{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-693d836982519621", "name": "Possibly dead Python function: is_answer_grounded", "shortDescription": {"text": "Possibly dead Python function: is_answer_grounded"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-85cebb8d9ff1f2e4", "name": "Possibly dead Python function: predict_top_scenarios", "shortDescription": {"text": "Possibly dead Python function: predict_top_scenarios"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-290d594d04efb3fa", "name": "Possibly dead Python function: is_followup", "shortDescription": {"text": "Possibly dead Python function: is_followup"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-10e917c9de1c7b43", "name": "Possibly dead Python function: to_list", "shortDescription": {"text": "Possibly dead Python function: to_list"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7ebf3a1dc5812631", "name": "Possibly dead Python function: plot_country_comparison", "shortDescription": {"text": "Possibly dead Python function: plot_country_comparison"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3964ba16f6ad23f8", "name": "Possibly dead Python function: query_import_data", "shortDescription": {"text": "Possibly dead Python function: query_import_data"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d24d95b272688c33", "name": "Possibly dead Python function: warm_cache", "shortDescription": {"text": "Possibly dead Python function: warm_cache"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9710c8d059e53154", "name": "No frontend routes/components detected", "shortDescription": {"text": "No frontend routes/components detected"}, "fullDescription": {"text": "No React/Vue/Next routes were found. This is fine for backend-only repos."}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-4db26be0beca0847", "name": "Insecure pattern 'cors_wildcard' in api.py:46", "shortDescription": {"text": "Insecure pattern 'cors_wildcard' in api.py:46"}, "fullDescription": {"text": "Found a known-risky pattern (cors_wildcard). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2a65b4f26067a195", "name": "Insecure pattern 'direct_innerhtml_assignment' in frontend/index.html:166", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in frontend/index.html:166"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3518a0924ffd6a86", "name": "Insecure pattern 'exec_used' in steel_rag/tariff_agent.py:648", "shortDescription": {"text": "Insecure pattern 'exec_used' in steel_rag/tariff_agent.py:648"}, "fullDescription": {"text": "Found a known-risky pattern (exec_used). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-65d24f0dfcd753f8", "name": "Insecure pattern 'exec_used' in steel_rag/data_agent.py:560", "shortDescription": {"text": "Insecure pattern 'exec_used' in steel_rag/data_agent.py:560"}, "fullDescription": {"text": "Found a known-risky pattern (exec_used). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-6372cebde0220094", "name": "No auth library detected", "shortDescription": {"text": "No auth library detected"}, "fullDescription": {"text": "The scanner did not find any standard auth library (JWT, OAuth, NextAuth, Auth0, etc.). The repo has auth/admin/session surface indicators, so auth may live in custom code, in a separate service, or be missing."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4601e3ad3bb28677", "name": "No CI/CD pipelines detected", "shortDescription": {"text": "No CI/CD pipelines detected"}, "fullDescription": {"text": "No GitHub Actions, GitLab CI, or CircleCI configs found. Without CI you can't gate deploys on tests/lints."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4c5debc4bd4f6b9a", "name": "Very large file: steel_rag/dashboard.py (1473 lines)", "shortDescription": {"text": "Very large file: steel_rag/dashboard.py (1473 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-31f9dd048878d7a5", "name": "Very large file: steel_rag/data_agent.py (1491 lines)", "shortDescription": {"text": "Very large file: steel_rag/data_agent.py (1491 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ea3b5e389d8c9c0f", "name": "Low test-to-source ratio", "shortDescription": {"text": "Low test-to-source ratio"}, "fullDescription": {"text": "5 tests / 32 src (ratio 0.16)."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-141b30a41e03817b", "name": "No license file detected", "shortDescription": {"text": "No license file detected"}, "fullDescription": {"text": "No LICENSE/COPYING/NOTICE file was found. Generated repositories often omit licensing, which blocks reuse and automated intake."