{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-38432c8a619a376f", "name": "`dangerouslySetInnerHTML` used in a React component \u2014 apps/web/src/components/ui/chart.tsx:70", "shortDescription": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 apps/web/src/components/ui/chart.tsx:70"}, "fullDescription": {"text": "Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library.\n\nWhy: OWASP basics. Already partially flagged by the security analyzer.\nRule id: fq.dangerous-html"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2294fb51eac01c3c", "name": "Insecure pattern 'node_child_process' in scripts/fitness.selftest.mjs:8", "shortDescription": {"text": "Insecure pattern 'node_child_process' in scripts/fitness.selftest.mjs:8"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d432f0101b21e242", "name": "Insecure pattern 'node_child_process' in scripts/selvtjek-docs.mjs:24", "shortDescription": {"text": "Insecure pattern 'node_child_process' in scripts/selvtjek-docs.mjs:24"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e6e169623a328e34", "name": "Insecure pattern 'node_child_process' in scripts/governance-check.selftest.mjs:6", "shortDescription": {"text": "Insecure pattern 'node_child_process' in scripts/governance-check.selftest.mjs:6"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-94e8299805e1ecca", "name": "Insecure pattern 'node_child_process' in scripts/kaede/dirigent.selftest.mjs:10", "shortDescription": {"text": "Insecure pattern 'node_child_process' in scripts/kaede/dirigent.selftest.mjs:10"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-06172f13b4aee6ef", "name": "Insecure pattern 'node_child_process' in scripts/kaede/tilstand.mjs:9", "shortDescription": {"text": "Insecure pattern 'node_child_process' in scripts/kaede/tilstand.mjs:9"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-65f2045beddf043b", "name": "Insecure pattern 'node_child_process' in scripts/kaede/dirigent.mjs:16", "shortDescription": {"text": "Insecure pattern 'node_child_process' in scripts/kaede/dirigent.mjs:16"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-fcd3076ed806fc89", "name": "Insecure pattern 'node_child_process' in scripts/kaede/adapters/mathias.mjs:7", "shortDescription": {"text": "Insecure pattern 'node_child_process' in scripts/kaede/adapters/mathias.mjs:7"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e145ab857d0889a3", "name": "Insecure pattern 'dangerous_innerhtml' in apps/web/src/components/ui/chart.tsx:70", "shortDescription": {"text": "Insecure pattern 'dangerous_innerhtml' in apps/web/src/components/ui/chart.tsx:70"}, "fullDescription": {"text": "Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-653563205380dba5", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "pnpm/action-setup@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-706d81b58ab25024", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-cb639d9a10a47b23", "name": "package.json defines install-time lifecycle scripts", "shortDescription": {"text": "package.json defines install-time lifecycle scripts"}, "fullDescription": {"text": "preinstall/install/postinstall/prepare scripts execute during dependency installation. Review them carefully for network calls, obfuscation, shell execution, or credential access."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-16f845d8fcaa9fda", "name": "Very large file: packages/types/src/database.ts (3520 lines)", "shortDescription": {"text": "Very large file: packages/types/src/database.ts (3520 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-40327faa7a6943af", "name": "Very large file: scripts/fitness.mjs (1875 lines)", "shortDescription": {"text": "Very large file: scripts/fitness.mjs (1875 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-25b85d3b4b337675", "name": "Very large file: scripts/kaede/dirigent.selftest.mjs (1685 lines)", "shortDescription": {"text": "Very large file: scripts/kaede/dirigent.selftest.mjs (1685 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6893a6c8b0861585", "name": "Very low test-to-source ratio", "shortDescription": {"text": "Very low test-to-source ratio"}, "fullDescription": {"text": "7 test file(s) for 75 source file(s) (ratio 0.09). Consider adding integration or unit tests for critical paths."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-141b30a41e03817b", "name": "No license file detected", "shortDescription": {"text": "No license file detected"}, "fullDescription": {"text": "No LICENSE/COPYING/NOTICE file was found. Generated repositories often omit licensing, which blocks reuse and automated intake."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3f65e1ca9b00183a", "name": "Node manifest has dependencies but no lockfile: packages/eslint-config/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: packages/eslint-config/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4a9eb7dc7c6e3880", "name": "Node manifest has dependencies but no lockfile: apps/web/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: apps/web/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 42 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b9088664ace7f748", "name": "Composite production-readiness gap", "shortDescription": {"text": "Composite production-readiness gap"}, "fullDescription": {"text": "Multiple low-cost hardening controls are missing together: license, lockfile. Opus verification showed these co-occurring gaps are a better readiness signal than reading each flag in isolation."