{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "WEB003", "name": "Public web service has no security.txt", "shortDescription": {"text": "Public web service has no security.txt"}, "fullDescription": {"text": "security.txt gives researchers and customers a safe disclosure channel. Public web apps and APIs should publish it under /.well-known/security.txt."}, "properties": {"scanner": "repobility-web-presence", "category": "quality", "severity": "medium", "confidence": 0.78, "cwe": "", "owasp": ""}}, {"id": "WEB015", "name": "Public web app has no Content Security Policy", "shortDescription": {"text": "Public web app has no Content Security Policy"}, "fullDescription": {"text": "A Content Security Policy reduces the blast radius of injected scripts if the app is ever served through preview, static hosting, or a web container outside its normal sandbox."}, "properties": {"scanner": "repobility-web-presence", "category": "quality", "severity": "medium", "confidence": 0.7, "cwe": "", "owasp": ""}}, {"id": "JRN003", "name": "Frontend API reference is not matched by discovered backend routes", "shortDescription": {"text": "Frontend API reference is not matched by discovered backend routes"}, "fullDescription": {"text": "A frontend string references a same-origin API path that Repobility could not match to backend route inventory. This often causes live 404s in user journeys."}, "properties": {"scanner": "repobility-journey-contract", "category": "quality", "severity": "medium", "confidence": 0.74, "cwe": "", "owasp": ""}}, {"id": "AUC009", "name": "[AUC009] Sensitive function route lacks elevated authorization evidence: A route appears to perform a sensitive function", "shortDescription": {"text": "[AUC009] Sensitive function route lacks elevated authorization evidence: A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: POST /p"}, "fullDescription": {"text": "A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: POST /persist/route."}, "properties": {"scanner": "repobility-access-control", "category": "auth", "severity": "medium", "confidence": 0.68, "cwe": "CWE-285", "owasp": "API5:2023 Broken Function Level Authorization"}}, {"id": "AUC004", "name": "[AUC004] Admin route does not show super_admin separation: An administrative route was detected without nearby evidence ", "shortDescription": {"text": "[AUC004] Admin route does not show super_admin separation: An administrative route was detected without nearby evidence that platform super_admin access is separated from tenant/application admin access. Endpoint: POST /settings/route."}, "fullDescription": {"text": "An administrative route was detected without nearby evidence that platform super_admin access is separated from tenant/application admin access. Endpoint: POST /settings/route."}, "properties": {"scanner": "repobility-access-control", "category": "auth", "severity": "medium", "confidence": 0.66, "cwe": "CWE-285", "owasp": "API5:2023 Broken Function Level Authorization"}}, {"id": "AUC001", "name": "[AUC001] No Repobility access matrix policy found: The repository uses web/API frameworks but does not define .repobilit", "shortDescription": {"text": "[AUC001] No Repobility access matrix policy found: The repository uses web/API frameworks but does not define .repobility/access.yml or equivalent authorization documentation."}, "fullDescription": {"text": "The repository uses web/API frameworks but does not define .repobility/access.yml or equivalent authorization documentation."}, "properties": {"scanner": "repobility-access-control", "category": "auth", "severity": "medium", "confidence": 0.92, "cwe": "CWE-285", "owasp": "WSTG-AUTHZ"}}, {"id": "GHSA-qx2v-qp2m-jg93", "name": "postcss: GHSA-qx2v-qp2m-jg93", "shortDescription": {"text": "postcss: GHSA-qx2v-qp2m-jg93"}, "fullDescription": {"text": "PostCSS has XSS via Unescaped </style> in its CSS Stringify Output"}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "medium", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "GHSA-3v7f-55p6-f55p", "name": "picomatch: GHSA-3v7f-55p6-f55p", "shortDescription": {"text": "picomatch: GHSA-3v7f-55p6-f55p"}, "fullDescription": {"text": "Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching"}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "medium", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "GHSA-wfc6-r584-vfw7", "name": "next: GHSA-wfc6-r584-vfw7", "shortDescription": {"text": "next: GHSA-wfc6-r584-vfw7"}, "fullDescription": {"text": "Next.js vulnerable to cache poisoning in React Server Component responses"}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "medium", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "GHSA-mq59-m269-xvcx", "name": "next: GHSA-mq59-m269-xvcx", "shortDescription": {"text": "next: GHSA-mq59-m269-xvcx"}, "fullDescription": {"text": "Next.js: null origin can bypass Server Actions CSRF checks"}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "medium", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "GHSA-h64f-5h5j-jqjh", "name": "next: GHSA-h64f-5h5j-jqjh", "shortDescription": {"text": "next: GHSA-h64f-5h5j-jqjh"}, "fullDescription": {"text": "Next.js has a Denial of Service in the Image Optimization API"}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "medium", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "GHSA-h27x-g6w4-24gq", "name": "next: GHSA-h27x-g6w4-24gq", "shortDescription": {"text": "next: GHSA-h27x-g6w4-24gq"}, "fullDescription": {"text": "Next.js: Unbounded postponed resume buffering can lead to DoS"}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "medium", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "GHSA-gx5p-jg67-6x7h", "name": "next: GHSA-gx5p-jg67-6x7h", "shortDescription": {"text": "next: GHSA-gx5p-jg67-6x7h"}, "fullDescription": {"text": "Next.js has cross-site scripting in beforeInteractive scripts with untrusted input"}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "medium", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "GHSA-ggv3-7p47-pfv8", "name": "next: GHSA-ggv3-7p47-pfv8", "shortDescription": {"text": "next: GHSA-ggv3-7p47-pfv8"}, "fullDescription": {"text": "Next.js: HTTP request smuggling in rewrites"}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "medium", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "GHSA-ffhc-5mcf-pf4q", "name": "next: GHSA-ffhc-5mcf-pf4q", "shortDescription": {"text": "next: GHSA-ffhc-5mcf-pf4q"}, "fullDescription": {"text": "Next.js vulnerable to cross-site scripting in App Router applications using CSP nonces"}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "medium", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "GHSA-9g9p-9gw9-jx7f", "name": "next: GHSA-9g9p-9gw9-jx7f", "shortDescription": {"text": "next: GHSA-9g9p-9gw9-jx7f"}, "fullDescription": {"text": "Next.js self-hosted applications vulnerable to DoS via Image Optimizer remotePatterns configuration"}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "medium", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "GHSA-5f7q-jpqc-wp7h", "name": "next: GHSA-5f7q-jpqc-wp7h", "shortDescription": {"text": "next: GHSA-5f7q-jpqc-wp7h"}, "fullDescription": {"text": "Next.js has Unbounded Memory Consumption via PPR Resume Endpoint "}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "medium", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "GHSA-3x4c-7xq6-9pq8", "name": "next: GHSA-3x4c-7xq6-9pq8", "shortDescription": {"text": "next: GHSA-3x4c-7xq6-9pq8"}, "fullDescription": {"text": "Next.js: Unbounded next/image disk cache growth can exhaust storage"}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "medium", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "GHSA-h67p-54hq-rp68", "name": "js-yaml: GHSA-h67p-54hq-rp68", "shortDescription": {"text": "js-yaml: GHSA-h67p-54hq-rp68"}, "fullDescription": {"text": "JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases"}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "medium", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "GHSA-jp2q-39xq-3w4g", "name": "fast-xml-parser: GHSA-jp2q-39xq-3w4g", "shortDescription": {"text": "fast-xml-parser: GHSA-jp2q-39xq-3w4g"}, "fullDescription": {"text": "Entity Expansion Limits Bypassed When Set to Zero Due to JavaScript Falsy Evaluation in fast-xml-parser"}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "medium", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "GHSA-gh4j-gqv2-49f6", "name": "fast-xml-parser: GHSA-gh4j-gqv2-49f6", "shortDescription": {"text": "fast-xml-parser: GHSA-gh4j-gqv2-49f6"}, "fullDescription": {"text": "fast-xml-parser XMLBuilder: XML Comment and CDATA Injection via Unescaped Delimiters"}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "medium", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "GHSA-f886-m6hf-6m8v", "name": "brace-expansion: GHSA-f886-m6hf-6m8v", "shortDescription": {"text": "brace-expansion: GHSA-f886-m6hf-6m8v"}, "fullDescription": {"text": "brace-expansion: Zero-step sequence causes process hang and memory exhaustion"}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "medium", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "GHSA-2g4f-4pwh-qvx6", "name": "ajv: GHSA-2g4f-4pwh-qvx6", "shortDescription": {"text": "ajv: GHSA-2g4f-4pwh-qvx6"}, "fullDescription": {"text": "ajv has ReDoS when using `$data` option"}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "medium", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "DKR014", "name": "Dockerfile copies broad context with incomplete .dockerignore", "shortDescription": {"text": "Dockerfile copies broad context with incomplete .dockerignore"}, "fullDescription": {"text": "COPY . or ADD . is safer when .dockerignore excludes secrets, git history, keys, and generated artifacts."}, "properties": {"scanner": "repobility-docker", "category": "docker", "severity": "medium", "confidence": 0.76, "cwe": "", "owasp": ""}}, {"id": "SEC045", "name": "[SEC045] eval()/exec() on stored or user-supplied data: eval() and exec() on data \u2014 even admin-stored data \u2014 is a latera", "shortDescription": {"text": "[SEC045] eval()/exec() on stored or user-supplied data: eval() and exec() on data \u2014 even admin-stored data \u2014 is a lateral-movement vector after any one credential compromise. Sandboxes (__builtins__ cleared) are escapable: attackers use obj"}, "fullDescription": {"text": "For literal data structures: use ast.literal_eval(text) \u2014 only parses literals, raises on code.\nFor formula evaluation: use asteval or simpleeval (purpose-built sandboxes with allow-lists).\nFor Odoo: use odoo.tools.safe_eval(expr, locals_dict, mode='exec').\nIf you genuinely need to execute admin-stored code: require explicit super-admin permission AND log every execution with a stack trace."}, "properties": {"scanner": "repobility-threat-engine", "category": "injection", "severity": "medium", "confidence": 1.0, "cwe": "", "owasp": ""}}, {"id": "AGT006", "name": "React interval is created without an explicit cleanup", "shortDescription": {"text": "React interval is created without an explicit cleanup"}, "fullDescription": {"text": "Intervals created in React hooks or components should be cleared on unmount. Missing cleanup can keep stale callbacks alive after recording, polling, or overlay components close."}, "properties": {"scanner": "repobility-agent-runtime", "category": "quality", "severity": "medium", "confidence": 0.78, "cwe": "", "owasp": ""}}, {"id": "DEPCUR-NPM", "name": "npm package `otplib` is 1 major version(s) behind (12.0.1 -> 13.4.1)", "shortDescription": {"text": "npm package `otplib` is 1 major version(s) behind (12.0.1 -> 13.4.1)"}, "fullDescription": {"text": "`otplib` is pinned/resolved at 12.0.1 but the latest stable release on the npm registry is 13.4.1 (1 major version(s) behind). Outdated dependencies accumulate unpatched bugs and make future security upgrades harder. This is the version-currency signal Dependabot version-update PRs raise."}, "properties": {"scanner": "repobility-dependency-currency", "category": "dependency", "severity": "medium", "confidence": 0.9, "cwe": "", "owasp": ""}}, {"id": "CORE_NO_CI", "name": "No CI/CD configuration found", "shortDescription": {"text": "No CI/CD configuration found"}, "fullDescription": {"text": "Add a CI/CD pipeline: create .github/workflows/ci.yml for GitHub Actions with steps to lint, test, and build on every push and pull request."}, "properties": {"scanner": "repobility-core", "category": "practices", "severity": "medium", "confidence": null, "cwe": "", "owasp": ""}}, {"id": "WEB011", "name": "Public web app has no humans.txt", "shortDescription": {"text": "Public web app has no humans.txt"}, "fullDescription": {"text": "humans.txt is optional, but it gives operators and reviewers a simple place to find ownership, contact, and important public documentation links."}, "properties": {"scanner": "repobility-web-presence", "category": "quality", "severity": "low", "confidence": 0.5, "cwe": "", "owasp": ""}}, {"id": "WEB008", "name": "Public docs site has no llms.txt", "shortDescription": {"text": "Public docs site has no llms.txt"}, "fullDescription": {"text": "AI coding agents increasingly read llms.txt to find canonical docs and API workflows. Without it, agents are more likely to browse pages repeatedly or use stale instructions."}, "properties": {"scanner": "repobility-web-presence", "category": "quality", "severity": "low", "confidence": 0.64, "cwe": "", "owasp": ""}}, {"id": "WEB002", "name": "Public web app has no sitemap", "shortDescription": {"text": "Public web app has no sitemap"}, "fullDescription": {"text": "A sitemap gives search engines, docs crawlers, and AI agents a structured list of public pages. Without one, important docs and product pages are easy to miss."}, "properties": {"scanner": "repobility-web-presence", "category": "quality", "severity": "low", "confidence": 0.72, "cwe": "", "owasp": ""}}, {"id": "AUC005", "name": "[AUC005] No authorization-focused tests detected: No test files with common authorization, ownership, 403, admin, or sup", "shortDescription": {"text": "[AUC005] No authorization-focused tests detected: No test files with common authorization, ownership, 403, admin, or super_admin assertions were found."}, "fullDescription": {"text": "No test files with common authorization, ownership, 403, admin, or super_admin assertions were found."}, "properties": {"scanner": "repobility-access-control", "category": "auth", "severity": "low", "confidence": 0.76, "cwe": "CWE-285", "owasp": "WSTG-AUTHZ"}}, {"id": "GHSA-vfv6-92ff-j949", "name": "next: GHSA-vfv6-92ff-j949", "shortDescription": {"text": "next: GHSA-vfv6-92ff-j949"}, "fullDescription": {"text": "Next.js vulnerable to cache poisoning via collisions in React Server Component cache-busting"}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "low", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "GHSA-jcc7-9wpm-mj36", "name": "next: GHSA-jcc7-9wpm-mj36", "shortDescription": {"text": "next: GHSA-jcc7-9wpm-mj36"}, "fullDescription": {"text": "Next.js: null origin can bypass dev HMR websocket CSRF checks"}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "low", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "GHSA-3g8h-86w9-wvmq", "name": "next: GHSA-3g8h-86w9-wvmq", "shortDescription": {"text": "next: GHSA-3g8h-86w9-wvmq"}, "fullDescription": {"text": "Next.js's Middleware / Proxy redirects can be cache-poisoned"}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "low", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "GHSA-fj3w-jwp8-x2g3", "name": "fast-xml-parser: GHSA-fj3w-jwp8-x2g3", "shortDescription": {"text": "fast-xml-parser: GHSA-fj3w-jwp8-x2g3"}, "fullDescription": {"text": "fast-xml-parser has stack overflow in XMLBuilder with preserveOrder"}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "low", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "GHSA-4x5r-pxfx-6jf8", "name": "@babel/core: GHSA-4x5r-pxfx-6jf8", "shortDescription": {"text": "@babel/core: GHSA-4x5r-pxfx-6jf8"}, "fullDescription": {"text": "@babel/core: Arbitrary File Read via sourceMappingURL Comment"}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "low", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "DKC017", "name": "Database password is wired through an environment variable placeholder", "shortDescription": {"text": "Database password is wired through an environment variable placeholder"}, "fullDescription": {"text": "Environment placeholders are not committed secrets, but database official images often support *_FILE variables so Compose secrets can provide narrower filesystem-based access."