{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-88afb955c7218137", "name": "Possibly dead Python function: forward", "shortDescription": {"text": "Possibly dead Python function: forward"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fc823f9fb68ac9f6", "name": "Possibly dead Python function: collate_hlr", "shortDescription": {"text": "Possibly dead Python function: collate_hlr"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-02da8b141ae71809", "name": "Possibly dead Python function: patched_init", "shortDescription": {"text": "Possibly dead Python function: patched_init"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2cdad4a029380e92", "name": "Possibly dead Python function: reward_func", "shortDescription": {"text": "Possibly dead Python function: reward_func"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-df81c11baaca1e39", "name": "Possibly dead Python function: wrapped", "shortDescription": {"text": "Possibly dead Python function: wrapped"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-125f0f191601577a", "name": "Possibly dead Python function: compute_loss", "shortDescription": {"text": "Possibly dead Python function: compute_loss"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-286d1329e186c916", "name": "Possibly dead Python function: compute_a_feasibility", "shortDescription": {"text": "Possibly dead Python function: compute_a_feasibility"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1282b48e779774d1", "name": "Possibly dead Python function: patched_uvicorn_run", "shortDescription": {"text": "Possibly dead Python function: patched_uvicorn_run"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-211599ce85b6bee8", "name": "Possibly dead Python function: reward_func", "shortDescription": {"text": "Possibly dead Python function: reward_func"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1f35b6f0a810af11", "name": "Possibly dead Python function: is_argmax_invariant", "shortDescription": {"text": "Possibly dead Python function: is_argmax_invariant"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b7d1bba3a10c274e", "name": "Possibly dead Python function: new_req_logits_processor", "shortDescription": {"text": "Possibly dead Python function: new_req_logits_processor"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-09d8d49f6d113e3e", "name": "Possibly dead Python function: wrapped", "shortDescription": {"text": "Possibly dead Python function: wrapped"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-58a672cb57eb1e64", "name": "Possibly dead Python function: compute_loss", "shortDescription": {"text": "Possibly dead Python function: compute_loss"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7a1d9bbd562f2ceb", "name": "Possibly dead Python function: compute_a_feasibility", "shortDescription": {"text": "Possibly dead Python function: compute_a_feasibility"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b5a82d757b459b2a", "name": "Possibly dead Python function: patched_init", "shortDescription": {"text": "Possibly dead Python function: patched_init"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-91c4653fccd61be1", "name": "Possibly dead Python function: patched_uvicorn_run", "shortDescription": {"text": "Possibly dead Python function: patched_uvicorn_run"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-288a124920d95b40", "name": "Possibly dead Python function: is_argmax_invariant", "shortDescription": {"text": "Possibly dead Python function: is_argmax_invariant"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6ac4377330666e4b", "name": "Possibly dead Python function: new_req_logits_processor", "shortDescription": {"text": "Possibly dead Python function: new_req_logits_processor"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-67971c26507bd23e", "name": "Possibly dead Python function: reward_func", "shortDescription": {"text": "Possibly dead Python function: reward_func"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3951c783ba56700d", "name": "Possibly dead Python function: is_argmax_invariant", "shortDescription": {"text": "Possibly dead Python function: is_argmax_invariant"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2b496b9188e7ebdd", "name": "Possibly dead Python function: new_req_logits_processor", "shortDescription": {"text": "Possibly dead Python function: new_req_logits_processor"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ff5aee75a6a37036", "name": "Privileged port 30 in use", "shortDescription": {"text": "Privileged port 30 in use"}, "fullDescription": {"text": "Port 30 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3ac7088c4cb1e896", "name": "Privileged port 480 in use", "shortDescription": {"text": "Privileged port 480 in use"}, "fullDescription": {"text": "Port 480 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9710c8d059e53154", "name": "No frontend routes/components detected", "shortDescription": {"text": "No frontend routes/components detected"}, "fullDescription": {"text": "No React/Vue/Next routes were found. This is fine for backend-only repos."}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-aa23372c1db9be23", "name": "Insecure pattern 'eval_used' in FOARL/run_grpo_foarl_cvrp.sh:172", "shortDescription": {"text": "Insecure pattern 'eval_used' in FOARL/run_grpo_foarl_cvrp.sh:172"}, "fullDescription": {"text": "Found a known-risky pattern (eval_used). