{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-9710c8d059e53154", "name": "No frontend routes/components detected", "shortDescription": {"text": "No frontend routes/components detected"}, "fullDescription": {"text": "No React/Vue/Next routes were found. This is fine for backend-only repos."}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-955f97a06f6262f5", "name": "Insecure pattern 'new_function_used' in _gas_test.mjs:45", "shortDescription": {"text": "Insecure pattern 'new_function_used' in _gas_test.mjs:45"}, "fullDescription": {"text": "Found a known-risky pattern (new_function_used). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-ed27d0c3ac8352cb", "name": "Insecure pattern 'new_function_used' in _upw_test.mjs:62", "shortDescription": {"text": "Insecure pattern 'new_function_used' in _upw_test.mjs:62"}, "fullDescription": {"text": "Found a known-risky pattern (new_function_used). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-cc7032810755884e", "name": "Insecure pattern 'new_function_used' in _timeline_test.mjs:4", "shortDescription": {"text": "Insecure pattern 'new_function_used' in _timeline_test.mjs:4"}, "fullDescription": {"text": "Found a known-risky pattern (new_function_used). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-7dd9bd16595ec2e2", "name": "Insecure pattern 'new_function_used' in _schematic_test.mjs:33", "shortDescription": {"text": "Insecure pattern 'new_function_used' in _schematic_test.mjs:33"}, "fullDescription": {"text": "Found a known-risky pattern (new_function_used). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-f2413952d0c4b692", "name": "Insecure pattern 'new_function_used' in _upw_measure.mjs:6", "shortDescription": {"text": "Insecure pattern 'new_function_used' in _upw_measure.mjs:6"}, "fullDescription": {"text": "Found a known-risky pattern (new_function_used). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-96c6b469fb7bd3a2", "name": "Insecure pattern 'new_function_used' in _selftest.mjs:8", "shortDescription": {"text": "Insecure pattern 'new_function_used' in _selftest.mjs:8"}, "fullDescription": {"text": "Found a known-risky pattern (new_function_used). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-784fbfd27831ee4a", "name": "Insecure pattern 'new_function_used' in _trends_test.mjs:12", "shortDescription": {"text": "Insecure pattern 'new_function_used' in _trends_test.mjs:12"}, "fullDescription": {"text": "Found a known-risky pattern (new_function_used). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-3e86a656bbd67df7", "name": "Insecure pattern 'direct_innerhtml_assignment' in src/ui/widgets.js:160", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in src/ui/widgets.js:160"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b36064a62523df7c", "name": "Insecure pattern 'direct_innerhtml_assignment' in src/ui/livefab.js:104", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in src/ui/livefab.js:104"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-34e106e791a31fa6", "name": "Insecure pattern 'direct_innerhtml_assignment' in src/ui/util.js:22", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in src/ui/util.js:22"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f2dbbfac40664e00", "name": "Insecure pattern 'direct_innerhtml_assignment' in src/app/shell.js:230", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in src/app/shell.js:230"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2c9be90ae152e285", "name": "Insecure pattern 'direct_innerhtml_assignment' in src/modules/overview.js:48", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in src/modules/overview.js:48"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-549fdf17cf4137b0", "name": "Insecure pattern 'direct_innerhtml_assignment' in src/modules/energy.js:48", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in src/modules/energy.js:48"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-26afc437c7353ae2", "name": "Insecure pattern 'direct_innerhtml_assignment' in src/modules/gas-exhaust.js:99", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in src/modules/gas-exhaust.js:99"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d0b7734cbd2f8ccb", "name": "Insecure pattern 'direct_innerhtml_assignment' in src/modules/upw.js:58", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in src/modules/upw.js:58"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ad42c363ccc3ee1a", "name": "Insecure pattern 'direct_innerhtml_assignment' in src/modules/cleanroom.js:50", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in src/modules/cleanroom.js:50"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-dc93c47ecef5b933", "name": "Insecure pattern 'direct_innerhtml_assignment' in src/modules/masterdata.js:79", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in