{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-2f97abb80f4d6d36", "name": "Possibly dead Python function: handle_reporting_queue", "shortDescription": {"text": "Possibly dead Python function: handle_reporting_queue"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c06c882c6cd818ef", "name": "Possibly dead Python function: create_all_languages", "shortDescription": {"text": "Possibly dead Python function: create_all_languages"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1cf0c9669df84b73", "name": "Possibly dead Python function: measure_all_languages", "shortDescription": {"text": "Possibly dead Python function: measure_all_languages"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-307f8038b9cc1e36", "name": "Possibly dead Python function: update_all_languages", "shortDescription": {"text": "Possibly dead Python function: update_all_languages"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1571c36ae6216dc6", "name": "Possibly dead Python function: set_label_file", "shortDescription": {"text": "Possibly dead Python function: set_label_file"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a78efc83a0fe34af", "name": "TODO/FIXME marker in shipping code \u2014 homepage/static/Chart.bundle.js:2996", "shortDescription": {"text": "TODO/FIXME marker in shipping code \u2014 homepage/static/Chart.bundle.js:2996"}, "fullDescription": {"text": "Track in /reviews or /issues, not as a code comment that rots.\n\nWhy: Drift control \u2014 shouldn't be the same as Quality TODO scanner.\nRule id: fq.todo-marker"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-c00ad61a2c011058", "name": "Stray `console.log` in TS/JS \u2014 homepage/static/Chart.bundle.js:17137", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 homepage/static/Chart.bundle.js:17137"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9ecdfdc9217d93ee", "name": "TODO/FIXME marker in shipping code \u2014 homepage/static/dialog-polyfill.js:138", "shortDescription": {"text": "TODO/FIXME marker in shipping code \u2014 homepage/static/dialog-polyfill.js:138"}, "fullDescription": {"text": "Track in /reviews or /issues, not as a code comment that rots.\n\nWhy: Drift control \u2014 shouldn't be the same as Quality TODO scanner.\nRule id: fq.todo-marker"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-fcb16292103467c5", "name": "Privileged port 18 in use", "shortDescription": {"text": "Privileged port 18 in use"}, "fullDescription": {"text": "Port 18 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a588b4c5c9d5c3f8", "name": "Privileged port 14 in use", "shortDescription": {"text": "Privileged port 14 in use"}, "fullDescription": {"text": "Port 14 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9710c8d059e53154", "name": "No frontend routes/components detected", "shortDescription": {"text": "No frontend routes/components detected"}, "fullDescription": {"text": "No React/Vue/Next routes were found. This is fine for backend-only repos."}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-93a179b3e61e22af", "name": "Insecure pattern 'direct_innerhtml_assignment' in homepage/static/custom-audio-player.js:86", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in homepage/static/custom-audio-player.js:86"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-fbc1e75f26d8e25f", "name": "Insecure pattern 'direct_innerhtml_assignment' in homepage/static/timeline-view.js:89", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in homepage/static/timeline-view.js:89"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-68a47afb09503a3d", "name": "Insecure pattern 'direct_innerhtml_assignment' in homepage/static/dashboard-charts.js:38", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in homepage/static/dashboard-charts.js:38"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d2dcad57847e163c", "name": "Insecure pattern 'direct_innerhtml_assignment' in homepage/static/palette.js:42", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in homepage/static/palette.js:42"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8571e42de6817eeb", "name": "Insecure pattern 'direct_innerhtml_assignment' in homepage/static/plupload.full.min.js:14", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in homepage/static/plupload.full.min.js:14"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-5c0e529515400b8b", "name": "Insecure pattern 'direct_outerhtml_assignment' in homepage/static/plupload.full.min.js:15", "shortDescription": {"text": "Insecure pattern 'direct_outerhtml_assignment' in homepage/static/plupload.full.min.js:15"}, "fullDescription": {"text": "Found a known-risky pattern (direct_outerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-92ab4ce6855a6e31", "name": "Insecure pattern 'direct_innerhtml_assignment' in homepage/static/ui-helpers.js:53", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in homepage/static/ui-helpers.js:53"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6372cebde0220094", "name": "No auth library detected", "shortDescription": {"text": "No auth library detected"}, "fullDescription": {"text": "The scanner did not find any standard auth library (JWT, OAuth, NextAuth, Auth0, etc.). The repo has auth/admin/session surface indicators, so auth may live in custom code, in a separate service, or be missing."