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-d3a285f35d9f74df", "name": "Insecure pattern 'eval_used' in FOARL/submit_sft_foarl_cvrp.sh:104", "shortDescription": {"text": "Insecure pattern 'eval_used' in FOARL/submit_sft_foarl_cvrp.sh:104"}, "fullDescription": {"text": "Found a known-risky pattern (eval_used). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-15eea1259bacdcc8", "name": "Insecure pattern 'eval_used' in UniCOP-Reason-Mask/run_grpo_cvrp20_v6_instruct.sh:152", "shortDescription": {"text": "Insecure pattern 'eval_used' in UniCOP-Reason-Mask/run_grpo_cvrp20_v6_instruct.sh:152"}, "fullDescription": {"text": "Found a known-risky pattern (eval_used). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-6372cebde0220094", "name": "No auth library detected", "shortDescription": {"text": "No auth library detected"}, "fullDescription": {"text": "The scanner did not find any standard auth library (JWT, OAuth, NextAuth, Auth0, etc.). The repo has auth/admin/session surface indicators, so auth may live in custom code, in a separate service, or be missing."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4601e3ad3bb28677", "name": "No CI/CD pipelines detected", "shortDescription": {"text": "No CI/CD pipelines detected"}, "fullDescription": {"text": "No GitHub Actions, GitLab CI, or CircleCI configs found. Without CI you can't gate deploys on tests/lints."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9b7aae3f3cdbaba3", "name": "Very large file: UniCOP-Distill/build_think_chains.py (1453 lines)", "shortDescription": {"text": "Very large file: UniCOP-Distill/build_think_chains.py (1453 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3d2b149a8406c5ea", "name": "Very large file: UniCOP-Reason-Mask/grpo_prm_trainer.py (2705 lines)", "shortDescription": {"text": "Very large file: UniCOP-Reason-Mask/grpo_prm_trainer.py (2705 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-79ffbdaa1627f789", "name": "Very large file: UniCOP-Reason-Mask/pomo_prm.py (1188 lines)", "shortDescription": {"text": "Very large file: UniCOP-Reason-Mask/pomo_prm.py (1188 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-37cff983a67c4ac6", "name": "Very large file: UniCOP-Reason-Mask/evaluate.py (1819 lines)", "shortDescription": {"text": "Very large file: UniCOP-Reason-Mask/evaluate.py (1819 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6f4f04ae26d2ca53", "name": "Very large file: UniCOP-Reason/grpo_prm_trainer.py (1062 lines)", "shortDescription": {"text": "Very large file: UniCOP-Reason/grpo_prm_trainer.py (1062 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0252422d31193292", "name": "Very large file: UniCOP-Reason/evaluate.py (1598 lines)", "shortDescription": {"text": "Very large file: UniCOP-Reason/evaluate.py (1598 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6893a6c8b0861585", "name": "Very low test-to-source ratio", "shortDescription": {"text": "Very low test-to-source ratio"}, "fullDescription": {"text": "6 test file(s) for 108 source file(s) (ratio 0.06). Consider adding integration or unit tests for critical paths."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-141b30a41e03817b", "name": "No license file detected", "shortDescription": {"text": "No license file detected"}, "fullDescription": {"text": "No LICENSE/COPYING/NOTICE file was found. Generated repositories often omit licensing, which blocks reuse and automated intake."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 1430 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b9088664ace7f748", "name": "Composite production-readiness gap", "shortDescription": {"text": "Composite production-readiness gap"}, "fullDescription": {"text": "Multiple low-cost hardening controls are missing together: license, ci. Opus verification showed these co-occurring gaps are a better readiness signal than reading each flag in isolation."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-55cac069d3d4499a", "name": "Commented-code block (10 lines) in Latent-SFT/train.py:119", "shortDescription": {"text": "Commented-code block (10 lines) in Latent-SFT/train.py:119"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-e8b16e2bc1513ab9", "name": "Commented-code block (6 lines) in Latent-SFT/model.py:41", "shortDescription": {"text": "Commented-code block (6 lines) in Latent-SFT/model.py:41"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-8de95f7b3cbaf87c", "name": "Network/subprocess call without timeout or try/except \u2014 Latent-SFT/eval_hlr_compare.py:38", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 Latent-SFT/eval_hlr_compare.py:38"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7a6bb40b19d1db97", "name": "Commented-code block (7 lines) in UniCOP-Distill/build_reverse_chains.py:249", "shortDescription": {"text": "Commented-code block (7 lines) in UniCOP-Distill/build_reverse_chains.py:249"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-c295f8dc7d896f84", "name": "Commented-code block (5 lines) in UniCOP-Distill/stage2_reasoning/train_sft_stage2.py:363", "shortDescription": {"text": "Commented-code block (5 lines) in UniCOP-Distill/stage2_reasoning/train_sft_stage2.py:363"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-b9cabd3e115562f1", "name": "Commented-code block (5 lines) in FOARL/train_grpo_foarl.py:79", "shortDescription": {"text": "Commented-code block (5 lines) in FOARL/train_grpo_foarl.py:79"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-9499a2e4f872a79d", "name": "Commented-code