (5 lines) in site/shell.mjs:11"}, "properties": {"repobilityId": "013f3dd5eefe4ff8", "scanner": "scanner-primary", "fingerprint": "857cbef4abcc98ff", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}]}]}