}, "properties": {"scanner": "repobility-docker", "category": "docker", "severity": "low", "confidence": 0.58, "cwe": "", "owasp": ""}}, {"id": "DKC010", "name": "Compose service lacks no-new-privileges hardening", "shortDescription": {"text": "Compose service lacks no-new-privileges hardening"}, "fullDescription": {"text": "no-new-privileges prevents processes from gaining additional privileges through setuid binaries or file capabilities."}, "properties": {"scanner": "repobility-docker", "category": "docker", "severity": "low", "confidence": 0.62, "cwe": "", "owasp": ""}}, {"id": "DKR008", "name": ".dockerignore misses sensitive defaults", "shortDescription": {"text": ".dockerignore misses sensitive defaults"}, "fullDescription": {"text": ".dockerignore exists but does not cover common secret or VCS patterns."}, "properties": {"scanner": "repobility-docker", "category": "docker", "severity": "low", "confidence": 0.72, "cwe": "", "owasp": ""}}, {"id": "AIC003", "name": "Duplicated implementation block across source files", "shortDescription": {"text": "Duplicated implementation block across source files"}, "fullDescription": {"text": "Duplicated blocks are a common artifact when generated code is pasted or recreated instead of reused. They increase maintenance cost because every future bug fix must be found in multiple locations."}, "properties": {"scanner": "repobility-ai-code-hygiene", "category": "quality", "severity": "low", "confidence": 0.86, "cwe": "", "owasp": ""}}, {"id": "SEC020", "name": "[SEC020] Secret Printed to Logs: Debug or diagnostic code appears to print a credential-bearing value. This is a frequen", "shortDescription": {"text": "[SEC020] Secret Printed to Logs: Debug or diagnostic code appears to print a credential-bearing value. This is a frequent AI-assisted coding failure: the helper exposes the exact value needed for troubleshooting."}, "fullDescription": {"text": "Log only redacted, hashed, or last-four-style metadata. Rotate any secret that may have reached logs."}, "properties": {"scanner": "repobility-threat-engine", "category": "credential_exposure", "severity": "info", "confidence": 0.15, "cwe": "", "owasp": ""}}, {"id": "MINED056", "name": "[MINED056] React Key As Index: key={index} in map() \u2014 re-renders the wrong elements on re-order.", "shortDescription": {"text": "[MINED056] React Key As Index: key={index} in map() \u2014 re-renders the wrong elements on re-order."}, "fullDescription": {"text": "Review and fix per the pattern semantics. See CWE-682 /  for context."}, "properties": {"scanner": "repobility-threat-engine", "category": "quality", "severity": "info", "confidence": 1.0, "cwe": "", "owasp": ""}}, {"id": "SEC029", "name": "[SEC029] Server-Side Request Forgery (SSRF) \u2014 outbound HTTP from user input (and 2 more): Same pattern found in 2 additi", "shortDescription": {"text": "[SEC029] Server-Side Request Forgery (SSRF) \u2014 outbound HTTP from user input (and 2 more): Same pattern found in 2 additional files. Review if needed."}, "fullDescription": {"text": "Validate the URL against an allowlist BEFORE fetching:\n  ALLOWED = {'images.example.com', 'cdn.example.com'}\n  host = urlparse(url).hostname\n  if host not in ALLOWED: abort(400)\nOr use a server-side proxy (Imgproxy / serve-files-only-from-S3) that isolates outbound network access from the request handler.\nBlock private CIDRs explicitly: 10/8, 172.16/12, 192.168/16, 169.254/16."}, "properties": {"scanner": "repobility-threat-engine", "category": "ssrf", "severity": "info", "confidence": 0.2, "cwe": "", "owasp": ""}}, {"id": "MINED044", "name": "[MINED044] Js Console Log Prod (and 13 more): Same pattern found in 13 additional files. Review if needed.", "shortDescription": {"text": "[MINED044] Js Console Log Prod (and 13 more): Same pattern found in 13 additional files. Review if needed."}, "fullDescription": {"text": "Review and fix per the pattern semantics. See CWE-532 /  for context."}, "properties": {"scanner": "repobility-threat-engine", "category": "quality", "severity": "info", "confidence": 0.2, "cwe": "", "owasp": ""}}, {"id": "JRN009", "name": "Secret-like setting is echoed into a password input value", "shortDescription": {"text": "Secret-like setting is echoed into a password input value"}, "fullDescription": {"text": "Settings screens sometimes render API keys, tokens, or passwords back into HTML/JSX password fields. That still exposes the secret to page source, browser extensions, screenshots, and DOM scraping."}, "properties": {"scanner": "repobility-journey-contract", "category": "auth", "severity": "high", "confidence": 0.83, "cwe": "", "owasp": ""}}, {"id": "GHSA-c2c7-rcm5-vvqj", "name": "picomatch: GHSA-c2c7-rcm5-vvqj", "shortDescription": {"text": "picomatch: GHSA-c2c7-rcm5-vvqj"}, "fullDescription": {"text": "Picomatch has a ReDoS vulnerability via extglob quantifiers"}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "high", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "GHSA-q4gf-8mx6-v5v3", "name": "next: GHSA-q4gf-8mx6-v5v3", "shortDescription": {"text": "next: GHSA-q4gf-8mx6-v5v3"}, "fullDescription": {"text": "Next.js has a Denial of Service with Server Components"}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "high", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "GHSA-mg66-mrh9-m8jx", "name": "next: GHSA-mg66-mrh9-m8jx", "shortDescription": {"text": "next: GHSA-mg66-mrh9-m8jx"}, "fullDescription": {"text": "Next.js vulnerable to Denial of Service via connection exhaustion in applications using Cache Components"}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "high", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "GHSA-h25m-26qc-wcjf", "name": "next: GHSA-h25m-26qc-wcjf", "shortDescription": {"text": "next: GHSA-h25m-26qc-wcjf"}, "fullDescription": {"text": "Next.js HTTP request deserialization can lead to DoS when using insecure React Server Components"}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "high", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "GHSA-c4j6-fc7j-m34r", "name": "next: GHSA-c4j6-fc7j-m34r", "shortDescription": {"text": "next: GHSA-c4j6-fc7j-m34r"}, "fullDescription": {"text": "Next.js vulnerable to server-side request forgery in applications using WebSocket upgrades"}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "high", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "GHSA-8h8q-6873-q5fj", "name": "next: GHSA-8h8q-6873-q5fj", "shortDescription": {"text": "next: GHSA-8h8q-6873-q5fj"}, "fullDescription": {"text": "Next.js Vulnerable to Denial of Service with Server Components"}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "high", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "GHSA-492v-c6pp-mqqv", "name": "next: GHSA-492v-c6pp-mqqv", "shortDescription": {"text": "next: GHSA-492v-c6pp-mqqv"}, "fullDescription": {"text": "Next.js has a Middleware / Proxy bypass through dynamic route parameter injection"}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "high", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "GHSA-36qx-fr4f-26g5", "name": "next: GHSA-36qx-fr4f-26g5", "shortDescription": {"text": "next: GHSA-36qx-fr4f-26g5"}, "fullDescription": {"text": "Next.js has a Middleware / Proxy bypass in Pages Router applications using i18n"}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "high", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "GHSA-26hh-7cqf-hhc6", "name": "next: GHSA-26hh-7cqf-hhc6", "shortDescription": {"text": "next: GHSA-26hh-7cqf-hhc6"}, "fullDescription": {"text": "Next.js has a Middleware / Proxy bypass in App Router applications via segment-prefetch routes - Incomplete Fix Follow-Up"}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "high", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "GHSA-267c-6grr-h53f", "name": "next: GHSA-267c-6grr-h53f", "shortDescription": {"text": "next: GHSA-267c-6grr-h53f"}, "fullDescription": {"text": "Next.js has a Middleware / Proxy bypass in App Router applications via segment-prefetch routes"}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "high", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "GHSA-7r86-cg39-jmmj", "name": "minimatch: GHSA-7r86-cg39-jmmj", "shortDescription": {"text": "minimatch: GHSA-7r86-cg39-jmmj"}, "fullDescription": {"text": "minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments"}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "high", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "GHSA-3ppc-4f35-3m26", "name": "minimatch: GHSA-3ppc-4f35-3m26", "shortDescription": {"text": "minimatch: GHSA-3ppc-4f35-3m26"}, "fullDescription": {"text": "minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern"}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "high", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "GHSA-23c5-xmqv-rm74", "name": "minimatch: GHSA-23c5-xmqv-rm74", "shortDescription": {"text": "minimatch: GHSA-23c5-xmqv-rm74"}, "fullDescription": {"text": "minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions"}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "high", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "GHSA-rf6f-7fwh-wjgh", "name": "flatted: GHSA-rf6f-7fwh-wjgh", "shortDescription": {"text": "flatted: GHSA-rf6f-7fwh-wjgh"}, "fullDescription": {"text": "Prototype Pollution via parse() in NodeJS flatted"}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "high", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "GHSA-25h7-pfq9-p65f", "name": "flatted: GHSA-25h7-pfq9-p65f", "shortDescription": {"text": "flatted: GHSA-25h7-pfq9-p65f"}, "fullDescription": {"text": "flatted vulnerable to unbounded recursion DoS in parse() revive phase"}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "high", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "GHSA-8gc5-j5rx-235r", "name": "fast-xml-parser: GHSA-8gc5-j5rx-235r", "shortDescription": {"text": "fast-xml-parser: GHSA-8gc5-j5rx-235r"}, "fullDescription": {"text": "fast-xml-parser affected by numeric entity expansion bypassing all entity expansion limits (incomplete fix for CVE-2026-26278)"}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "high", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "GHSA-37qj-frw5-hhjh", "name": "fast-xml-parser: GHSA-37qj-frw5-hhjh", "shortDescription": {"text": "fast-xml-parser: GHSA-37qj-frw5-hhjh"}, "fullDescription": {"text": "fast-xml-parser has RangeError DoS Numeric Entities Bug"}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "high", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "DKC011", "name": "Database service publishes a host port", "shortDescription": {"text": "Database service publishes a host port"}, "fullDescription": {"text": "Publishing database ports to the host increases exposure. Internal Compose networking usually only needs expose, not ports."}, "properties": {"scanner": "repobility-docker", "category": "docker", "severity": "high", "confidence": 0.84, "cwe": "", "owasp": ""}}, {"id": "SEC085", "name": "[SEC085] JS: child_process.exec with non-literal: child_process.exec with user-derived input enables command injection. ", "shortDescription": {"text": "[SEC085] JS: child_process.exec with non-literal: child_process.exec with user-derived input enables command injection. Ported from eslint-plugin-security detect-child-process (Apache-2.0)."}, "fullDescription": {"text": "Use execFile / spawn with separate args array; never pass shell strings."}, "properties": {"scanner": "repobility-threat-engine", "category": "quality", "severity": "high", "confidence": 1.0, "cwe": "", "owasp": ""}}, {"id": "SEC083", "name": "[SEC083] JS: new RegExp() with non-literal: new RegExp(<variable>) \u2014 variable input can craft a ReDoS pattern. Ported fr", "shortDescription": {"text": "[SEC083] JS: new RegExp() with non-literal: new RegExp(<variable>) \u2014 variable input can craft a ReDoS pattern. Ported from eslint-plugin-security detect-non-literal-regexp (Apache-2.0)."}, "fullDescription": {"text": "Use a literal RegExp or whitelist-validate user input before constructing patterns."}, "properties": {"scanner": "repobility-threat-engine", "category": "quality", "severity": "high", "confidence": 1.0, "cwe": "", "owasp": ""}}, {"id": "MINED118", "name": "Dockerfile FROM `node:22-alpine` not pinned by digest", "shortDescription": {"text": "Dockerfile FROM `node:22-alpine` not pinned by digest"}, "fullDescription": {"text": "`FROM node:22-alpine` resolves the tag at build time. The registry CAN re-push a different image for the same tag, so every build is potentially different. Production images should pin to `image@sha256:...` for reproducibility + supply-chain integrity."}, "properties": {"scanner": "repobility-supply-chain", "category": "dependency", "severity": "high", "confidence": 0.9, "cwe": "", "owasp": ""}}, {"id": "CORE_NO_TESTS", "name": "No test files found", "shortDescription": {"text": "No test files found"}, "fullDescription": {"text": "Add a test directory (tests/ or __tests__/) with unit tests for core functionality. Use pytest (Python), Jest (JS/TS), or go test (Go). Start with tests for critical business logic and security-sensitive functions."}, "properties": {"scanner": "repobility-core", "category": "testing", "severity": "high", "confidence": null, "cwe": "", "owasp": ""}}, {"id": "GHSA-m7jm-9gc2-mpf2", "name": "fast-xml-parser: GHSA-m7jm-9gc2-mpf2", "shortDescription": {"text": "fast-xml-parser: GHSA-m7jm-9gc2-mpf2"}, "fullDescription": {"text": "fast-xml-parser has an entity encoding bypass via regex injection in DOCTYPE entity names"}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "critical", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "scanner-bead75b0f9233e05", "name": "No API endpoints detected", "shortDescription": {"text": "No API endpoints detected"}, "fullDescription": {"text": "The scanner did not find FastAPI/Flask/Express/NestJS/GraphQL/gRPC routes. If this repo exposes APIs, the framework may be unsupported."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "info", "confidence": 1.0}}, {"id": "scanner-82e47bc5162e0189", "name": "`truncate` class without `title=` for hover reveal \u2014 src/components/ui/timezone-select.tsx:273", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 src/components/ui/timezone-select.tsx:273"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-c03904b60a70f674", "name": "Stray `console.log` in TS/JS \u2014 src/app/api/callback/route.ts:216", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 src/app/api/callback/route.ts:216"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d9a4ccdb2634a4b8", "name": "Stray `console.log` in TS/JS \u2014 src/app/api/setup/sync/route.ts:429", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 src/app/api/setup/sync/route.ts:429"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-035f02a9d1488fb3", "name": "`truncate` class without `title=` for hover reveal \u2014 src/app/(dashboard)/dashboard/page.tsx:276", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 src/app/(dashboard)/dashboard/page.tsx:276"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-cee5f27ad060f69d", "name": "`truncate` class without `title=` for hover reveal \u2014 src/app/(dashboard)/payloads/page.tsx:506", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 src/app/(dashboard)/payloads/page.tsx:506"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-cb17e8f67493a7e3", "name": "`truncate` class without `title=` for hover reveal \u2014 src/app/(dashboard)/reports/page.tsx:478", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 src/app/(dashboard)/reports/page.tsx:478"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-d324d6e5cd5b9094", "name": "`truncate` class without `title=` for hover reveal \u2014 src/app/(dashboard)/reports/[id]/page.tsx:585", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 src/app/(dashboard)/reports/[id]/page.tsx:585"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-aef7c6d26b1aee62", "name": "Stray `console.log` in TS/JS \u2014 src/lib/cleanup.ts:299", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 src/lib/cleanup.ts:299"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ce15b0de74efb84e", "name": "Stray `console.log` in TS/JS \u2014 src/services/base.service.ts:109", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 src/services/base.service.ts:109"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-835eae4c7f17a2f8", "name": "Docker base image is tag-pinned but not digest-pinned: node:22-alpine", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: node:22-alpine"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5cb3f13f7258bc67", "name": "Insecure pattern 'eval_used' in src/app/route.ts:381", "shortDescription": {"text": "Insecure pattern 'eval_used' in src/app/route.ts:381"}, "fullDescription": {"text": "Found a known-risky pattern (eval_used). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-030b83d65f9ec952", "name": "Insecure pattern 'direct_innerhtml_assignment' in src/app/route.ts:340", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in src/app/route.ts:340"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-340111ff83cecdb8", "name": "Possible secret in src/app/api/setup/sync/route.ts", "shortDescription": {"text": "Possible secret in src/app/api/setup/sync/route.ts"}, "fullDescription": {"text": "Detected pattern matching password_literal. Rotate the credential and move to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-5563481675d7cbee", "name": "Insecure pattern 'eval_used' in src/app/(dashboard)/payloads/page.tsx:226", "shortDescription": {"text": "Insecure pattern 'eval_used' in src/app/(dashboard)/payloads/page.tsx:226"}, "fullDescription": {"text": "Found a known-risky pattern (eval_used). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-663e69a1f83bac14", "name": "Insecure pattern 'cors_wildcard' in src/lib/cors.ts:10", "shortDescription": {"text": "Insecure pattern 'cors_wildcard' in src/lib/cors.ts:10"}, "fullDescription": {"text": "Found a known-risky pattern (cors_wildcard). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0eb1dd0eb91a49c2", "name": "Very large file: src/app/(dashboard)/settings/page.tsx (896 lines)", "shortDescription": {"text": "Very large file: src/app/(dashboard)/settings/page.tsx (896 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-53623be4b24f21e7", "name": "Very large file: src/app/(dashboard)/reports/[id]/page.tsx (1634 lines)", "shortDescription": {"text": "Very large file: src/app/(dashboard)/reports/[id]/page.tsx (1634 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6893a6c8b0861585", "name": "Very low test-to-source ratio", "shortDescription": {"text": "Very low test-to-source ratio"}, "fullDescription": {"text": "0 test file(s) for 80 source file(s) (ratio 0.00). Consider adding integration or unit tests for critical paths."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 9 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-72b2a6250083a784", "name": "Placeholder or mock-heavy implementation detected", "shortDescription": {"text": "Placeholder or mock-heavy implementation detected"}, "fullDescription": {"text": "Found 34 placeholder/mock markers across 10 source files. This often means the repo looks complete while core flows still use generated scaffolding or fake data."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b9088664ace7f748", "name": "Composite production-readiness gap", "shortDescription": {"text": "Composite production-readiness gap"}, "fullDescription": {"text": "Multiple low-cost hardening controls are missing together: ci, tests. Opus verification showed these co-occurring gaps are a better readiness signal than reading each flag in isolation."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-88e9f9a2e38adcff", "name": "`fetch()` without try/.catch or AbortSignal \u2014 src/components/layout/header.tsx:23", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/components/layout/header.tsx:23"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-fdd1436c6046bb1f", "name": "`fetch()` without try/.catch or AbortSignal \u2014 src/app/route.ts:309", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/app/route.ts:309"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-81a462b0a58419ee", "name": "`fetch()` without try/.catch or AbortSignal \u2014 src/app/(dashboard)/payloads/page.tsx:231", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/app/(dashboard)/payloads/page.tsx:231"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f588e0a4f493a6ad", "name": "`fetch()` without try/.catch or AbortSignal \u2014 src/app/(dashboard)/reports/page.tsx:96", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/app/(dashboard)/reports/page.tsx:96"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e104a50c12f810ec", "name": "`fetch()` without try/.catch or AbortSignal \u2014 src/lib/api-client.ts:41", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/lib/api-client.ts:41"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-75670695dd46445c", "name": "`fetch()` without try/.catch or AbortSignal \u2014 src/lib/settings-context.tsx:23", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/lib/settings-context.tsx:23"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1343609900f18b8d", "name": "`fetch()` without try/.catch or AbortSignal \u2014 src/lib/telegram.ts:131", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/lib/telegram.ts:131"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/30715"}, "properties": {"repository": "mastomii/nexss", "repoUrl": "https://github.com/mastomii/nexss", "branch": "main"}, "results": [{"ruleId": "WEB003", "level": "warning", "message": {"text": "Public web service has no security.txt"}, "properties": {"repobilityId": 225136, "scanner": "repobility-web-presence", "fingerprint": "5cd26606c5a53c9f403ff7a92a6917c19cf440a23ce03e2b90e8c493312ef8cd", "category": "quality", "severity": "medium", "confidence": 0.78, "triageState": "open", "verdict": "likely", "isResolved": false, "reason": "Repository looks like a public web app/API but no security.txt file or route was discovered.", "evidence": {"rule_id": "WEB003", "scanner": "repobility-web-presence", "references": ["https://www.rfc-editor.org/rfc/rfc9116", "https://github.com/Lissy93/web-check"], "correlation_key": "fp|5cd26606c5a53c9f403ff7a92a6917c19cf440a23ce03e2b90e8c493312ef8cd"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".well-known/security.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "WEB015", "level": "warning", "message": {"text": "Public web app has no Content Security Policy"}, "properties": {"repobilityId": 225135, "scanner": "repobility-web-presence", "fingerprint": "7eb70cae3ff63d8ed7c31706185d32b37655333b40b58ca826d740b08fb1ad63", "category": "quality", "severity": "medium", "confidence": 0.7, "triageState": "open", "verdict": "likely", "isResolved": false, "reason": "Repository looks like a public web app but no CSP header, framework header config, Helmet policy, or CSP meta tag was discovered.", "evidence": {"rule_id": "WEB015", "scanner": "repobility-web-presence", "references": ["https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP", "https://github.com/Lissy93/web-check"], "correlation_key": "fp|7eb70cae3ff63d8ed7c31706185d32b37655333b40b58ca826d740b08fb1ad63"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "index.html"}, "region": {"startLine": 1}}}]}, {"ruleId": "JRN003", "level": "warning", "message": {"text": "Frontend API reference is not matched by discovered backend routes"}, "properties": {"repobilityId": 225130, "scanner": "repobility-journey-contract", "fingerprint": "c3a61dab40ce88ca4f50907a1f479747c985d5626c45086ce6543dda42450666", "category": "quality", "severity": "medium", "confidence": 0.74, "triageState": "open", "verdict": "likely", "isResolved": false, "reason": "Same-origin /api path appears in frontend code but no discovered backend endpoint has the same route shape.", "evidence": {"rule_id": "JRN003", "scanner": "repobility-journey-contract", "references": ["https://repobility.com/library/authorization/"], "route_shape": "/api/persist", "correlation_key": "fp|c3a61dab40ce88ca4f50907a1f479747c985d5626c45086ce6543dda42450666", "backend_endpoint_count": 42}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/app/(dashboard)/reports/[id]/page.tsx"}, "region": {"startLine": 311}}}]}, {"ruleId": "JRN003", "level": "warning", "message": {"text": "Frontend API reference is not matched by discovered backend routes"}, "properties": {"repobilityId": 225129, "scanner": "repobility-journey-contract", "fingerprint": "0b1fe03b09640113eeeb75d797f80361485185b3f7ffcc7691b9c81d6ba76dcc", "category": "quality", "severity": "medium", "confidence": 0.74, "triageState": "open", "verdict": "likely", "isResolved": false, "reason": "Same-origin /api path appears in frontend code but no discovered backend endpoint has the same route shape.", "evidence": {"rule_id": "JRN003", "scanner": "repobility-journey-contract", "references": ["https://repobility.com/library/authorization/"], "route_shape": "/api/user", "correlation_key": "fp|0b1fe03b09640113eeeb75d797f80361485185b3f7ffcc7691b9c81d6ba76dcc", "backend_endpoint_count": 42}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/app/(dashboard)/profile/page.tsx"}, "region": {"startLine": 127}}}]}, {"ruleId": "JRN003", "level": "warning", "message": {"text": "Frontend API reference is not matched by discovered backend routes"}, "properties": {"repobilityId": 225128, "scanner": "repobility-journey-contract", "fingerprint": "2e3d41fdb33c78069a10659989815928e72221ac5ff0e8ab175f3ae3ad446d6e", "category": "quality", "severity": "medium", "confidence": 0.74, "triageState": "open", "verdict": "likely", "isResolved": false, "reason": "Same-origin /api path appears in frontend code but no discovered backend endpoint has the same route shape.", "evidence": {"rule_id": "JRN003", "scanner": "repobility-journey-contract", "references": ["https://repobility.com/library/authorization/"], "route_shape": "/api/user", "correlation_key": "fp|2e3d41fdb33c78069a10659989815928e72221ac5ff0e8ab175f3ae3ad446d6e", "backend_endpoint_count": 42}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/app/(dashboard)/profile/page.tsx"}, "region": {"startLine": 66}}}]}, {"ruleId": "JRN003", "level": "warning", "message": {"text": "Frontend API reference is not matched by discovered backend routes"}, "properties": {"repobilityId": 225127, "scanner": "repobility-journey-contract", "fingerprint": "98ccb8c8acf6c66962c3a7c8802ab38c7830116ecda3e91adbadbcda29679365", "category": "quality", "severity": "medium", "confidence": 0.74, "triageState": "open", "verdict": "likely", "isResolved": false, "reason": "Same-origin /api path appears in frontend code but no discovered backend endpoint has the same route shape.", "evidence": {"rule_id": "JRN003", "scanner": "repobility-journey-contract", "references": ["https://repobility.com/library/authorization/"], "route_shape": "/api/users", "correlation_key": "fp|98ccb8c8acf6c66962c3a7c8802ab38c7830116ecda3e91adbadbcda29679365", "backend_endpoint_count": 42}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/app/(dashboard)/payloads/page.tsx"}, "region": {"startLine": 465}}}]}, {"ruleId": "JRN003", "level": "warning", "message": {"text": "Frontend API reference is not matched by discovered backend routes"}, "properties": {"repobilityId": 225126, "scanner": "repobility-journey-contract", "fingerprint": "a8525b9aa8fc3435e00df65b0439118f95014e87104c615d3600bab3227b9bde", "category": "quality", "severity": "medium", "confidence": 0.74, "triageState": "open", "verdict": "likely", "isResolved": false, "reason": "Same-origin /api path appears in frontend code but no discovered backend endpoint has the same route shape.", "evidence": {"rule_id": "JRN003", "scanner": "repobility-journey-contract", "references": ["https://repobility.com/library/authorization/"], "route_shape": "/api/settings", "correlation_key": "fp|a8525b9aa8fc3435e00df65b0439118f95014e87104c615d3600bab3227b9bde", "backend_endpoint_count": 42}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/app/(dashboard)/payloads/page.tsx"}, "region": {"startLine": 172}}}]}, {"ruleId": "JRN003", "level": "warning", "message": {"text": "Frontend API reference is not matched by discovered backend routes"}, "properties": {"repobilityId": 225125, "scanner": "repobility-journey-contract", "fingerprint": "441e587b9793c319b7c96bc5a27487807f01cbe4e050645ec3123babb79a9552", "category": "quality", "severity": "medium", "confidence": 0.74, "triageState": "open", "verdict": "likely", "isResolved": false, "reason": "Same-origin /api path appears in frontend code but no discovered backend endpoint has the same route shape.", "evidence": {"rule_id": "JRN003", "scanner": "repobility-journey-contract", "references": ["https://repobility.com/library/authorization/"], "route_shape": "/api/enumeration", "correlation_key": "fp|441e587b9793c319b7c96bc5a27487807f01cbe4e050645ec3123babb79a9552", "backend_endpoint_count": 42}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/app/(dashboard)/payloads/page.tsx"}, "region": {"startLine": 157}}}]}, {"ruleId": "JRN003", "level": "warning", "message": {"text": "Frontend API reference is not matched by discovered backend routes"}, "properties": {"repobilityId": 225124, "scanner": "repobility-journey-contract", "fingerprint": "f3d3ead3161208b61595c504c5d6d1ce825885687939488a364adb05bec40e80", "category": "quality", "severity": "medium", "confidence": 0.74, "triageState": "open", "verdict": "likely", "isResolved": false, "reason": "Same-origin /api path appears in frontend code but no discovered backend endpoint has the same route shape.", "evidence": {"rule_id": "JRN003", "scanner": "repobility-journey-contract", "references": ["https://repobility.com/library/authorization/"], "route_shape": "/api/enumeration", "correlation_key": "fp|f3d3ead3161208b61595c504c5d6d1ce825885687939488a364adb05bec40e80", "backend_endpoint_count": 42}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/app/(dashboard)/payloads/page.tsx"}, "region": {"startLine": 143}}}]}, {"ruleId": "JRN003", "level": "warning", "message": {"text": "Frontend API reference is not matched by discovered backend routes"}, "properties": {"repobilityId": 225123, "scanner": "repobility-journey-contract", "fingerprint": "a97acce04fff5e15643d1694e805e5511b469e98ef11e0f872da21acd1e90f95", "category": "quality", "severity": "medium", "confidence": 0.74, "triageState": "open", "verdict": "likely", "isResolved": false, "reason": "Same-origin /api path appears in frontend code but no discovered backend endpoint has the same route shape.", "evidence": {"rule_id": "JRN003", "scanner": "repobility-journey-contract", "references": ["https://repobility.com/library/authorization/"], "route_shape": "/api/enumeration", "correlation_key": "fp|a97acce04fff5e15643d1694e805e5511b469e98ef11e0f872da21acd1e90f95", "backend_endpoint_count": 42}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/app/(dashboard)/payloads/page.tsx"}, "region": {"startLine": 120}}}]}, {"ruleId": "JRN003", "level": "warning", "message": {"text": "Frontend API reference is not matched by discovered backend routes"}, "properties": {"repobilityId": 225122, "scanner": "repobility-journey-contract", "fingerprint": "e8d726e510efb05c29d2e9280424b01343a966fb942160c6a2f410f38f51b782", "category": "quality", "severity": "medium", "confidence": 0.74, "triageState": "open", "verdict": "likely", "isResolved": false, "reason": "Same-origin /api path appears in frontend code but no discovered backend endpoint has the same route shape.", "evidence": {"rule_id": "JRN003", "scanner": "repobility-journey-contract", "references": ["https://repobility.com/library/authorization/"], "route_shape": "/api/enumeration", "correlation_key": "fp|e8d726e510efb05c29d2e9280424b01343a966fb942160c6a2f410f38f51b782", "backend_endpoint_count": 42}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/app/(dashboard)/payloads/page.tsx"}, "region": {"startLine": 98}}}]}, {"ruleId": "JRN003", "level": "warning", "message": {"text": "Frontend API reference is not matched by discovered backend routes"}, "properties": {"repobilityId": 225121, "scanner": "repobility-journey-contract", "fingerprint": "63a9d5c71063ce0a4d72e1a57857e922fce984bd92cc6df4d380477b09cbb7d6", "category": "quality", "severity": "medium", "confidence": 0.74, "triageState": "open", "verdict": "likely", "isResolved": false, "reason": "Same-origin /api path appears in frontend code but no discovered backend endpoint has the same route shape.", "evidence": {"rule_id": "JRN003", "scanner": "repobility-journey-contract", "references": ["https://repobility.com/library/authorization/"], "route_shape": "/api/settings", "correlation_key": "fp|63a9d5c71063ce0a4d72e1a57857e922fce984bd92cc6df4d380477b09cbb7d6", "backend_endpoint_count": 42}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/app/(dashboard)/payloads/page.tsx"}, "region": {"startLine": 80}}}]}, {"ruleId": "JRN003", "level": "warning", "message": {"text": "Frontend API reference is not matched by discovered backend routes"}, "properties": {"repobilityId": 225120, "scanner": "repobility-journey-contract", "fingerprint": "2d37a9adb6eb458fe5ba67a6ab1685642594faacb4cc4600299ae486997ddbb4", "category": "quality", "severity": "medium", "confidence": 0.74, "triageState": "open", "verdict": "likely", "isResolved": false, "reason": "Same-origin /api path appears in frontend code but no discovered backend endpoint has the same route