block (5 lines) in tools/merge_lora.py:47", "shortDescription": {"text": "Commented-code block (5 lines) in tools/merge_lora.py:47"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-c8e6b61408670f80", "name": "Commented-code block (11 lines) in UniCOP-Reason-Mask/train.py:32", "shortDescription": {"text": "Commented-code block (11 lines) in UniCOP-Reason-Mask/train.py:32"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-8b4840c80a377196", "name": "Legacy-named symbol `d_old` in UniCOP-Reason-Mask/ref_solver.py:64", "shortDescription": {"text": "Legacy-named symbol `d_old` in UniCOP-Reason-Mask/ref_solver.py:64"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-41892d4fde047729", "name": "Commented-code block (5 lines) in UniCOP-Reason-Mask/grpo_prm_trainer.py:93", "shortDescription": {"text": "Commented-code block (5 lines) in UniCOP-Reason-Mask/grpo_prm_trainer.py:93"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-c8946c4cd8262926", "name": "Commented-code block (19 lines) in UniCOP-Reason-Mask/config.py:36", "shortDescription": {"text": "Commented-code block (19 lines) in UniCOP-Reason-Mask/config.py:36"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-4b71a2f8e7b51b0b", "name": "Commented-code block (7 lines) in UniCOP-Reason-Mask/terminal_reward.py:56", "shortDescription": {"text": "Commented-code block (7 lines) in UniCOP-Reason-Mask/terminal_reward.py:56"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-148716e025ece4b5", "name": "Commented-code block (5 lines) in UniCOP-Reason-Mask/merge_shards.py:25", "shortDescription": {"text": "Commented-code block (5 lines) in UniCOP-Reason-Mask/merge_shards.py:25"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-99e4990edc805177", "name": "Commented-code block (5 lines) in UniCOP-Reason-Mask/pomo_prm.py:113", "shortDescription": {"text": "Commented-code block (5 lines) in UniCOP-Reason-Mask/pomo_prm.py:113"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-a242ccc76aa91fbf", "name": "Commented-code block (5 lines) in UniCOP-Reason-Mask/evaluate.py:51", "shortDescription": {"text": "Commented-code block (5 lines) in UniCOP-Reason-Mask/evaluate.py:51"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-75611be2cf24c154", "name": "Commented-code block (5 lines) in UniCOP-Reason-Mask/utils/pipd_wrapper.py:163", "shortDescription": {"text": "Commented-code block (5 lines) in UniCOP-Reason-Mask/utils/pipd_wrapper.py:163"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-258be43eb18dcbb1", "name": "Commented-code block (5 lines) in UniCOP-Reason-Mask/problems/cvrp.py:52", "shortDescription": {"text": "Commented-code block (5 lines) in UniCOP-Reason-Mask/problems/cvrp.py:52"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-3fc8cf8abd1c794b", "name": "Commented-code block (11 lines) in UniCOP-Reason/train.py:32", "shortDescription": {"text": "Commented-code block (11 lines) in UniCOP-Reason/train.py:32"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-c1105b1479fa8278", "name": "Legacy-named symbol `d_old` in UniCOP-Reason/ref_solver.py:64", "shortDescription": {"text": "Legacy-named symbol `d_old` in UniCOP-Reason/ref_solver.py:64"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b92a6a45737683d1", "name": "Commented-code block (5 lines) in UniCOP-Reason/grpo_prm_trainer.py:73", "shortDescription": {"text": "Commented-code block (5 lines) in UniCOP-Reason/grpo_prm_trainer.py:73"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-2c3f14c8a7002153", "name": "Commented-code block (8 lines) in UniCOP-Reason/config.py:36", "shortDescription": {"text": "Commented-code block (8 lines) in UniCOP-Reason/config.py:36"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-641e5dea2333b31d", "name": "Commented-code block (7 lines) in UniCOP-Reason/terminal_reward.py:56", "shortDescription": {"text": "Commented-code block (7 lines) in UniCOP-Reason/terminal_reward.py:56"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-ce315c5a2f92f059", "name": "Commented-code block (5 lines) in UniCOP-Reason/pomo_prm.py:110", "shortDescription": {"text": "Commented-code block (5 lines) in UniCOP-Reason/pomo_prm.py:110"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-d48c11943b0a0286", "name": "Commented-code block (5 lines) in UniCOP-Reason/evaluate.py:51", "shortDescription": {"text": "Commented-code block (5 lines) in UniCOP-Reason/evaluate.py:51"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-c864c8323d1e1f91", "name": "Commented-code block (5 lines) in UniCOP-Reason/utils/pipd_wrapper.py:163", "shortDescription": {"text": "Commented-code block (5 lines) in UniCOP-Reason/utils/pipd_wrapper.py:163"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-33a6b62e30ce7ab4", "name": "Near-duplicate function bodies in 6 places", "shortDescription": {"text": "Near-duplicate function bodies in 6 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nLatent-SFT/model.py:forward, Latent-SFT/model.py:forward, Latent-SFT/model.py:forward, Latent-SFT/model.py:forward\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2c04133e54348533", "name": "Near-duplicate function bodies in 2 places", "shortDescription": {"text": "Near-duplicate function bodies in 2 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nLatent-SFT/inference.py:generate_batch, Latent-SFT/inference.py:generate\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0d0930f07ff86c0e", "name": "FastAPI