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 672 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b9088664ace7f748", "name": "Composite production-readiness gap", "shortDescription": {"text": "Composite production-readiness gap"}, "fullDescription": {"text": "Multiple low-cost hardening controls are missing together: license, ci. Opus verification showed these co-occurring gaps are a better readiness signal than reading each flag in isolation."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-9bd48009dd4e324e", "name": "Commented-code block (7 lines) in vllm/setup_vllm_colab.py:123", "shortDescription": {"text": "Commented-code block (7 lines) in vllm/setup_vllm_colab.py:123"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-4e693b8eb2a427ec", "name": "Network/subprocess call without timeout or try/except \u2014 vllm/setup_vllm_colab.py:48", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 vllm/setup_vllm_colab.py:48"}, "fullDescription": {"text": "`subprocess.Popen(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ddad910d2770127e", "name": "Commented-code block (8 lines) in steel_rag/gravity_model.py:373", "shortDescription": {"text": "Commented-code block (8 lines) in steel_rag/gravity_model.py:373"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-d9c6b153cde97735", "name": "Legacy-named symbol `baseline_v1` in steel_rag/dashboard.py:7", "shortDescription": {"text": "Legacy-named symbol `baseline_v1` in steel_rag/dashboard.py:7"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7fb8ba1a6fc187dd", "name": "Legacy-named symbol `baseline_v1` in steel_rag/eval_harness.py:32", "shortDescription": {"text": "Legacy-named symbol `baseline_v1` in steel_rag/eval_harness.py:32"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e114ce59a654cd04", "name": "Commented-code block (8 lines) in steel_rag/data_agent.py:27", "shortDescription": {"text": "Commented-code block (8 lines) in steel_rag/data_agent.py:27"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-c09488f7253453cf", "name": "Commented-code block (6 lines) in steel_rag/steel_futures.py:222", "shortDescription": {"text": "Commented-code block (6 lines) in steel_rag/steel_futures.py:222"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-4a0b1d5d948ed902", "name": "Legacy-named symbol `baseline_v1` in steel_rag/run_eval.py:17", "shortDescription": {"text": "Legacy-named symbol `baseline_v1` in steel_rag/run_eval.py:17"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-05ba5ed8da46a800", "name": "Legacy-named symbol `ground_truth_v2` in steel_rag/eval/run_eval.py:42", "shortDescription": {"text": "Legacy-named symbol `ground_truth_v2` in steel_rag/eval/run_eval.py:42"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b334d875f2339fa1", "name": "5 env vars used in code but missing from .env.example", "shortDescription": {"text": "5 env vars used in code but missing from .env.example"}, "fullDescription": {"text": "Drift between code and config docs. The first few: `PINECONE_API_KEY`, `PINECONE_CLOUD`, `PINECONE_INDEX_NAME`, `PINECONE_REGION`, `VLLM_BASE_URL`. Add them (with a placeholder/comment) to .env.example so onboarding doesn't break."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-602107c0c4ba0b8f", "name": "FastAPI POST `query` without auth dependency \u2014 api.py:110", "shortDescription": {"text": "FastAPI POST `query` without auth dependency \u2014 api.py:110"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-eac4dd6312c967df", "name": "FastAPI POST `query_impact` without auth dependency \u2014 api.py:154", "shortDescription": {"text": "FastAPI POST `query_impact` without auth dependency \u2014 api.py:154"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-609be02ce8138f46", "name": "FastAPI POST `cache_clear` without auth dependency \u2014 api.py:180", "shortDescription": {"text": "FastAPI POST `cache_clear` without auth dependency \u2014 api.py:180"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-36068cc1e2056f1a", "name": "FastAPI POST `gravity_scenario` without auth dependency \u2014 api.py:203", "shortDescription": {"text": "FastAPI POST `gravity_scenario` without auth dependency \u2014 api.py:203"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-1bb3714794b14146", "name": "Unused endpoint: POST /query", "shortDescription": {"text": "Unused endpoint: POST /query"}, "fullDescription": {"text": "`api.py` declares `POST /query` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-66f4bdf8278ec0cd", "name": "Unused endpoint: POST /query/impact", "shortDescription": {"text": "Unused endpoint: POST /query/impact"}, "fullDescription": {"text": "`api.py` declares `POST /query/impact` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-578b401db4f0fb2b", "name": "Unused