shape.", "evidence": {"rule_id": "JRN003", "scanner": "repobility-journey-contract", "references": ["https://repobility.com/library/authorization/"], "route_shape": "/api/dashboard", "correlation_key": "fp|2d37a9adb6eb458fe5ba67a6ab1685642594faacb4cc4600299ae486997ddbb4", "backend_endpoint_count": 42}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/app/(dashboard)/dashboard/page.tsx"}, "region": {"startLine": 51}}}]}, {"ruleId": "JRN003", "level": "warning", "message": {"text": "Frontend API reference is not matched by discovered backend routes"}, "properties": {"repobilityId": 225119, "scanner": "repobility-journey-contract", "fingerprint": "e3e7cbf59729a84bf728b6dfbdef62860a27b0507a065fe5b05e343b3433dacf", "category": "quality", "severity": "medium", "confidence": 0.74, "triageState": "open", "verdict": "likely", "isResolved": false, "reason": "Same-origin /api path appears in frontend code but no discovered backend endpoint has the same route shape.", "evidence": {"rule_id": "JRN003", "scanner": "repobility-journey-contract", "references": ["https://repobility.com/library/authorization/"], "route_shape": "/api/enumeration", "correlation_key": "fp|e3e7cbf59729a84bf728b6dfbdef62860a27b0507a065fe5b05e343b3433dacf", "backend_endpoint_count": 42}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "next.config.ts"}, "region": {"startLine": 102}}}]}, {"ruleId": "JRN003", "level": "warning", "message": {"text": "Frontend API reference is not matched by discovered backend routes"}, "properties": {"repobilityId": 225118, "scanner": "repobility-journey-contract", "fingerprint": "a13f8eadeb02d39167db6ecffa71492861a5373307ffbbfee6d3d57b7b10df9b", "category": "quality", "severity": "medium", "confidence": 0.74, "triageState": "open", "verdict": "likely", "isResolved": false, "reason": "Same-origin /api path appears in frontend code but no discovered backend endpoint has the same route shape.", "evidence": {"rule_id": "JRN003", "scanner": "repobility-journey-contract", "references": ["https://repobility.com/library/authorization/"], "route_shape": "/api/traffic", "correlation_key": "fp|a13f8eadeb02d39167db6ecffa71492861a5373307ffbbfee6d3d57b7b10df9b", "backend_endpoint_count": 42}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "next.config.ts"}, "region": {"startLine": 78}}}]}, {"ruleId": "JRN003", "level": "warning", "message": {"text": "Frontend API reference is not matched by discovered backend routes"}, "properties": {"repobilityId": 225117, "scanner": "repobility-journey-contract", "fingerprint": "709cfb8eb7450c3be0d93e4bff884a851d4606240c51e5c69b3f8687cd864e14", "category": "quality", "severity": "medium", "confidence": 0.74, "triageState": "open", "verdict": "likely", "isResolved": false, "reason": "Same-origin /api path appears in frontend code but no discovered backend endpoint has the same route shape.", "evidence": {"rule_id": "JRN003", "scanner": "repobility-journey-contract", "references": ["https://repobility.com/library/authorization/"], "route_shape": "/api/persist", "correlation_key": "fp|709cfb8eb7450c3be0d93e4bff884a851d4606240c51e5c69b3f8687cd864e14", "backend_endpoint_count": 42}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "next.config.ts"}, "region": {"startLine": 54}}}]}, {"ruleId": "JRN003", "level": "warning", "message": {"text": "Frontend API reference is not matched by discovered backend routes"}, "properties": {"repobilityId": 225116, "scanner": "repobility-journey-contract", "fingerprint": "3385c3071041238bde4aa92e562ffd25ffb78bc021f617912d349188ddc68251", "category": "quality", "severity": "medium", "confidence": 0.74, "triageState": "open", "verdict": "likely", "isResolved": false, "reason": "Same-origin /api path appears in frontend code but no discovered backend endpoint has the same route shape.", "evidence": {"rule_id": "JRN003", "scanner": "repobility-journey-contract", "references": ["https://repobility.com/library/authorization/"], "route_shape": "/api/callback", "correlation_key": "fp|3385c3071041238bde4aa92e562ffd25ffb78bc021f617912d349188ddc68251", "backend_endpoint_count": 42}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "next.config.ts"}, "region": {"startLine": 30}}}]}, {"ruleId": "AUC009", "level": "warning", "message": {"text": "[AUC009] Sensitive function route lacks elevated authorization evidence: A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: POST /persist/route."}, "properties": {"repobilityId": 225114, "scanner": "repobility-access-control", "fingerprint": "fdb8ea39420de24f9f2c340ac251a3e22c67ef6d7682580184d9f39755db2ca6", "category": "auth", "severity": "medium", "confidence": 0.68, "triageState": "open", "verdict": "needs_review", "isResolved": false, "reason": "Static route and framework evidence require project-owner confirmation.", "evidence": {"path": "/persist/route", "method": "POST", "scanner": "repobility-access-control", "framework": "Next.js", "correlation_key": "code|auth|token|75|cwe-285", "identity_targets": ["unknown"]}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/app/api/persist/route.ts"}, "region": {"startLine": 75}}}]}, {"ruleId": "AUC009", "level": "warning", "message": {"text": "[AUC009] Sensitive function route lacks elevated authorization evidence: A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: PATCH /enumeration/route."}, "properties": {"repobilityId": 225113, "scanner": "repobility-access-control", "fingerprint": "5a21bfb3d5c4616322bb2914eb361245992a2cc0cfa1aaa0a43ceeaa666e0beb", "category": "auth", "severity": "medium", "confidence": 0.68, "triageState": "open", "verdict": "needs_review", "isResolved": false, "reason": "Static route and framework evidence require project-owner confirmation.", "evidence": {"path": "/enumeration/route", "method": "PATCH", "scanner": "repobility-access-control", "framework": "Next.js", "correlation_key": "code|auth|token|113|cwe-285", "identity_targets": ["authenticated"]}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/app/api/enumeration/route.ts"}, "region": {"startLine": 113}}}]}, {"ruleId": "AUC009", "level": "warning", "message": {"text": "[AUC009] Sensitive function route lacks elevated authorization evidence: A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: DELETE /enumeration/route."}, "properties": {"repobilityId": 225112, "scanner": "repobility-access-control", "fingerprint": "4401fa1489415a41a3249d8aebbb04a9f3805cfefa5bbaeb41b269b7de43df2e", "category": "auth", "severity": "medium", "confidence": 0.68, "triageState": "open", "verdict": "needs_review", "isResolved": false, "reason": "Static route and framework evidence require project-owner confirmation.", "evidence": {"path": "/enumeration/route", "method": "DELETE", "scanner": "repobility-access-control", "framework": "Next.js", "correlation_key": "code|auth|token|84|cwe-285", "identity_targets": ["authenticated"]}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/app/api/enumeration/route.ts"}, "region": {"startLine": 84}}}]}, {"ruleId": "AUC009", "level": "warning", "message": {"text": "[AUC009] Sensitive function route lacks elevated authorization evidence: A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: PUT /enumeration/route."}, "properties": {"repobilityId": 225111, "scanner": "repobility-access-control", "fingerprint": "214960034de9d847d4e984ef68824700b23c89a628d429b9832f736c9f0dbf9d", "category": "auth", "severity": "medium", "confidence": 0.68, "triageState": "open", "verdict": "needs_review", "isResolved": false, "reason": "Static route and framework evidence require project-owner confirmation.", "evidence": {"path": "/enumeration/route", "method": "PUT", "scanner": "repobility-access-control", "framework": "Next.js", "correlation_key": "code|auth|token|47|cwe-285", "identity_targets": ["authenticated"]}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/app/api/enumeration/route.ts"}, "region": {"startLine": 47}}}]}, {"ruleId": "AUC009", "level": "warning", "message": {"text": "[AUC009] Sensitive function route lacks elevated authorization evidence: A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: POST /enumeration/route."}, "properties": {"repobilityId": 225110, "scanner": "repobility-access-control", "fingerprint": "766ca9d764eb0eec48b719afb37b47c8489117d7ab74e8619910a23e2e99ea0d", "category": "auth", "severity": "medium", "confidence": 0.68, "triageState": "open", "verdict": "needs_review", "isResolved": false, "reason": "Static route and framework evidence require project-owner confirmation.", "evidence": {"path": "/enumeration/route", "method": "POST", "scanner": "repobility-access-control", "framework": "Next.js", "correlation_key": "code|auth|token|19|cwe-285", "identity_targets": ["authenticated"]}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/app/api/enumeration/route.ts"}, "region": {"startLine": 19}}}]}, {"ruleId": "AUC009", "level": "warning", "message": {"text": "[AUC009] Sensitive function route lacks elevated authorization evidence: A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: GET /traffic/route."}, "properties": {"repobilityId": 225109, "scanner": "repobility-access-control", "fingerprint": "cff579e00c8a012d177f71e84aacf47705d815b51ac704e8249713d2a4dee701", "category": "auth", "severity": "medium", "confidence": 0.68, "triageState": "open", "verdict": "needs_review", "isResolved": false, "reason": "Static route and framework evidence require project-owner confirmation.", "evidence": {"path": "/traffic/route", "method": "GET", "scanner": "repobility-access-control", "framework": "Next.js", "correlation_key": "code|auth|token|186|cwe-285", "identity_targets": ["authenticated"]}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/app/api/traffic/route.ts"}, "region": {"startLine": 186}}}]}, {"ruleId": "AUC009", "level": "warning", "message": {"text": "[AUC009] Sensitive function route lacks elevated authorization evidence: A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: PUT /user/route."}, "properties": {"repobilityId": 225108, "scanner": "repobility-access-control", "fingerprint": "1a7357d32a406ffe90490e371add02f4b1c3c797f0d2154c54e196b8e5ee0f88", "category": "auth", "severity": "medium", "confidence": 0.68, "triageState": "open", "verdict": "needs_review", "isResolved": false, "reason": "Static route and framework evidence require project-owner confirmation.", "evidence": {"path": "/user/route", "method": "PUT", "scanner": "repobility-access-control", "framework": "Next.js", "correlation_key": "code|auth|src/app/api/user/route.ts|23|cwe-285", "identity_targets": ["authenticated"]}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/app/api/user/route.ts"}, "region": {"startLine": 23}}}]}, {"ruleId": "AUC009", "level": "warning", "message": {"text": "[AUC009] Sensitive function route lacks elevated authorization evidence: A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: GET /user/route."}, "properties": {"repobilityId": 225107, "scanner": "repobility-access-control", "fingerprint": "7436030b26cfc90d31f3cfc96289fb39cf732b73ae7568175c913895725ecf6c", "category": "auth", "severity": "medium", "confidence": 0.68, "triageState": "open", "verdict": "needs_review", "isResolved": false, "reason": "Static route and framework evidence require project-owner confirmation.", "evidence": {"path": "/user/route", "method": "GET", "scanner": "repobility-access-control", "framework": "Next.js", "correlation_key": "code|auth|src/app/api/user/route.ts|7|cwe-285", "identity_targets": ["authenticated"]}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/app/api/user/route.ts"}, "region": {"startLine": 7}}}]}, {"ruleId": "AUC009", "level": "warning", "message": {"text": "[AUC009] Sensitive function route lacks elevated authorization evidence: A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: GET /reports/route."}, "properties": {"repobilityId": 225106, "scanner": "repobility-access-control", "fingerprint": "ebc469f00c3d7a4b991f38132163d18e75319f73e8a611457efc316eb2e18313", "category": "auth", "severity": "medium", "confidence": 0.68, "triageState": "open", "verdict": "needs_review", "isResolved": false, "reason": "Static route and framework evidence require project-owner confirmation.", "evidence": {"path": "/reports/route", "method": "GET", "scanner": "repobility-access-control", "framework": "Next.js", "correlation_key": "code|auth|token|6|cwe-285", "identity_targets": ["authenticated"]}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/app/api/reports/route.ts"}, "region": {"startLine": 6}}}]}, {"ruleId": "AUC004", "level": "warning", "message": {"text": "[AUC004] Admin route does not show super_admin separation: An administrative route was detected without nearby evidence that platform super_admin access is separated from tenant/application admin access. Endpoint: POST /settings/route."}, "properties": {"repobilityId": 225105, "scanner": "repobility-access-control", "fingerprint": "e522708905308293562f0ffdfb7ad32e4ee00a10dd73b1fdbd5aafe61c31f52a", "category": "auth", "severity": "medium", "confidence": 0.66, "triageState": "open", "verdict": "needs_review", "isResolved": false, "reason": "Static route and framework evidence require project-owner confirmation.", "evidence": {"path": "/settings/route", "method": "POST", "scanner": "repobility-access-control", "framework": "Next.js", "correlation_key": "code|auth|token|63|cwe-285", "identity_targets": ["authenticated", "admin"]}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/app/api/settings/route.ts"}, "region": {"startLine": 63}}}]}, {"ruleId": "AUC004", "level": "warning", "message": {"text": "[AUC004] Admin route does not show super_admin separation: An administrative route was detected without nearby evidence that platform super_admin access is separated from tenant/application admin access. Endpoint: PUT /settings/route."}, "properties": {"repobilityId": 225104, "scanner": "repobility-access-control", "fingerprint": "571d4f9441f2371806632b8e0ca186513f35ff669880003ab6005e5aeb5a9a5c", "category": "auth", "severity": "medium", "confidence": 0.66, "triageState": "open", "verdict": "needs_review", "isResolved": false, "reason": "Static route and framework evidence require project-owner confirmation.", "evidence": {"path": "/settings/route", "method": "PUT", "scanner": "repobility-access-control", "framework": "Next.js", "correlation_key": "code|auth|token|24|cwe-285", "identity_targets": ["authenticated", "admin"]}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/app/api/settings/route.ts"}, "region": {"startLine": 24}}}]}, {"ruleId": "AUC009", "level": "warning", "message": {"text": "[AUC009] Sensitive function route lacks elevated authorization evidence: A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: GET /enumeration/route."}, "properties": {"repobilityId": 225103, "scanner": "repobility-access-control", "fingerprint": "e6dcbd41dc6c91bb119d12e4590af2dcf986ac6660ee65711557dcc83e7189cb", "category": "auth", "severity": "medium", "confidence": 0.68, "triageState": "open", "verdict": "needs_review", "isResolved": false, "reason": "Static route and framework evidence require project-owner confirmation. Collapsed 1 duplicate scanner signal(s) for the same underlying issue.", "evidence": {"path": "/enumeration/route", "method": "GET", "scanner": "repobility-access-control", "framework": "Next.js", "correlation_key": "code|auth|token|8|cwe-285", "duplicate_count": 1, "identity_targets": ["authenticated"], "duplicate_rule_ids": ["AUC004", "AUC009"], "duplicate_scanners": ["repobility-access-control"], "duplicate_fingerprints": ["b824157f00268962efb1dda8e78b5ec01bb740bad293c9923cf6fea38b622295", "e6dcbd41dc6c91bb119d12e4590af2dcf986ac6660ee65711557dcc83e7189cb"]}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/app/api/enumeration/route.ts"}, "region": {"startLine": 8}}}]}, {"ruleId": "AUC001", "level": "warning", "message": {"text": "[AUC001] No Repobility access matrix policy found: The repository uses web/API frameworks but does not define .repobility/access.yml or equivalent authorization documentation."