POST `generate` without auth dependency \u2014 UniCOP-Reason-Mask/utils/vllm_serve_logprobs.py:172", "shortDescription": {"text": "FastAPI POST `generate` without auth dependency \u2014 UniCOP-Reason-Mask/utils/vllm_serve_logprobs.py:172"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-0c023edd63dfc191", "name": "FastAPI POST `get_reward` without auth dependency \u2014 UniCOP-Reason-Mask/openrlhf/reward/remote_reward_server.py:183", "shortDescription": {"text": "FastAPI POST `get_reward` without auth dependency \u2014 UniCOP-Reason-Mask/openrlhf/reward/remote_reward_server.py:183"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-75d1cadf07584d3f", "name": "FastAPI POST `generate` without auth dependency \u2014 UniCOP-Reason/utils/vllm_serve_ngram.py:172", "shortDescription": {"text": "FastAPI POST `generate` without auth dependency \u2014 UniCOP-Reason/utils/vllm_serve_ngram.py:172"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-ed0bc2462503d7cc", "name": "FastAPI POST `get_reward` without auth dependency \u2014 UniCOP-Reason/openrlhf/reward/remote_reward_server.py:183", "shortDescription": {"text": "FastAPI POST `get_reward` without auth dependency \u2014 UniCOP-Reason/openrlhf/reward/remote_reward_server.py:183"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-fb5a3852c9323e24", "name": "Unused endpoint: POST /generate/", "shortDescription": {"text": "Unused endpoint: POST /generate/"}, "fullDescription": {"text": "`UniCOP-Reason-Mask/utils/vllm_serve_logprobs.py` declares `POST /generate/` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-89b9fd75c4ff7232", "name": "Unused endpoint: POST /get_reward", "shortDescription": {"text": "Unused endpoint: POST /get_reward"}, "fullDescription": {"text": "`UniCOP-Reason-Mask/openrlhf/reward/remote_reward_server.py` declares `POST /get_reward` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/23659"}, "properties": {"repository": "ZIJIAN004/UniCOP", "repoUrl": "https://github.com/ZIJIAN004/UniCOP", "branch": "main"}, "results": [{"ruleId": "scanner-88afb955c7218137", "level": "note", "message": {"text": "Possibly dead Python function: forward"}, "properties": {"repobilityId": "ea414cce7f8e5874", "scanner": "scanner-primary", "fingerprint": "88afb955c7218137", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Latent-SFT/model.py:348"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-fc823f9fb68ac9f6", "level": "note", "message": {"text": "Possibly dead Python function: collate_hlr"}, "properties": {"repobilityId": "a1dda566ab441773", "scanner": "scanner-primary", "fingerprint": "fc823f9fb68ac9f6", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Latent-SFT/data_utils.py:333"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-02da8b141ae71809", "level": "note", "message": {"text": "Possibly dead Python function: patched_init"}, "properties": {"repobilityId": "cfcc6f54ddb56d61", "scanner": "scanner-primary", "fingerprint": "02da8b141ae71809", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "UniCOP-Distill/vllm_serve_ngram.py:60"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-2cdad4a029380e92", "level": "note", "message": {"text": "Possibly dead Python function: reward_func"}, "properties": {"repobilityId": "e7c283be2c5590f1", "scanner": "scanner-primary", "fingerprint": "2cdad4a029380e92", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "FOARL/train_grpo_foarl.py:184"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-df81c11baaca1e39", "level": "note", "message": {"text": "Possibly dead Python function: wrapped"}, "properties": {"repobilityId": "faacdada21d43bd9", "scanner": "scanner-primary", "fingerprint": "df81c11baaca1e39", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "UniCOP-Reason-Mask/train.py:113"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-125f0f191601577a", "level": "note", "message": {"text": "Possibly dead Python function: compute_loss"}, "properties": {"repobilityId": "70b270f82fffe454", "scanner": "scanner-primary", "fingerprint": "125f0f191601577a", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "UniCOP-Reason-Mask/grpo_prm_trainer.py:2397"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-286d1329e186c916", "level": "note", "message": {"text": "Possibly dead Python function: compute_a_feasibility"}, "properties": {"repobilityId": "3fe30d85b27d4d29", "scanner": "scanner-primary", "fingerprint": "286d1329e186c916", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "UniCOP-Reason-Mask/terminal_reward.py:105"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-1282b48e779774d1", "level": "note", "message": {"text": "Possibly dead Python function: patched_uvicorn_run"}, "properties": {"repobilityId": "a8ec04a0dd814011", "scanner": "scanner-primary", "fingerprint": "1282b48e779774d1", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "UniCOP-Reason-Mask/utils/vllm_serve_logprobs.py:71"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-211599ce85b6bee8", "level": "note", "message": {"text": "Possibly dead Python function: reward_func"}, "properties": {"repobilityId": "e7c283be2c5590f1", "scanner": "scanner-primary", "fingerprint": "211599ce85b6bee8", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "UniCOP-Reason-Mask/openrlhf/reward/reward_fn.py:98"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-1f35b6f0a810af11", "level": "note", "message": {"text": "Possibly