{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "AIC003", "name": "Duplicated implementation block across source files", "shortDescription": {"text": "Duplicated implementation block across source files"}, "fullDescription": {"text": "Duplicated blocks are a common artifact when generated code is pasted or recreated instead of reused. They increase maintenance cost because every future bug fix must be found in multiple locations."}, "properties": {"scanner": "repobility-ai-code-hygiene", "category": "quality", "severity": "medium", "confidence": 0.86, "cwe": "", "owasp": ""}}, {"id": "SEC020", "name": "[SEC020] Secret Printed to Logs: Debug or diagnostic code appears to print a credential-bearing value. This is a frequen", "shortDescription": {"text": "[SEC020] Secret Printed to Logs: Debug or diagnostic code appears to print a credential-bearing value. This is a frequent AI-assisted coding failure: the helper exposes the exact value needed for troubleshooting."}, "fullDescription": {"text": "Log only redacted, hashed, or last-four-style metadata. Rotate any secret that may have reached logs."}, "properties": {"scanner": "repobility-threat-engine", "category": "credential_exposure", "severity": "info", "confidence": 0.1, "cwe": "", "owasp": ""}}, {"id": "SEC015", "name": "[SEC015] Insecure Randomness for Security: Weak PRNG used in security-sensitive context. Output is predictable.", "shortDescription": {"text": "[SEC015] Insecure Randomness for Security: Weak PRNG used in security-sensitive context. Output is predictable."}, "fullDescription": {"text": "Use secrets module (Python) or crypto.getRandomValues() (JS) for security-sensitive randomness."}, "properties": {"scanner": "repobility-threat-engine", "category": "crypto", "severity": "info", "confidence": 0.25, "cwe": "", "owasp": ""}}]}}, "automationDetails": {"id": "repobility/410"}, "properties": {"repository": "pyca/cryptography", "repoUrl": "https://github.com/pyca/cryptography.git", "branch": "main"}, "results": [{"ruleId": "AIC003", "level": "warning", "message": {"text": "Duplicated implementation block across source files"}, "properties": {"repobilityId": 16477, "scanner": "repobility-ai-code-hygiene", "fingerprint": "fa9bdd44f8b3d171e48151e5957673613eb50cbfd1f5b5083b31bf3da372b78d", "category": "quality", "severity": "medium", "confidence": 0.86, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "A normalized source-code window appears in two different non-test files.", "evidence": {"lines": 12, "rule_id": "AIC003", "scanner": "repobility-ai-code-hygiene", "references": ["https://jscpd.dev/"], "duplicate_file": "src/rust/src/backend/dh.rs", "duplicate_line": 185, "correlation_key": "fp|fa9bdd44f8b3d171e48151e5957673613eb50cbfd1f5b5083b31bf3da372b78d"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/rust/src/backend/dsa.rs"}, "region": {"startLine": 116}}}]}, {"ruleId": "AIC003", "level": "warning", "message": {"text": "Duplicated implementation block across source files"}, "properties": {"repobilityId": 16476, "scanner": "repobility-ai-code-hygiene", "fingerprint": "65bc7d6ebebf5e19c723a6975a075c0a39f7cb96b5461e83a67cefff60bf09fb", "category": "quality", "severity": "medium", "confidence": 0.86, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "A normalized source-code window appears in two different non-test files.", "evidence": {"lines": 12, "rule_id": "AIC003", "scanner": "repobility-ai-code-hygiene", "references": ["https://jscpd.dev/"], "duplicate_file": "src/cryptography/hazmat/primitives/asymmetric/x25519.py", "duplicate_line": 22, "correlation_key": "fp|65bc7d6ebebf5e19c723a6975a075c0a39f7cb96b5461e83a67cefff60bf09fb"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/cryptography/hazmat/primitives/asymmetric/x448.py"}, "region": {"startLine": 