}, "properties": {"repobilityId": 225102, "scanner": "repobility-access-control", "fingerprint": "f1305052c3ba1e6c1cdb5dccc19e58a8168cf78b176658f32b1fc823df3e9d10", "category": "auth", "severity": "medium", "confidence": 0.92, "triageState": "open", "verdict": "likely", "isResolved": false, "reason": "Static route and framework evidence require project-owner confirmation.", "evidence": {"scanner": "repobility-access-control", "frameworks": ["Next.js"], "expected_files": [".repobility/access.yml", ".repobility/access.yaml", ".repobility/access.json", ".repobility/authorization.yml"], "correlation_key": "fp|f1305052c3ba1e6c1cdb5dccc19e58a8168cf78b176658f32b1fc823df3e9d10"}}}, {"ruleId": "GHSA-qx2v-qp2m-jg93", "level": "warning", "message": {"text": "postcss: GHSA-qx2v-qp2m-jg93"}, "properties": {"repobilityId": 225101, "scanner": "osv-scanner", "fingerprint": "33aa829b4458c5ef73d832c9e568cf3032217bd31f4b18cc6a572d90111a50bb", "category": "dependency", "severity": "medium", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["CVE-2026-41305"], "package": "postcss", "rule_id": "GHSA-qx2v-qp2m-jg93", "scanner": "osv-scanner", "correlation_key": "vuln|postcss|CVE-2026-41305|package-lock.json"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "GHSA-3v7f-55p6-f55p", "level": "warning", "message": {"text": "picomatch: GHSA-3v7f-55p6-f55p"}, "properties": {"repobilityId": 225099, "scanner": "osv-scanner", "fingerprint": "d01f2097e7b318fed09051dc9486d1856dda99f71ea520983bca2d575128e70d", "category": "dependency", "severity": "medium", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["CVE-2026-33672"], "package": "picomatch", "rule_id": "GHSA-3v7f-55p6-f55p", "scanner": "osv-scanner", "correlation_key": "vuln|picomatch|CVE-2026-33672|package-lock.json"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "GHSA-wfc6-r584-vfw7", "level": "warning", "message": {"text": "next: GHSA-wfc6-r584-vfw7"}, "properties": {"repobilityId": 225098, "scanner": "osv-scanner", "fingerprint": "b135063ee03824d6cf1e30a6a6aac40f574e1115e9b4b1c66c5e989952dc04fb", "category": "dependency", "severity": "medium", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["CVE-2026-44576"], "package": "next", "rule_id": "GHSA-wfc6-r584-vfw7", "scanner": "osv-scanner", "correlation_key": "vuln|next|CVE-2026-44576|package-lock.json"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "GHSA-mq59-m269-xvcx", "level": "warning", "message": {"text": "next: GHSA-mq59-m269-xvcx"}, "properties": {"repobilityId": 225095, "scanner": "osv-scanner", "fingerprint": "9f429329769ffcf4be2c21cd106265a7b0733c3d852097844d0bc0441ea90da4", "category": "dependency", "severity": "medium", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["CVE-2026-27978"], "package": "next", "rule_id": "GHSA-mq59-m269-xvcx", "scanner": "osv-scanner", "correlation_key": "vuln|next|CVE-2026-27978|package-lock.json"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "GHSA-h64f-5h5j-jqjh", "level": "warning", "message": {"text": "next: GHSA-h64f-5h5j-jqjh"}, "properties": {"repobilityId": 225092, "scanner": "osv-scanner", "fingerprint": "a1dfd0945a57e11c2bef9ff1a367d8e3717d6f85b2d9c963a9923283f4130bda", "category": "dependency", "severity": "medium", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["CVE-2026-44577"], "package": "next", "rule_id": "GHSA-h64f-5h5j-jqjh", "scanner": "osv-scanner", "correlation_key": "vuln|next|CVE-2026-44577|package-lock.json"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "GHSA-h27x-g6w4-24gq", "level": "warning", "message": {"text": "next: GHSA-h27x-g6w4-24gq"}, "properties": {"repobilityId": 225091, "scanner": "osv-scanner", "fingerprint": "ddfb7bea7625f556f57c59924ee16282e11df66da96be3a81794fce231bf63ac", "category": "dependency", "severity": "medium", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["CVE-2026-27979"], "package": "next", "rule_id": "GHSA-h27x-g6w4-24gq", "scanner": "osv-scanner", "correlation_key": "vuln|next|CVE-2026-27979|package-lock.json"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "GHSA-gx5p-jg67-6x7h", "level": "warning", "message": {"text": "next: GHSA-gx5p-jg67-6x7h"}, "properties": {"repobilityId": 225089, "scanner": "osv-scanner", "fingerprint": "90ba648bcec3971ebd91627a1eab941850d4e6fd16d341d52fd70c8994d30530", "category": "dependency", "severity": "medium", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["CVE-2026-44580"], "package": "next", "rule_id": "GHSA-gx5p-jg67-6x7h", "scanner": "osv-scanner", "correlation_key": "vuln|next|CVE-2026-44580|package-lock.json"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "GHSA-ggv3-7p47-pfv8", "level": "warning", "message": {"text": "next: GHSA-ggv3-7p47-pfv8"}, "properties": {"repobilityId": 225088, "scanner": "osv-scanner", "fingerprint": "6d9bb335a8f5e9f9435ace6347fd98e0df3601efa1b88e34a3ed4850c3200123", "category": "dependency", "severity": "medium", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["CVE-2026-29057"], "package": "next", "rule_id": "GHSA-ggv3-7p47-pfv8", "scanner": "osv-scanner", "correlation_key": "vuln|next|CVE-2026-29057|package-lock.json"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "GHSA-ffhc-5mcf-pf4q", "level": "warning", "message": {"text": "next: GHSA-ffhc-5mcf-pf4q"}, "properties": {"repobilityId": 225087, "scanner": "osv-scanner", "fingerprint": "92be124c35f21e4a1f71e03937b28d99993213a328a38f184cbc4723c7bf0fd8", "category": "dependency", "severity": "medium", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["CVE-2026-44581"], "package": "next", "rule_id": "GHSA-ffhc-5mcf-pf4q", "scanner": "osv-scanner", "correlation_key": "vuln|next|CVE-2026-44581|package-lock.json"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "GHSA-9g9p-9gw9-jx7f", "level": "warning", "message": {"text": "next: GHSA-9g9p-9gw9-jx7f"}, "properties": {"repobilityId": 225085, "scanner": "osv-scanner", "fingerprint": "f8a00943da541498cf7d1651274f627cd957f17d8cd01c58149ca57a69d72f70", "category": "dependency", "severity": "medium", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["CVE-2025-59471"], "package": "next", "rule_id": "GHSA-9g9p-9gw9-jx7f", "scanner": "osv-scanner", "correlation_key": "vuln|next|CVE-2025-59471|package-lock.json"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "GHSA-5f7q-jpqc-wp7h", "level": "warning", "message": {"text": "next: GHSA-5f7q-jpqc-wp7h"}, "properties": {"repobilityId": 225083, "scanner": "osv-scanner", "fingerprint": "59746009347b39fd8b6d9f7f32c58bf0fa5474c696782bdcb0613f69bb169081", "category": "dependency", "severity": "medium", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["CVE-2025-59472"], "package": "next", "rule_id": "GHSA-5f7q-jpqc-wp7h", "scanner": "osv-scanner", "correlation_key": "vuln|next|CVE-2025-59472|package-lock.json"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "GHSA-3x4c-7xq6-9pq8", "level": "warning", "message": {"text": "next: GHSA-3x4c-7xq6-9pq8"}, "properties": {"repobilityId": 225081, "scanner": "osv-scanner", "fingerprint": "9695b74d580d0559aa92621bb451e796987ab996cc4791024990a23849942658", "category": "dependency", "severity": "medium", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["CVE-2026-27980"], "package": "next", "rule_id": "GHSA-3x4c-7xq6-9pq8", "scanner": "osv-scanner", "correlation_key": "vuln|next|CVE-2026-27980|package-lock.json"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "GHSA-h67p-54hq-rp68", "level": "warning", "message": {"text": "js-yaml: GHSA-h67p-54hq-rp68"}, "properties": {"repobilityId": 225073, "scanner": "osv-scanner", "fingerprint": "7476d7f6ef55e64a558471197b18238875bd6ca44de25c3d4684d515590f8f8a", "category": "dependency", "severity": "medium", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["CVE-2026-53550"], "package": "js-yaml", "rule_id": "GHSA-h67p-54hq-rp68", "scanner": "osv-scanner", "correlation_key": "vuln|js-yaml|CVE-2026-53550|package-lock.json"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "GHSA-jp2q-39xq-3w4g", "level": "warning", "message": {"text": "fast-xml-parser: GHSA-jp2q-39xq-3w4g"}, "properties": {"repobilityId": 225069, "scanner": "osv-scanner", "fingerprint": "1c3c4b0149a577c61e8a3dad0583f86b5f18ef51845b2bbc6d9ac37105ede583", "category": "dependency", "severity": "medium", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["CVE-2026-33349"], "package": "fast-xml-parser", "rule_id": "GHSA-jp2q-39xq-3w4g", "scanner": "osv-scanner", "correlation_key": "vuln|fast-xml-parser|CVE-2026-33349|package-lock.json"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "GHSA-gh4j-gqv2-49f6", "level": "warning", "message": {"text": "fast-xml-parser: GHSA-gh4j-gqv2-49f6"}, "properties": {"repobilityId": 225068, "scanner": "osv-scanner", "fingerprint": "56411109eb0f6c1436a466bff3f9655d09b243240d5810279e07b0cc81ce4dfa", "category": "dependency", "severity": "medium", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["CVE-2026-41650"], "package": "fast-xml-parser", "rule_id": "GHSA-gh4j-gqv2-49f6", "scanner": "osv-scanner", "correlation_key": "vuln|fast-xml-parser|CVE-2026-41650|package-lock.json"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "GHSA-f886-m6hf-6m8v", "level": "warning", "message": {"text": "brace-expansion: GHSA-f886-m6hf-6m8v"}, "properties": {"repobilityId": 225064, "scanner": "osv-scanner", "fingerprint": "e8eb0ab1ffbb15b3b127c7436af364aa04d69dbc42fb22d21fcb4f304d428269", "category": "dependency", "severity": "medium", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["CVE-2026-33750"], "package": "brace-expansion", "rule_id": "GHSA-f886-m6hf-6m8v", "scanner": "osv-scanner", "correlation_key": "vuln|brace-expansion|CVE-2026-33750|package-lock.json"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "GHSA-2g4f-4pwh-qvx6", "level": "warning", "message": {"text": "ajv: GHSA-2g4f-4pwh-qvx6"}, "properties": {"repobilityId": 225063, "scanner": "osv-scanner", "fingerprint": "b6e4ab66cc3522d009fa9b7b4cb49ad3d9a60843a6d25559c80bbc6b5b65b8d7", "category": "dependency", "severity": "medium", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["CVE-2025-69873"], "package": "ajv", "rule_id": "GHSA-2g4f-4pwh-qvx6", "scanner": "osv-scanner", "correlation_key": "vuln|ajv|CVE-2025-69873|package-lock.json"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "DKR014", "level": "warning", "message": {"text": "Dockerfile copies broad context with incomplete .dockerignore"}, "properties": {"repobilityId": 225057, "scanner": "repobility-docker", "fingerprint": "dfe8dc72e764f7ceaa72db9fbca6c0e032f50e03486a1364e3d7c913cf6dd740", "category": "docker", "severity": "medium", "confidence": 0.76, "triageState": "open", "verdict": "likely", "isResolved": false, "reason": "Broad context copy found and .dockerignore misses sensitive defaults.", "evidence": {"rule_id": "DKR014", "scanner": "repobility-docker", "references": ["https://docs.docker.com/develop/develop-images/dockerfile_best-practices/"], "correlation_key": "fp|dfe8dc72e764f7ceaa72db9fbca6c0e032f50e03486a1364e3d7c913cf6dd740", "missing_patterns": ["id_rsa", "*.pem", "*.key"]}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Dockerfile"}, "region": {"startLine": 25}}}]}, {"ruleId": "SEC045", "level": "warning", "message": {"text": "[SEC045] eval()/exec() on stored or user-supplied data: eval() and exec() on data \u2014 even admin-stored data \u2014 is a lateral-movement vector after any one credential compromise. Sandboxes (__builtins__ cleared) are escapable: attackers use object introspection (().__class__.__mro__[-1].__subclasses__()) to reach os.system. CWE-95 (eval injection)."}, "properties": {"repobilityId": 225053, "scanner": "repobility-threat-engine", "fingerprint": "eeccb7f8ba18c336820f3e6bb38e7777ffd55e0f4ddad8a9bcc26ec716a44de3", "category": "injection", "severity": "medium", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": ".exec(", "reason": "Pattern matched with no mitigating context found", "rule_id": "SEC045", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "code|injection|token|75|sec045"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/components/ui/virtual-code-viewer.tsx"}, "region": {"startLine": 75}}}]}, {"ruleId": "AGT006", "level": "warning", "message": {"text": "React interval is created without an explicit cleanup"}, "properties": {"repobilityId": 225042, "scanner": "repobility-agent-runtime", "fingerprint": "e2953badd0f76bff0b23bac46877210e00243da4629e3688e85135ebc3dfcc71", "category": "quality", "severity": "medium", "confidence": 0.78, "triageState": "open", "verdict": "likely", "isResolved": false, "reason": "File uses setInterval with useEffect or hook-style code and no clearInterval cleanup was found.", "evidence": {"rule_id": "AGT006", "scanner": "repobility-agent-runtime", "references": ["https://react.dev/reference/react/useEffect"], "correlation_key": "fp|e2953badd0f76bff0b23bac46877210e00243da4629e3688e85135ebc3dfcc71"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/app/route.ts"}, "region": {"startLine": 292}}}]}, {"ruleId": "DEPCUR-NPM", "level": "warning", "message": {"text": "npm package `otplib` is 1 major version(s) behind (12.0.1 -> 13.4.1)"}, "properties": {"repobilityId": 225036, "scanner": "repobility-dependency-currency", "fingerprint": "602c97596c6eeb1ada1d72d60a552d6c3b74dd7a8e6414d2061e733e3b77932f", "category": "dependency", "severity": "medium", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"gap": "1 major version(s) behind", "signal": "currency", "cwe_ids": [], "package": "otplib", "scanner": "repobility-dependency-currency", "ecosystem": "npm", "languages": ["javascript"], "latest_version": "13.4.1", "correlation_key": "fp|602c97596c6eeb1ada1d72d60a552d6c3b74dd7a8e6414d2061e733e3b77932f", "current_version": "12.0.1"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "CORE_NO_CI", "level": "warning", "message": {"text": "No CI/CD configuration found"}, "properties": {"repobilityId": 225026, "scanner": "repobility-core", "fingerprint": "ca5da3551af97272c4f099fc472740148135a15816b81b90bd862e8f91ec66ce", "category": "practices", "severity": "medium", "confidence": null, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"rule_id": "CORE_NO_CI", "scanner": "repobility-core", "correlation_key": "repo|practices|core_no_ci"}}}, {"ruleId": "WEB011", "level": "note", "message": {"text": "Public web app has no humans.txt"}, "properties": {"repobilityId": 225134, "scanner": "repobility-web-presence", "fingerprint": "bdd551fbe1ab6405480e0d5755632562c2096cb9e9a6a071ef60e4c27a6873f1", "category": "quality", "severity": "low", "confidence": 0.5, "triageState": "open", "verdict": "needs_review", "isResolved": false, "reason": "Repository looks like a public web app but no humans.txt file or route was discovered.", "evidence": {"rule_id": "WEB011", "scanner": "repobility-web-presence", "references": ["https://github.com/Lissy93/web-check"], "correlation_key": "fp|bdd551fbe1ab6405480e0d5755632562c2096cb9e9a6a071ef60e4c27a6873f1"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "humans.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "WEB008", "level": "note", "message": {"text": "Public docs site has no llms.txt"}, "properties": {"repobilityId": 225133, "scanner": "repobility-web-presence", "fingerprint": "cdce8ed8706710d39c3e7272dad572dd639cff74fd3d2ac62d8f6f522b891d76", "category": "quality", "severity": "low", "confidence": 0.64, "triageState": "open", "verdict": "needs_review", "isResolved": false, "reason": "Repository looks public and documentation-heavy but no llms.txt file or route was discovered.", "evidence": {"rule_id": "WEB008", "scanner": "repobility-web-presence", "references": ["https://llmstxt.org/"], "correlation_key": "fp|cdce8ed8706710d39c3e7272dad572dd639cff74fd3d2ac62d8f6f522b891d76"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "llms.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "WEB002", "level": "note", "message": {"text": "Public web app has no sitemap"}, "properties": {"repobilityId": 225132, "scanner": "repobility-web-presence", "fingerprint": "fccbe72d13ca3ba9197ec37b0daa0802fb6d5ebff54b3eb9f09b59b0f8d0acdf", "category": "quality", "severity": "low", "confidence": 0.72, "triageState": "open", "verdict": "likely", "isResolved": false, "reason": "Repository looks like a public web app but no sitemap file or route was discovered.", "evidence": {"rule_id": "WEB002", "scanner": "repobility-web-presence", "references": ["https://www.sitemaps.org/protocol.html", "https://github.com/Lissy93/web-check"], "correlation_key": "fp|fccbe72d13ca3ba9197ec37b0daa0802fb6d5ebff54b3eb9f09b59b0f8d0acdf"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "sitemap.xml"}, "region": {"startLine": 1}}}]}, {"ruleId": "AUC005", "level": "note", "message": {"text": "[AUC005] No authorization-focused tests detected: No test files with common authorization, ownership, 403, admin, or super_admin assertions were found."