dead Python function: is_argmax_invariant"}, "properties": {"repobilityId": "f29127bfdc65790e", "scanner": "scanner-primary", "fingerprint": "1f35b6f0a810af11", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "UniCOP-Reason-Mask/openrlhf/custom/ngram_processor.py:80"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b7d1bba3a10c274e", "level": "note", "message": {"text": "Possibly dead Python function: new_req_logits_processor"}, "properties": {"repobilityId": "0e77653704172da1", "scanner": "scanner-primary", "fingerprint": "b7d1bba3a10c274e", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "UniCOP-Reason-Mask/openrlhf/custom/ngram_processor.py:83"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-09d8d49f6d113e3e", "level": "note", "message": {"text": "Possibly dead Python function: wrapped"}, "properties": {"repobilityId": "faacdada21d43bd9", "scanner": "scanner-primary", "fingerprint": "09d8d49f6d113e3e", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "UniCOP-Reason/train.py:111"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-58a672cb57eb1e64", "level": "note", "message": {"text": "Possibly dead Python function: compute_loss"}, "properties": {"repobilityId": "70b270f82fffe454", "scanner": "scanner-primary", "fingerprint": "58a672cb57eb1e64", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "UniCOP-Reason/grpo_prm_trainer.py:878"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-7a1d9bbd562f2ceb", "level": "note", "message": {"text": "Possibly dead Python function: compute_a_feasibility"}, "properties": {"repobilityId": "3fe30d85b27d4d29", "scanner": "scanner-primary", "fingerprint": "7a1d9bbd562f2ceb", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "UniCOP-Reason/terminal_reward.py:105"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b5a82d757b459b2a", "level": "note", "message": {"text": "Possibly dead Python function: patched_init"}, "properties": {"repobilityId": "cfcc6f54ddb56d61", "scanner": "scanner-primary", "fingerprint": "b5a82d757b459b2a", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "UniCOP-Reason/utils/vllm_serve_ngram.py:76"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-91c4653fccd61be1", "level": "note", "message": {"text": "Possibly dead Python function: patched_uvicorn_run"}, "properties": {"repobilityId": "a8ec04a0dd814011", "scanner": "scanner-primary", "fingerprint": "91c4653fccd61be1", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "UniCOP-Reason/utils/vllm_serve_ngram.py:98"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-288a124920d95b40", "level": "note", "message": {"text": "Possibly dead Python function: is_argmax_invariant"}, "properties": {"repobilityId": "f29127bfdc65790e", "scanner": "scanner-primary", "fingerprint": "288a124920d95b40", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "UniCOP-Reason/utils/vllm_ngram_processor.py:138"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6ac4377330666e4b", "level": "note", "message": {"text": "Possibly dead Python function: new_req_logits_processor"}, "properties": {"repobilityId": "0e77653704172da1", "scanner": "scanner-primary", "fingerprint": "6ac4377330666e4b", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "UniCOP-Reason/utils/vllm_ngram_processor.py:146"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-67971c26507bd23e", "level": "note", "message": {"text": "Possibly dead Python function: reward_func"}, "properties": {"repobilityId": "e7c283be2c5590f1", "scanner": "scanner-primary", "fingerprint": "67971c26507bd23e", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "UniCOP-Reason/openrlhf/reward/reward_fn.py:101"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3951c783ba56700d", "level": "note", "message": {"text": "Possibly dead Python function: is_argmax_invariant"}, "properties": {"repobilityId": "f29127bfdc65790e", "scanner": "scanner-primary", "fingerprint": "3951c783ba56700d", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "UniCOP-Reason/openrlhf/custom/ngram_processor.py:80"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-2b496b9188e7ebdd", "level": "note", "message": {"text": "Possibly dead Python function: new_req_logits_processor"}, "properties": {"repobilityId": "0e77653704172da1", "scanner": "scanner-primary", "fingerprint": "2b496b9188e7ebdd", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "UniCOP-Reason/openrlhf/custom/ngram_processor.py:83"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ff5aee75a6a37036", "level": "warning", "message": {"text": "Privileged port 30 in use"}, "properties": {"repobilityId": "54f172e7d16fc662", "scanner": "scanner-primary", "fingerprint": "ff5aee75a6a37036", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Latent-SFT/submit_smoke_repro.sh"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3ac7088c4cb1e896", "level": "warning", "message": {"text": "Privileged port 480 in use"}, "properties": {"repobilityId": "e0ff1af548376231", "scanner": "scanner-primary", "fingerprint": "3ac7088c4cb1e896", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Latent-SFT/submit_train_hlr.sh"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-9710c8d059e53154", "level": "none", "message": {"text": "No frontend routes/components detected"}, "properties": {"repobilityId": "44ca61485762e494", "scanner": "scanner-primary", "fingerprint": "9710c8d059e53154", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-aa23372c1db9be23", "level": "error", "message": {"text": "Insecure