{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-aca8b818b67ba5c0", "name": "TODO/FIXME marker in shipping code \u2014 packages/wallets/src/wallets/wallet.ts:726", "shortDescription": {"text": "TODO/FIXME marker in shipping code \u2014 packages/wallets/src/wallets/wallet.ts:726"}, "fullDescription": {"text": "Track in /reviews or /issues, not as a code comment that rots.\n\nWhy: Drift control \u2014 shouldn't be the same as Quality TODO scanner.\nRule id: fq.todo-marker"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-a94443c10247545f", "name": "TODO/FIXME marker in shipping code \u2014 packages/wallets/src/api/client-integration.test.ts:983", "shortDescription": {"text": "TODO/FIXME marker in shipping code \u2014 packages/wallets/src/api/client-integration.test.ts:983"}, "fullDescription": {"text": "Track in /reviews or /issues, not as a code comment that rots.\n\nWhy: Drift control \u2014 shouldn't be the same as Quality TODO scanner.\nRule id: fq.todo-marker"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-6a83c39d994263db", "name": "TODO/FIXME marker in shipping code \u2014 packages/client/wallets/walletconnect/src/wallets/WalletConnectEVMAAWallet.ts:5", "shortDescription": {"text": "TODO/FIXME marker in shipping code \u2014 packages/client/wallets/walletconnect/src/wallets/WalletConnectEVMAAWallet.ts:5"}, "fullDescription": {"text": "Track in /reviews or /issues, not as a code comment that rots.\n\nWhy: Drift control \u2014 shouldn't be the same as Quality TODO scanner.\nRule id: fq.todo-marker"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-6d4b101da01644be", "name": "TODO/FIXME marker in shipping code \u2014 packages/client/wallets/walletconnect/src/utils/sendTransaction/decodeSendTransacti", "shortDescription": {"text": "TODO/FIXME marker in shipping code \u2014 packages/client/wallets/walletconnect/src/utils/sendTransaction/decodeSendTransactionRequest.ts:6"}, "fullDescription": {"text": "Track in /reviews or /issues, not as a code comment that rots.\n\nWhy: Drift control \u2014 shouldn't be the same as Quality TODO scanner.\nRule id: fq.todo-marker"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-72d9ccde8a49d1fe", "name": "TODO/FIXME marker in shipping code \u2014 packages/client/wallets/walletconnect/src/utils/wallet/walletToSupportedNamespaces.", "shortDescription": {"text": "TODO/FIXME marker in shipping code \u2014 packages/client/wallets/walletconnect/src/utils/wallet/walletToSupportedNamespaces.ts:21"}, "fullDescription": {"text": "Track in /reviews or /issues, not as a code comment that rots.\n\nWhy: Drift control \u2014 shouldn't be the same as Quality TODO scanner.\nRule id: fq.todo-marker"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-76061aa8f67bbce8", "name": "Stray `console.log` in TS/JS \u2014 packages/client/wallets/walletconnect/src/hooks/usePairWithURI.tsx:32", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 packages/client/wallets/walletconnect/src/hooks/usePairWithURI.tsx:32"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cedd097d6380bca9", "name": "Stray `console.log` in TS/JS \u2014 packages/client/wallets/walletconnect/src/hooks/useWalletConnectSessions.tsx:48", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 packages/client/wallets/walletconnect/src/hooks/useWalletConnectSessions.tsx:48"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-66578a8fc9889477", "name": "Stray `console.log` in TS/JS \u2014 packages/client/wallets/walletconnect/src/hooks/useWalletConnectRequests.tsx:41", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 packages/client/wallets/walletconnect/src/hooks/useWalletConnectRequests.tsx:41"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0d729d72d0730535", "name": "Stray `console.log` in TS/JS \u2014 packages/client/wallets/walletconnect/src/hooks/useWalletConnectProvider.tsx:31", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 packages/client/wallets/walletconnect/src/hooks/useWalletConnectProvider.tsx:31"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-07e4385076fdc97d", "name": "TODO/FIXME marker in shipping code \u2014 packages/client/wallets/walletconnect/src/components/modals/SessionRequest/SessionR", "shortDescription": {"text": "TODO/FIXME marker in shipping code \u2014 packages/client/wallets/walletconnect/src/components/modals/SessionRequest/SessionRequestViewRouter.tsx:62"}, "fullDescription": {"text": "Track in /reviews or /issues, not as a code comment that rots.\n\nWhy: Drift control \u2014 shouldn't be the same as Quality TODO scanner.\nRule id: fq.todo-marker"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-6d4721b9f6c46885", "name": "`truncate` class without `title=` for hover reveal \u2014 packages/client/wallets/walletconnect/src/components/EnterURI/Enter", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 packages/client/wallets/walletconnect/src/components/EnterURI/EnterURIInput.tsx:36"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-76a769fdb70f9ade", "name": "`truncate` class without `title=` for hover reveal \u2014 packages/client/wallets/walletconnect/src/components/common/layouts", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 packages/client/wallets/walletconnect/src/components/common/layouts/modal/DAppRequestHeader.tsx:53"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-a58c20045446a4e9", "name": "TODO/FIXME marker in shipping code \u2014 packages/client/base/src/types/embed/v3/CrossmintEmbeddedCheckoutV3Props.ts:221", "shortDescription": {"text": "TODO/FIXME marker in shipping code \u2014 packages/client/base/src/types/embed/v3/CrossmintEmbeddedCheckoutV3Props.ts:221"}, "fullDescription": {"text": "Track in /reviews or /issues, not as a code comment that rots.\n\nWhy: Drift control \u2014 shouldn't be the same as Quality TODO scanner.\nRule id: fq.todo-marker"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-35790c37a41ed5ba", "name": "TODO/FIXME marker in shipping code \u2014 packages/client/base/src/types/events/public/payloads.ts:61", "shortDescription": {"text": "TODO/FIXME marker in shipping code \u2014 packages/client/base/src/types/events/public/payloads.ts:61"}, "fullDescription": {"text": "Track in /reviews or /issues, not as a code comment that rots.\n\nWhy: Drift control \u2014 shouldn't be the same as Quality TODO scanner.\nRule id: fq.todo-marker"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-ffbdd0a4fa718615", "name": "Stray `console.log` in TS/JS \u2014 packages/client/base/src/services/logging/ConsoleProvider.ts:5", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 packages/client/base/src/services/logging/ConsoleProvider.ts:5"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-dd07d5d6beb707ab", "name": "TODO/FIXME marker in shipping code \u2014 packages/client/base/src/services/hosted/v3/crossmintHostedCheckoutV3Service.ts:55", "shortDescription": {"text": "TODO/FIXME marker in shipping code \u2014 packages/client/base/src/services/hosted/v3/crossmintHostedCheckoutV3Service.ts:55"}, "fullDescription": {"text": "Track in /reviews or /issues, not as a code comment that rots.\n\nWhy: Drift control \u2014 shouldn't be the same as Quality TODO scanner.\nRule id: fq.todo-marker"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-12d1edfb27212dfe", "name": "Stray `console.log` in TS/JS \u2014 packages/client/rn-window/src/rn-webview/RNWebView.test.tsx:71", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 packages/client/rn-window/src/rn-webview/RNWebView.test.tsx:71"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-08fcaec2d703f7d2", "name": "TODO/FIXME marker in shipping code \u2014 packages/client/auth/src/CrossmintAuthClient.ts:246", "shortDescription": {"text": "TODO/FIXME marker in shipping code \u2014 packages/client/auth/src/CrossmintAuthClient.ts:246"}, "fullDescription": {"text": "Track in /reviews or /issues, not as a code comment that rots.\n\nWhy: Drift control \u2014 shouldn't be the same as Quality TODO scanner.\nRule id: fq.todo-marker"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-e89ae3762543ef43", "name": "Stray `console.log` in TS/JS \u2014 packages/client/verifiable-credentials/src/presentation/getCredential.ts:53", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 packages/client/verifiable-credentials/src/presentation/getCredential.ts:53"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a621f2d99c997610", "name": "Stray `console.log` in TS/JS \u2014 packages/client/verifiable-credentials/src/decryption/wallet.ts:36", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 packages/client/verifiable-credentials/src/decryption/wallet.ts:36"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e3f6e913d6632157", "name": "Stray `console.log` in TS/JS \u2014 packages/client/verifiable-credentials/src/verifiableCredentialsSDK/encryption/lit.ts:56", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 packages/client/verifiable-credentials/src/verifiableCredentialsSDK/encryption/lit.ts:56"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-79f173cf0c515749", "name": "Stray `console.log` in TS/JS \u2014 packages/client/verifiable-credentials/src/verifiableCredentialsSDK/presentation/getColle", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 packages/client/verifiable-credentials/src/verifiableCredentialsSDK/presentation/getCollections.ts:63"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-aa58da1b4a2cb621", "name": "Stray `console.log` in TS/JS \u2014 