}, "properties": {"repobilityId": 225115, "scanner": "repobility-access-control", "fingerprint": "c58bb88e6682225dc480b3036f30153044953a3d94f500396678a77324e8d30e", "category": "auth", "severity": "low", "confidence": 0.76, "triageState": "open", "verdict": "needs_review", "isResolved": false, "reason": "Static route and framework evidence require project-owner confirmation.", "evidence": {"scanner": "repobility-access-control", "frameworks": ["Next.js"], "correlation_key": "fp|c58bb88e6682225dc480b3036f30153044953a3d94f500396678a77324e8d30e"}}}, {"ruleId": "GHSA-vfv6-92ff-j949", "level": "note", "message": {"text": "next: GHSA-vfv6-92ff-j949"}, "properties": {"repobilityId": 225097, "scanner": "osv-scanner", "fingerprint": "020875b224996bae0292b1c4c40a8f42cbf22211fc1f510c40b8efc0ebefd7f5", "category": "dependency", "severity": "low", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["CVE-2026-44582"], "package": "next", "rule_id": "GHSA-vfv6-92ff-j949", "scanner": "osv-scanner", "correlation_key": "vuln|next|CVE-2026-44582|package-lock.json"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "GHSA-jcc7-9wpm-mj36", "level": "note", "message": {"text": "next: GHSA-jcc7-9wpm-mj36"}, "properties": {"repobilityId": 225093, "scanner": "osv-scanner", "fingerprint": "ca689a4e09876def8df077fb6e8eb7830c4d32fc72e28ec1a2e8a79e727ecb9c", "category": "dependency", "severity": "low", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["CVE-2026-27977"], "package": "next", "rule_id": "GHSA-jcc7-9wpm-mj36", "scanner": "osv-scanner", "correlation_key": "vuln|next|CVE-2026-27977|package-lock.json"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "GHSA-3g8h-86w9-wvmq", "level": "note", "message": {"text": "next: GHSA-3g8h-86w9-wvmq"}, "properties": {"repobilityId": 225080, "scanner": "osv-scanner", "fingerprint": "38510533c287efb9e7623096f4a697e2ff4c505d6885330e9cd14b714b201040", "category": "dependency", "severity": "low", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["CVE-2026-44572"], "package": "next", "rule_id": "GHSA-3g8h-86w9-wvmq", "scanner": "osv-scanner", "correlation_key": "vuln|next|CVE-2026-44572|package-lock.json"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "GHSA-fj3w-jwp8-x2g3", "level": "note", "message": {"text": "fast-xml-parser: GHSA-fj3w-jwp8-x2g3"}, "properties": {"repobilityId": 225067, "scanner": "osv-scanner", "fingerprint": "9f54b0976937f53962f6089a38dbbbca1ede054e21d8a5cb3203a7002ef0d0b7", "category": "dependency", "severity": "low", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["CVE-2026-27942"], "package": "fast-xml-parser", "rule_id": "GHSA-fj3w-jwp8-x2g3", "scanner": "osv-scanner", "correlation_key": "vuln|fast-xml-parser|CVE-2026-27942|package-lock.json"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "GHSA-4x5r-pxfx-6jf8", "level": "note", "message": {"text": "@babel/core: GHSA-4x5r-pxfx-6jf8"}, "properties": {"repobilityId": 225062, "scanner": "osv-scanner", "fingerprint": "83a5d14bb8496c702b322c8a881008f257b51a7cfd23a89cb5bf189f592903e2", "category": "dependency", "severity": "low", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["CVE-2026-49356"], "package": "@babel/core", "rule_id": "GHSA-4x5r-pxfx-6jf8", "scanner": "osv-scanner", "correlation_key": "vuln|babel/core|CVE-2026-49356|package-lock.json"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "DKC017", "level": "note", "message": {"text": "Database password is wired through an environment variable placeholder"}, "properties": {"repobilityId": 225061, "scanner": "repobility-docker", "fingerprint": "261483014a92ad22f51bd924ffd2d55c6c402815cdee33e344899b84323e8051", "category": "docker", "severity": "low", "confidence": 0.58, "triageState": "open", "verdict": "needs_review", "isResolved": false, "reason": "Database image supports file-based secret variables, but only placeholder environment variables were found.", "evidence": {"rule_id": "DKC017", "scanner": "repobility-docker", "service": "db", "variables": ["POSTGRES_PASSWORD"], "references": ["https://docs.docker.com/compose/how-tos/use-secrets/"], "correlation_key": "fp|261483014a92ad22f51bd924ffd2d55c6c402815cdee33e344899b84323e8051"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docker-compose.yml"}, "region": {"startLine": 38}}}]}, {"ruleId": "DKC010", "level": "note", "message": {"text": "Compose service lacks no-new-privileges hardening"}, "properties": {"repobilityId": 225059, "scanner": "repobility-docker", "fingerprint": "ea8d03e4703f381cfc74cf72cf0a3c10b7b8b592f04fb71f56b7422334925264", "category": "docker", "severity": "low", "confidence": 0.62, "triageState": "open", "verdict": "needs_review", "isResolved": false, "reason": "App-like service has no security_opt no-new-privileges setting.", "evidence": {"rule_id": "DKC010", "scanner": "repobility-docker", "service": "app", "references": ["https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html"], "correlation_key": "fp|ea8d03e4703f381cfc74cf72cf0a3c10b7b8b592f04fb71f56b7422334925264"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docker-compose.yml"}, "region": {"startLine": 4}}}]}, {"ruleId": "DKR008", "level": "note", "message": {"text": ".dockerignore misses sensitive defaults"}, "properties": {"repobilityId": 225058, "scanner": "repobility-docker", "fingerprint": "aea2ad92c68c4ee1f8432bb1ec25e7d45ac12c9e1790ac2d3fffe638b1acce12", "category": "docker", "severity": "low", "confidence": 0.72, "triageState": "open", "verdict": "likely", "isResolved": false, "reason": "A Docker build context should exclude secrets and repository metadata.", "evidence": {"rule_id": "DKR008", "scanner": "repobility-docker", "references": ["https://docs.docker.com/develop/develop-images/dockerfile_best-practices/"], "correlation_key": "fp|aea2ad92c68c4ee1f8432bb1ec25e7d45ac12c9e1790ac2d3fffe638b1acce12", "missing_patterns": ["id_rsa", "*.pem", "*.key"]}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".dockerignore"}, "region": {"startLine": 1}}}]}, {"ruleId": "DEPCUR-NPM", "level": "note", "message": {"text": "npm package `tailwind-merge` is minor version(s) behind (3.4.0 -> 3.6.0)"}, "properties": {"repobilityId": 225041, "scanner": "repobility-dependency-currency", "fingerprint": "31f7a7ae4b54882728ea54b9f8394bef0a25dcf6c66df7f869e468bc70b44e58", "category": "dependency", "severity": "low", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"gap": "minor version(s) behind", "signal": "currency", "cwe_ids": [], "package": "tailwind-merge", "scanner": "repobility-dependency-currency", "ecosystem": "npm", "languages": ["javascript"], "latest_version": "3.6.0", "correlation_key": "fp|31f7a7ae4b54882728ea54b9f8394bef0a25dcf6c66df7f869e468bc70b44e58", "current_version": "3.4.0"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "DEPCUR-NPM", "level": "note", "message": {"text": "npm package `swr` is minor version(s) behind (2.3.8 -> 2.4.1)"}, "properties": {"repobilityId": 225040, "scanner": "repobility-dependency-currency", "fingerprint": "4183f9da8decb837e62180eca5ad3c1624a08650fc06c98a0adfbefd22597acf", "category": "dependency", "severity": "low", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"gap": "minor version(s) behind", "signal": "currency", "cwe_ids": [], "package": "swr", "scanner": "repobility-dependency-currency", "ecosystem": "npm", "languages": ["javascript"], "latest_version": "2.4.1", "correlation_key": "fp|4183f9da8decb837e62180eca5ad3c1624a08650fc06c98a0adfbefd22597acf", "current_version": "2.3.8"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "DEPCUR-NPM", "level": "note", "message": {"text": "npm package `sharp` is minor version(s) behind (0.34.5 -> 0.35.1)"}, "properties": {"repobilityId": 225039, "scanner": "repobility-dependency-currency", "fingerprint": "b29bcfaf703c2b134b867cd77d55b39846e50eca91505c15ba289375819e7d1f", "category": "dependency", "severity": "low", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"gap": "minor version(s) behind", "signal": "currency", "cwe_ids": [], "package": "sharp", "scanner": "repobility-dependency-currency", "ecosystem": "npm", "languages": ["javascript"], "latest_version": "0.35.1", "correlation_key": "fp|b29bcfaf703c2b134b867cd77d55b39846e50eca91505c15ba289375819e7d1f", "current_version": "0.34.5"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "DEPCUR-NPM", "level": "note", "message": {"text": "npm package `pg` is minor version(s) behind (8.16.3 -> 8.21.0)"}, "properties": {"repobilityId": 225037, "scanner": "repobility-dependency-currency", "fingerprint": "396882ef0720a601f92bd6ef91df8e2008d4516982826e5933ade8c1f4f713a9", "category": "dependency", "severity": "low", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"gap": "minor version(s) behind", "signal": "currency", "cwe_ids": [], "package": "pg", "scanner": "repobility-dependency-currency", "ecosystem": "npm", "languages": ["javascript"], "latest_version": "8.21.0", "correlation_key": "fp|396882ef0720a601f92bd6ef91df8e2008d4516982826e5933ade8c1f4f713a9", "current_version": "8.16.3"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "DEPCUR-NPM", "level": "note", "message": {"text": "npm package `jose` is minor version(s) behind (6.1.3 -> 6.2.3)"}, "properties": {"repobilityId": 225035, "scanner": "repobility-dependency-currency", "fingerprint": "597be1932a8b949a12c6462bac4e424750017606c65ac7327f4a2a9ad2f30a85", "category": "dependency", "severity": "low", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"gap": "minor version(s) behind", "signal": "currency", "cwe_ids": [], "package": "jose", "scanner": "repobility-dependency-currency", "ecosystem": "npm", "languages": ["javascript"], "latest_version": "6.2.3", "correlation_key": "fp|597be1932a8b949a12c6462bac4e424750017606c65ac7327f4a2a9ad2f30a85", "current_version": "6.1.3"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "DEPCUR-NPM", "level": "note", "message": {"text": "npm package `@types/pg` is minor version(s) behind (8.16.0 -> 8.20.0)"}, "properties": {"repobilityId": 225034, "scanner": "repobility-dependency-currency", "fingerprint": "6e1bfb6037a95e082ad474956a158254069a41a5d64e29e080bd29dfcf95836b", "category": "dependency", "severity": "low", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"gap": "minor version(s) behind", "signal": "currency", "cwe_ids": [], "package": "@types/pg", "scanner": "repobility-dependency-currency", "ecosystem": "npm", "languages": ["javascript"], "latest_version": "8.20.0", "correlation_key": "fp|6e1bfb6037a95e082ad474956a158254069a41a5d64e29e080bd29dfcf95836b", "current_version": "8.16.0"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "AIC003", "level": "note", "message": {"text": "Duplicated implementation block across source files"}, "properties": {"repobilityId": 225030, "scanner": "repobility-ai-code-hygiene", "fingerprint": "10de7770b7c457060ac78c6f2a2495a442fd97d79dd1e5ca0dbbd69eb72b0add", "category": "quality", "severity": "low", "confidence": 0.86, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "A normalized source-code window appears in two different non-test files.", "evidence": {"lines": 12, "rule_id": "AIC003", "scanner": "repobility-ai-code-hygiene", "references": ["https://jscpd.dev/"], "duplicate_file": "src/app/api/auth/2fa/verify/route.ts", "duplicate_line": 71, "correlation_key": "fp|10de7770b7c457060ac78c6f2a2495a442fd97d79dd1e5ca0dbbd69eb72b0add"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/lib/auth.ts"}, "region": {"startLine": 84}}}]}, {"ruleId": "AIC003", "level": "note", "message": {"text": "Duplicated implementation block across source files"}, "properties": {"repobilityId": 225029, "scanner": "repobility-ai-code-hygiene", "fingerprint": "2f16a70f63a91a7801ec001c92f272bc7adf07ba25e8800fe9522053e3df042a", "category": "quality", "severity": "low", "confidence": 0.86, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "A normalized source-code window appears in two different non-test files.", "evidence": {"lines": 12, "rule_id": "AIC003", "scanner": "repobility-ai-code-hygiene", "references": ["https://jscpd.dev/"], "duplicate_file": "src/app/api/persist/route.ts", "duplicate_line": 54, "correlation_key": "fp|2f16a70f63a91a7801ec001c92f272bc7adf07ba25e8800fe9522053e3df042a"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/app/api/traffic/route.ts"}, "region": {"startLine": 43}}}]}, {"ruleId": "AIC003", "level": "note", "message": {"text": "Duplicated implementation block across source files"}, "properties": {"repobilityId": 225028, "scanner": "repobility-ai-code-hygiene", "fingerprint": "8464f419917e530da5083e6499229613cd23f9b26cddec484aa2f7157c921dea", "category": "quality", "severity": "low", "confidence": 0.86, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "A normalized source-code window appears in two different non-test files.", "evidence": {"lines": 12, "rule_id": "AIC003", "scanner": "repobility-ai-code-hygiene", "references": ["https://jscpd.dev/"], "duplicate_file": "src/app/api/enumeration/route.ts", "duplicate_line": 31, "correlation_key": "fp|8464f419917e530da5083e6499229613cd23f9b26cddec484aa2f7157c921dea"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/app/api/settings/route.ts"}, "region": {"startLine": 15}}}]}, {"ruleId": "AIC003", "level": "note", "message": {"text": "Duplicated implementation block across source files"}, "properties": {"repobilityId": 225027, "scanner": "repobility-ai-code-hygiene", "fingerprint": "ef90267670966a918777eb2f17629b1db7d95d49a85ac3dd333026440945a5ca", "category": "quality", "severity": "low", "confidence": 0.86, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "A normalized source-code window appears in two different non-test files.", "evidence": {"lines": 12, "rule_id": "AIC003", "scanner": "repobility-ai-code-hygiene", "references": ["https://jscpd.dev/"], "duplicate_file": "src/app/(dashboard)/profile/page.tsx", "duplicate_line": 369, "correlation_key": "fp|ef90267670966a918777eb2f17629b1db7d95d49a85ac3dd333026440945a5ca"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/app/(dashboard)/settings/page.tsx"}, "region": {"startLine": 425}}}]}, {"ruleId": "SEC020", "level": "none", "message": {"text": "[SEC020] Secret Printed to Logs: Debug or diagnostic code appears to print a credential-bearing value. This is a frequent AI-assisted coding failure: the helper exposes the exact value needed for troubleshooting."}, "properties": {"repobilityId": 225056, "scanner": "repobility-threat-engine", "fingerprint": "a714fd75ffe5567d57d9fea64dc54fa2e766b59027a159789131aeba539d472e", "category": "credential_exposure", "severity": "info", "confidence": 0.15, "triageState": "false_positive", "verdict": "likely_fp", "isResolved": true, "reason": "Log message mentions credential-related metadata but does not print a credential-bearing value", "evidence": {"match": "logger.info('Password updated', { userId })", "reason": "Log message mentions credential-related metadata but does not print a credential-bearing value", "rule_id": "SEC020", "scanner": "repobility-threat-engine", "confidence": 0.15, "correlation_key": "secret|token|15|logger.info password updated userid"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/services/user.service.ts"}, "region": {"startLine": 153}}}]}, {"ruleId": "MINED056", "level": "none", "message": {"text": "[MINED056] React Key As Index: key={index} in map() \u2014 re-renders the wrong elements on re-order."}, "properties": {"repobilityId": 225052, "scanner": "repobility-threat-engine", "fingerprint": "6617ae92698da05460687435ff4483526b3aaf7361dec321073ca19745b38160", "category": "quality", "severity": "info", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "react-key-as-index", "owasp": null, "cwe_ids": ["CWE-682"], "languages": ["typescript", "tsx", "javascript", "jsx"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.348032+00:00", "triaged_in_corpus": 12, "observations_count": 299917, "ai_coder_pattern_id": 135}, "scanner": "repobility-threat-engine", "correlation_key": "fp|6617ae92698da05460687435ff4483526b3aaf7361dec321073ca19745b38160"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/components/ui/totp-input.tsx"}, "region": {"startLine": 124}}}]}, {"ruleId": "MINED056", "level": "none", "message": {"text": "[MINED056] React Key As Index: key={index} in map() \u2014 re-renders the wrong elements on re-order."}, "properties": {"repobilityId": 225051, "scanner": "repobility-threat-engine", "fingerprint": "2ab45e69707a99fbdf19caeadd8b270393745d74d76e1fcf24e22f5e5d145f6f", "category": "quality", "severity": "info", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "react-key-as-index", "owasp": null, "cwe_ids": ["CWE-682"], "languages": ["typescript", "tsx", "javascript", "jsx"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.348032+00:00", "triaged_in_corpus": 12, "observations_count": 299917, "ai_coder_pattern_id": 135}, "scanner": "repobility-threat-engine", "correlation_key": "fp|2ab45e69707a99fbdf19caeadd8b270393745d74d76e1fcf24e22f5e5d145f6f"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/components/ui/password-input.tsx"}, "region": {"startLine": 142}}}]}, {"ruleId": "SEC029", "level": "none", "message": {"text": "[SEC029] Server-Side Request Forgery (SSRF) \u2014 outbound HTTP from user input (and 2 more): Same pattern found in 2 additional files. Review if needed."