pattern 'eval_used' in FOARL/run_grpo_foarl_cvrp.sh:172"}, "properties": {"repobilityId": "0e9ec765a1b100d5", "scanner": "scanner-primary", "fingerprint": "aa23372c1db9be23", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "eval_used"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "FOARL/run_grpo_foarl_cvrp.sh"}, "region": {"startLine": 172}}}]}, {"ruleId": "scanner-d3a285f35d9f74df", "level": "error", "message": {"text": "Insecure pattern 'eval_used' in FOARL/submit_sft_foarl_cvrp.sh:104"}, "properties": {"repobilityId": "3c90caaaced71ea3", "scanner": "scanner-primary", "fingerprint": "d3a285f35d9f74df", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "eval_used"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "FOARL/submit_sft_foarl_cvrp.sh"}, "region": {"startLine": 104}}}]}, {"ruleId": "scanner-15eea1259bacdcc8", "level": "error", "message": {"text": "Insecure pattern 'eval_used' in UniCOP-Reason-Mask/run_grpo_cvrp20_v6_instruct.sh:152"}, "properties": {"repobilityId": "d09ceb9c48b7726b", "scanner": "scanner-primary", "fingerprint": "15eea1259bacdcc8", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "eval_used"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "UniCOP-Reason-Mask/run_grpo_cvrp20_v6_instruct.sh"}, "region": {"startLine": 152}}}]}, {"ruleId": "scanner-6372cebde0220094", "level": "warning", "message": {"text": "No auth library detected"}, "properties": {"repobilityId": "a5b6035a5bbf8054", "scanner": "scanner-primary", "fingerprint": "6372cebde0220094", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["coverage", "auth"]}}, {"ruleId": "scanner-4601e3ad3bb28677", "level": "warning", "message": {"text": "No CI/CD pipelines detected"}, "properties": {"repobilityId": "c3ee439bce2bc51e", "scanner": "scanner-primary", "fingerprint": "4601e3ad3bb28677", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-9b7aae3f3cdbaba3", "level": "note", "message": {"text": "Very large file: UniCOP-Distill/build_think_chains.py (1453 lines)"}, "properties": {"repobilityId": "70c9421376237c37", "scanner": "scanner-primary", "fingerprint": "9b7aae3f3cdbaba3", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-3d2b149a8406c5ea", "level": "note", "message": {"text": "Very large file: UniCOP-Reason-Mask/grpo_prm_trainer.py (2705 lines)"}, "properties": {"repobilityId": "59e206c419ddcda1", "scanner": "scanner-primary", "fingerprint": "3d2b149a8406c5ea", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-79ffbdaa1627f789", "level": "note", "message": {"text": "Very large file: UniCOP-Reason-Mask/pomo_prm.py (1188 lines)"}, "properties": {"repobilityId": "a72781cb7f876b39", "scanner": "scanner-primary", "fingerprint": "79ffbdaa1627f789", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-37cff983a67c4ac6", "level": "note", "message": {"text": "Very large file: UniCOP-Reason-Mask/evaluate.py (1819 lines)"}, "properties": {"repobilityId": "49fe5c4263882dd0", "scanner": "scanner-primary", "fingerprint": "37cff983a67c4ac6", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-6f4f04ae26d2ca53", "level": "note", "message": {"text": "Very large file: UniCOP-Reason/grpo_prm_trainer.py (1062 lines)"}, "properties": {"repobilityId": "6527901e45d34cc5", "scanner": "scanner-primary", "fingerprint": "6f4f04ae26d2ca53", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-0252422d31193292", "level": "note", "message": {"text": "Very large file: UniCOP-Reason/evaluate.py (1598 lines)"}, "properties": {"repobilityId": "8b854f5ff945e0a5", "scanner": "scanner-primary", "fingerprint": "0252422d31193292", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-6893a6c8b0861585", "level": "warning", "message": {"text": "Very low test-to-source ratio"}, "properties": {"repobilityId": "54a7de3f06314bf0", "scanner": "scanner-primary", "fingerprint": "6893a6c8b0861585", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["tests", "coverage"]}}, {"ruleId": "scanner-141b30a41e03817b", "level": "note", "message": {"text": "No license file detected"}, "properties": {"repobilityId": "40448e7c6057e698", "scanner": "scanner-primary", "fingerprint": "141b30a41e03817b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["license", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "8160122b060b4b37", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "58231e22340527b8", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-b9088664ace7f748", "level": "note", "message": {"text": "Composite production-readiness gap"}, "properties": {"repobilityId": "f89c6f8ea4469714", "scanner": "scanner-primary", "fingerprint": "b9088664ace7f748", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["production-readiness", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "45c304a19e9bf514", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "090c23712e9e5463", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-55cac069d3d4499a", "level": "none", "message": {"text": "Commented-code block (10 lines) in Latent-SFT/train.py:119"}, "properties": {"repobilityId": "fb898ad7303a6288", "scanner": "scanner-primary", "fingerprint": "55cac069d3d4499a", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-e8b16e2bc1513ab9", "level": "none", "message": {"text": "Commented-code block (6 lines) in