packages/client/verifiable-credentials/src/services/walletAuth.ts:27", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 packages/client/verifiable-credentials/src/services/walletAuth.ts:27"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b8c6a6180d811cef", "name": "Stray `console.log` in TS/JS \u2014 packages/client/verifiable-credentials/src/services/delegationSignature.ts:12", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 packages/client/verifiable-credentials/src/services/delegationSignature.ts:12"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5cabbabdd53cba34", "name": "Stray `console.log` in TS/JS \u2014 packages/client/react-base/src/providers/CrossmintAuthBaseProvider.tsx:124", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 packages/client/react-base/src/providers/CrossmintAuthBaseProvider.tsx:124"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5e152a4100deda1e", "name": "Stray `console.log` in TS/JS \u2014 packages/client/signers-cryptography/src/utils/performance.ts:5", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 packages/client/signers-cryptography/src/utils/performance.ts:5"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e93c774ecf60d970", "name": "Stray `console.log` in TS/JS \u2014 packages/client/ui/react-ui/src/providers/CrossmintAuthProvider.tsx:66", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 packages/client/ui/react-ui/src/providers/CrossmintAuthProvider.tsx:66"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-afc01f259e5da074", "name": "Stray `console.log` in TS/JS \u2014 packages/client/ui/react-ui/src/components/embed/v3/crypto/CryptoWalletConnectionHandler.", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 packages/client/ui/react-ui/src/components/embed/v3/crypto/CryptoWalletConnectionHandler.tsx:29"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1967dd851dc76c13", "name": "TODO/FIXME marker in shipping code \u2014 packages/client/ui/react-ui/src/components/embed/v3/crypto/utils/handleSolanaTransa", "shortDescription": {"text": "TODO/FIXME marker in shipping code \u2014 packages/client/ui/react-ui/src/components/embed/v3/crypto/utils/handleSolanaTransaction.ts:16"}, "fullDescription": {"text": "Track in /reviews or /issues, not as a code comment that rots.\n\nWhy: Drift control \u2014 shouldn't be the same as Quality TODO scanner.\nRule id: fq.todo-marker"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-5c662e902735d217", "name": "Stray `console.log` in TS/JS \u2014 packages/client/ui/react-ui/src/components/embed/v3/crypto/utils/handleSolanaTransaction.", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 packages/client/ui/react-ui/src/components/embed/v3/crypto/utils/handleSolanaTransaction.ts:45"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-42b86799fd563da3", "name": "Stray `console.log` in TS/JS \u2014 packages/client/ui/react-ui/src/components/embed/v3/crypto/utils/handleEvmTransaction.ts:", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 packages/client/ui/react-ui/src/components/embed/v3/crypto/utils/handleEvmTransaction.ts:66"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a489a18dd7cb758a", "name": "Stray `console.log` in TS/JS \u2014 packages/client/ui/react-ui/src/components/embed/v3/crypto/utils/handleSuiTransaction.ts:", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 packages/client/ui/react-ui/src/components/embed/v3/crypto/utils/handleSuiTransaction.ts:59"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d8f0d39e80d2faa0", "name": "Stray `console.log` in TS/JS \u2014 apps/wallets/quickstart-devkit/tests/smoke/specs/wallets/smoke.spec.ts:118", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 apps/wallets/quickstart-devkit/tests/smoke/specs/wallets/smoke.spec.ts:118"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2c58588ac8692be1", "name": "Stray `console.log` in TS/JS \u2014 apps/wallets/quickstart-devkit/tests/shared/utils/email.ts:9", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 apps/wallets/quickstart-devkit/tests/shared/utils/email.ts:9"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-793144c565923fdf", "name": "Stray `console.log` in TS/JS \u2014 apps/wallets/quickstart-devkit/tests/shared/utils/auth.ts:7", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 apps/wallets/quickstart-devkit/tests/shared/utils/auth.ts:7"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2350513ff5d3ba44", "name": "Stray `console.log` in TS/JS \u2014 apps/wallets/quickstart-devkit/tests/shared/utils/wallet.ts:21", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 apps/wallets/quickstart-devkit/tests/shared/utils/wallet.ts:21"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4e51910e7af09f65", "name": "Stray `console.log` in TS/JS \u2014 apps/wallets/quickstart-devkit/tests/shared/constants/globalConstants.ts:107", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 apps/wallets/quickstart-devkit/tests/shared/constants/globalConstants.ts:107"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0e59a8884f9a59d6", "name": "Stray `console.log` in TS/JS \u2014 apps/wallets/quickstart-devkit/tests/shared/fixtures/auth.fixture.ts:27", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 apps/wallets/quickstart-devkit/tests/shared/fixtures/auth.fixture.ts:27"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fb57d8204a9f38d3", "name": "Stray `console.log` in TS/JS \u2014 apps/wallets/quickstart-devkit/tests/e2e/specs/wallets/e2e.spec.ts:20", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 apps/wallets/quickstart-devkit/tests/e2e/specs/wallets/e2e.spec.ts:20"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-11a9b81f197a7955", "name": "Stray `console.log` in TS/JS \u2014 apps/wallets/quickstart-devkit/scripts/notify-slack.js:202", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 apps/wallets/quickstart-devkit/scripts/notify-slack.js:202"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5b254174c8a88600", "name": "Stray `console.log` in TS/JS \u2014 apps/wallets/quickstart-devkit/scripts/generate-test-report.js:215", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 apps/wallets/quickstart-devkit/scripts/generate-test-report.js:215"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-63349473700d377e", "name": "Stray `console.log` in TS/JS \u2014 apps/payments/nextjs/components/embed-v3/EmbeddedCheckoutV3Content.tsx:10", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 apps/payments/nextjs/components/embed-v3/EmbeddedCheckoutV3Content.tsx:10"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-50fd81e5f8843ecc", "name": "Stray `console.log` in TS/JS \u2014 apps/auth/node-and-express-server/express.js:59", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 apps/auth/node-and-express-server/express.js:59"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ac6d10f0ba072b24", "name": "Stray `console.log` in TS/JS \u2014 apps/auth/node-and-express-server/index.js:46", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 apps/auth/node-and-express-server/index.js:46"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9afaf5f99eb0a97a", "name": "Stray `console.log` in TS/JS \u2014 apps/auth/remix-ssr/app/routes/_index.tsx:24", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 apps/auth/remix-ssr/app/routes/_index.tsx:24"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-eeeb9d54c3130747", "name": "Possible secret in packages/wallets/src/api/client-integration.test.ts", "shortDescription": {"text": "Possible secret in packages/wallets/src/api/client-integration.test.ts"}, "fullDescription": {"text": "Detected pattern matching generic_api_key. Rotate the credential and move to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-48577372b8a63023", "name": "Possible secret in packages/wallets/src/api/__tests__/constants.ts", "shortDescription": {"text": "Possible secret in packages/wallets/src/api/__tests__/constants.ts"}, "fullDescription": {"text": "Detected pattern matching generic_api_key. Rotate the credential and move to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-912803144345ca08", "name": "Possible secret in packages/client/wallets/smart-wallet/src/sdk.test.ts", "shortDescription": {"text": "Possible secret in packages/client/wallets/smart-wallet/src/sdk.test.ts"}, "fullDescription": {"text": "Detected pattern matching generic_api_key. Rotate the credential and move to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-38f93c21a1490cda", "name": "Insecure pattern 'direct_innerhtml_assignment' in packages/client/base/src/services/hosted/v3/crossmintHostedCheckoutOve", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in packages/client/base/src/services/hosted/v3/crossmintHostedCheckoutOverlayService.ts:26"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-94a24f39e456ebb4", "name": "Insecure pattern 'direct_innerhtml_assignment' in packages/client/base/src/services/hosted/v3/styles/crossmintHostedChec", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in packages/client/base/src/services/hosted/v3/styles/crossmintHostedCheckoutV3StylesService.ts:101"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-351316dc58db06c0", "name": "Possible secret in packages/client/react-base/src/hooks/useCrossmint.test.tsx", "shortDescription": {"text": "Possible secret in packages/client/react-base/src/hooks/useCrossmint.test.tsx"}, "fullDescription": {"text": "Detected pattern matching generic_api_key. Rotate the credential and move