endpoint: GET /cache/stats", "shortDescription": {"text": "Unused endpoint: GET /cache/stats"}, "fullDescription": {"text": "`api.py` declares `GET /cache/stats` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ad68c06f5b5283a", "name": "Unused endpoint: POST /cache/clear", "shortDescription": {"text": "Unused endpoint: POST /cache/clear"}, "fullDescription": {"text": "`api.py` declares `POST /cache/clear` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-397ed507a908a357", "name": "Unused endpoint: GET /gravity/insights", "shortDescription": {"text": "Unused endpoint: GET /gravity/insights"}, "fullDescription": {"text": "`api.py` declares `GET /gravity/insights` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3b022ce067275b5e", "name": "Unused endpoint: POST /gravity/scenario", "shortDescription": {"text": "Unused endpoint: POST /gravity/scenario"}, "fullDescription": {"text": "`api.py` declares `POST /gravity/scenario` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/17970"}, "properties": {"repository": "RedRightH/Steel_Trade_Intelligence_System", "repoUrl": "https://github.com/RedRightH/Steel_Trade_Intelligence_System", "branch": "main"}, "results": [{"ruleId": "scanner-693d836982519621", "level": "note", "message": {"text": "Possibly dead Python function: is_answer_grounded"}, "properties": {"repobilityId": "fe00d703c08c3172", "scanner": "scanner-primary", "fingerprint": "693d836982519621", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "steel_rag/guardrails.py:102"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-85cebb8d9ff1f2e4", "level": "note", "message": {"text": "Possibly dead Python function: predict_top_scenarios"}, "properties": {"repobilityId": "a9afccc1468e12cc", "scanner": "scanner-primary", "fingerprint": "85cebb8d9ff1f2e4", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "steel_rag/gravity_model.py:622"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-290d594d04efb3fa", "level": "note", "message": {"text": "Possibly dead Python function: is_followup"}, "properties": {"repobilityId": "af6246edef085b6e", "scanner": "scanner-primary", "fingerprint": "290d594d04efb3fa", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "steel_rag/memory.py:107"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-10e917c9de1c7b43", "level": "note", "message": {"text": "Possibly dead Python function: to_list"}, "properties": {"repobilityId": "b55a5f0208b564f8", "scanner": "scanner-primary", "fingerprint": "10e917c9de1c7b43", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "steel_rag/memory.py:125"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-7ebf3a1dc5812631", "level": "note", "message": {"text": "Possibly dead Python function: plot_country_comparison"}, "properties": {"repobilityId": "03aa3c5d006928fc", "scanner": "scanner-primary", "fingerprint": "7ebf3a1dc5812631", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "steel_rag/data_agent.py:794"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3964ba16f6ad23f8", "level": "note", "message": {"text": "Possibly dead Python function: query_import_data"}, "properties": {"repobilityId": "90eac3ad4f407b9b", "scanner": "scanner-primary", "fingerprint": "3964ba16f6ad23f8", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "steel_rag/data_agent.py:1277"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d24d95b272688c33", "level": "note", "message": {"text": "Possibly dead Python function: warm_cache"}, "properties": {"repobilityId": "02c1f804ca2dedeb", "scanner": "scanner-primary", "fingerprint": "d24d95b272688c33", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "steel_rag/semantic_cache.py:204"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-9710c8d059e53154", "level": "none", "message": {"text": "No frontend routes/components detected"}, "properties": {"repobilityId": "44ca61485762e494", "scanner": "scanner-primary", "fingerprint": "9710c8d059e53154", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-4db26be0beca0847", "level": "warning", "message": {"text": "Insecure pattern 'cors_wildcard' in api.py:46"}, "properties": {"repobilityId": "fdae122c19e8aace", "scanner": "scanner-primary", "fingerprint": "4db26be0beca0847", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "cors_wildcard"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "api.py"}, "region": {"startLine": 46}}}]}, {"ruleId": "scanner-2a65b4f26067a195", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in frontend/index.html:166"}, "properties": {"repobilityId": "e5e3013c3e1d93a5", "scanner": "scanner-primary", "fingerprint": "2a65b4f26067a195", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/index.html"}, "region": {"startLine": 