Latent-SFT/model.py:41"}, "properties": {"repobilityId": "2b0987845da9f76f", "scanner": "scanner-primary", "fingerprint": "e8b16e2bc1513ab9", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-8de95f7b3cbaf87c", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 Latent-SFT/eval_hlr_compare.py:38"}, "properties": {"repobilityId": "8a2b04bc898dda65", "scanner": "scanner-primary", "fingerprint": "8de95f7b3cbaf87c", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-7a6bb40b19d1db97", "level": "none", "message": {"text": "Commented-code block (7 lines) in UniCOP-Distill/build_reverse_chains.py:249"}, "properties": {"repobilityId": "f75648c94adb8040", "scanner": "scanner-primary", "fingerprint": "7a6bb40b19d1db97", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-c295f8dc7d896f84", "level": "none", "message": {"text": "Commented-code block (5 lines) in UniCOP-Distill/stage2_reasoning/train_sft_stage2.py:363"}, "properties": {"repobilityId": "d311bcfdd1382724", "scanner": "scanner-primary", "fingerprint": "c295f8dc7d896f84", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-b9cabd3e115562f1", "level": "none", "message": {"text": "Commented-code block (5 lines) in FOARL/train_grpo_foarl.py:79"}, "properties": {"repobilityId": "7b43a3a7ee861c8e", "scanner": "scanner-primary", "fingerprint": "b9cabd3e115562f1", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-9499a2e4f872a79d", "level": "none", "message": {"text": "Commented-code block (5 lines) in tools/merge_lora.py:47"}, "properties": {"repobilityId": "82203cdc01c6c4fa", "scanner": "scanner-primary", "fingerprint": "9499a2e4f872a79d", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-c8e6b61408670f80", "level": "none", "message": {"text": "Commented-code block (11 lines) in UniCOP-Reason-Mask/train.py:32"}, "properties": {"repobilityId": "b9cc8f04cce24af0", "scanner": "scanner-primary", "fingerprint": "c8e6b61408670f80", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-8b4840c80a377196", "level": "note", "message": {"text": "Legacy-named symbol `d_old` in UniCOP-Reason-Mask/ref_solver.py:64"}, "properties": {"repobilityId": "e79207c1ad23aede", "scanner": "scanner-primary", "fingerprint": "8b4840c80a377196", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-41892d4fde047729", "level": "none", "message": {"text": "Commented-code block (5 lines) in UniCOP-Reason-Mask/grpo_prm_trainer.py:93"}, "properties": {"repobilityId": "5f3bb05ad2b2c2d3", "scanner": "scanner-primary", "fingerprint": "41892d4fde047729", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-c8946c4cd8262926", "level": "none", "message": {"text": "Commented-code block (19 lines) in UniCOP-Reason-Mask/config.py:36"}, "properties": {"repobilityId": "48b36f4e412eecce", "scanner": "scanner-primary", "fingerprint": "c8946c4cd8262926", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-4b71a2f8e7b51b0b", "level": "none", "message": {"text": "Commented-code block (7 lines) in UniCOP-Reason-Mask/terminal_reward.py:56"}, "properties": {"repobilityId": "0975644202d55ad1", "scanner": "scanner-primary", "fingerprint": "4b71a2f8e7b51b0b", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-148716e025ece4b5", "level": "none", "message": {"text": "Commented-code block (5 lines) in UniCOP-Reason-Mask/merge_shards.py:25"}, "properties": {"repobilityId": "ed5c8361ee01c2ea", "scanner": "scanner-primary", "fingerprint": "148716e025ece4b5", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-99e4990edc805177", "level": "none", "message": {"text": "Commented-code block (5 lines) in UniCOP-Reason-Mask/pomo_prm.py:113"}, "properties": {"repobilityId": "e44f2e6ed0648bbc", "scanner": "scanner-primary", "fingerprint": "99e4990edc805177", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-a242ccc76aa91fbf", "level": "none", "message": {"text": "Commented-code block (5 lines) in UniCOP-Reason-Mask/evaluate.py:51"}, "properties": {"repobilityId": "cf92a13f01811e4b", "scanner": "scanner-primary", "fingerprint": "a242ccc76aa91fbf", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-75611be2cf24c154", "level": "none", "message": {"text": "Commented-code block (5 lines) in UniCOP-Reason-Mask/utils/pipd_wrapper.py:163"}, "properties": {"repobilityId": "7ae805482310e290", "scanner": "scanner-primary", "fingerprint": "75611be2cf24c154", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-258be43eb18dcbb1", "level": "none", "message": {"text": "Commented-code block (5 lines) in UniCOP-Reason-Mask/problems/cvrp.py:52"}, "properties": {"repobilityId": "27aed3b4c1a1c6ef", "scanner": "scanner-primary", "fingerprint": "258be43eb18dcbb1", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-3fc8cf8abd1c794b", "level": "none", "message": {"text": "Commented-code block (11 lines) in UniCOP-Reason/train.py:32"}, "properties": {"repobilityId": "8c2011b4ff71b4ec", "scanner": "scanner-primary", "fingerprint": "3fc8cf8abd1c794b", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-c1105b1479fa8278", "level": "note", "message": {"text": "Legacy-named symbol `d_old` in UniCOP-Reason/ref_solver.py:64"}, "properties": {"repobilityId": "956a0769fc62249b", "scanner": "scanner-primary", "fingerprint": "c1105b1479fa8278", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-b92a6a45737683d1", "level": "none", "message": {"text": "Commented-code block (5 lines) in UniCOP-Reason/grpo_prm_trainer.py:73"}, "properties": {"repobilityId": "70d6d15d20c4d46f", "scanner": "scanner-primary", "fingerprint": "b92a6a45737683d1", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-2c3f14c8a7002153", "level": "none", "message": {"text": "Commented-code