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ae09f5268ebffe80", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/setup-python@v3 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-053d333fac98bc9d", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-86a4f32c86e0cbc3", "name": "Very large file: homepage/static/Chart.bundle.js (20776 lines)", "shortDescription": {"text": "Very large file: homepage/static/Chart.bundle.js (20776 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ea3b5e389d8c9c0f", "name": "Low test-to-source ratio", "shortDescription": {"text": "Low test-to-source ratio"}, "fullDescription": {"text": "5 tests / 27 src (ratio 0.19)."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0e8e6d4015425285", "name": "49 TODO/FIXME markers", "shortDescription": {"text": "49 TODO/FIXME markers"}, "fullDescription": {"text": "High count of TODO/FIXME/HACK markers \u2014 track them as issues so they're not forgotten."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 46 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-72b2a6250083a784", "name": "Placeholder or mock-heavy implementation detected", "shortDescription": {"text": "Placeholder or mock-heavy implementation detected"}, "fullDescription": {"text": "Found 47 placeholder/mock markers across 21 source files. This often means the repo looks complete while core flows still use generated scaffolding or fake data."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-963be83395a41e0b", "name": "Commented-code block (5 lines) in scripts/daily_plot.py:201", "shortDescription": {"text": "Commented-code block (5 lines) in scripts/daily_plot.py:201"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-22cae1344ecf5bc8", "name": "Network/subprocess call without timeout or try/except \u2014 scripts/utils/reporting.py:23", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/utils/reporting.py:23"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3d70e00a38e4b16a", "name": "Legacy-named symbol `Perch_v2` in scripts/utils/models.py:31", "shortDescription": {"text": "Legacy-named symbol `Perch_v2` in scripts/utils/models.py:31"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9ecd28aa8333a8f1", "name": "Stub function `set_meta_data` (body is just `pass`/`return`) \u2014 scripts/utils/models.py:79", "shortDescription": {"text": "Stub function `set_meta_data` (body is just `pass`/`return`) \u2014 scripts/utils/models.py:79"}, "fullDescription": {"text": "Likely an AI scaffold that was never filled in. Remove or implement."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e7cfc3afbe252944", "name": "Legacy-named symbol `rest_v1` in scripts/utils/maintainer.py:85", "shortDescription": {"text": "Legacy-named symbol `rest_v1` in scripts/utils/maintainer.py:85"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cffec958ad425a9e", "name": "Commented-code block (7 lines) in scripts/utils/maintainer.py:147", "shortDescription": {"text": "Commented-code block (7 lines) in scripts/utils/maintainer.py:147"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-a44da81029e6fc0b", "name": "Network/subprocess call without timeout or try/except \u2014 scripts/utils/helpers.py:66", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/utils/helpers.py:66"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a4819cc4e6f6d331", "name": "Legacy-named symbol `Perch_v2` in scripts/utils/analysis.py:198", "shortDescription": {"text": "Legacy-named symbol `Perch_v2` in scripts/utils/analysis.py:198"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e9c9110de8939be8", "name": "`fetch()` without try/.catch or AbortSignal \u2014 homepage/sw.js:40", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 homepage/sw.js:40"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9b7eb2ff89facb93", "name": "Commented-code block (7 lines) in homepage/static/Chart.bundle.js:2830", "shortDescription": {"text": "Commented-code block (7 lines) in homepage/static/Chart.bundle.js:2830"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-8661167a596cf6f2", "name": "`fetch()` without try/.catch or AbortSignal \u2014 homepage/static/palette.js:96", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 homepage/static/palette.js:96"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f2bbd2fe01389213", "name": "`fetch()` without try/.catch or AbortSignal \u2014 homepage/static/ui-helpers.js:63", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 homepage/static/ui-helpers.js:63"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2c04133e54348533", "name": "Near-duplicate