to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-9693bb220b91becd", "name": "Possible secret in packages/common/base/src/apiKey/validate-api-key.test.ts", "shortDescription": {"text": "Possible secret in packages/common/base/src/apiKey/validate-api-key.test.ts"}, "fullDescription": {"text": "Detected pattern matching generic_api_key. Rotate the credential and move to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-0b82a8c23697bbca", "name": "Possible secret in apps/payments/nextjs/app/payment-method-management/components/ClientProviders.tsx", "shortDescription": {"text": "Possible secret in apps/payments/nextjs/app/payment-method-management/components/ClientProviders.tsx"}, "fullDescription": {"text": "Detected pattern matching generic_api_key. Rotate the credential and move to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-a397129dbdd81ca7", "name": "Possible secret in apps/payments/nextjs/components/embed-v3/EmbeddedCheckoutV3ClientProviders.tsx", "shortDescription": {"text": "Possible secret in apps/payments/nextjs/components/embed-v3/EmbeddedCheckoutV3ClientProviders.tsx"}, "fullDescription": {"text": "Detected pattern matching generic_api_key. Rotate the credential and move to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-79fe0b539a67485b", "name": "Possible secret in apps/payments/nextjs/components/hosted-v3/HostedCheckoutV3ClientProviders.tsx", "shortDescription": {"text": "Possible secret in apps/payments/nextjs/components/hosted-v3/HostedCheckoutV3ClientProviders.tsx"}, "fullDescription": {"text": "Detected pattern matching generic_api_key. Rotate the credential and move to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-56f15c494012a456", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/upload-artifact@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f24e7b33cdfafcd8", "name": "GitHub Action tracks a moving branch", "shortDescription": {"text": "GitHub Action tracks a moving branch"}, "fullDescription": {"text": "flowwer-dev/pull-request-stats@master can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "high", "confidence": 1.0}}, {"id": "scanner-6529fd323efdff07", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3a1901eb29cd1be1", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1d7e834080dbebed", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/setup-node@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-299e5e0d9ac9f81f", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-27924aa79fa4a517", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2b218a4567416b03", "name": "Very large file: packages/wallets/src/wallets/wallet.test.ts (3267 lines)", "shortDescription": {"text": "Very large file: packages/wallets/src/wallets/wallet.test.ts (3267 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d1bd8086c5a4a4de", "name": "Very large file: packages/wallets/src/wallets/wallet.ts (2223 lines)", "shortDescription": {"text": "Very large file: packages/wallets/src/wallets/wallet.ts (2223 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-27de73007fdef168", "name": "Very large file: packages/wallets/src/api/client.test.ts (1395 lines)", "shortDescription": {"text": "Very large file: packages/wallets/src/api/client.test.ts (1395 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a11d4d93daab9442", "name": "Very large file: packages/client/base/src/lib/hosted-checkout/Order.ts (5609 lines)", "shortDescription": {"text": "Very large file: packages/client/base/src/lib/hosted-checkout/Order.ts (5609 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6ab71374e2c3302a", "name": "Very large file: packages/client/verifiable-credentials/src/ABI/upgradeable721-v0.8.ts (3589 lines)", "shortDescription": {"text": "Very large file: packages/client/verifiable-credentials/src/ABI/upgradeable721-v0.8.ts (3589 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ea3b5e389d8c9c0f", "name": "Low test-to-source ratio", "shortDescription": {"text": "Low test-to-source ratio"}, "fullDescription": {"text": "82 tests / 664 src (ratio 0.12)."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-62a6bfc618a0b582", "name": "Node manifest has dependencies but no lockfile: packages/wallets/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: packages/wallets/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b739f2f2be1d714d", "name": "Node manifest has dependencies but no lockfile: packages/server/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: packages/server/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b0c70c04d9fe01be", "name": "Node manifest has dependencies but no lockfile: packages/client/wallets/smart-wallet/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: packages/client/wallets/smart-wallet/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-611c9f08ae20c580", "name": "Node manifest has dependencies but no lockfile: packages/client/wallets/walletconnect/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: packages/client/wallets/walletconnect/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-59455e6ccd71b5ad", "name": "Node manifest has dependencies but no lockfile: packages/client/base/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: packages/client/base/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cf7eafc9534c46c6", "name": "Node manifest has dependencies but no lockfile: packages/client/rn-window/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: packages/client/rn-window/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-13c5112ead287727", "name": "Node manifest has dependencies but no lockfile: packages/client/auth/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: packages/client/auth/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1a2c6f6ff6bf2409", "name": "Node manifest has dependencies but no lockfile: packages/client/verifiable-credentials/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: packages/client/verifiable-credentials/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6bb8a410d7293eb5", "name": "Node manifest has dependencies but no lockfile: packages/client/signers/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: packages/client/signers/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fd32dd3a10d765da", "name": "Node manifest has dependencies but no lockfile: packages/client/window/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: packages/client/window/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5ddfbfe31cfadb21", "name": "Node manifest has dependencies but no lockfile: packages/client/react-base/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: packages/client/react-base/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-49bd7641d87f2563", "name": "Node manifest has dependencies but no lockfile: packages/client/signers-cryptography/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: packages/client/signers-cryptography/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8f619b2779bfa519", "name": "Node manifest has dependencies but no lockfile: packages/client/ui/react-ui/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: packages/client/ui/react-ui/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c10d6a9c0ada8f27", "name": "Node manifest has dependencies but no lockfile: packages/client/ui/react-native/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: packages/client/ui/react-native/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-81c0d15160dbe1b5", "name": "Node manifest has dependencies but no lockfile: packages/common/base/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: packages/common/base/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-34fcb229182daacb", "name": "Node manifest has dependencies but no lockfile: packages/common/auth/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: packages/common/auth/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8bde7f569062247f", "name": "Node manifest has dependencies but no lockfile: apps/wallets/react/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: apps/wallets/react/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d1bc08a43875fee0", "name": "Node manifest has dependencies but no lockfile: apps/wallets/expo/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: apps/wallets/expo/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c9f943aefd5b215e", "name": "Node manifest has dependencies but no lockfile: apps/wallets/quickstart-devkit/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: apps/wallets/quickstart-devkit/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c9ec58b71031ac54", "name": "Node manifest has dependencies but no lockfile: apps/payments/nextjs/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: apps/payments/nextjs/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7bee836db59cb215", "name": "Node manifest has dependencies but no lockfile: apps/auth/nextjs-ssr/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: apps/auth/nextjs-ssr/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ac4acf6185cc6ad8", "name": "Node manifest has dependencies but no lockfile: apps/auth/node-and-express-server/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: apps/auth/node-and-express-server/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-33aa829bd72278d1", "name": "Node manifest has dependencies but no lockfile: apps/auth/remix-ssr/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: apps/auth/remix-ssr/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 67 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-72b2a6250083a784", "name": "Placeholder or mock-heavy implementation detected", "shortDescription": {"text": "Placeholder or mock-heavy implementation detected"}, "fullDescription": {"text": "Found 34 placeholder/mock markers across 16 source files. This often means the repo looks complete while core flows still use generated scaffolding or fake data."