{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-e5683575cf64e1c5", "name": "Stray `console.log` in TS/JS \u2014 scripts/publish.ts:65", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 scripts/publish.ts:65"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b324c27b7e4aabc2", "name": "Stray `console.log` in TS/JS \u2014 packages/cli/src/commands/init.ts:392", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 packages/cli/src/commands/init.ts:392"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-50d3fcb6c69dcf04", "name": "Stray `console.log` in TS/JS \u2014 packages/cli/src/commands/pack.ts:51", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 packages/cli/src/commands/pack.ts:51"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a2b4e63ea25efdd6", "name": "Stray `console.log` in TS/JS \u2014 packages/cli/src/commands/diff.ts:47", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 packages/cli/src/commands/diff.ts:47"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-bc5213c033b0de1b", "name": "Stray `console.log` in TS/JS \u2014 packages/cli/src/commands/typegen.ts:61", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 packages/cli/src/commands/typegen.ts:61"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-de7c3128603f74df", "name": "Stray `console.log` in TS/JS \u2014 packages/cli/src/commands/locales-scaffold.ts:48", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 packages/cli/src/commands/locales-scaffold.ts:48"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-41bcb7a7c284e700", "name": "Stray `console.log` in TS/JS \u2014 packages/cli/src/commands/locales-check.ts:49", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 packages/cli/src/commands/locales-check.ts:49"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-15cc402b33a25b69", "name": "Stray `console.log` in TS/JS \u2014 packages/cli/src/commands/build.ts:44", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 packages/cli/src/commands/build.ts:44"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-30d9808f69f842fa", "name": "Stray `console.log` in TS/JS \u2014 packages/cli/src/commands/inspect.ts:19", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 packages/cli/src/commands/inspect.ts:19"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-69fcfeaa7bb86343", "name": "Stray `console.log` in TS/JS \u2014 packages/cli/src/commands/validate.ts:38", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 packages/cli/src/commands/validate.ts:38"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4269a2f95fe36009", "name": "Stray `console.log` in TS/JS \u2014 packages/sdk/scripts/emit-json-schema.ts:15", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 packages/sdk/scripts/emit-json-schema.ts:15"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9710c8d059e53154", "name": "No frontend routes/components detected", "shortDescription": {"text": "No frontend routes/components detected"}, "fullDescription": {"text": "No React/Vue/Next routes were found. This is fine for backend-only repos."}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-ec6491b9aa95f74e", "name": "Insecure pattern 'node_child_process' in scripts/publish.ts:1", "shortDescription": {"text": "Insecure pattern 'node_child_process' in scripts/publish.ts:1"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9ab19864d21b78a9", "name": "Insecure pattern 'exec_used' in packages/sdk/src/intent.ts:63", "shortDescription": {"text": "Insecure pattern 'exec_used' in packages/sdk/src/intent.ts:63"}, "fullDescription": {"text": "Found a known-risky pattern (exec_used). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-6372cebde0220094", "name": "No auth library detected", "shortDescription": {"text": "No auth library detected"}, "fullDescription": {"text": "The scanner did not find any standard auth library (JWT, OAuth, NextAuth, Auth0, etc.). The repo has auth/admin/session surface indicators, so auth may live in custom code, in a separate service, or be missing."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-27924aa79fa4a517", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v5 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-46c644c6227e4d4a", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v5 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1838a141491ce38c", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-cb639d9a10a47b23", "name": "package.json defines install-time lifecycle scripts", "shortDescription": {"text": "package.json defines install-time lifecycle scripts"}, "fullDescription": {"text": "preinstall/install/postinstall/prepare scripts execute during dependency installation. Review them carefully for network calls, obfuscation, shell execution, or credential access."