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-749d4bc1bd66df5f", "name": "Agent instructions exist but release-hardening basics are missing", "shortDescription": {"text": "Agent instructions exist but release-hardening basics are missing"}, "fullDescription": {"text": "AI-coder instruction files were found, but the repo is missing license, lockfile. Treat this as a contract gap: the agent is guided, but the generated output is not yet guarded by the controls that make it repeatable."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-bea357a6497a2d5d", "name": "Agent authority lacks a verifier contract: CLAUDE.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: CLAUDE.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c8bd38cfa4907d1f", "name": "Legacy-named symbol `v_old` in scripts/fitness.selftest.mjs:138", "shortDescription": {"text": "Legacy-named symbol `v_old` in scripts/fitness.selftest.mjs:138"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fabaf4f6a344ba18", "name": "Commented-code block (5 lines) in scripts/fitness.selftest.mjs:2", "shortDescription": {"text": "Commented-code block (5 lines) in scripts/fitness.selftest.mjs:2"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-ad08e7658ad52228", "name": "Commented-code block (7 lines) in scripts/fitness.mjs:68", "shortDescription": {"text": "Commented-code block (7 lines) in scripts/fitness.mjs:68"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-c38b7bfd19de5c71", "name": "Commented-code block (9 lines) in scripts/selvtjek-docs.mjs:4", "shortDescription": {"text": "Commented-code block (9 lines) in scripts/selvtjek-docs.mjs:4"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-d733cd4c4980a471", "name": "Legacy-named symbol `isDeprecated` in scripts/governance-check.mjs:132", "shortDescription": {"text": "Legacy-named symbol `isDeprecated` in scripts/governance-check.mjs:132"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8c4c8089c8d90b9d", "name": "`fetch()` without try/.catch or AbortSignal \u2014 scripts/run-db-tests.mjs:40", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 scripts/run-db-tests.mjs:40"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8525ed5c0a5ce3d4", "name": "Commented-code block (5 lines) in scripts/migration-gate.mjs:81", "shortDescription": {"text": "Commented-code block (5 lines) in scripts/migration-gate.mjs:81"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-93e69a11a800d7ad", "name": "Commented-code block (5 lines) in scripts/kaede/dirigent.selftest.mjs:1323", "shortDescription": {"text": "Commented-code block (5 lines) in scripts/kaede/dirigent.selftest.mjs:1323"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-ac2d6546b5c3cd47", "name": "Commented-code block (5 lines) in scripts/kaede/tilstand.mjs:156", "shortDescription": {"text": "Commented-code block (5 lines) in scripts/kaede/tilstand.mjs:156"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-92e31a8188b7c9e1", "name": "Commented-code block (5 lines) in scripts/kaede/dirigent.mjs:114", "shortDescription": {"text": "Commented-code block (5 lines) in scripts/kaede/dirigent.mjs:114"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-c2185b3653775e28", "name": "Commented-code block (5 lines) in scripts/kaede/adapters/mathias.mjs:2", "shortDescription": {"text": "Commented-code block (5 lines) in scripts/kaede/adapters/mathias.mjs:2"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/25106"}, "properties": {"repository": "Cphsales/stork-2.0", "repoUrl": "https://github.com/Cphsales/stork-2.0", "branch": "main"}, "results": [{"ruleId": "scanner-38432c8a619a376f", "level": "warning", "message": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 apps/web/src/components/ui/chart.tsx:70"}, "properties": {"repobilityId": "a3f6aa8e227cbb83", "scanner": "scanner-primary", "fingerprint": "38432c8a619a376f", "layer": "frontend", "severity": "medium", "confidence": 1.0, "tags": ["frontend-quality", "fq.dangerous-html"]}}, {"ruleId": "scanner-2294fb51eac01c3c", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in scripts/fitness.selftest.mjs:8"}, "properties": {"repobilityId": "45809bcc2dd5fbf7", "scanner": "scanner-primary", "fingerprint": "2294fb51eac01c3c", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/fitness.selftest.mjs"}, "region": {"startLine": 8}}}]}, {"ruleId": "scanner-d432f0101b21e242", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in scripts/selvtjek-docs.mjs:24"}, "properties": {"repobilityId": "763aa921896c64b0", "scanner": "scanner-primary", "fingerprint": "d432f0101b21e242", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/selvtjek-docs.mjs"}, "region": {"startLine": 24}}}]}, {"ruleId": "scanner-e6e169623a328e34", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in scripts/governance-check.selftest.mjs:6"}, "properties": {"repobilityId": "9853d372b253bd62", "scanner": "scanner-primary", "fingerprint": "e6e169623a328e34", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/governance-check.selftest.mjs"}, "region": {"startLine": 