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2c4f6208b5318ed1", "name": "Commented-code block (5 lines) in packages/wallets/src/wallets/wallet.test.ts:3194", "shortDescription": {"text": "Commented-code block (5 lines) in packages/wallets/src/wallets/wallet.test.ts:3194"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-25413e264b9f490b", "name": "Commented-code block (5 lines) in packages/wallets/src/wallets/wallet-factory.ts:128", "shortDescription": {"text": "Commented-code block (5 lines) in packages/wallets/src/wallets/wallet-factory.ts:128"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-95b050c6df518788", "name": "Commented-code block (5 lines) in packages/wallets/src/wallets/wallet.ts:204", "shortDescription": {"text": "Commented-code block (5 lines) in packages/wallets/src/wallets/wallet.ts:204"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-70930240c160d326", "name": "`fetch()` without try/.catch or AbortSignal \u2014 packages/client/auth/src/CrossmintAuthClient.ts:319", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 packages/client/auth/src/CrossmintAuthClient.ts:319"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-60893d334d65e595", "name": "`fetch()` without try/.catch or AbortSignal \u2014 packages/client/verifiable-credentials/src/verifiableCredentialsSDK/servic", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 packages/client/verifiable-credentials/src/verifiableCredentialsSDK/services/ipfs.ts:34"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-22221e338de0920a", "name": "`fetch()` without try/.catch or AbortSignal \u2014 packages/client/verifiable-credentials/src/services/walletAuth.ts:29", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 packages/client/verifiable-credentials/src/services/walletAuth.ts:29"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-82c823ccd87db627", "name": "`fetch()` without try/.catch or AbortSignal \u2014 packages/client/verifiable-credentials/src/services/delegationSignature.ts", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 packages/client/verifiable-credentials/src/services/delegationSignature.ts:14"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-25456561b88e562d", "name": "Commented-code block (5 lines) in packages/client/react-base/src/providers/CrossmintWalletUIBaseProvider.tsx:63", "shortDescription": {"text": "Commented-code block (5 lines) in packages/client/react-base/src/providers/CrossmintWalletUIBaseProvider.tsx:63"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-def102b696f89662", "name": "Commented-code block (5 lines) in packages/client/ui/react-native/src/providers/CrossmintWalletProvider.tsx:265", "shortDescription": {"text": "Commented-code block (5 lines) in packages/client/ui/react-native/src/providers/CrossmintWalletProvider.tsx:265"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-9bbae0da495e856f", "name": "`fetch()` without try/.catch or AbortSignal \u2014 packages/common/base/src/apiClient/ApiClient.ts:18", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 packages/common/base/src/apiClient/ApiClient.ts:18"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d229d7cdc6fa7da8", "name": "`fetch()` without try/.catch or AbortSignal \u2014 packages/common/base/src/logger/sinks/HttpDatadogSink.ts:168", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 packages/common/base/src/logger/sinks/HttpDatadogSink.ts:168"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e8b98a2b45a9d718", "name": "`fetch()` without try/.catch or AbortSignal \u2014 packages/common/auth/src/CrossmintAuth.ts:66", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 packages/common/auth/src/CrossmintAuth.ts:66"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-47ffdf3ea3519ad6", "name": "Commented-code block (13 lines) in apps/wallets/quickstart-devkit/app/home.tsx:18", "shortDescription": {"text": "Commented-code block (13 lines) in apps/wallets/quickstart-devkit/app/home.tsx:18"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-0163ae3455a3d9c4", "name": "Commented-code block (6 lines) in apps/wallets/quickstart-devkit/scripts/generate-test-report.js:37", "shortDescription": {"text": "Commented-code block (6 lines) in apps/wallets/quickstart-devkit/scripts/generate-test-report.js:37"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-795394e728311e74", "name": "Commented-code block (5 lines) in apps/wallets/quickstart-devkit/components/approval-test.tsx:64", "shortDescription": {"text": "Commented-code block (5 lines) in apps/wallets/quickstart-devkit/components/approval-test.tsx:64"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-6bff3436031f63af", "name": "Commented-code block (7 lines) in apps/payments/nextjs/components/embed-v3/EmbeddedCheckoutV3Content.tsx:51", "shortDescription": {"text": "Commented-code block (7 lines) in apps/payments/nextjs/components/embed-v3/EmbeddedCheckoutV3Content.tsx:51"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-65df07ab4020db79", "name": "18 env vars used in code but missing from .env.example", "shortDescription": {"text": "18 env vars used in code but missing from .env.example"}, "fullDescription": {"text": "Drift between code and config docs. The first few: `ANALYZE`, `CI`, `CROSSMINT_API_KEY`, `CROSSMINT_BASE_URL`, `DEBUG`, `GITHUB_REPOSITORY`, `GITHUB_RUN_ID`, `GITHUB_SHA` + 10 more. Add them (with a placeholder/comment) to .env.example so onboarding doesn't break."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/25133"}, "properties": {"repository": "Crossmint/crossmint-sdk", "repoUrl": "https://github.com/Crossmint/crossmint-sdk", "branch": "main"}, "results": [{"ruleId": "scanner-aca8b818b67ba5c0", "level": "none", "message": {"text": "TODO/FIXME marker in shipping code \u2014 packages/wallets/src/wallets/wallet.ts:726"}, "properties": {"repobilityId": "0aae9768e4b05146", "scanner": "scanner-primary", "fingerprint": "aca8b818b67ba5c0", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.todo-marker"]}}, {"ruleId": "scanner-a94443c10247545f", "level": "none", "message": {"text": "TODO/FIXME marker in shipping code \u2014 packages/wallets/src/api/client-integration.test.ts:983"}, "properties": {"repobilityId": "add6ca36c58cd0ed", "scanner": "scanner-primary", "fingerprint": "a94443c10247545f", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.todo-marker"]}}, {"ruleId": "scanner-6a83c39d994263db", "level": "none", "message": {"text": "TODO/FIXME marker in shipping code \u2014 packages/client/wallets/walletconnect/src/wallets/WalletConnectEVMAAWallet.ts:5"}, "properties": {"repobilityId": "589ff8e50502876d", "scanner": "scanner-primary", "fingerprint": "6a83c39d994263db", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.todo-marker"]}}, {"ruleId": "scanner-6d4b101da01644be", "level": "none", "message": {"text": "TODO/FIXME marker in shipping code \u2014 packages/client/wallets/walletconnect/src/utils/sendTransaction/decodeSendTransactionRequest.ts:6"}, "properties": {"repobilityId": "0616087ae5ac8e04", "scanner": "scanner-primary", "fingerprint": "6d4b101da01644be", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.todo-marker"]}}, {"ruleId": "scanner-72d9ccde8a49d1fe", "level": "none", "message": {"text": "TODO/FIXME marker in shipping code \u2014 packages/client/wallets/walletconnect/src/utils/wallet/walletToSupportedNamespaces.ts:21"}, "properties": {"repobilityId": "560bcb47db8261e9", "scanner": "scanner-primary", "fingerprint": "72d9ccde8a49d1fe", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.todo-marker"]}}, {"ruleId": "scanner-76061aa8f67bbce8", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 packages/client/wallets/walletconnect/src/hooks/usePairWithURI.tsx:32"}, "properties": {"repobilityId": "f47e162b25531ef8", "scanner": "scanner-primary", "fingerprint": "76061aa8f67bbce8", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-cedd097d6380bca9", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 packages/client/wallets/walletconnect/src/hooks/useWalletConnectSessions.tsx:48"}, "properties": {"repobilityId": "5483308337a31e20", "scanner": "scanner-primary", "fingerprint": "cedd097d6380bca9", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-66578a8fc9889477", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 packages/client/wallets/walletconnect/src/hooks/useWalletConnectRequests.tsx:41"}, "properties": {"repobilityId": "512e319e42646d18", "scanner": "scanner-primary", "fingerprint": "66578a8fc9889477", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-0d729d72d0730535", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 packages/client/wallets/walletconnect/src/hooks/useWalletConnectProvider.tsx:31"}, "properties": {"repobilityId": "16acda70a73503e1", "scanner": "scanner-primary", "fingerprint": "0d729d72d0730535", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-07e4385076fdc97d", "level": "none", "message": {"text": "TODO/FIXME marker in shipping code \u2014 