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8c2e3196a4ef0cdd", "name": "Node manifest has dependencies but no lockfile: packages/cli/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: packages/cli/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ae014485ab255591", "name": "Node manifest has dependencies but no lockfile: packages/sdk/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: packages/sdk/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 48 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-862961f4398c7939", "name": "Commented-code block (6 lines) in scripts/publish.ts:8", "shortDescription": {"text": "Commented-code block (6 lines) in scripts/publish.ts:8"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-3b9c873406e96f40", "name": "Commented-code block (5 lines) in packages/cli/src/typegen.ts:1", "shortDescription": {"text": "Commented-code block (5 lines) in packages/cli/src/typegen.ts:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-30371111e3dafeaa", "name": "Commented-code block (7 lines) in packages/cli/src/commands/init.ts:10", "shortDescription": {"text": "Commented-code block (7 lines) in packages/cli/src/commands/init.ts:10"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-3f0303719871a367", "name": "Commented-code block (5 lines) in packages/sdk/src/content.ts:1", "shortDescription": {"text": "Commented-code block (5 lines) in packages/sdk/src/content.ts:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-8c472b2eba9aa918", "name": "Commented-code block (5 lines) in packages/sdk/src/formula.ts:5", "shortDescription": {"text": "Commented-code block (5 lines) in packages/sdk/src/formula.ts:5"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-01395d4859f6d8b9", "name": "Commented-code block (7 lines) in packages/sdk/src/intent.ts:8", "shortDescription": {"text": "Commented-code block (7 lines) in packages/sdk/src/intent.ts:8"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-3de426d662d2c794", "name": "Commented-code block (12 lines) in packages/sdk/src/index.ts:10", "shortDescription": {"text": "Commented-code block (12 lines) in packages/sdk/src/index.ts:10"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-cb90eea65e5d25e0", "name": "Commented-code block (5 lines) in packages/sdk/src/schema/ops.ts:1", "shortDescription": {"text": "Commented-code block (5 lines) in packages/sdk/src/schema/ops.ts:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-fb5f287135c92005", "name": "Commented-code block (6 lines) in packages/sdk/src/schema/index.ts:1", "shortDescription": {"text": "Commented-code block (6 lines) in packages/sdk/src/schema/index.ts:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-3ebcd49d3d156faf", "name": "Commented-code block (6 lines) in packages/sdk/src/locales/index.ts:1", "shortDescription": {"text": "Commented-code block (6 lines) in packages/sdk/src/locales/index.ts:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-9dc1e7b1e027b9f8", "name": "Commented-code block (7 lines) in packages/sdk/src/pack/index.ts:1", "shortDescription": {"text": "Commented-code block (7 lines) in packages/sdk/src/pack/index.ts:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-262f20083c56c3c0", "name": "Commented-code block (5 lines) in packages/sdk/src/core/paths.ts:1", "shortDescription": {"text": "Commented-code block (5 lines) in packages/sdk/src/core/paths.ts:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-e12aca4c113fc0a2", "name": "Commented-code block (5 lines) in packages/sdk/src/core/expr.ts:5", "shortDescription": {"text": "Commented-code block (5 lines) in packages/sdk/src/core/expr.ts:5"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-5be979286691ca64", "name": "Commented-code block (8 lines) in packages/sdk/src/core/scope.ts:6", "shortDescription": {"text": "Commented-code block (8 lines) in packages/sdk/src/core/scope.ts:6"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/18149"}, "properties": {"repository": "rifted-game/tools", "repoUrl": "https://github.com/rifted-game/tools", "branch": "main"}, "results": [{"ruleId": "scanner-e5683575cf64e1c5", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 scripts/publish.ts:65"}, "properties": {"repobilityId": "aef3829f096b3404", "scanner": "scanner-primary", "fingerprint": "e5683575cf64e1c5", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-b324c27b7e4aabc2", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 packages/cli/src/commands/init.ts:392"}, "properties": {"repobilityId": "66eebb8d5a282eac", "scanner": "scanner-primary", "fingerprint": "b324c27b7e4aabc2", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-50d3fcb6c69dcf04", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 packages/cli/src/commands/pack.ts:51"}, "properties": {"repobilityId": "b8e587297d4434de", "scanner": "scanner-primary", "fingerprint": "50d3fcb6c69dcf04", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-a2b4e63ea25efdd6", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 packages/cli/src/commands/diff.ts:47"}, "properties": {"repobilityId": "a76e07cc13e4bf53", "scanner": "scanner-primary", "fingerprint": "a2b4e63ea25efdd6", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-bc5213c033b0de1b", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 