function bodies in 2 places", "shortDescription": {"text": "Near-duplicate function bodies in 2 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nscripts/utils/notifications.py:sendAppriseNotifications, scripts/utils/notifications.py:send\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-49c98f7cedd9c977", "name": "Near-duplicate function bodies in 4 places", "shortDescription": {"text": "Near-duplicate function bodies in 4 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nscripts/utils/models.py:predict, scripts/utils/models.py:predict, scripts/utils/models.py:predict, scripts/utils/models.py:predict\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-be46ea126aa5d8dc", "name": "Near-duplicate function bodies in 3 places", "shortDescription": {"text": "Near-duplicate function bodies in 3 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nscripts/utils/models.py:get_species_list, scripts/utils/models.py:get_species_list, scripts/utils/models.py:get_species_list\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/23503"}, "properties": {"repository": "zach7036/BirdNET-Pi-Enhanced-Version", "repoUrl": "https://github.com/zach7036/BirdNET-Pi-Enhanced-Version", "branch": "main"}, "results": [{"ruleId": "scanner-2f97abb80f4d6d36", "level": "note", "message": {"text": "Possibly dead Python function: handle_reporting_queue"}, "properties": {"repobilityId": "e1f3b00424e72772", "scanner": "scanner-primary", "fingerprint": "2f97abb80f4d6d36", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/birdnet_analysis.py:103"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c06c882c6cd818ef", "level": "note", "message": {"text": "Possibly dead Python function: create_all_languages"}, "properties": {"repobilityId": "e2de00dcf5a4dc08", "scanner": "scanner-primary", "fingerprint": "c06c882c6cd818ef", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/utils/maintainer.py:47"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-1cf0c9669df84b73", "level": "note", "message": {"text": "Possibly dead Python function: measure_all_languages"}, "properties": {"repobilityId": "32cfb7c52999ac57", "scanner": "scanner-primary", "fingerprint": "1cf0c9669df84b73", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/utils/maintainer.py:69"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-307f8038b9cc1e36", "level": "note", "message": {"text": "Possibly dead Python function: update_all_languages"}, "properties": {"repobilityId": "c16bd465d207c999", "scanner": "scanner-primary", "fingerprint": "307f8038b9cc1e36", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/utils/maintainer.py:156"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-1571c36ae6216dc6", "level": "note", "message": {"text": "Possibly dead Python function: set_label_file"}, "properties": {"repobilityId": "c1ede7f5e7628af5", "scanner": "scanner-primary", "fingerprint": "1571c36ae6216dc6", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/utils/helpers.py:112"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a78efc83a0fe34af", "level": "none", "message": {"text": "TODO/FIXME marker in shipping code \u2014 homepage/static/Chart.bundle.js:2996"}, "properties": {"repobilityId": "3aab2db139026d6c", "scanner": "scanner-primary", "fingerprint": "a78efc83a0fe34af", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.todo-marker"]}}, {"ruleId": "scanner-c00ad61a2c011058", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 homepage/static/Chart.bundle.js:17137"}, "properties": {"repobilityId": "b36bab5d543c72b4", "scanner": "scanner-primary", "fingerprint": "c00ad61a2c011058", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-9ecdfdc9217d93ee", "level": "none", "message": {"text": "TODO/FIXME marker in shipping code \u2014 homepage/static/dialog-polyfill.js:138"}, "properties": {"repobilityId": "4edde6e2863f7280", "scanner": "scanner-primary", "fingerprint": "9ecdfdc9217d93ee", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.todo-marker"]}}, {"ruleId": "scanner-fcb16292103467c5", "level": "warning", "message": {"text": "Privileged port 18 in use"}, "properties": {"repobilityId": "2d7b5e7d9c158e43", "scanner": "scanner-primary", "fingerprint": "fcb16292103467c5", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/birdnet_changeidentification.sh"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a588b4c5c9d5c3f8", "level": "warning", "message": {"text": "Privileged port 14 in use"}, "properties": {"repobilityId": "2dbd4b719a1412ff", "scanner": "scanner-primary", "fingerprint": "a588b4c5c9d5c3f8", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/birdnet_changeidentification.sh"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-9710c8d059e53154", "level": "none", "message": {"text": "No frontend routes/components detected"}, "properties": {"repobilityId": "44ca61485762e494", "scanner": "scanner-primary", "fingerprint": "9710c8d059e53154", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-93a179b3e61e22af", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in