22}}}]}, {"ruleId": "AIC003", "level": "warning", "message": {"text": "Duplicated implementation block across source files"}, "properties": {"repobilityId": 16475, "scanner": "repobility-ai-code-hygiene", "fingerprint": "d966635a94d7573dc2a52edcdc5582a064110757e482b8485cdec5197706fdc4", "category": "quality", "severity": "medium", "confidence": 0.86, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "A normalized source-code window appears in two different non-test files.", "evidence": {"lines": 12, "rule_id": "AIC003", "scanner": "repobility-ai-code-hygiene", "references": ["https://jscpd.dev/"], "duplicate_file": "src/cryptography/hazmat/primitives/asymmetric/ed25519.py", "duplicate_line": 10, "correlation_key": "fp|d966635a94d7573dc2a52edcdc5582a064110757e482b8485cdec5197706fdc4"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/cryptography/hazmat/primitives/asymmetric/x448.py"}, "region": {"startLine": 17}}}]}, {"ruleId": "AIC003", "level": "warning", "message": {"text": "Duplicated implementation block across source files"}, "properties": {"repobilityId": 16474, "scanner": "repobility-ai-code-hygiene", "fingerprint": "b19871ae86d137d5afa9c325c474e1c15286aacddbe47848c690fdeed26b7209", "category": "quality", "severity": "medium", "confidence": 0.86, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "A normalized source-code window appears in two different non-test files.", "evidence": {"lines": 12, "rule_id": "AIC003", "scanner": "repobility-ai-code-hygiene", "references": ["https://jscpd.dev/"], "duplicate_file": "src/cryptography/hazmat/primitives/asymmetric/ed25519.py", "duplicate_line": 10, "correlation_key": "fp|b19871ae86d137d5afa9c325c474e1c15286aacddbe47848c690fdeed26b7209"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/cryptography/hazmat/primitives/asymmetric/x25519.py"}, "region": {"startLine": 17}}}]}, {"ruleId": "AIC003", "level": "warning", "message": {"text": "Duplicated implementation block across source files"}, "properties": {"repobilityId": 16473, "scanner": "repobility-ai-code-hygiene", "fingerprint": "a034f8018bbf75493b3c533952bb1f69f027d8570e95d958282c0084221754bd", "category": "quality", "severity": "medium", "confidence": 0.86, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "A normalized source-code window appears in two different non-test files.", "evidence": {"lines": 12, "rule_id": "AIC003", "scanner": "repobility-ai-code-hygiene", "references": ["https://jscpd.dev/"], "duplicate_file": "src/cryptography/hazmat/primitives/asymmetric/dsa.py", "duplicate_line": 90, "correlation_key": "fp|a034f8018bbf75493b3c533952bb1f69f027d8570e95d958282c0084221754bd"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/cryptography/hazmat/primitives/asymmetric/rsa.py"}, "region": {"startLine": 82}}}]}, {"ruleId": "AIC003", "level": "warning", "message": {"text": "Duplicated implementation block across source files"}, "properties": {"repobilityId": 16472, "scanner": "repobility-ai-code-hygiene", "fingerprint": "8115fee2ce4d5f8795b889dc2b9577cc7cf7219af7cff947f06ecd73167a99e6", "category": "quality", "severity": "medium", "confidence": 0.86, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "A normalized source-code window appears in two different non-test files.", "evidence": {"lines": 12, "rule_id": "AIC003", "scanner": "repobility-ai-code-hygiene", "references": ["https://jscpd.dev/"], "duplicate_file": "src/cryptography/hazmat/primitives/asymmetric/dh.py", "duplicate_line": 101, "correlation_key": "fp|8115fee2ce4d5f8795b889dc2b9577cc7cf7219af7cff947f06ecd73167a99e6"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/cryptography/hazmat/primitives/asymmetric/rsa.py"}, "region": {"startLine": 43}}}]}, {"ruleId": "AIC003", "level": "warning", "message": {"text": "Duplicated