packages/client/wallets/walletconnect/src/components/modals/SessionRequest/SessionRequestViewRouter.tsx:62"}, "properties": {"repobilityId": "9daf5ac5c6b4f259", "scanner": "scanner-primary", "fingerprint": "07e4385076fdc97d", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.todo-marker"]}}, {"ruleId": "scanner-6d4721b9f6c46885", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 packages/client/wallets/walletconnect/src/components/EnterURI/EnterURIInput.tsx:36"}, "properties": {"repobilityId": "77cb8f217b318bce", "scanner": "scanner-primary", "fingerprint": "6d4721b9f6c46885", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-76a769fdb70f9ade", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 packages/client/wallets/walletconnect/src/components/common/layouts/modal/DAppRequestHeader.tsx:53"}, "properties": {"repobilityId": "4a494d84d732ac25", "scanner": "scanner-primary", "fingerprint": "76a769fdb70f9ade", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-a58c20045446a4e9", "level": "none", "message": {"text": "TODO/FIXME marker in shipping code \u2014 packages/client/base/src/types/embed/v3/CrossmintEmbeddedCheckoutV3Props.ts:221"}, "properties": {"repobilityId": "3263cf80d6d0a980", "scanner": "scanner-primary", "fingerprint": "a58c20045446a4e9", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.todo-marker"]}}, {"ruleId": "scanner-35790c37a41ed5ba", "level": "none", "message": {"text": "TODO/FIXME marker in shipping code \u2014 packages/client/base/src/types/events/public/payloads.ts:61"}, "properties": {"repobilityId": "0d2957cbedd3fcde", "scanner": "scanner-primary", "fingerprint": "35790c37a41ed5ba", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.todo-marker"]}}, {"ruleId": "scanner-ffbdd0a4fa718615", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 packages/client/base/src/services/logging/ConsoleProvider.ts:5"}, "properties": {"repobilityId": "b324e334141675f2", "scanner": "scanner-primary", "fingerprint": "ffbdd0a4fa718615", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-dd07d5d6beb707ab", "level": "none", "message": {"text": "TODO/FIXME marker in shipping code \u2014 packages/client/base/src/services/hosted/v3/crossmintHostedCheckoutV3Service.ts:55"}, "properties": {"repobilityId": "347032d1d7204325", "scanner": "scanner-primary", "fingerprint": "dd07d5d6beb707ab", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.todo-marker"]}}, {"ruleId": "scanner-12d1edfb27212dfe", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 packages/client/rn-window/src/rn-webview/RNWebView.test.tsx:71"}, "properties": {"repobilityId": "c01ddfcbf79b95c9", "scanner": "scanner-primary", "fingerprint": "12d1edfb27212dfe", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-08fcaec2d703f7d2", "level": "none", "message": {"text": "TODO/FIXME marker in shipping code \u2014 packages/client/auth/src/CrossmintAuthClient.ts:246"}, "properties": {"repobilityId": "95f6a71b6e3f26a7", "scanner": "scanner-primary", "fingerprint": "08fcaec2d703f7d2", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.todo-marker"]}}, {"ruleId": "scanner-e89ae3762543ef43", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 packages/client/verifiable-credentials/src/presentation/getCredential.ts:53"}, "properties": {"repobilityId": "20c0b4236dbe9e6c", "scanner": "scanner-primary", "fingerprint": "e89ae3762543ef43", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-a621f2d99c997610", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 packages/client/verifiable-credentials/src/decryption/wallet.ts:36"}, "properties": {"repobilityId": "3321a036b78fa426", "scanner": "scanner-primary", "fingerprint": "a621f2d99c997610", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-e3f6e913d6632157", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 packages/client/verifiable-credentials/src/verifiableCredentialsSDK/encryption/lit.ts:56"}, "properties": {"repobilityId": "78072af7562834bb", "scanner": "scanner-primary", "fingerprint": "e3f6e913d6632157", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-79f173cf0c515749", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 packages/client/verifiable-credentials/src/verifiableCredentialsSDK/presentation/getCollections.ts:63"}, "properties": {"repobilityId": "c985ed3cb8c48ab3", "scanner": "scanner-primary", "fingerprint": "79f173cf0c515749", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-aa58da1b4a2cb621", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 packages/client/verifiable-credentials/src/services/walletAuth.ts:27"}, "properties": {"repobilityId": "83b9908396695792", "scanner": "scanner-primary", "fingerprint": "aa58da1b4a2cb621", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-b8c6a6180d811cef", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 packages/client/verifiable-credentials/src/services/delegationSignature.ts:12"}, "properties": {"repobilityId": "64771ac05c6dc0ae", "scanner": "scanner-primary", "fingerprint": "b8c6a6180d811cef", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-5cabbabdd53cba34", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 packages/client/react-base/src/providers/CrossmintAuthBaseProvider.tsx:124"}, "properties": {"repobilityId": "046d19a7e4f439f0", "scanner": "scanner-primary", "fingerprint": "5cabbabdd53cba34", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-5e152a4100deda1e", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 packages/client/signers-cryptography/src/utils/performance.ts:5"}, "properties": {"repobilityId": "54ed14cab9dcbc76", "scanner": "scanner-primary", "fingerprint": "5e152a4100deda1e", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-e93c774ecf60d970", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 packages/client/ui/react-ui/src/providers/CrossmintAuthProvider.tsx:66"}, "properties": {"repobilityId": "0edb6ac790852529", "scanner": "scanner-primary", "fingerprint": "e93c774ecf60d970", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-afc01f259e5da074", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 packages/client/ui/react-ui/src/components/embed/v3/crypto/CryptoWalletConnectionHandler.tsx:29"}, "properties": {"repobilityId": "101ebe3e3493adf6", "scanner": "scanner-primary", "fingerprint": "afc01f259e5da074", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-1967dd851dc76c13", "level": "none", "message": {"text": "TODO/FIXME marker in shipping code \u2014 packages/client/ui/react-ui/src/components/embed/v3/crypto/utils/handleSolanaTransaction.ts:16"}, "properties": {"repobilityId": "154ae40d28b7961d", "scanner": "scanner-primary", "fingerprint": "1967dd851dc76c13", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.todo-marker"]}}, {"ruleId": "scanner-5c662e902735d217", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 packages/client/ui/react-ui/src/components/embed/v3/crypto/utils/handleSolanaTransaction.ts:45"}, "properties": {"repobilityId": "c60de718f644ff2e", "scanner": "scanner-primary", "fingerprint": "5c662e902735d217", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-42b86799fd563da3", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 packages/client/ui/react-ui/src/components/embed/v3/crypto/utils/handleEvmTransaction.ts:66"}, "properties": {"repobilityId": "f0210adb6acd3f4a", "scanner": "scanner-primary", "fingerprint": "42b86799fd563da3", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-a489a18dd7cb758a", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 packages/client/ui/react-ui/src/components/embed/v3/crypto/utils/handleSuiTransaction.ts:59"}, "properties": {"repobilityId": "937cd734e2ac0584", "scanner": "scanner-primary", "fingerprint": "a489a18dd7cb758a", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-d8f0d39e80d2faa0", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 apps/wallets/quickstart-devkit/tests/smoke/specs/wallets/smoke.spec.ts:118"}, "properties": {"repobilityId": "877d4775baffbc00", "scanner": "scanner-primary", "fingerprint": "d8f0d39e80d2faa0", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-2c58588ac8692be1", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 apps/wallets/quickstart-devkit/tests/shared/utils/email.ts:9"}, "properties": {"repobilityId": "b341b9cbad19891a", "scanner": "scanner-primary", "fingerprint": "2c58588ac8692be1", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-793144c565923fdf", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 apps/wallets/quickstart-devkit/tests/shared/utils/auth.ts:7"}, "properties": {"repobilityId": "5e37c8ab67c3164c", "scanner": "scanner-primary", "fingerprint": "793144c565923fdf", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-2350513ff5d3ba44", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 apps/wallets/quickstart-devkit/tests/shared/utils/wallet.ts:21"}, "properties": {"repobilityId": "e85d544117bdcabb", "scanner": "scanner-primary", "fingerprint": "2350513ff5d3ba44", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-4e51910e7af09f65", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 apps/wallets/quickstart-devkit/tests/shared/constants/globalConstants.ts:107"}, "properties": {"repobilityId": "5f96e590df2b227e", "scanner": "scanner-primary", "fingerprint": "4e51910e7af09f65", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-0e59a8884f9a59d6", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 apps/wallets/quickstart-devkit/tests/shared/fixtures/auth.fixture.ts:27"}, "properties": {"repobilityId": "61e643dc3d2e69e0", "scanner": "scanner-primary", "fingerprint": "0e59a8884f9a59d6", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-fb57d8204a9f38d3", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 