homepage/static/custom-audio-player.js:86"}, "properties": {"repobilityId": "4d101261a4c2d8cd", "scanner": "scanner-primary", "fingerprint": "93a179b3e61e22af", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "homepage/static/custom-audio-player.js"}, "region": {"startLine": 86}}}]}, {"ruleId": "scanner-fbc1e75f26d8e25f", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in homepage/static/timeline-view.js:89"}, "properties": {"repobilityId": "d1cd429245d42f5b", "scanner": "scanner-primary", "fingerprint": "fbc1e75f26d8e25f", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "homepage/static/timeline-view.js"}, "region": {"startLine": 89}}}]}, {"ruleId": "scanner-68a47afb09503a3d", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in homepage/static/dashboard-charts.js:38"}, "properties": {"repobilityId": "869e962e5a5afea6", "scanner": "scanner-primary", "fingerprint": "68a47afb09503a3d", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "homepage/static/dashboard-charts.js"}, "region": {"startLine": 38}}}]}, {"ruleId": "scanner-d2dcad57847e163c", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in homepage/static/palette.js:42"}, "properties": {"repobilityId": "f340637cf575c557", "scanner": "scanner-primary", "fingerprint": "d2dcad57847e163c", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "homepage/static/palette.js"}, "region": {"startLine": 42}}}]}, {"ruleId": "scanner-8571e42de6817eeb", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in homepage/static/plupload.full.min.js:14"}, "properties": {"repobilityId": "d1e2187dc22a2bc0", "scanner": "scanner-primary", "fingerprint": "8571e42de6817eeb", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "homepage/static/plupload.full.min.js"}, "region": {"startLine": 14}}}]}, {"ruleId": "scanner-5c0e529515400b8b", "level": "warning", "message": {"text": "Insecure pattern 'direct_outerhtml_assignment' in homepage/static/plupload.full.min.js:15"}, "properties": {"repobilityId": "0206c2426e450967", "scanner": "scanner-primary", "fingerprint": "5c0e529515400b8b", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_outerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "homepage/static/plupload.full.min.js"}, "region": {"startLine": 15}}}]}, {"ruleId": "scanner-92ab4ce6855a6e31", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in homepage/static/ui-helpers.js:53"}, "properties": {"repobilityId": "e94bdc8bb5fc0dc2", "scanner": "scanner-primary", "fingerprint": "92ab4ce6855a6e31", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "homepage/static/ui-helpers.js"}, "region": {"startLine": 53}}}]}, {"ruleId": "scanner-6372cebde0220094", "level": "warning", "message": {"text": "No auth library detected"}, "properties": {"repobilityId": "a5b6035a5bbf8054", "scanner": "scanner-primary", "fingerprint": "6372cebde0220094", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["coverage", "auth"]}}, {"ruleId": "scanner-ae09f5268ebffe80", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "b459fe1d6182f387", "scanner": "scanner-primary", "fingerprint": "ae09f5268ebffe80", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/python-app.yml"}, "region": {"startLine": 23}}}]}, {"ruleId": "scanner-053d333fac98bc9d", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "fa1c7ec49d440ca3", "scanner": "scanner-primary", "fingerprint": "053d333fac98bc9d", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/python-ci.yml"}, "region": {"startLine": 19}}}]}, {"ruleId": "scanner-053d333fac98bc9d", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "ab44beb5c15349b3", "scanner": "scanner-primary", "fingerprint": "053d333fac98bc9d", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/python-ci.yml"}, "region": {"startLine": 22}}}]}, {"ruleId": "scanner-86a4f32c86e0cbc3", "level": "note", "message": {"text": "Very large file: homepage/static/Chart.bundle.js (20776 lines)"}, "properties": {"repobilityId": "e57c9508a9d9f607", "scanner": "scanner-primary", "fingerprint": "86a4f32c86e0cbc3", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-ea3b5e389d8c9c0f", "level": "note", "message": {"text": "Low test-to-source ratio"}, "properties": {"repobilityId": "ef7b2552cc00a375", "scanner": "scanner-primary", "fingerprint": "ea3b5e389d8c9c0f", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["tests"]}}, {"ruleId": "scanner-0e8e6d4015425285", "level": "note", "message": {"text": "49 TODO/FIXME markers"}, "properties": {"repobilityId": "4b38c118003e07d2", "scanner": "scanner-primary", "fingerprint": "0e8e6d4015425285", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["maintenance"]}}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "c7b45912f2fd0dbb", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-72b2a6250083a784", "level": "warning", "message": {"text": "Placeholder or mock-heavy implementation