implementation block across source files"}, "properties": {"repobilityId": 16471, "scanner": "repobility-ai-code-hygiene", "fingerprint": "2f19c9bb85d9873a06b273ea2438dd1bd69c1900efa92c3b207fc814ec04e996", "category": "quality", "severity": "medium", "confidence": 0.86, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "A normalized source-code window appears in two different non-test files.", "evidence": {"lines": 12, "rule_id": "AIC003", "scanner": "repobility-ai-code-hygiene", "references": ["https://jscpd.dev/"], "duplicate_file": "src/cryptography/hazmat/primitives/asymmetric/ed25519.py", "duplicate_line": 10, "correlation_key": "fp|2f19c9bb85d9873a06b273ea2438dd1bd69c1900efa92c3b207fc814ec04e996"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/cryptography/hazmat/primitives/asymmetric/mlkem.py"}, "region": {"startLine": 22}}}]}, {"ruleId": "AIC003", "level": "warning", "message": {"text": "Duplicated implementation block across source files"}, "properties": {"repobilityId": 16470, "scanner": "repobility-ai-code-hygiene", "fingerprint": "ad5e10917260bd73450f5cfbf529584ebdd53785156d0762dd894ec159949670", "category": "quality", "severity": "medium", "confidence": 0.86, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "A normalized source-code window appears in two different non-test files.", "evidence": {"lines": 12, "rule_id": "AIC003", "scanner": "repobility-ai-code-hygiene", "references": ["https://jscpd.dev/"], "duplicate_file": "src/cryptography/hazmat/primitives/asymmetric/ed25519.py", "duplicate_line": 10, "correlation_key": "fp|ad5e10917260bd73450f5cfbf529584ebdd53785156d0762dd894ec159949670"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/cryptography/hazmat/primitives/asymmetric/mldsa.py"}, "region": {"startLine": 17}}}]}, {"ruleId": "AIC003", "level": "warning", "message": {"text": "Duplicated implementation block across source files"}, "properties": {"repobilityId": 16469, "scanner": "repobility-ai-code-hygiene", "fingerprint": "8e37d2561e18ef70b5d5f69db247ab0eda1308600cc15adfa7452c9edf62ad44", "category": "quality", "severity": "medium", "confidence": 0.86, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "A normalized source-code window appears in two different non-test files.", "evidence": {"lines": 12, "rule_id": "AIC003", "scanner": "repobility-ai-code-hygiene", "references": ["https://jscpd.dev/"], "duplicate_file": "src/cryptography/hazmat/primitives/asymmetric/ed25519.py", "duplicate_line": 10, "correlation_key": "fp|8e37d2561e18ef70b5d5f69db247ab0eda1308600cc15adfa7452c9edf62ad44"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/cryptography/hazmat/primitives/asymmetric/ed448.py"}, "region": {"startLine": 17}}}]}, {"ruleId": "AIC003", "level": "warning", "message": {"text": "Duplicated implementation block across source files"}, "properties": {"repobilityId": 16468, "scanner": "repobility-ai-code-hygiene", "fingerprint": "cb69a25c149d2b3bab4cc0b396890d2999a93917caed002dc23bcda675736f5e", "category": "quality", "severity": "medium", "confidence": 0.86, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "A normalized source-code window appears in two different non-test files.", "evidence": {"lines": 12, "rule_id": "AIC003", "scanner": "repobility-ai-code-hygiene", "references": ["https://jscpd.dev/"], "duplicate_file": "src/cryptography/hazmat/primitives/asymmetric/dsa.py", "duplicate_line": 90, "correlation_key": "fp|cb69a25c149d2b3bab4cc0b396890d2999a93917caed002dc23bcda675736f5e"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/cryptography/hazmat/primitives/asymmetric/ec.py"}, "region": {"startLine": 127}}}]}, {"ruleId": "AIC003", "level": "warning", "message": {"text": "Duplicated implementation block across source files"}, "properties": {"repobilityId": 