{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-6f181a2dcdad8cc6", "name": "Privileged port 4 in use", "shortDescription": {"text": "Privileged port 4 in use"}, "fullDescription": {"text": "Port 4 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-fb21d7c2babe0f55", "name": "Privileged port 14 in use", "shortDescription": {"text": "Privileged port 14 in use"}, "fullDescription": {"text": "Port 14 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-01731e6d565f1c70", "name": "Privileged port 19 in use", "shortDescription": {"text": "Privileged port 19 in use"}, "fullDescription": {"text": "Port 19 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-678c841fd03e36eb", "name": "Privileged port 3 in use", "shortDescription": {"text": "Privileged port 3 in use"}, "fullDescription": {"text": "Port 3 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c44846d17c68257a", "name": "Privileged port 10 in use", "shortDescription": {"text": "Privileged port 10 in use"}, "fullDescription": {"text": "Port 10 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7ed305f13da56151", "name": "Privileged port 40 in use", "shortDescription": {"text": "Privileged port 40 in use"}, "fullDescription": {"text": "Port 40 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-41846e305433d927", "name": "Privileged port 16 in use", "shortDescription": {"text": "Privileged port 16 in use"}, "fullDescription": {"text": "Port 16 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0e32d13640c82c8a", "name": "Privileged port 9 in use", "shortDescription": {"text": "Privileged port 9 in use"}, "fullDescription": {"text": "Port 9 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6d5668957f11668c", "name": "Privileged port 20 in use", "shortDescription": {"text": "Privileged port 20 in use"}, "fullDescription": {"text": "Port 20 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f83ad8f2983bcdbf", "name": "Runtime dotenv file present in repo: admin/.env", "shortDescription": {"text": "Runtime dotenv file present in repo: admin/.env"}, "fullDescription": {"text": "`admin/.env` looks like a runtime dotenv file. No high-confidence secret value was matched, but runtime dotenv files often drift into live credentials. Move real values to a secret manager and keep only `.env.example` style templates in source control."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-7f316e6f5834a6cf", "name": "Possible secret in admin/src/components/x-table/XTable.vue", "shortDescription": {"text": "Possible secret in admin/src/components/x-table/XTable.vue"}, "fullDescription": {"text": "Detected pattern matching password_literal. Rotate the credential and move to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-9437ce78972566a3", "name": "Possible secret in server/rbac/handler_user.go", "shortDescription": {"text": "Possible secret in server/rbac/handler_user.go"}, "fullDescription": {"text": "Detected pattern matching password_literal. Rotate the credential and move to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-749d4bc1bd66df5f", "name": "Agent instructions exist but release-hardening basics are missing", "shortDescription": {"text": "Agent instructions exist but release-hardening basics are missing"}, "fullDescription": {"text": "AI-coder instruction files were found, but the repo is missing ci. Treat this as a contract gap: the agent is guided, but the generated output is not yet guarded by the controls that make it repeatable."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-fc3711505879a5d9", "name": "`fetch()` without try/.catch or AbortSignal \u2014 admin/vite.config.ts:17", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 admin/vite.config.ts:17"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/24559"}, "properties": {"repository": "BenxinAdminPro/BenxinAdminPro", "repoUrl": "https://github.com/BenxinAdminPro/BenxinAdminPro", "branch": "main"}, "results": [{"ruleId": "scanner-6f181a2dcdad8cc6", "level": "warning", "message": {"text": "Privileged port 4 in use"}, "properties": {"repobilityId": "1594bfeff919296e", "scanner": "scanner-primary", "fingerprint": "6f181a2dcdad8cc6", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server/examples/demo/config.example.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-fb21d7c2babe0f55", "level": "warning", "message": {"text": "Privileged port 14 in use"}, "properties": {"repobilityId": "2dbd4b719a1412ff", "scanner": "scanner-primary", "fingerprint": "fb21d7c2babe0f55", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server/spec/openapi/openapi.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-01731e6d565f1c70", "level": "warning", "message": {"text": "Privileged port 19 in use"}, "properties": {"repobilityId": "a6b5b06deac36eac", "scanner": "scanner-primary", "fingerprint": "01731e6d565f1c70", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server/spec/openapi/openapi.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-678c841fd03e36eb", "level": "warning", "message": {"text": "Privileged port 3 in use"}, "properties": {"repobilityId": "261b7b1c6a18d412", "scanner": "scanner-primary", "fingerprint": "678c841fd03e36eb", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server/spec/openapi/openapi.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c44846d17c68257a", "level": "warning", "message": {"text": "Privileged port 10 in use"}, "properties": {"repobilityId": "735372d6b5594915", "scanner": "scanner-primary", "fingerprint": "c44846d17c68257a", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server/spec/openapi/openapi.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-7ed305f13da56151", "level": "warning", "message": {"text": "Privileged port 40 in use"}, "properties": {"repobilityId": "28c59d470d4929c6", "scanner": "scanner-primary", "fingerprint": "7ed305f13da56151", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server/spec/openapi/openapi.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-41846e305433d927", "level": "warning", "message": {"text": "Privileged port 16 in use"}, "properties": {"repobilityId": "d31009168c502ace", "scanner": "scanner-primary", "fingerprint": "41846e305433d927", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server/spec/openapi/openapi.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-0e32d13640c82c8a", "level": "warning", "message": {"text": "Privileged port 9 in use"}, "properties": {"repobilityId": "31590a6ba3409390", "scanner": "scanner-primary", "fingerprint": "0e32d13640c82c8a", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server/spec/openapi/openapi.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6d5668957f11668c", "level": "warning", "message": {"text": "Privileged port 20 in use"}, "properties": {"repobilityId": "a59f3e53d617e0f8", "scanner": "scanner-primary", "fingerprint": "6d5668957f11668c", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "deploy/docker-compose.dev.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f83ad8f2983bcdbf", "level": "error", "message": {"text": "Runtime dotenv file present in repo: admin/.env"}, "properties": {"repobilityId": "b612f621af66402a", "scanner": "scanner-primary", "fingerprint": "f83ad8f2983bcdbf", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["secrets", "config", "env-file", "runtime-env"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "admin/.env"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-7f316e6f5834a6cf", "level": "error", "message": {"text": "Possible secret in admin/src/components/x-table/XTable.vue"}, "properties": {"repobilityId": "ed17a4501ee885f6", "scanner": "scanner-primary", "fingerprint": "7f316e6f5834a6cf", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "admin/src/components/x-table/XTable.vue"}, "region": {"startLine": 460}}}]}, {"ruleId": "scanner-9437ce78972566a3", "level": "error", "message": {"text": "Possible secret in server/rbac/handler_user.go"}, "properties": {"repobilityId": "99f81eff33ddcac2", "scanner": "scanner-primary", "fingerprint": "9437ce78972566a3", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server/rbac/handler_user.go"}, "region": {"startLine": 30}}}]}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "6909c9a757c39bb3", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-749d4bc1bd66df5f", "level": "warning", "message": {"text": "Agent instructions exist but release-hardening basics are missing"}, "properties": {"repobilityId": "122b9d0b3307643b", "scanner": "scanner-primary", "fingerprint": "749d4bc1bd66df5f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-fc3711505879a5d9", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 admin/vite.config.ts:17"}, "properties": {"repobilityId": "4e57dee9e743daf9", "scanner": "scanner-primary", "fingerprint": "fc3711505879a5d9", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}]}]}