6}}}]}, {"ruleId": "scanner-94e8299805e1ecca", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in scripts/kaede/dirigent.selftest.mjs:10"}, "properties": {"repobilityId": "8402903276931dca", "scanner": "scanner-primary", "fingerprint": "94e8299805e1ecca", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/kaede/dirigent.selftest.mjs"}, "region": {"startLine": 10}}}]}, {"ruleId": "scanner-06172f13b4aee6ef", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in scripts/kaede/tilstand.mjs:9"}, "properties": {"repobilityId": "9f2cb52503b99335", "scanner": "scanner-primary", "fingerprint": "06172f13b4aee6ef", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/kaede/tilstand.mjs"}, "region": {"startLine": 9}}}]}, {"ruleId": "scanner-65f2045beddf043b", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in scripts/kaede/dirigent.mjs:16"}, "properties": {"repobilityId": "75a850d624493f7f", "scanner": "scanner-primary", "fingerprint": "65f2045beddf043b", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/kaede/dirigent.mjs"}, "region": {"startLine": 16}}}]}, {"ruleId": "scanner-fcd3076ed806fc89", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in scripts/kaede/adapters/mathias.mjs:7"}, "properties": {"repobilityId": "702f7f5b39d3399f", "scanner": "scanner-primary", "fingerprint": "fcd3076ed806fc89", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/kaede/adapters/mathias.mjs"}, "region": {"startLine": 7}}}]}, {"ruleId": "scanner-e145ab857d0889a3", "level": "warning", "message": {"text": "Insecure pattern 'dangerous_innerhtml' in apps/web/src/components/ui/chart.tsx:70"}, "properties": {"repobilityId": "96fca721b4362b9f", "scanner": "scanner-primary", "fingerprint": "e145ab857d0889a3", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "dangerous_innerhtml"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/web/src/components/ui/chart.tsx"}, "region": {"startLine": 70}}}]}, {"ruleId": "scanner-653563205380dba5", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "1334b44432c67de2", "scanner": "scanner-primary", "fingerprint": "653563205380dba5", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/migrations-deploy.yml"}, "region": {"startLine": 33}}}]}, {"ruleId": "scanner-653563205380dba5", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "096ead6957b0730b", "scanner": "scanner-primary", "fingerprint": "653563205380dba5", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/migrations-deploy.yml"}, "region": {"startLine": 38}}}]}, {"ruleId": "scanner-653563205380dba5", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "1334b44432c67de2", "scanner": "scanner-primary", "fingerprint": "653563205380dba5", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/migrations-deploy.yml"}, "region": {"startLine": 68}}}]}, {"ruleId": "scanner-653563205380dba5", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "096ead6957b0730b", "scanner": "scanner-primary", "fingerprint": "653563205380dba5", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/migrations-deploy.yml"}, "region": {"startLine": 73}}}]}, {"ruleId": "scanner-653563205380dba5", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "96d0b0a081c4692e", "scanner": "scanner-primary", "fingerprint": "653563205380dba5", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/migrations-deploy.yml"}, "region": {"startLine": 98}}}]}, {"ruleId": "scanner-706d81b58ab25024", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "12f31b9bfd6a060f", "scanner": "scanner-primary", "fingerprint": "706d81b58ab25024", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/migrations-deploy.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-cb639d9a10a47b23", "level": "note", "message": {"text": "package.json defines install-time lifecycle scripts"}, "properties": {"repobilityId": "b86179956da3a4a8", "scanner": "scanner-primary", "fingerprint": "cb639d9a10a47b23", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "npm", "install-scripts"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-16f845d8fcaa9fda", "level": "note", "message": {"text": "Very large file: packages/types/src/database.ts (3520 lines)"}, "properties": {"repobilityId": "e804aa8140aeebf4", "scanner": "scanner-primary", "fingerprint": "16f845d8fcaa9fda", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-40327faa7a6943af", "level": "note", "message": {"text": "Very large file: scripts/fitness.mjs (1875 lines)"}, "properties": {"repobilityId": "9fd6a30174949139", "scanner": "scanner-primary", "fingerprint": "40327faa7a6943af", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-25b85d3b4b337675", "level": "note", "message": {"text": "Very large file: scripts/kaede/dirigent.selftest.mjs (1685 lines)"}, "properties": {"repobilityId": "cca97161f3413011", "scanner": "scanner-primary", "fingerprint": "25b85d3b4b337675", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-6893a6c8b0861585", "level": "warning", "message": {"text": "Very low test-to-source ratio"}, "properties": {"repobilityId": "54a7de3f06314bf0", "scanner": "scanner-primary", "fingerprint": "6893a6c8b0861585", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["tests", "coverage"]}}, {"ruleId": "scanner-141b30a41e03817b", "level": "note", "message": {"text": "No