apps/wallets/quickstart-devkit/tests/e2e/specs/wallets/e2e.spec.ts:20"}, "properties": {"repobilityId": "ac0c3e5ae793980c", "scanner": "scanner-primary", "fingerprint": "fb57d8204a9f38d3", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-11a9b81f197a7955", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 apps/wallets/quickstart-devkit/scripts/notify-slack.js:202"}, "properties": {"repobilityId": "293188bfe9b8a229", "scanner": "scanner-primary", "fingerprint": "11a9b81f197a7955", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-5b254174c8a88600", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 apps/wallets/quickstart-devkit/scripts/generate-test-report.js:215"}, "properties": {"repobilityId": "b5297c6021fb6c0c", "scanner": "scanner-primary", "fingerprint": "5b254174c8a88600", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-63349473700d377e", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 apps/payments/nextjs/components/embed-v3/EmbeddedCheckoutV3Content.tsx:10"}, "properties": {"repobilityId": "744b4316eaefb951", "scanner": "scanner-primary", "fingerprint": "63349473700d377e", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-50fd81e5f8843ecc", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 apps/auth/node-and-express-server/express.js:59"}, "properties": {"repobilityId": "fdd27ac1a9b5b736", "scanner": "scanner-primary", "fingerprint": "50fd81e5f8843ecc", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-ac6d10f0ba072b24", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 apps/auth/node-and-express-server/index.js:46"}, "properties": {"repobilityId": "85a8fa747b0bb622", "scanner": "scanner-primary", "fingerprint": "ac6d10f0ba072b24", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-9afaf5f99eb0a97a", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 apps/auth/remix-ssr/app/routes/_index.tsx:24"}, "properties": {"repobilityId": "08a4faad6113dd6f", "scanner": "scanner-primary", "fingerprint": "9afaf5f99eb0a97a", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-eeeb9d54c3130747", "level": "error", "message": {"text": "Possible secret in packages/wallets/src/api/client-integration.test.ts"}, "properties": {"repobilityId": "06c2d6b85bc27edb", "scanner": "scanner-primary", "fingerprint": "eeeb9d54c3130747", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/wallets/src/api/client-integration.test.ts"}, "region": {"startLine": 395}}}]}, {"ruleId": "scanner-48577372b8a63023", "level": "error", "message": {"text": "Possible secret in packages/wallets/src/api/__tests__/constants.ts"}, "properties": {"repobilityId": "ce22ae2a88ca5a88", "scanner": "scanner-primary", "fingerprint": "48577372b8a63023", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/wallets/src/api/__tests__/constants.ts"}, "region": {"startLine": 84}}}]}, {"ruleId": "scanner-912803144345ca08", "level": "error", "message": {"text": "Possible secret in packages/client/wallets/smart-wallet/src/sdk.test.ts"}, "properties": {"repobilityId": "7e64cd2554bba98d", "scanner": "scanner-primary", "fingerprint": "912803144345ca08", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/client/wallets/smart-wallet/src/sdk.test.ts"}, "region": {"startLine": 21}}}]}, {"ruleId": "scanner-38f93c21a1490cda", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in packages/client/base/src/services/hosted/v3/crossmintHostedCheckoutOverlayService.ts:26"}, "properties": {"repobilityId": "8281ab72d7c12ff2", "scanner": "scanner-primary", "fingerprint": "38f93c21a1490cda", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/client/base/src/services/hosted/v3/crossmintHostedCheckoutOverlayService.ts"}, "region": {"startLine": 26}}}]}, {"ruleId": "scanner-94a24f39e456ebb4", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in packages/client/base/src/services/hosted/v3/styles/crossmintHostedCheckoutV3StylesService.ts:101"}, "properties": {"repobilityId": "39f694cf0f0e4859", "scanner": "scanner-primary", "fingerprint": "94a24f39e456ebb4", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/client/base/src/services/hosted/v3/styles/crossmintHostedCheckoutV3StylesService.ts"}, "region": {"startLine": 101}}}]}, {"ruleId": "scanner-351316dc58db06c0", "level": "error", "message": {"text": "Possible secret in packages/client/react-base/src/hooks/useCrossmint.test.tsx"}, "properties": {"repobilityId": "d3868caf97ca47ed", "scanner": "scanner-primary", "fingerprint": "351316dc58db06c0", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/client/react-base/src/hooks/useCrossmint.test.tsx"}, "region": {"startLine": 10}}}]}, {"ruleId": "scanner-9693bb220b91becd", "level": "error", "message": {"text": "Possible secret in packages/common/base/src/apiKey/validate-api-key.test.ts"}, "properties": {"repobilityId": "87318a56ec487514", "scanner": "scanner-primary", "fingerprint": "9693bb220b91becd", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/common/base/src/apiKey/validate-api-key.test.ts"}, "region": {"startLine": 6}}}]}, {"ruleId": "scanner-0b82a8c23697bbca", "level": "error", "message": {"text": "Possible secret in apps/payments/nextjs/app/payment-method-management/components/ClientProviders.tsx"}, "properties": {"repobilityId": "d45184b1aac9e67f", "scanner": "scanner-primary", "fingerprint": "0b82a8c23697bbca", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/payments/nextjs/app/payment-method-management/components/ClientProviders.tsx"}, "region": {"startLine": 8}}}]}, {"ruleId": "scanner-a397129dbdd81ca7", "level": "error", "message": {"text": "Possible secret in apps/payments/nextjs/components/embed-v3/EmbeddedCheckoutV3ClientProviders.tsx"}, "properties": {"repobilityId": "e6acfc196cad56d7", "scanner": "scanner-primary", "fingerprint": "a397129dbdd81ca7", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/payments/nextjs/components/embed-v3/EmbeddedCheckoutV3ClientProviders.tsx"}, "region": {"startLine": 8}}}]}, {"ruleId": "scanner-a397129dbdd81ca7", "level": "error", "message": {"text": "Possible secret in apps/payments/nextjs/components/embed-v3/EmbeddedCheckoutV3ClientProviders.tsx"}, "properties": {"repobilityId": "e6acfc196cad56d7", "scanner": "scanner-primary", "fingerprint": "a397129dbdd81ca7", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/payments/nextjs/components/embed-v3/EmbeddedCheckoutV3ClientProviders.tsx"}, "region": {"startLine": 9}}}]}, {"ruleId": "scanner-79fe0b539a67485b", "level": "error", "message": {"text": "Possible secret in apps/payments/nextjs/components/hosted-v3/HostedCheckoutV3ClientProviders.tsx"}, "properties": {"repobilityId": "58384f12be1b70e2", "scanner": "scanner-primary", "fingerprint": "79fe0b539a67485b", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/payments/nextjs/components/hosted-v3/HostedCheckoutV3ClientProviders.tsx"}, "region": {"startLine": 8}}}]}, {"ruleId": "scanner-56f15c494012a456", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "6e880faebd7b1218", "scanner": "scanner-primary", "fingerprint": "56f15c494012a456", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/sdk-reference-docs-generate.yml"}, "region": {"startLine": 124}}}]}, {"ruleId": "scanner-56f15c494012a456", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "6aaabd16f933d677", "scanner": "scanner-primary", "fingerprint": "56f15c494012a456", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/sdk-reference-docs-generate.yml"}, "region": {"startLine": 132}}}]}, {"ruleId": "scanner-f24e7b33cdfafcd8", "level": "error", "message": {"text": "GitHub Action tracks a moving branch"}, "properties": {"repobilityId": "af625b607437b11c", "scanner": "scanner-primary", "fingerprint": "f24e7b33cdfafcd8", "layer": "cicd", "severity": "high", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/pr-stats-slack.yml"}, "region": {"startLine": 12}}}]}, {"ruleId": "scanner-6529fd323efdff07", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "0729081163e87549", "scanner": "scanner-primary", "fingerprint": "6529fd323efdff07", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/smoke-tests.yml"}, "region": {"startLine": 24}}}]}, {"ruleId": "scanner-6529fd323efdff07", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "dbf025b49ed29eae", "scanner": "scanner-primary", "fingerprint": "6529fd323efdff07", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/smoke-tests.yml"}, "region": {"startLine": 27}}}]}, {"ruleId": "scanner-6529fd323efdff07", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "6c11163ff25cac1e", "scanner": "scanner-primary", "fingerprint": "6529fd323efdff07", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/smoke-tests.yml"}, "region": {"startLine": 32}}}]}, {"ruleId": "scanner-6529fd323efdff07", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "f4c51714dc379f49", "scanner": "scanner-primary", "fingerprint": "6529fd323efdff07", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/smoke-tests.yml"}, "region": {"startLine": 98}}}]}, {"ruleId": "scanner-3a1901eb29cd1be1", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "f2d2af4f39a17b81", "scanner": "scanner-primary", "fingerprint": "3a1901eb29cd1be1", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/e2e-regression-tests.yml"}, "region": {"startLine": 23}}}]}, {"ruleId": "scanner-3a1901eb29cd1be1", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "105901209fc0b31b", "scanner": "scanner-primary", "fingerprint": "3a1901eb29cd1be1", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/e2e-regression-tests.yml"}, "region": {"startLine": 