16467, "scanner": "repobility-ai-code-hygiene", "fingerprint": "a1474218205cf5216043a9446495a389016019d95777792f8fc0ea0b0a73ffea", "category": "quality", "severity": "medium", "confidence": 0.86, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "A normalized source-code window appears in two different non-test files.", "evidence": {"lines": 12, "rule_id": "AIC003", "scanner": "repobility-ai-code-hygiene", "references": ["https://jscpd.dev/"], "duplicate_file": "src/cryptography/hazmat/primitives/asymmetric/dh.py", "duplicate_line": 101, "correlation_key": "fp|a1474218205cf5216043a9446495a389016019d95777792f8fc0ea0b0a73ffea"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/cryptography/hazmat/primitives/asymmetric/ec.py"}, "region": {"startLine": 87}}}]}, {"ruleId": "AIC003", "level": "warning", "message": {"text": "Duplicated implementation block across source files"}, "properties": {"repobilityId": 16466, "scanner": "repobility-ai-code-hygiene", "fingerprint": "9bd30155c9f15e0a9f568d5306d169fd3a874d86e0d9bdeeff5a49837e222e57", "category": "quality", "severity": "medium", "confidence": 0.86, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "A normalized source-code window appears in two different non-test files.", "evidence": {"lines": 12, "rule_id": "AIC003", "scanner": "repobility-ai-code-hygiene", "references": ["https://jscpd.dev/"], "duplicate_file": "src/cryptography/hazmat/primitives/asymmetric/dh.py", "duplicate_line": 101, "correlation_key": "fp|9bd30155c9f15e0a9f568d5306d169fd3a874d86e0d9bdeeff5a49837e222e57"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/cryptography/hazmat/primitives/asymmetric/dsa.py"}, "region": {"startLine": 51}}}]}, {"ruleId": "SEC020", "level": "none", "message": {"text": "[SEC020] Secret Printed to Logs: Debug or diagnostic code appears to print a credential-bearing value. This is a frequent AI-assisted coding failure: the helper exposes the exact value needed for troubleshooting."}, "properties": {"repobilityId": 16479, "scanner": "repobility-threat-engine", "fingerprint": "ea6439929564d1a7283c29de3810fda7416b813f4ee65516b0ca4f120b0a8340", "category": "credential_exposure", "severity": "info", "confidence": 0.1, "triageState": "false_positive", "verdict": "likely_fp", "isResolved": true, "reason": "Safe context pattern detected", "evidence": {"match": "print(bool(sysconfig.get_config_var('Py_GIL_DISABLED')", "reason": "Safe context pattern detected", "rule_id": "SEC020", "scanner": "repobility-threat-engine", "confidence": 0.1, "correlation_key": "secret|token|9|print bool sysconfig.get_config_var py_gil_disabled"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/rust/cryptography-cffi/build.rs"}, "region": {"startLine": 92}}}]}, {"ruleId": "SEC015", "level": "none", "message": {"text": "[SEC015] Insecure Randomness for Security: Weak PRNG used in security-sensitive context. Output is predictable."}, "properties": {"repobilityId": 16478, "scanner": "repobility-threat-engine", "fingerprint": "1df19521fb069626505d16040f0bd9df99d757ec232291ccc9c4de2ed58c0103", "category": "crypto", "severity": "info", "confidence": 0.25, "triageState": "false_positive", "verdict": "likely_fp", "isResolved": true, "reason": "Weak PRNG appears to be used for non-security behavior (UI, sampling, demos, shuffling, or backoff), not for secrets", "evidence": {"match": "random.randint(", "reason": "Weak PRNG appears to be used for non-security behavior (UI, sampling, demos, shuffling, or backoff), not for secrets", "rule_id": "SEC015", "scanner": "repobility-threat-engine", "confidence": 0.25, "correlation_key": "code|crypto|token|275|sec015"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/cryptography/hazmat/primitives/asymmetric/rsa.py"}, "region": {"startLine": 275}}}]}]}]}