}, "properties": {"repobilityId": 225050, "scanner": "repobility-threat-engine", "fingerprint": "821cba61ed8ca9932fa4a20b298f5d896106f8bf2152c246419c88b94424b756", "category": "ssrf", "severity": "info", "confidence": 0.2, "triageState": "false_positive", "verdict": "likely_fp", "isResolved": true, "reason": "Deduplicated summary only: 2 additional occurrences found. The top occurrences remain visible as actionable findings.", "evidence": {"reason": "Deduplicated summary only: 2 additional occurrences found. The top occurrences remain visible as actionable findings.", "rule_id": "SEC029", "scanner": "repobility-threat-engine", "confidence": 0.2, "correlation_key": "fp|821cba61ed8ca9932fa4a20b298f5d896106f8bf2152c246419c88b94424b756"}}}, {"ruleId": "MINED044", "level": "none", "message": {"text": "[MINED044] Js Console Log Prod (and 13 more): Same pattern found in 13 additional files. Review if needed."}, "properties": {"repobilityId": 225046, "scanner": "repobility-threat-engine", "fingerprint": "32a0c4b8eb59896358b09f6f62cfc62156eff6eb76004bde5c08520a91514dfe", "category": "quality", "severity": "info", "confidence": 0.2, "triageState": "false_positive", "verdict": "likely_fp", "isResolved": true, "reason": "Deduplicated summary only: 13 additional occurrences found. The top occurrences remain visible as actionable findings.", "evidence": {"mined": true, "mining": {"slug": "js-console-log-prod", "owasp": null, "cwe_ids": ["CWE-532"], "languages": ["javascript", "typescript", "tsx", "jsx"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.348003+00:00", "triaged_in_corpus": 10, "observations_count": 1940833, "ai_coder_pattern_id": 102}, "scanner": "repobility-threat-engine", "aggregated": true, "correlation_key": "fp|32a0c4b8eb59896358b09f6f62cfc62156eff6eb76004bde5c08520a91514dfe", "aggregated_count": 13}}}, {"ruleId": "MINED044", "level": "none", "message": {"text": "[MINED044] Js Console Log Prod: console.log left in code. Should be replaced with logger or removed."}, "properties": {"repobilityId": 225045, "scanner": "repobility-threat-engine", "fingerprint": "ac004d107ba6de538b2c4092c5b9d6b7fa85e214231c164aa4b710ff3dc8e7d1", "category": "quality", "severity": "info", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "js-console-log-prod", "owasp": null, "cwe_ids": ["CWE-532"], "languages": ["javascript", "typescript", "tsx", "jsx"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.348003+00:00", "triaged_in_corpus": 10, "observations_count": 1940833, "ai_coder_pattern_id": 102}, "scanner": "repobility-threat-engine", "correlation_key": "fp|ac004d107ba6de538b2c4092c5b9d6b7fa85e214231c164aa4b710ff3dc8e7d1"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/app/api/auth/2fa/setup/route.ts"}, "region": {"startLine": 64}}}]}, {"ruleId": "MINED044", "level": "none", "message": {"text": "[MINED044] Js Console Log Prod: console.log left in code. Should be replaced with logger or removed."}, "properties": {"repobilityId": 225044, "scanner": "repobility-threat-engine", "fingerprint": "326d79e3df47f722bc264b6f1ff7856724075715797d9608477399b57d9e2960", "category": "quality", "severity": "info", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "js-console-log-prod", "owasp": null, "cwe_ids": ["CWE-532"], "languages": ["javascript", "typescript", "tsx", "jsx"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.348003+00:00", "triaged_in_corpus": 10, "observations_count": 1940833, "ai_coder_pattern_id": 102}, "scanner": "repobility-threat-engine", "correlation_key": "fp|326d79e3df47f722bc264b6f1ff7856724075715797d9608477399b57d9e2960"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/app/api/auth/2fa/disable/route.ts"}, "region": {"startLine": 90}}}]}, {"ruleId": "MINED044", "level": "none", "message": {"text": "[MINED044] Js Console Log Prod: console.log left in code. Should be replaced with logger or removed."}, "properties": {"repobilityId": 225043, "scanner": "repobility-threat-engine", "fingerprint": "3585a4cb270342389dd59fef0ce6094cf621d26198fdb4230fc7445dc041608d", "category": "quality", "severity": "info", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "js-console-log-prod", "owasp": null, "cwe_ids": ["CWE-532"], "languages": ["javascript", "typescript", "tsx", "jsx"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.348003+00:00", "triaged_in_corpus": 10, "observations_count": 1940833, "ai_coder_pattern_id": 102}, "scanner": "repobility-threat-engine", "correlation_key": "fp|3585a4cb270342389dd59fef0ce6094cf621d26198fdb4230fc7445dc041608d"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/app/api/auth/2fa/backup/route.ts"}, "region": {"startLine": 39}}}]}, {"ruleId": "DEPCUR-NPM", "level": "none", "message": {"text": "npm package `react-syntax-highlighter` is patch version(s) behind (16.1.0 -> 16.1.1)"}, "properties": {"repobilityId": 225038, "scanner": "repobility-dependency-currency", "fingerprint": "2d46ed51f191f899741763f11756a1dc4c6f6585505a57ce89399a83b337040b", "category": "dependency", "severity": "info", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"gap": "patch version(s) behind", "signal": "currency", "cwe_ids": [], "package": "react-syntax-highlighter", "scanner": "repobility-dependency-currency", "ecosystem": "npm", "languages": ["javascript"], "latest_version": "16.1.1", "correlation_key": "fp|2d46ed51f191f899741763f11756a1dc4c6f6585505a57ce89399a83b337040b", "current_version": "16.1.0"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "JRN009", "level": "error", "message": {"text": "Secret-like setting is echoed into a password input value"}, "properties": {"repobilityId": 225131, "scanner": "repobility-journey-contract", "fingerprint": "4f1f7973947323bea78e530561117503566a7a38427bbd2553ffddd8ed50d4d6", "category": "auth", "severity": "high", "confidence": 0.83, "triageState": "open", "verdict": "likely", "isResolved": false, "reason": "A password or secret-named input is populated from a secret-like variable instead of a masked placeholder.", "evidence": {"rule_id": "JRN009", "scanner": "repobility-journey-contract", "references": ["https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html"], "correlation_key": "code|auth|src/app/login/page.tsx|185|jrn009"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/app/login/page.tsx"}, "region": {"startLine": 185}}}]}, {"ruleId": "GHSA-c2c7-rcm5-vvqj", "level": "error", "message": {"text": "picomatch: GHSA-c2c7-rcm5-vvqj"}, "properties": {"repobilityId": 225100, "scanner": "osv-scanner", "fingerprint": "3cd93794643bff3fd4328203c06c842a2d7c54c53b7a77b0e6bc61b44cf4e561", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["CVE-2026-33671"], "package": "picomatch", "rule_id": "GHSA-c2c7-rcm5-vvqj", "scanner": "osv-scanner", "correlation_key": "vuln|picomatch|CVE-2026-33671|package-lock.json"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "GHSA-q4gf-8mx6-v5v3", "level": "error", "message": {"text": "next: GHSA-q4gf-8mx6-v5v3"}, "properties": {"repobilityId": 225096, "scanner": "osv-scanner", "fingerprint": "da8b53df5895ed40a19febe52afb2d18a839dccf701e02fc3d50edf4d33cc0b0", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "package": "next", "rule_id": "GHSA-q4gf-8mx6-v5v3", "scanner": "osv-scanner", "correlation_key": "vuln|next|GHSA-Q4GF-8MX6-V5V3|package-lock.json"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "GHSA-mg66-mrh9-m8jx", "level": "error", "message": {"text": "next: GHSA-mg66-mrh9-m8jx"}, "properties": {"repobilityId": 225094, "scanner": "osv-scanner", "fingerprint": "e1c0b57c4691bd55051dcc27f3ca4a26439aef2dc39ff13b828e829584b4a6ae", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["CVE-2026-44579"], "package": "next", "rule_id": "GHSA-mg66-mrh9-m8jx", "scanner": "osv-scanner", "correlation_key": "vuln|next|CVE-2026-44579|package-lock.json"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "GHSA-h25m-26qc-wcjf", "level": "error", "message": {"text": "next: GHSA-h25m-26qc-wcjf"}, "properties": {"repobilityId": 225090, "scanner": "osv-scanner", "fingerprint": "3dca699f288814db9faa4c21ab6075f7191535c0a7d0a4bb007d3d11d095a448", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "package": "next", "rule_id": "GHSA-h25m-26qc-wcjf", "scanner": "osv-scanner", "correlation_key": "vuln|next|GHSA-H25M-26QC-WCJF|package-lock.json"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "GHSA-c4j6-fc7j-m34r", "level": "error", "message": {"text": "next: GHSA-c4j6-fc7j-m34r"}, "properties": {"repobilityId": 225086, "scanner": "osv-scanner", "fingerprint": "0a54f4cd5b76bccd059af56553760a1f50a3286bc36bcaded036ef36ae7ec3e6", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["CVE-2026-44578"], "package": "next", "rule_id": "GHSA-c4j6-fc7j-m34r", "scanner": "osv-scanner", "correlation_key": "vuln|next|CVE-2026-44578|package-lock.json"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "GHSA-8h8q-6873-q5fj", "level": "error", "message": {"text": "next: GHSA-8h8q-6873-q5fj"}, "properties": {"repobilityId": 225084, "scanner": "osv-scanner", "fingerprint": "1d6b5734f8709c48c82d64fd23dd05b727b7b6aec52424e0787cfb1086cb47b8", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "package": "next", "rule_id": "GHSA-8h8q-6873-q5fj", "scanner": "osv-scanner", "correlation_key": "vuln|next|GHSA-8H8Q-6873-Q5FJ|package-lock.json"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "GHSA-492v-c6pp-mqqv", "level": "error", "message": {"text": "next: GHSA-492v-c6pp-mqqv"}, "properties": {"repobilityId": 225082, "scanner": "osv-scanner", "fingerprint": "8c549cd0bcc75567b39779ee35dc1dbf7d32479989afbdeb6a44f75ca9ed5777", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["CVE-2026-44574"], "package": "next", "rule_id": "GHSA-492v-c6pp-mqqv", "scanner": "osv-scanner", "correlation_key": "vuln|next|CVE-2026-44574|package-lock.json"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "GHSA-36qx-fr4f-26g5", "level": "error", "message": {"text": "next: GHSA-36qx-fr4f-26g5"}, "properties": {"repobilityId": 225079, "scanner": "osv-scanner", "fingerprint": "bb3fe10cb390a6ea557cd455f29985b3d1f2cb255161f44e9e0d26f9abaeeddc", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["CVE-2026-44573"], "package": "next", "rule_id": "GHSA-36qx-fr4f-26g5", "scanner": "osv-scanner", "correlation_key": "vuln|next|CVE-2026-44573|package-lock.json"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "GHSA-26hh-7cqf-hhc6", "level": "error", "message": {"text": "next: GHSA-26hh-7cqf-hhc6"}, "properties": {"repobilityId": 225078, "scanner": "osv-scanner", "fingerprint": "3f81a2f571f36f0c5b9663a798ce9c1c12fa6b3ad5f35cd604e3d1c76ec2c5ce", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["CVE-2026-45109"], "package": "next", "rule_id": "GHSA-26hh-7cqf-hhc6", "scanner": "osv-scanner", "correlation_key": "vuln|next|CVE-2026-45109|package-lock.json"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "GHSA-267c-6grr-h53f", "level": "error", "message": {"text": "next: GHSA-267c-6grr-h53f"}, "properties": {"repobilityId": 225077, "scanner": "osv-scanner", "fingerprint": "db0a48544c830b2ce031153d65e173d9f13810926f1560b66b44efa2d72fece1", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["CVE-2026-44575"], "package": "next", "rule_id": "GHSA-267c-6grr-h53f", "scanner": "osv-scanner", "correlation_key": "vuln|next|CVE-2026-44575|package-lock.json"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "GHSA-7r86-cg39-jmmj", "level": "error", "message": {"text": "minimatch: GHSA-7r86-cg39-jmmj"}, "properties": {"repobilityId": 225076, "scanner": "osv-scanner", "fingerprint": "eefef250e5a6e239df447b5946f207cdb0dd68151255b2332fb8ba8f476755c1", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["CVE-2026-27903"], "package": "minimatch", "rule_id": "GHSA-7r86-cg39-jmmj", "scanner": "osv-scanner", "correlation_key": "vuln|minimatch|CVE-2026-27903|package-lock.json"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "GHSA-3ppc-4f35-3m26", "level": "error", "message": {"text": "minimatch: GHSA-3ppc-4f35-3m26"}, "properties": {"repobilityId": 225075, "scanner": "osv-scanner", "fingerprint": "51db4fe99f02113d5057e54849a1514660f72202efa765a619a8195e282ff31f", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["CVE-2026-26996"], "package": "minimatch", "rule_id": "GHSA-3ppc-4f35-3m26", "scanner": "osv-scanner", "correlation_key": "vuln|minimatch|CVE-2026-26996|package-lock.json"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "GHSA-23c5-xmqv-rm74", "level": "error", "message": {"text": "minimatch: GHSA-23c5-xmqv-rm74"}, "properties": {"repobilityId": 225074, "scanner": "osv-scanner", "fingerprint": "f4f398661d95064420cba5942b7bc163815b09d09751c05f0247afa0ed407b54", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["CVE-2026-27904"], "package": "minimatch", "rule_id": "GHSA-23c5-xmqv-rm74", "scanner": "osv-scanner", "correlation_key": "vuln|minimatch|CVE-2026-27904|package-lock.json"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "GHSA-rf6f-7fwh-wjgh", "level": "error", "message": {"text": "flatted: GHSA-rf6f-7fwh-wjgh"}, "properties": {"repobilityId": 225072, "scanner": "osv-scanner", "fingerprint": "12f8c13a1500c4e201cd19c15c7415ed765defb1c8c79e0887745cf5d0c7caba", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["CVE-2026-33228"], "package": "flatted", "rule_id": "GHSA-rf6f-7fwh-wjgh", "scanner": "osv-scanner", "correlation_key": "vuln|flatted|CVE-2026-33228|package-lock.json"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "GHSA-25h7-pfq9-p65f", "level": "error", "message": {"text": "flatted: GHSA-25h7-pfq9-p65f"}, "properties": {"repobilityId": 225071, "scanner": "osv-scanner", "fingerprint": "b797beca07deb64b07234792c672e8b741104617529fbd9314dd615ac2f0d51d", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["CVE-2026-32141"], "package": "flatted", "rule_id": "GHSA-25h7-pfq9-p65f", "scanner": "osv-scanner", "correlation_key": "vuln|flatted|CVE-2026-32141|package-lock.json"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "GHSA-8gc5-j5rx-235r", "level": "error", "message": {"text": "fast-xml-parser: GHSA-8gc5-j5rx-235r"}, "properties": {"repobilityId": 225066, "scanner": "osv-scanner", "fingerprint": "be1ebaff8f47023fbc77cbeb17ff2ddbe590255324d1826d56b4e2fe7eca5ed0", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "Collapsed 1 duplicate scanner signal(s) for the same underlying issue.", "evidence": {"match": "", "aliases": ["CVE-2026-33036"], "package": "fast-xml-parser", "rule_id": "GHSA-8gc5-j5rx-235r", "scanner": "osv-scanner", "correlation_key": "vuln|fast-xml-parser|CVE-2026-26278|package-lock.json", "duplicate_count": 1, "duplicate_rule_ids": ["GHSA-8gc5-j5rx-235r", "GHSA-jmr7-xgp7-cmfj"], "duplicate_scanners": ["osv-scanner"], "duplicate_fingerprints": ["5efdec8e1c33321f1223d76e5655337d8f93ed65e3003802370c1c57bfc4536c", "be1ebaff8f47023fbc77cbeb17ff2ddbe590255324d1826d56b4e2fe7eca5ed0"]}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "GHSA-37qj-frw5-hhjh", "level": "error", "message": {"text": "fast-xml-parser: GHSA-37qj-frw5-hhjh"}, "properties": {"repobilityId": 225065, "scanner": "osv-scanner", "fingerprint": "a4cdfca18b10555ca6b92346f2040f93a4b826e307518a747504610ff5f7e56b", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["CVE-2026-25128"], "package": "fast-xml-parser", "rule_id": "GHSA-37qj-frw5-hhjh", "scanner": "osv-scanner", "correlation_key": "vuln|fast-xml-parser|CVE-2026-25128|package-lock.json"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "DKC011", "level": "error", "message": {"text": "Database service publishes a host port"}, "properties": {"repobilityId": 225060, "scanner": "repobility-docker", "fingerprint": "9b206681a2a2b7ab9dc42012ab4911e998a5c81f143d51f3dee787e174d5f000", "category": "docker", "severity": "high", "confidence": 0.84, "triageState": "open", "verdict": "likely", "isResolved": false, "reason": "Database-like image publishes host ports without a loopback-only bind.", "evidence": {"ports": [{"raw": "5432:5432", "target": "5432", "host_ip": "", "published": "5432"}], "rule_id": "DKC011", "scanner": "repobility-docker", "service": "db", "references": ["https://docs.docker.com/compose/how-tos/environment-variables/best-practices/", "https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html"], "exposure_scope": "public", "correlation_key": "fp|9b206681a2a2b7ab9dc42012ab4911e998a5c81f143d51f3dee787e174d5f000"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docker-compose.yml"}, "region": {"startLine": 38}}}]}, {"ruleId": "SEC085", "level": "error", "message": {"text": "[SEC085] JS: child_process.exec with non-literal: child_process.exec with user-derived input enables command injection. Ported from eslint-plugin-security detect-child-process (Apache-2.0)."