detected"}, "properties": {"repobilityId": "1a10e32d9bd4d27d", "scanner": "scanner-primary", "fingerprint": "72b2a6250083a784", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "incomplete", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "8f3fdd03918e444c", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "863f81fb8097ebd3", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "c9ecad6e33644cad", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-963be83395a41e0b", "level": "none", "message": {"text": "Commented-code block (5 lines) in scripts/daily_plot.py:201"}, "properties": {"repobilityId": "777a350408e3444f", "scanner": "scanner-primary", "fingerprint": "963be83395a41e0b", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-22cae1344ecf5bc8", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/utils/reporting.py:23"}, "properties": {"repobilityId": "443cffd3bf11301e", "scanner": "scanner-primary", "fingerprint": "22cae1344ecf5bc8", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-3d70e00a38e4b16a", "level": "note", "message": {"text": "Legacy-named symbol `Perch_v2` in scripts/utils/models.py:31"}, "properties": {"repobilityId": "9d0b67c09b71ab76", "scanner": "scanner-primary", "fingerprint": "3d70e00a38e4b16a", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-9ecd28aa8333a8f1", "level": "note", "message": {"text": "Stub function `set_meta_data` (body is just `pass`/`return`) \u2014 scripts/utils/models.py:79"}, "properties": {"repobilityId": "fad522c8c5fa31b2", "scanner": "scanner-primary", "fingerprint": "9ecd28aa8333a8f1", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "empty-handler", "dead-code"]}}, {"ruleId": "scanner-e7cfc3afbe252944", "level": "note", "message": {"text": "Legacy-named symbol `rest_v1` in scripts/utils/maintainer.py:85"}, "properties": {"repobilityId": "5a819686d8b97926", "scanner": "scanner-primary", "fingerprint": "e7cfc3afbe252944", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-cffec958ad425a9e", "level": "none", "message": {"text": "Commented-code block (7 lines) in scripts/utils/maintainer.py:147"}, "properties": {"repobilityId": "2b6138e66619be34", "scanner": "scanner-primary", "fingerprint": "cffec958ad425a9e", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-a44da81029e6fc0b", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/utils/helpers.py:66"}, "properties": {"repobilityId": "6ee01e021ac4a2b5", "scanner": "scanner-primary", "fingerprint": "a44da81029e6fc0b", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-a4819cc4e6f6d331", "level": "note", "message": {"text": "Legacy-named symbol `Perch_v2` in scripts/utils/analysis.py:198"}, "properties": {"repobilityId": "baaa89fefc83ca33", "scanner": "scanner-primary", "fingerprint": "a4819cc4e6f6d331", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-e9c9110de8939be8", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 homepage/sw.js:40"}, "properties": {"repobilityId": "cb364974d5c16dc4", "scanner": "scanner-primary", "fingerprint": "e9c9110de8939be8", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-9b7eb2ff89facb93", "level": "none", "message": {"text": "Commented-code block (7 lines) in homepage/static/Chart.bundle.js:2830"}, "properties": {"repobilityId": "84efcd60f93ec548", "scanner": "scanner-primary", "fingerprint": "9b7eb2ff89facb93", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-8661167a596cf6f2", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 homepage/static/palette.js:96"}, "properties": {"repobilityId": "9771c76e2a94cf51", "scanner": "scanner-primary", "fingerprint": "8661167a596cf6f2", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-f2bbd2fe01389213", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 homepage/static/ui-helpers.js:63"}, "properties": {"repobilityId": "dd9f5dfde042f2ef", "scanner": "scanner-primary", "fingerprint": "f2bbd2fe01389213", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "d096c2b159481a07", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "c2a37047f38046f4", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-49c98f7cedd9c977", "level": "note", "message": {"text": "Near-duplicate function bodies in 4 places"}, "properties": {"repobilityId": "51d5ecbbd7e2bca3", "scanner": "scanner-primary", "fingerprint": "49c98f7cedd9c977", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-49c98f7cedd9c977", "level": "note", "message": {"text": "Near-duplicate function bodies in 4 places"}, "properties": {"repobilityId": "3d146a1ad9d1e0a1", "scanner": "scanner-primary", "fingerprint": "49c98f7cedd9c977", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-be46ea126aa5d8dc", "level": "note", "message": {"text": "Near-duplicate function bodies in 3 places"}, "properties": {"repobilityId": "3e201609144893cc", "scanner": "scanner-primary", "fingerprint": "be46ea126aa5d8dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "61ee5d56ca132af8", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}]}]}