block (8 lines) in UniCOP-Reason/config.py:36"}, "properties": {"repobilityId": "b9a20b3221bf4936", "scanner": "scanner-primary", "fingerprint": "2c3f14c8a7002153", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-641e5dea2333b31d", "level": "none", "message": {"text": "Commented-code block (7 lines) in UniCOP-Reason/terminal_reward.py:56"}, "properties": {"repobilityId": "e94c5a4204409aa4", "scanner": "scanner-primary", "fingerprint": "641e5dea2333b31d", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-ce315c5a2f92f059", "level": "none", "message": {"text": "Commented-code block (5 lines) in UniCOP-Reason/pomo_prm.py:110"}, "properties": {"repobilityId": "041244429705e732", "scanner": "scanner-primary", "fingerprint": "ce315c5a2f92f059", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-d48c11943b0a0286", "level": "none", "message": {"text": "Commented-code block (5 lines) in UniCOP-Reason/evaluate.py:51"}, "properties": {"repobilityId": "cbec489734b67a63", "scanner": "scanner-primary", "fingerprint": "d48c11943b0a0286", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-c864c8323d1e1f91", "level": "none", "message": {"text": "Commented-code block (5 lines) in UniCOP-Reason/utils/pipd_wrapper.py:163"}, "properties": {"repobilityId": "ee858733cbb5e51f", "scanner": "scanner-primary", "fingerprint": "c864c8323d1e1f91", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-33a6b62e30ce7ab4", "level": "note", "message": {"text": "Near-duplicate function bodies in 6 places"}, "properties": {"repobilityId": "4038da988f10c04b", "scanner": "scanner-primary", "fingerprint": "33a6b62e30ce7ab4", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "3b5eebc8066a3feb", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "28e8045858b14a05", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "dae896d43787186e", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "36be2fe738767b34", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "42f0e80d07c311f9", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "a61b751c538325cd", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "1cee9f3b168c6f4c", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "dd3cd5ca74727831", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "301ea711dc9784cc", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "087185fe818cf7bc", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "67759f81e1a1cf37", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "c33bdb2cdc8dd7d0", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "8a7279f8dce83119", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "397f121151a0e22a", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "e0dc28511c7dc362", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "e1dbcefb8105e8e0", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "8ac18a2abf5aa3da", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "5b637172bfba6055", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "a516673f2b4ccafa", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-0d0930f07ff86c0e", "level": "error", "message": {"text": "FastAPI POST `generate` without auth dependency \u2014 UniCOP-Reason-Mask/utils/vllm_serve_logprobs.py:172"}, "properties": {"repobilityId": "0b2b4bcb32da7053", "scanner": "scanner-primary", "fingerprint": "0d0930f07ff86c0e", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "UniCOP-Reason-Mask/utils/vllm_serve_logprobs.py"}, "region": {"startLine": 172}}}]}, {"ruleId": "scanner-0c023edd63dfc191", "level": "error", "message": {"text": "FastAPI POST `get_reward` without auth dependency \u2014 UniCOP-Reason-Mask/openrlhf/reward/remote_reward_server.py:183"}, "properties": {"repobilityId": "4ba91d3ec141f9f4", "scanner": "scanner-primary", "fingerprint": "0c023edd63dfc191", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "UniCOP-Reason-Mask/openrlhf/reward/remote_reward_server.py"}, "region": {"startLine": 183}}}]}, {"ruleId": "scanner-75d1cadf07584d3f", "level": "error", "message": {"text": "FastAPI POST `generate` without auth dependency \u2014 UniCOP-Reason/utils/vllm_serve_ngram.py:172"}, "properties": {"repobilityId": "8dcc78741e596408", "scanner": "scanner-primary", "fingerprint": "75d1cadf07584d3f", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "UniCOP-Reason/utils/vllm_serve_ngram.py"}, "region": {"startLine": 172}}}]}, {"ruleId": "scanner-ed0bc2462503d7cc", "level": "error", "message": {"text": "FastAPI POST `get_reward` without auth dependency \u2014 UniCOP-Reason/openrlhf/reward/remote_reward_server.py:183"}, "properties": {"repobilityId": "7bd67d0a31d0c655", "scanner": "scanner-primary", "fingerprint": "ed0bc2462503d7cc", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "UniCOP-Reason/openrlhf/reward/remote_reward_server.py"}, "region": {"startLine": 183}}}]}, {"ruleId": "scanner-fb5a3852c9323e24", "level": "note", "message": {"text": "Unused endpoint: POST /generate/"}, "properties": {"repobilityId": "3c4139a59452751c", "scanner": "scanner-primary", "fingerprint": "fb5a3852c9323e24", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-89b9fd75c4ff7232", "level": "note", "message": {"text": "Unused endpoint: POST /get_reward"}, "properties": {"repobilityId": "8000eef044df990a", "scanner": "scanner-primary", "fingerprint": "89b9fd75c4ff7232", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}]}]}