166}}}]}, {"ruleId": "scanner-3518a0924ffd6a86", "level": "error", "message": {"text": "Insecure pattern 'exec_used' in steel_rag/tariff_agent.py:648"}, "properties": {"repobilityId": "d891291073b1d8f3", "scanner": "scanner-primary", "fingerprint": "3518a0924ffd6a86", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "exec_used"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "steel_rag/tariff_agent.py"}, "region": {"startLine": 648}}}]}, {"ruleId": "scanner-65d24f0dfcd753f8", "level": "error", "message": {"text": "Insecure pattern 'exec_used' in steel_rag/data_agent.py:560"}, "properties": {"repobilityId": "75ed60d7c50ca87b", "scanner": "scanner-primary", "fingerprint": "65d24f0dfcd753f8", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "exec_used"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "steel_rag/data_agent.py"}, "region": {"startLine": 560}}}]}, {"ruleId": "scanner-6372cebde0220094", "level": "warning", "message": {"text": "No auth library detected"}, "properties": {"repobilityId": "a5b6035a5bbf8054", "scanner": "scanner-primary", "fingerprint": "6372cebde0220094", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["coverage", "auth"]}}, {"ruleId": "scanner-4601e3ad3bb28677", "level": "warning", "message": {"text": "No CI/CD pipelines detected"}, "properties": {"repobilityId": "c3ee439bce2bc51e", "scanner": "scanner-primary", "fingerprint": "4601e3ad3bb28677", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-4c5debc4bd4f6b9a", "level": "note", "message": {"text": "Very large file: steel_rag/dashboard.py (1473 lines)"}, "properties": {"repobilityId": "60a537778d35cbfd", "scanner": "scanner-primary", "fingerprint": "4c5debc4bd4f6b9a", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-31f9dd048878d7a5", "level": "note", "message": {"text": "Very large file: steel_rag/data_agent.py (1491 lines)"}, "properties": {"repobilityId": "e0568548c55f9b90", "scanner": "scanner-primary", "fingerprint": "31f9dd048878d7a5", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-ea3b5e389d8c9c0f", "level": "note", "message": {"text": "Low test-to-source ratio"}, "properties": {"repobilityId": "ef7b2552cc00a375", "scanner": "scanner-primary", "fingerprint": "ea3b5e389d8c9c0f", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["tests"]}}, {"ruleId": "scanner-141b30a41e03817b", "level": "note", "message": {"text": "No license file detected"}, "properties": {"repobilityId": "b5f85b8dd0f293c4", "scanner": "scanner-primary", "fingerprint": "141b30a41e03817b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["license", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "df57af43c95b7c52", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "e4ff433eb664b97b", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-b9088664ace7f748", "level": "note", "message": {"text": "Composite production-readiness gap"}, "properties": {"repobilityId": "e1686af41da3146c", "scanner": "scanner-primary", "fingerprint": "b9088664ace7f748", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["production-readiness", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "226e99b96e2cedb4", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "59ade9b32db3e878", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-9bd48009dd4e324e", "level": "none", "message": {"text": "Commented-code block (7 lines) in vllm/setup_vllm_colab.py:123"}, "properties": {"repobilityId": "d3d58873f269e296", "scanner": "scanner-primary", "fingerprint": "9bd48009dd4e324e", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-4e693b8eb2a427ec", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 vllm/setup_vllm_colab.py:48"}, "properties": {"repobilityId": "2b4a74e93f5f223b", "scanner": "scanner-primary", "fingerprint": "4e693b8eb2a427ec", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-ddad910d2770127e", "level": "none", "message": {"text": "Commented-code block (8 lines) in steel_rag/gravity_model.py:373"}, "properties": {"repobilityId": "77026f4c59237fa4", "scanner": "scanner-primary", "fingerprint": "ddad910d2770127e", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-d9c6b153cde97735", "level": "note", "message": {"text": "Legacy-named symbol `baseline_v1` in steel_rag/dashboard.py:7"}, "properties": {"repobilityId": "af17d4e157d2edb1", "scanner": "scanner-primary", "fingerprint": "d9c6b153cde97735", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-7fb8ba1a6fc187dd", "level": "note", "message": {"text": "Legacy-named symbol `baseline_v1` in