26}}}]}, {"ruleId": "scanner-3a1901eb29cd1be1", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "e87819c88e39d655", "scanner": "scanner-primary", "fingerprint": "3a1901eb29cd1be1", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/e2e-regression-tests.yml"}, "region": {"startLine": 31}}}]}, {"ruleId": "scanner-3a1901eb29cd1be1", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "2d8013fdae7a5aa4", "scanner": "scanner-primary", "fingerprint": "3a1901eb29cd1be1", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/e2e-regression-tests.yml"}, "region": {"startLine": 79}}}]}, {"ruleId": "scanner-3a1901eb29cd1be1", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "f2d2af4f39a17b81", "scanner": "scanner-primary", "fingerprint": "3a1901eb29cd1be1", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/e2e-regression-tests.yml"}, "region": {"startLine": 93}}}]}, {"ruleId": "scanner-3a1901eb29cd1be1", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "4019e6ae5ef9e9f7", "scanner": "scanner-primary", "fingerprint": "3a1901eb29cd1be1", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/e2e-regression-tests.yml"}, "region": {"startLine": 96}}}]}, {"ruleId": "scanner-3a1901eb29cd1be1", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "4019e6ae5ef9e9f7", "scanner": "scanner-primary", "fingerprint": "3a1901eb29cd1be1", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/e2e-regression-tests.yml"}, "region": {"startLine": 103}}}]}, {"ruleId": "scanner-3a1901eb29cd1be1", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "4019e6ae5ef9e9f7", "scanner": "scanner-primary", "fingerprint": "3a1901eb29cd1be1", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/e2e-regression-tests.yml"}, "region": {"startLine": 110}}}]}, {"ruleId": "scanner-1d7e834080dbebed", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "929bffda342e03e6", "scanner": "scanner-primary", "fingerprint": "1d7e834080dbebed", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/main.yml"}, "region": {"startLine": 52}}}]}, {"ruleId": "scanner-1d7e834080dbebed", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "1c4eaecca0b496ae", "scanner": "scanner-primary", "fingerprint": "1d7e834080dbebed", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/main.yml"}, "region": {"startLine": 61}}}]}, {"ruleId": "scanner-299e5e0d9ac9f81f", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "cb6b9b70fd6463a9", "scanner": "scanner-primary", "fingerprint": "299e5e0d9ac9f81f", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/main.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-27924aa79fa4a517", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "ae16880318b99912", "scanner": "scanner-primary", "fingerprint": "27924aa79fa4a517", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 20}}}]}, {"ruleId": "scanner-27924aa79fa4a517", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "ae16880318b99912", "scanner": "scanner-primary", "fingerprint": "27924aa79fa4a517", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 37}}}]}, {"ruleId": "scanner-2b218a4567416b03", "level": "note", "message": {"text": "Very large file: packages/wallets/src/wallets/wallet.test.ts (3267 lines)"}, "properties": {"repobilityId": "ac65e2d5f6bae5c6", "scanner": "scanner-primary", "fingerprint": "2b218a4567416b03", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-d1bd8086c5a4a4de", "level": "note", "message": {"text": "Very large file: packages/wallets/src/wallets/wallet.ts (2223 lines)"}, "properties": {"repobilityId": "f55603f507ae9d0e", "scanner": "scanner-primary", "fingerprint": "d1bd8086c5a4a4de", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-27de73007fdef168", "level": "note", "message": {"text": "Very large file: packages/wallets/src/api/client.test.ts (1395 lines)"}, "properties": {"repobilityId": "a9eacf4dc62b568a", "scanner": "scanner-primary", "fingerprint": "27de73007fdef168", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-a11d4d93daab9442", "level": "note", "message": {"text": "Very large file: packages/client/base/src/lib/hosted-checkout/Order.ts (5609 lines)"}, "properties": {"repobilityId": "30272ed48364c4a8", "scanner": "scanner-primary", "fingerprint": "a11d4d93daab9442", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-6ab71374e2c3302a", "level": "note", "message": {"text": "Very large file: packages/client/verifiable-credentials/src/ABI/upgradeable721-v0.8.ts (3589 lines)"}, "properties": {"repobilityId": "eae46cbaeed0f9ea", "scanner": "scanner-primary", "fingerprint": "6ab71374e2c3302a", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-ea3b5e389d8c9c0f", "level": "note", "message": {"text": "Low test-to-source ratio"}, "properties": {"repobilityId": "ef7b2552cc00a375", "scanner": "scanner-primary", "fingerprint": "ea3b5e389d8c9c0f", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["tests"]}}, {"ruleId": "scanner-62a6bfc618a0b582", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: packages/wallets/package.json"}, "properties": {"repobilityId": "dcc3c222db7d8b6e", "scanner": "scanner-primary", "fingerprint": "62a6bfc618a0b582", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/wallets/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b739f2f2be1d714d", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: packages/server/package.json"}, "properties": {"repobilityId": "d7cb4fafc3b292b2", "scanner": "scanner-primary", "fingerprint": "b739f2f2be1d714d", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/server/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b0c70c04d9fe01be", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: packages/client/wallets/smart-wallet/package.json"}, "properties": {"repobilityId": "3b779280acd166bf", "scanner": "scanner-primary", "fingerprint": "b0c70c04d9fe01be", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/client/wallets/smart-wallet/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-611c9f08ae20c580", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: packages/client/wallets/walletconnect/package.json"}, "properties": {"repobilityId": "9b4e3613f155f7c9", "scanner": "scanner-primary", "fingerprint": "611c9f08ae20c580", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/client/wallets/walletconnect/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-59455e6ccd71b5ad", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: packages/client/base/package.json"}, "properties": {"repobilityId": "a27a0bb363482623", "scanner": "scanner-primary", "fingerprint": "59455e6ccd71b5ad", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/client/base/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-cf7eafc9534c46c6", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: packages/client/rn-window/package.json"}, "properties": {"repobilityId": "4ae6104807300350", "scanner": "scanner-primary", "fingerprint": "cf7eafc9534c46c6", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/client/rn-window/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-13c5112ead287727", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: packages/client/auth/package.json"}, "properties": {"repobilityId": "b65ca91761cd6b18", "scanner": "scanner-primary", "fingerprint": "13c5112ead287727", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/client/auth/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-1a2c6f6ff6bf2409", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: packages/client/verifiable-credentials/package.json"}, "properties": {"repobilityId": "d5d4d72e07a11240", "scanner": "scanner-primary", "fingerprint": "1a2c6f6ff6bf2409", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/client/verifiable-credentials/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6bb8a410d7293eb5", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: packages/client/signers/package.json"}, "properties": {"repobilityId": "0cde24e52ece255a", "scanner": "scanner-primary", "fingerprint": "6bb8a410d7293eb5", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/client/signers/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-fd32dd3a10d765da", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: packages/client/window/package.json"}, "properties": {"repobilityId": "d0c485b71b65be29", "scanner": "scanner-primary", "fingerprint": "fd32dd3a10d765da", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/client/window/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-5ddfbfe31cfadb21", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: packages/client/react-base/package.json"}, "properties": {"repobilityId": "172039c75a0300cc", "scanner": "scanner-primary", "fingerprint": "5ddfbfe31cfadb21", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/client/react-base/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-49bd7641d87f2563", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: packages/client/signers-cryptography/package.json"}, "properties": {"repobilityId": "72c8983f66a307c5", "scanner": "scanner-primary", "fingerprint": "49bd7641d87f2563", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/client/signers-cryptography/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-8f619b2779bfa519", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: packages/client/ui/react-ui/package.json"}, "properties": {"repobilityId": "bb483faff18b348e", "scanner": "scanner-primary", "fingerprint": "8f619b2779bfa519", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/client/ui/react-ui/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c10d6a9c0ada8f27", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: packages/client/ui/react-native/package.json"}, "properties": {"repobilityId": "b79584e91c7bbe36", "scanner": "scanner-primary", "fingerprint": "c10d6a9c0ada8f27", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/client/ui/react-native/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-81c0d15160dbe1b5", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: packages/common/base/package.json"}, "properties": {"repobilityId": "916f30add5861241", "scanner": "scanner-primary", "fingerprint": "81c0d15160dbe1b5", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/common/base/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-34fcb229182daacb", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: packages/common/auth/package.json"}, "properties": {"repobilityId": "bc382f89ff820fff", "scanner": "scanner-primary", "fingerprint": "34fcb229182daacb", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/common/auth/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-8bde7f569062247f", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: apps/wallets/react/package.json"}, "properties": {"repobilityId": "6670ba4be80bb852", "scanner": "scanner-primary", "fingerprint": "8bde7f569062247f", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/wallets/react/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d1bc08a43875fee0", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: apps/wallets/expo/package.json"}, "properties": {"repobilityId": "f409993b06dac64e", "scanner": "scanner-primary", "fingerprint": "d1bc08a43875fee0", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/wallets/expo/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c9f943aefd5b215e", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: apps/wallets/quickstart-devkit/package.json"}, "properties": {"repobilityId": "643bfd374463d4cc", "scanner": "scanner-primary", "fingerprint": "c9f943aefd5b215e", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/wallets/quickstart-devkit/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c9ec58b71031ac54", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: apps/payments/nextjs/package.json"}, "properties": {"repobilityId": "8b05a3ebe8d9d4fd", "scanner": "scanner-primary", "fingerprint": "c9ec58b71031ac54", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/payments/nextjs/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-7bee836db59cb215", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: apps/auth/nextjs-ssr/package.json"}, "properties": {"repobilityId": "f2f71a087233b1c1", "scanner": "scanner-primary", "fingerprint": "7bee836db59cb215", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/auth/nextjs-ssr/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ac4acf6185cc6ad8", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: apps/auth/node-and-express-server/package.json"}, "properties": {"repobilityId": "901fef25d4792361", "scanner": "scanner-primary", "fingerprint": "ac4acf6185cc6ad8", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/auth/node-and-express-server/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-33aa829bd72278d1", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: apps/auth/remix-ssr/package.json"}, "properties": {"repobilityId": "9eabb2b384d61bb3", "scanner": "scanner-primary", "fingerprint": "33aa829bd72278d1", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/auth/remix-ssr/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "09efc4f042caead4", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-72b2a6250083a784", "level": "warning", "message": {"text": "Placeholder or mock-heavy implementation detected"}, "properties": {"repobilityId": "32eb70729d14f4ce", "scanner": "scanner-primary", "fingerprint": "72b2a6250083a784", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "incomplete", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "01805797d4c02646", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-2c4f6208b5318ed1", "level": "none", "message": {"text": "Commented-code block (5 lines) in packages/wallets/src/wallets/wallet.test.ts:3194"}, "properties": {"repobilityId": "1965acfa34cfd032", "scanner": "scanner-primary", "fingerprint": "2c4f6208b5318ed1", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-25413e264b9f490b", "level": "none", "message": {"text": "Commented-code block (5 lines) in packages/wallets/src/wallets/wallet-factory.ts:128"}, "properties": {"repobilityId": "0bf287da02498943", "scanner": "scanner-primary", "fingerprint": "25413e264b9f490b", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-95b050c6df518788", "level": "none", "message": {"text": "Commented-code block (5 lines) in packages/wallets/src/wallets/wallet.ts:204"}, "properties": {"repobilityId": "595a289638fd6f42", "scanner": "scanner-primary", "fingerprint": "95b050c6df518788", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-70930240c160d326", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 packages/client/auth/src/CrossmintAuthClient.ts:319"}, "properties": {"repobilityId": "74a00031ced83317", "scanner": "scanner-primary", "fingerprint": "70930240c160d326", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-60893d334d65e595", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 packages/client/verifiable-credentials/src/verifiableCredentialsSDK/services/ipfs.ts:34"}, "properties": {"repobilityId": "1ff720d73fbc3c27", "scanner": "scanner-primary", "fingerprint": "60893d334d65e595", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-22221e338de0920a", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 packages/client/verifiable-credentials/src/services/walletAuth.ts:29"}, "properties": {"repobilityId": "566cda293d82e80f", "scanner": "scanner-primary", "fingerprint": "22221e338de0920a", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-82c823ccd87db627", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 packages/client/verifiable-credentials/src/services/delegationSignature.ts:14"}, "properties": {"repobilityId": "7bb638660bf25335", "scanner": "scanner-primary", "fingerprint": "82c823ccd87db627", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-25456561b88e562d", "level": "none", "message": {"text": "Commented-code block (5 lines) in packages/client/react-base/src/providers/CrossmintWalletUIBaseProvider.tsx:63"}, "properties": {"repobilityId": "995035d1c840cf40", "scanner": "scanner-primary", "fingerprint": "25456561b88e562d", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-def102b696f89662", "level": "none", "message": {"text": "Commented-code block (5 lines) in packages/client/ui/react-native/src/providers/CrossmintWalletProvider.tsx:265"}, "properties": {"repobilityId": "66b33bc819182e3e", "scanner": "scanner-primary", "fingerprint": "def102b696f89662", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-9bbae0da495e856f", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 packages/common/base/src/apiClient/ApiClient.ts:18"}, "properties": {"repobilityId": "2b658f76f0ab49bd", "scanner": "scanner-primary", "fingerprint": "9bbae0da495e856f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-d229d7cdc6fa7da8", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 packages/common/base/src/logger/sinks/HttpDatadogSink.ts:168"}, "properties": {"repobilityId": "253ea56e035afa35", "scanner": "scanner-primary", "fingerprint": "d229d7cdc6fa7da8", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-e8b98a2b45a9d718", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 packages/common/auth/src/CrossmintAuth.ts:66"}, "properties": {"repobilityId": "1de379aa4ec66056", "scanner": "scanner-primary", "fingerprint": "e8b98a2b45a9d718", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-47ffdf3ea3519ad6", "level": "none", "message": {"text": "Commented-code block (13 lines) in apps/wallets/quickstart-devkit/app/home.tsx:18"}, "properties": {"repobilityId": "53f7ac60d7c21ad4", "scanner": "scanner-primary", "fingerprint": "47ffdf3ea3519ad6", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-0163ae3455a3d9c4", "level": "none", "message": {"text": "Commented-code block (6 lines) in apps/wallets/quickstart-devkit/scripts/generate-test-report.js:37"}, "properties": {"repobilityId": "e70d31d705870478", "scanner": "scanner-primary", "fingerprint": "0163ae3455a3d9c4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-795394e728311e74", "level": "none", "message": {"text": "Commented-code block (5 lines) in apps/wallets/quickstart-devkit/components/approval-test.tsx:64"}, "properties": {"repobilityId": "b216edf3a912f215", "scanner": "scanner-primary", "fingerprint": "795394e728311e74", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-6bff3436031f63af", "level": "none", "message": {"text": "Commented-code block (7 lines) in apps/payments/nextjs/components/embed-v3/EmbeddedCheckoutV3Content.tsx:51"}, "properties": {"repobilityId": "817cbb2352e53a87", "scanner": "scanner-primary", "fingerprint": "6bff3436031f63af", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-65df07ab4020db79", "level": "note", "message": {"text": "18 env vars used in code but missing from .env.example"}, "properties": {"repobilityId": "5e334d56f52c02e1", "scanner": "scanner-primary", "fingerprint": "65df07ab4020db79", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "config-drift"]}}]}]}