license file detected"}, "properties": {"repobilityId": "c9abc99ac68b96fe", "scanner": "scanner-primary", "fingerprint": "141b30a41e03817b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["license", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-3f65e1ca9b00183a", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: packages/eslint-config/package.json"}, "properties": {"repobilityId": "7374bbf66cd702ed", "scanner": "scanner-primary", "fingerprint": "3f65e1ca9b00183a", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/eslint-config/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-4a9eb7dc7c6e3880", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: apps/web/package.json"}, "properties": {"repobilityId": "6c1704bf24cf19ac", "scanner": "scanner-primary", "fingerprint": "4a9eb7dc7c6e3880", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/web/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "fcf3f177b3059ba2", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "512fd1776247acad", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-b9088664ace7f748", "level": "note", "message": {"text": "Composite production-readiness gap"}, "properties": {"repobilityId": "0b0e710a36f76cb0", "scanner": "scanner-primary", "fingerprint": "b9088664ace7f748", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["production-readiness", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-749d4bc1bd66df5f", "level": "warning", "message": {"text": "Agent instructions exist but release-hardening basics are missing"}, "properties": {"repobilityId": "cc8c8cfb4084187c", "scanner": "scanner-primary", "fingerprint": "749d4bc1bd66df5f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-bea357a6497a2d5d", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: CLAUDE.md"}, "properties": {"repobilityId": "aae72df3934829ac", "scanner": "scanner-primary", "fingerprint": "bea357a6497a2d5d", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "CLAUDE.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c8bd38cfa4907d1f", "level": "note", "message": {"text": "Legacy-named symbol `v_old` in scripts/fitness.selftest.mjs:138"}, "properties": {"repobilityId": "5f759eccb6dbaf7f", "scanner": "scanner-primary", "fingerprint": "c8bd38cfa4907d1f", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-fabaf4f6a344ba18", "level": "none", "message": {"text": "Commented-code block (5 lines) in scripts/fitness.selftest.mjs:2"}, "properties": {"repobilityId": "327d54d8ec218c51", "scanner": "scanner-primary", "fingerprint": "fabaf4f6a344ba18", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-ad08e7658ad52228", "level": "none", "message": {"text": "Commented-code block (7 lines) in scripts/fitness.mjs:68"}, "properties": {"repobilityId": "45f5f76ac6e76712", "scanner": "scanner-primary", "fingerprint": "ad08e7658ad52228", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-c38b7bfd19de5c71", "level": "none", "message": {"text": "Commented-code block (9 lines) in scripts/selvtjek-docs.mjs:4"}, "properties": {"repobilityId": "4488694910486031", "scanner": "scanner-primary", "fingerprint": "c38b7bfd19de5c71", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-d733cd4c4980a471", "level": "note", "message": {"text": "Legacy-named symbol `isDeprecated` in scripts/governance-check.mjs:132"}, "properties": {"repobilityId": "fe0dba5326a822ad", "scanner": "scanner-primary", "fingerprint": "d733cd4c4980a471", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-8c4c8089c8d90b9d", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 scripts/run-db-tests.mjs:40"}, "properties": {"repobilityId": "3946b2767e98b11d", "scanner": "scanner-primary", "fingerprint": "8c4c8089c8d90b9d", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-8525ed5c0a5ce3d4", "level": "none", "message": {"text": "Commented-code block (5 lines) in scripts/migration-gate.mjs:81"}, "properties": {"repobilityId": "c11b2f0897cc779b", "scanner": "scanner-primary", "fingerprint": "8525ed5c0a5ce3d4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-93e69a11a800d7ad", "level": "none", "message": {"text": "Commented-code block (5 lines) in scripts/kaede/dirigent.selftest.mjs:1323"}, "properties": {"repobilityId": "9de2b78e225acd97", "scanner": "scanner-primary", "fingerprint": "93e69a11a800d7ad", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-ac2d6546b5c3cd47", "level": "none", "message": {"text": "Commented-code block (5 lines) in scripts/kaede/tilstand.mjs:156"}, "properties": {"repobilityId": "8120c6e688aceed2", "scanner": "scanner-primary", "fingerprint": "ac2d6546b5c3cd47", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-92e31a8188b7c9e1", "level": "none", "message": {"text": "Commented-code block (5 lines) in scripts/kaede/dirigent.mjs:114"}, "properties": {"repobilityId": "1fd9bd9ef69fc75b", "scanner": "scanner-primary", "fingerprint": "92e31a8188b7c9e1", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-c2185b3653775e28", "level": "none", "message": {"text": "Commented-code block (5 lines) in scripts/kaede/adapters/mathias.mjs:2"}, "properties": {"repobilityId": "be3159e6f76877c4", "scanner": "scanner-primary", "fingerprint": "c2185b3653775e28", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}]}]}