steel_rag/eval_harness.py:32"}, "properties": {"repobilityId": "27a104f3f9272519", "scanner": "scanner-primary", "fingerprint": "7fb8ba1a6fc187dd", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-e114ce59a654cd04", "level": "none", "message": {"text": "Commented-code block (8 lines) in steel_rag/data_agent.py:27"}, "properties": {"repobilityId": "fa2dcc063e63cc4c", "scanner": "scanner-primary", "fingerprint": "e114ce59a654cd04", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-c09488f7253453cf", "level": "none", "message": {"text": "Commented-code block (6 lines) in steel_rag/steel_futures.py:222"}, "properties": {"repobilityId": "e577cd8f460463f9", "scanner": "scanner-primary", "fingerprint": "c09488f7253453cf", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-4a0b1d5d948ed902", "level": "note", "message": {"text": "Legacy-named symbol `baseline_v1` in steel_rag/run_eval.py:17"}, "properties": {"repobilityId": "ea8aef7caaa36119", "scanner": "scanner-primary", "fingerprint": "4a0b1d5d948ed902", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-05ba5ed8da46a800", "level": "note", "message": {"text": "Legacy-named symbol `ground_truth_v2` in steel_rag/eval/run_eval.py:42"}, "properties": {"repobilityId": "b5ec79ca143d05ea", "scanner": "scanner-primary", "fingerprint": "05ba5ed8da46a800", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-b334d875f2339fa1", "level": "note", "message": {"text": "5 env vars used in code but missing from .env.example"}, "properties": {"repobilityId": "faa38682016f5d53", "scanner": "scanner-primary", "fingerprint": "b334d875f2339fa1", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "config-drift"]}}, {"ruleId": "scanner-602107c0c4ba0b8f", "level": "error", "message": {"text": "FastAPI POST `query` without auth dependency \u2014 api.py:110"}, "properties": {"repobilityId": "486a4ca34f06c057", "scanner": "scanner-primary", "fingerprint": "602107c0c4ba0b8f", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "api.py"}, "region": {"startLine": 110}}}]}, {"ruleId": "scanner-eac4dd6312c967df", "level": "error", "message": {"text": "FastAPI POST `query_impact` without auth dependency \u2014 api.py:154"}, "properties": {"repobilityId": "2f8cfc20ddc7b722", "scanner": "scanner-primary", "fingerprint": "eac4dd6312c967df", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "api.py"}, "region": {"startLine": 154}}}]}, {"ruleId": "scanner-609be02ce8138f46", "level": "error", "message": {"text": "FastAPI POST `cache_clear` without auth dependency \u2014 api.py:180"}, "properties": {"repobilityId": "ca1a786de776012c", "scanner": "scanner-primary", "fingerprint": "609be02ce8138f46", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "api.py"}, "region": {"startLine": 180}}}]}, {"ruleId": "scanner-36068cc1e2056f1a", "level": "error", "message": {"text": "FastAPI POST `gravity_scenario` without auth dependency \u2014 api.py:203"}, "properties": {"repobilityId": "90504ffce765a9e7", "scanner": "scanner-primary", "fingerprint": "36068cc1e2056f1a", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "api.py"}, "region": {"startLine": 203}}}]}, {"ruleId": "scanner-1bb3714794b14146", "level": "note", "message": {"text": "Unused endpoint: POST /query"}, "properties": {"repobilityId": "7b31d44967928f10", "scanner": "scanner-primary", "fingerprint": "1bb3714794b14146", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-66f4bdf8278ec0cd", "level": "note", "message": {"text": "Unused endpoint: POST /query/impact"}, "properties": {"repobilityId": "c54d4d895540678f", "scanner": "scanner-primary", "fingerprint": "66f4bdf8278ec0cd", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-578b401db4f0fb2b", "level": "note", "message": {"text": "Unused endpoint: GET /cache/stats"}, "properties": {"repobilityId": "ef02dd55483cade7", "scanner": "scanner-primary", "fingerprint": "578b401db4f0fb2b", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-3ad68c06f5b5283a", "level": "note", "message": {"text": "Unused endpoint: POST /cache/clear"}, "properties": {"repobilityId": "7d1e253e58579c92", "scanner": "scanner-primary", "fingerprint": "3ad68c06f5b5283a", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-397ed507a908a357", "level": "note", "message": {"text": "Unused endpoint: GET /gravity/insights"}, "properties": {"repobilityId": "abe6b1da4770fc76", "scanner": "scanner-primary", "fingerprint": "397ed507a908a357", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-3b022ce067275b5e", "level": "note", "message": {"text": "Unused endpoint: POST /gravity/scenario"}, "properties": {"repobilityId": "fbcc0f776720600f", "scanner": "scanner-primary", "fingerprint": "3b022ce067275b5e", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}]}]}