src/modules/masterdata.js:79"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-923b3301508ff2ef", "name": "Insecure pattern 'direct_innerhtml_assignment' in src/modules/cooling.js:41", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in src/modules/cooling.js:41"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4d2f39d01b5ca3b7", "name": "Insecure pattern 'direct_innerhtml_assignment' in src/modules/production.js:40", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in src/modules/production.js:40"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ac78de68e234e233", "name": "Insecure pattern 'direct_innerhtml_assignment' in src/modules/sustainability.js:45", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in src/modules/sustainability.js:45"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-329ef34827da8c19", "name": "Insecure pattern 'direct_innerhtml_assignment' in src/modules/trends.js:289", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in src/modules/trends.js:289"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6372cebde0220094", "name": "No auth library detected", "shortDescription": {"text": "No auth library detected"}, "fullDescription": {"text": "The scanner did not find any standard auth library (JWT, OAuth, NextAuth, Auth0, etc.). The repo has auth/admin/session surface indicators, so auth may live in custom code, in a separate service, or be missing."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7013afd263b6bbdb", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1d9f4939256a7d20", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ab9d4bd66f96e073", "name": "Very large file: src/i18n.js (1023 lines)", "shortDescription": {"text": "Very large file: src/i18n.js (1023 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ea3b5e389d8c9c0f", "name": "Low test-to-source ratio", "shortDescription": {"text": "Low test-to-source ratio"}, "fullDescription": {"text": "6 tests / 31 src (ratio 0.19)."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-141b30a41e03817b", "name": "No license file detected", "shortDescription": {"text": "No license file detected"}, "fullDescription": {"text": "No LICENSE/COPYING/NOTICE file was found. Generated repositories often omit licensing, which blocks reuse and automated intake."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 61 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-11825279136b53a3", "name": "CI is configured but no tests are detected", "shortDescription": {"text": "CI is configured but no tests are detected"}, "fullDescription": {"text": "A CI pipeline exists, but the scan found no test files to gate. Opus labeled this generated-code pattern as config theater: release machinery exists, but it has little behavioral signal."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b9088664ace7f748", "name": "Composite production-readiness gap", "shortDescription": {"text": "Composite production-readiness gap"}, "fullDescription": {"text": "Multiple low-cost hardening controls are missing together: license, tests. Opus verification showed these co-occurring gaps are a better readiness signal than reading each flag in isolation."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-749d4bc1bd66df5f", "name": "Agent instructions exist but release-hardening basics are missing", "shortDescription": {"text": "Agent instructions exist but release-hardening basics are missing"}, "fullDescription": {"text": "AI-coder instruction files were found, but the repo is missing license, tests. Treat this as a contract gap: the agent is guided, but the generated output is not yet guarded by the controls that make it repeatable."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-7135162f33fe7cf4", "name": "Commented-code block (5 lines) in _upw_test.mjs:164", "shortDescription": {"text": "Commented-code block (5 lines) in _upw_test.mjs:164"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-ed2dbdd7b6124b5d", "name": "Commented-code block (5 lines) in _schematic_test.mjs:234", "shortDescription": {"text": "Commented-code block (5 lines) in _schematic_test.mjs:234"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-6c0e5f0d20db1cc9", "name": "Commented-code block (5 lines) in src/ui/schematic.js:209", "shortDescription": {"text": "Commented-code block (5 lines) in src/ui/schematic.js:209"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-d7c89c49aa0d4401", "name": "Commented-code block (5 lines) in src/ui/ticker.js:42", "shortDescription": {"text": "Commented-code block (5 lines) in src/ui/ticker.js:42"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-9d1e623e8cbe9475", "name": "Commented-code block (5 lines) in src/modules/overview.js:231", "shortDescription": {"text": "Commented-code block (5 lines) in