}, "properties": {"repobilityId": 225055, "scanner": "repobility-threat-engine", "fingerprint": "4b97b71147cb524848fa50430d9fe0125e781c15b9856651991abb9cb25025fc", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": "exec(line", "reason": "Pattern matched with no mitigating context found", "rule_id": "SEC085", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "fp|4b97b71147cb524848fa50430d9fe0125e781c15b9856651991abb9cb25025fc"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/components/ui/virtual-code-viewer.tsx"}, "region": {"startLine": 75}}}]}, {"ruleId": "SEC083", "level": "error", "message": {"text": "[SEC083] JS: new RegExp() with non-literal: new RegExp(<variable>) \u2014 variable input can craft a ReDoS pattern. Ported from eslint-plugin-security detect-non-literal-regexp (Apache-2.0)."}, "properties": {"repobilityId": 225054, "scanner": "repobility-threat-engine", "fingerprint": "165168d2c1a6572abb6c6f13d51a169b438c1b65fca79f57cff9eac09200ea55", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": "new RegExp(pattern", "reason": "Pattern matched with no mitigating context found", "rule_id": "SEC083", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "fp|165168d2c1a6572abb6c6f13d51a169b438c1b65fca79f57cff9eac09200ea55"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/components/ui/virtual-code-viewer.tsx"}, "region": {"startLine": 73}}}]}, {"ruleId": "SEC029", "level": "error", "message": {"text": "[SEC029] Server-Side Request Forgery (SSRF) \u2014 outbound HTTP from user input: Outbound HTTP request to a user-controlled URL without allowlist validation. Attackers can probe internal services (169.254.169.254 metadata, internal Kubernetes endpoints, file:// URIs), exfiltrate data, or pivot through your network. SSRF is OWASP A10:2021 and a frequent foothold in cloud breaches."}, "properties": {"repobilityId": 225049, "scanner": "repobility-threat-engine", "fingerprint": "e96450b284a4835d89ebabc252a170918d9978c317155df09a150b9fe74bc307", "category": "ssrf", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": "new URL(r", "reason": "Pattern matched with no mitigating context found", "rule_id": "SEC029", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "fp|e96450b284a4835d89ebabc252a170918d9978c317155df09a150b9fe74bc307"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/app/api/reports/route.ts"}, "region": {"startLine": 12}}}]}, {"ruleId": "SEC029", "level": "error", "message": {"text": "[SEC029] Server-Side Request Forgery (SSRF) \u2014 outbound HTTP from user input: Outbound HTTP request to a user-controlled URL without allowlist validation. Attackers can probe internal services (169.254.169.254 metadata, internal Kubernetes endpoints, file:// URIs), exfiltrate data, or pivot through your network. SSRF is OWASP A10:2021 and a frequent foothold in cloud breaches."}, "properties": {"repobilityId": 225048, "scanner": "repobility-threat-engine", "fingerprint": "0eab14ab52e62ea88396081232966e4c741fda888b325ffa0b94e23fbab3c66d", "category": "ssrf", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": "new URL(r", "reason": "Pattern matched with no mitigating context found", "rule_id": "SEC029", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "fp|0eab14ab52e62ea88396081232966e4c741fda888b325ffa0b94e23fbab3c66d"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/app/api/reports/bulk/route.ts"}, "region": {"startLine": 52}}}]}, {"ruleId": "SEC029", "level": "error", "message": {"text": "[SEC029] Server-Side Request Forgery (SSRF) \u2014 outbound HTTP from user input: Outbound HTTP request to a user-controlled URL without allowlist validation. Attackers can probe internal services (169.254.169.254 metadata, internal Kubernetes endpoints, file:// URIs), exfiltrate data, or pivot through your network. SSRF is OWASP A10:2021 and a frequent foothold in cloud breaches."}, "properties": {"repobilityId": 225047, "scanner": "repobility-threat-engine", "fingerprint": "0d8e510f9126bcd1c99da7afd5be27573fbf430b3b5d63c05f0c5dd788c1a440", "category": "ssrf", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": "new URL(r", "reason": "Pattern matched with no mitigating context found", "rule_id": "SEC029", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "fp|0d8e510f9126bcd1c99da7afd5be27573fbf430b3b5d63c05f0c5dd788c1a440"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/app/api/persist/route.ts"}, "region": {"startLine": 248}}}]}, {"ruleId": "MINED118", "level": "error", "message": {"text": "Dockerfile FROM `node:22-alpine` not pinned by digest"}, "properties": {"repobilityId": 225033, "scanner": "repobility-supply-chain", "fingerprint": "afed5c3acc2a1e59801a8013cc34fafbf37ab2c647599e101e358ec0f23f462e", "category": "dependency", "severity": "high", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "docker-from-unpinned", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["dockerfile"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|afed5c3acc2a1e59801a8013cc34fafbf37ab2c647599e101e358ec0f23f462e"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Dockerfile"}, "region": {"startLine": 36}}}]}, {"ruleId": "MINED118", "level": "error", "message": {"text": "Dockerfile FROM `node:22-alpine` not pinned by digest"}, "properties": {"repobilityId": 225032, "scanner": "repobility-supply-chain", "fingerprint": "dc9658feff7519e307d15193cac80ec4941b1810f0654eb537061d3ec1804ff3", "category": "dependency", "severity": "high", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "docker-from-unpinned", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["dockerfile"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|dc9658feff7519e307d15193cac80ec4941b1810f0654eb537061d3ec1804ff3"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Dockerfile"}, "region": {"startLine": 20}}}]}, {"ruleId": "MINED118", "level": "error", "message": {"text": "Dockerfile FROM `node:22-alpine` not pinned by digest"}, "properties": {"repobilityId": 225031, "scanner": "repobility-supply-chain", "fingerprint": "2fed950eb88e6c3cfef0738f1b9bb8573030ae6b0dd94568ffa9c9cfae5ac997", "category": "dependency", "severity": "high", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "docker-from-unpinned", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["dockerfile"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|2fed950eb88e6c3cfef0738f1b9bb8573030ae6b0dd94568ffa9c9cfae5ac997"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Dockerfile"}, "region": {"startLine": 6}}}]}, {"ruleId": "CORE_NO_TESTS", "level": "error", "message": {"text": "No test files found"}, "properties": {"repobilityId": 225025, "scanner": "repobility-core", "fingerprint": "0200e9918bc2a7bf9c116d0907e50ac3df640c758b93852cf1890ec6e14d870d", "category": "testing", "severity": "high", "confidence": null, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"rule_id": "CORE_NO_TESTS", "scanner": "repobility-core", "correlation_key": "repo|testing|core_no_tests"}}}, {"ruleId": "GHSA-m7jm-9gc2-mpf2", "level": "error", "message": {"text": "fast-xml-parser: GHSA-m7jm-9gc2-mpf2"}, "properties": {"repobilityId": 225070, "scanner": "osv-scanner", "fingerprint": "20012b088e586bb0c05f84419dca16b4fe89c18a54165cb2c4e434a9efbac881", "category": "dependency", "severity": "critical", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["CVE-2026-25896"], "package": "fast-xml-parser", "rule_id": "GHSA-m7jm-9gc2-mpf2", "scanner": "osv-scanner", "correlation_key": "vuln|fast-xml-parser|CVE-2026-25896|package-lock.json"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-bead75b0f9233e05", "level": "none", "message": {"text": "No API endpoints detected"}, "properties": {"repobilityId": "0f8bb852027c38f8", "scanner": "scanner-primary", "fingerprint": "bead75b0f9233e05", "layer": "api", "severity": "info", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-82e47bc5162e0189", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 src/components/ui/timezone-select.tsx:273"}, "properties": {"repobilityId": "db207bb0a10d40aa", "scanner": "scanner-primary", "fingerprint": "82e47bc5162e0189", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-c03904b60a70f674", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 src/app/api/callback/route.ts:216"}, "properties": {"repobilityId": "ff12d2ad9ea16609", "scanner": "scanner-primary", "fingerprint": "c03904b60a70f674", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-d9a4ccdb2634a4b8", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 src/app/api/setup/sync/route.ts:429"}, "properties": {"repobilityId": "b77938ca83a3e4aa", "scanner": "scanner-primary", "fingerprint": "d9a4ccdb2634a4b8", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-035f02a9d1488fb3", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 src/app/(dashboard)/dashboard/page.tsx:276"}, "properties": {"repobilityId": "de14d6be6ed6ce3a", "scanner": "scanner-primary", "fingerprint": "035f02a9d1488fb3", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-cee5f27ad060f69d", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 src/app/(dashboard)/payloads/page.tsx:506"}, "properties": {"repobilityId": "e871eabc8e4c5101", "scanner": "scanner-primary", "fingerprint": "cee5f27ad060f69d", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-cb17e8f67493a7e3", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 src/app/(dashboard)/reports/page.tsx:478"}, "properties": {"repobilityId": "ab433c04bfdd1c2f", "scanner": "scanner-primary", "fingerprint": "cb17e8f67493a7e3", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-d324d6e5cd5b9094", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 src/app/(dashboard)/reports/[id]/page.tsx:585"}, "properties": {"repobilityId": "bc730e62100580c1", "scanner": "scanner-primary", "fingerprint": "d324d6e5cd5b9094", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-aef7c6d26b1aee62", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 src/lib/cleanup.ts:299"}, "properties": {"repobilityId": "2d02d004d1d73893", "scanner": "scanner-primary", "fingerprint": "aef7c6d26b1aee62", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-ce15b0de74efb84e", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 src/services/base.service.ts:109"}, "properties": {"repobilityId": "cf88c08352d6e52e", "scanner": "scanner-primary", "fingerprint": "ce15b0de74efb84e", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-835eae4c7f17a2f8", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: node:22-alpine"}, "properties": {"repobilityId": "d55361cffb198cb4", "scanner": "scanner-primary", "fingerprint": "835eae4c7f17a2f8", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Dockerfile"}, "region": {"startLine": 6}}}]}, {"ruleId": "scanner-835eae4c7f17a2f8", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: node:22-alpine"}, "properties": {"repobilityId": "85c41f0ba00437d5", "scanner": "scanner-primary", "fingerprint": "835eae4c7f17a2f8", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Dockerfile"}, "region": {"startLine": 20}}}]}, {"ruleId": "scanner-835eae4c7f17a2f8", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: node:22-alpine"}, "properties": {"repobilityId": "4f47eba9c55f3cd1", "scanner": "scanner-primary", "fingerprint": "835eae4c7f17a2f8", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Dockerfile"}, "region": {"startLine": 36}}}]}, {"ruleId": "scanner-5cb3f13f7258bc67", "level": "error", "message": {"text": "Insecure pattern 'eval_used' in src/app/route.ts:381"}, "properties": {"repobilityId": "4c1e6d63cfb7ea95", "scanner": "scanner-primary", "fingerprint": "5cb3f13f7258bc67", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "eval_used"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/app/route.ts"}, "region": {"startLine": 381}}}]}, {"ruleId": "scanner-030b83d65f9ec952", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in src/app/route.ts:340"}, "properties": {"repobilityId": "a2f853fa17e622b4", "scanner": "scanner-primary", "fingerprint": "030b83d65f9ec952", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/app/route.ts"}, "region": {"startLine": 340}}}]}, {"ruleId": "scanner-340111ff83cecdb8", "level": "error", "message": {"text": "Possible secret in src/app/api/setup/sync/route.ts"}, "properties": {"repobilityId": "0ff884e1f36dfd4e", "scanner": "scanner-primary", "fingerprint": "340111ff83cecdb8", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/app/api/setup/sync/route.ts"}, "region": {"startLine": 197}}}]}, {"ruleId": "scanner-5563481675d7cbee", "level": "error", "message": {"text": "Insecure pattern 'eval_used' in src/app/(dashboard)/payloads/page.tsx:226"}, "properties": {"repobilityId": "427a2320ed451e24", "scanner": "scanner-primary", "fingerprint": "5563481675d7cbee", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "eval_used"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/app/(dashboard)/payloads/page.tsx"}, "region": {"startLine": 226}}}]}, {"ruleId": "scanner-663e69a1f83bac14", "level": "warning", "message": {"text": "Insecure pattern 'cors_wildcard' in src/lib/cors.ts:10"}, "properties": {"repobilityId": "2c6033d3ebd4bc17", "scanner": "scanner-primary", "fingerprint": "663e69a1f83bac14", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "cors_wildcard"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/lib/cors.ts"}, "region": {"startLine": 10}}}]}, {"ruleId": "scanner-0eb1dd0eb91a49c2", "level": "note", "message": {"text": "Very large file: src/app/(dashboard)/settings/page.tsx (896 lines)"}, "properties": {"repobilityId": "c82549d3d08c08e4", "scanner": "scanner-primary", "fingerprint": "0eb1dd0eb91a49c2", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-53623be4b24f21e7", "level": "note", "message": {"text": "Very large file: src/app/(dashboard)/reports/[id]/page.tsx (1634 lines)"}, "properties": {"repobilityId": "25290a2d6c614e2f", "scanner": "scanner-primary", "fingerprint": "53623be4b24f21e7", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-6893a6c8b0861585", "level": "warning", "message": {"text": "Very low test-to-source ratio"}, "properties": {"repobilityId": "54a7de3f06314bf0", "scanner": "scanner-primary", "fingerprint": "6893a6c8b0861585", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["tests", "coverage"]}}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "5be7961fc32e69bb", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-72b2a6250083a784", "level": "warning", "message": {"text": "Placeholder or mock-heavy implementation detected"}, "properties": {"repobilityId": "943b92291a435cc8", "scanner": "scanner-primary", "fingerprint": "72b2a6250083a784", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "incomplete", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "21e8b68d4ae1ac34", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-b9088664ace7f748", "level": "note", "message": {"text": "Composite production-readiness gap"}, "properties": {"repobilityId": "831ba8fef0043990", "scanner": "scanner-primary", "fingerprint": "b9088664ace7f748", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["production-readiness", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "ae836027cd8094c9", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "af79acf68329648c", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-88e9f9a2e38adcff", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/components/layout/header.tsx:23"}, "properties": {"repobilityId": "0443f9a7be5c65b9", "scanner": "scanner-primary", "fingerprint": "88e9f9a2e38adcff", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-fdd1436c6046bb1f", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/app/route.ts:309"}, "properties": {"repobilityId": "b2a6b4e9ae4a35f5", "scanner": "scanner-primary", "fingerprint": "fdd1436c6046bb1f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-81a462b0a58419ee", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/app/(dashboard)/payloads/page.tsx:231"}, "properties": {"repobilityId": "5409a8b0f964dcc9", "scanner": "scanner-primary", "fingerprint": "81a462b0a58419ee", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-f588e0a4f493a6ad", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/app/(dashboard)/reports/page.tsx:96"}, "properties": {"repobilityId": "7081c8a23fdb6d78", "scanner": "scanner-primary", "fingerprint": "f588e0a4f493a6ad", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-e104a50c12f810ec", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/lib/api-client.ts:41"}, "properties": {"repobilityId": "d3823047d72fbdd0", "scanner": "scanner-primary", "fingerprint": "e104a50c12f810ec", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-75670695dd46445c", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/lib/settings-context.tsx:23"}, "properties": {"repobilityId": "9024b33e8dfa33bf", "scanner": "scanner-primary", "fingerprint": "75670695dd46445c", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-1343609900f18b8d", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/lib/telegram.ts:131"}, "properties": {"repobilityId": "fb078178e88b2394", "scanner": "scanner-primary", "fingerprint": "1343609900f18b8d", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}]}]}