packages/cli/src/commands/typegen.ts:61"}, "properties": {"repobilityId": "2852ea018f892642", "scanner": "scanner-primary", "fingerprint": "bc5213c033b0de1b", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-de7c3128603f74df", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 packages/cli/src/commands/locales-scaffold.ts:48"}, "properties": {"repobilityId": "a6be8a105d4f74b1", "scanner": "scanner-primary", "fingerprint": "de7c3128603f74df", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-41bcb7a7c284e700", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 packages/cli/src/commands/locales-check.ts:49"}, "properties": {"repobilityId": "f7824267093d2dd5", "scanner": "scanner-primary", "fingerprint": "41bcb7a7c284e700", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-15cc402b33a25b69", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 packages/cli/src/commands/build.ts:44"}, "properties": {"repobilityId": "f7d4b383f313eb21", "scanner": "scanner-primary", "fingerprint": "15cc402b33a25b69", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-30d9808f69f842fa", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 packages/cli/src/commands/inspect.ts:19"}, "properties": {"repobilityId": "102418f3c8abb6a4", "scanner": "scanner-primary", "fingerprint": "30d9808f69f842fa", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-69fcfeaa7bb86343", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 packages/cli/src/commands/validate.ts:38"}, "properties": {"repobilityId": "437f71fdc2f67719", "scanner": "scanner-primary", "fingerprint": "69fcfeaa7bb86343", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-4269a2f95fe36009", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 packages/sdk/scripts/emit-json-schema.ts:15"}, "properties": {"repobilityId": "3d5d595c3733e0a9", "scanner": "scanner-primary", "fingerprint": "4269a2f95fe36009", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-9710c8d059e53154", "level": "none", "message": {"text": "No frontend routes/components detected"}, "properties": {"repobilityId": "44ca61485762e494", "scanner": "scanner-primary", "fingerprint": "9710c8d059e53154", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-ec6491b9aa95f74e", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in scripts/publish.ts:1"}, "properties": {"repobilityId": "0150fe9e3db51585", "scanner": "scanner-primary", "fingerprint": "ec6491b9aa95f74e", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/publish.ts"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-9ab19864d21b78a9", "level": "error", "message": {"text": "Insecure pattern 'exec_used' in packages/sdk/src/intent.ts:63"}, "properties": {"repobilityId": "238a2b8a19eafdb9", "scanner": "scanner-primary", "fingerprint": "9ab19864d21b78a9", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "exec_used"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/sdk/src/intent.ts"}, "region": {"startLine": 63}}}]}, {"ruleId": "scanner-6372cebde0220094", "level": "warning", "message": {"text": "No auth library detected"}, "properties": {"repobilityId": "a5b6035a5bbf8054", "scanner": "scanner-primary", "fingerprint": "6372cebde0220094", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["coverage", "auth"]}}, {"ruleId": "scanner-27924aa79fa4a517", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "0b7984a0d98960fe", "scanner": "scanner-primary", "fingerprint": "27924aa79fa4a517", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 19}}}]}, {"ruleId": "scanner-27924aa79fa4a517", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "dcb6504096fc20e7", "scanner": "scanner-primary", "fingerprint": "27924aa79fa4a517", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 22}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "a236e5722d902eaf", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 21}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "cedbda24771e393e", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 26}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "7c434d8683811720", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 31}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "795422ca0cf75519", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 43}}}]}, {"ruleId": "scanner-1838a141491ce38c", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "b8fd4f5048f96576", "scanner": "scanner-primary", "fingerprint": "1838a141491ce38c", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-cb639d9a10a47b23", "level": "note", "message": {"text": "package.json defines install-time lifecycle scripts"}, "properties": {"repobilityId": "b86179956da3a4a8", "scanner": "scanner-primary", "fingerprint": "cb639d9a10a47b23", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "npm", "install-scripts"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-8c2e3196a4ef0cdd", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: packages/cli/package.json"}, "properties": {"repobilityId": "2faf23490612d7a6", "scanner": "scanner-primary", "fingerprint": "8c2e3196a4ef0cdd", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/cli/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ae014485ab255591", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: packages/sdk/package.json"}, "properties": {"repobilityId": "666cbe5826d686db", "scanner": "scanner-primary", "fingerprint": "ae014485ab255591", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/sdk/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "e3bb10836471e2eb", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "09354c1f70e314f8", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "c600ba8109c8322b", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-862961f4398c7939", "level": "none", "message": {"text": "Commented-code block (6 lines) in scripts/publish.ts:8"}, "properties": {"repobilityId": "1669d8e5de135a40", "scanner": "scanner-primary", "fingerprint": "862961f4398c7939", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-3b9c873406e96f40", "level": "none", "message": {"text": "Commented-code block (5 lines) in packages/cli/src/typegen.ts:1"}, "properties": {"repobilityId": "7afdf4a5b5ac1bde", "scanner": "scanner-primary", "fingerprint": "3b9c873406e96f40", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-30371111e3dafeaa", "level": "none", "message": {"text": "Commented-code block (7 lines) in packages/cli/src/commands/init.ts:10"}, "properties": {"repobilityId": "0f55bc9be56e5ec6", "scanner": "scanner-primary", "fingerprint": "30371111e3dafeaa", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-3f0303719871a367", "level": "none", "message": {"text": "Commented-code block (5 lines) in packages/sdk/src/content.ts:1"}, "properties": {"repobilityId": "eaad7eeb9902f59d", "scanner": "scanner-primary", "fingerprint": "3f0303719871a367", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-8c472b2eba9aa918", "level": "none", "message": {"text": "Commented-code block (5 lines) in packages/sdk/src/formula.ts:5"}, "properties": {"repobilityId": "00b305a20f166a19", "scanner": "scanner-primary", "fingerprint": "8c472b2eba9aa918", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-01395d4859f6d8b9", "level": "none", "message": {"text": "Commented-code block (7 lines) in packages/sdk/src/intent.ts:8"}, "properties": {"repobilityId": "54b09b8828987a10", "scanner": "scanner-primary", "fingerprint": "01395d4859f6d8b9", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-3de426d662d2c794", "level": "none", "message": {"text": "Commented-code block (12 lines) in packages/sdk/src/index.ts:10"}, "properties": {"repobilityId": "85f2b9ed4101ee5f", "scanner": "scanner-primary", "fingerprint": "3de426d662d2c794", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-cb90eea65e5d25e0", "level": "none", "message": {"text": "Commented-code block (5 lines) in packages/sdk/src/schema/ops.ts:1"}, "properties": {"repobilityId": "5d855f84068ad799", "scanner": "scanner-primary", "fingerprint": "cb90eea65e5d25e0", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-fb5f287135c92005", "level": "none", "message": {"text": "Commented-code block (6 lines) in packages/sdk/src/schema/index.ts:1"}, "properties": {"repobilityId": "0650fa27ede7ee11", "scanner": "scanner-primary", "fingerprint": "fb5f287135c92005", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-3ebcd49d3d156faf", "level": "none", "message": {"text": "Commented-code block (6 lines) in packages/sdk/src/locales/index.ts:1"}, "properties": {"repobilityId": "3f1767459da30268", "scanner": "scanner-primary", "fingerprint": "3ebcd49d3d156faf", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-9dc1e7b1e027b9f8", "level": "none", "message": {"text": "Commented-code block (7 lines) in packages/sdk/src/pack/index.ts:1"}, "properties": {"repobilityId": "2187eb89247288e6", "scanner": "scanner-primary", "fingerprint": "9dc1e7b1e027b9f8", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-262f20083c56c3c0", "level": "none", "message": {"text": "Commented-code block (5 lines) in packages/sdk/src/core/paths.ts:1"}, "properties": {"repobilityId": "2d0bc1894b21810e", "scanner": "scanner-primary", "fingerprint": "262f20083c56c3c0", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-e12aca4c113fc0a2", "level": "none", "message": {"text": "Commented-code block (5 lines) in packages/sdk/src/core/expr.ts:5"}, "properties": {"repobilityId": "ca384164576c50e4", "scanner": "scanner-primary", "fingerprint": "e12aca4c113fc0a2", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-5be979286691ca64", "level": "none", "message": {"text": "Commented-code block (8 lines) in packages/sdk/src/core/scope.ts:6"}, "properties": {"repobilityId": "47c47d73894128ca", "scanner": "scanner-primary", "fingerprint": "5be979286691ca64", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}]}]}