src/modules/overview.js:231"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-25adf85187fa0923", "name": "Commented-code block (5 lines) in src/modules/upw.js:30", "shortDescription": {"text": "Commented-code block (5 lines) in src/modules/upw.js:30"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-128a970405b1d5f0", "name": "Commented-code block (5 lines) in src/modules/cleanroom.js:312", "shortDescription": {"text": "Commented-code block (5 lines) in src/modules/cleanroom.js:312"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-16f07ebfe534488a", "name": "Commented-code block (5 lines) in src/modules/cooling.js:94", "shortDescription": {"text": "Commented-code block (5 lines) in src/modules/cooling.js:94"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-e19e18f66a94d73c", "name": "Commented-code block (5 lines) in src/modules/trends.js:553", "shortDescription": {"text": "Commented-code block (5 lines) in src/modules/trends.js:553"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-67f49e2645ec1017", "name": "Commented-code block (5 lines) in src/engine/load-model.js:19", "shortDescription": {"text": "Commented-code block (5 lines) in src/engine/load-model.js:19"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/18286"}, "properties": {"repository": "robertoshiu/bas-ems", "repoUrl": "https://github.com/robertoshiu/bas-ems", "branch": "main"}, "results": [{"ruleId": "scanner-9710c8d059e53154", "level": "none", "message": {"text": "No frontend routes/components detected"}, "properties": {"repobilityId": "44ca61485762e494", "scanner": "scanner-primary", "fingerprint": "9710c8d059e53154", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-955f97a06f6262f5", "level": "error", "message": {"text": "Insecure pattern 'new_function_used' in _gas_test.mjs:45"}, "properties": {"repobilityId": "a8dc9b1e4b163143", "scanner": "scanner-primary", "fingerprint": "955f97a06f6262f5", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "new_function_used"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "_gas_test.mjs"}, "region": {"startLine": 45}}}]}, {"ruleId": "scanner-ed27d0c3ac8352cb", "level": "error", "message": {"text": "Insecure pattern 'new_function_used' in _upw_test.mjs:62"}, "properties": {"repobilityId": "68282a1a78041374", "scanner": "scanner-primary", "fingerprint": "ed27d0c3ac8352cb", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "new_function_used"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "_upw_test.mjs"}, "region": {"startLine": 62}}}]}, {"ruleId": "scanner-cc7032810755884e", "level": "error", "message": {"text": "Insecure pattern 'new_function_used' in _timeline_test.mjs:4"}, "properties": {"repobilityId": "c96304a8c5e0ec95", "scanner": "scanner-primary", "fingerprint": "cc7032810755884e", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "new_function_used"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "_timeline_test.mjs"}, "region": {"startLine": 4}}}]}, {"ruleId": "scanner-7dd9bd16595ec2e2", "level": "error", "message": {"text": "Insecure pattern 'new_function_used' in _schematic_test.mjs:33"}, "properties": {"repobilityId": "972b3edeec6d414e", "scanner": "scanner-primary", "fingerprint": "7dd9bd16595ec2e2", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "new_function_used"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "_schematic_test.mjs"}, "region": {"startLine": 33}}}]}, {"ruleId": "scanner-f2413952d0c4b692", "level": "error", "message": {"text": "Insecure pattern 'new_function_used' in _upw_measure.mjs:6"}, "properties": {"repobilityId": "f53b40af0e68e94e", "scanner": "scanner-primary", "fingerprint": "f2413952d0c4b692", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "new_function_used"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "_upw_measure.mjs"}, "region": {"startLine": 6}}}]}, {"ruleId": "scanner-96c6b469fb7bd3a2", "level": "error", "message": {"text": "Insecure pattern 'new_function_used' in _selftest.mjs:8"}, "properties": {"repobilityId": "d4a37ff4d820e726", "scanner": "scanner-primary", "fingerprint": "96c6b469fb7bd3a2", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "new_function_used"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "_selftest.mjs"}, "region": {"startLine": 8}}}]}, {"ruleId": "scanner-784fbfd27831ee4a", "level": "error", "message": {"text": "Insecure pattern 'new_function_used' in _trends_test.mjs:12"}, "properties": {"repobilityId": "9d67413cbfc8eafc", "scanner": "scanner-primary", "fingerprint": "784fbfd27831ee4a", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "new_function_used"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "_trends_test.mjs"}, "region": {"startLine": 12}}}]}, {"ruleId": "scanner-3e86a656bbd67df7", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in src/ui/widgets.js:160"}, "properties": {"repobilityId": "ec6ce8aead4cd78b", "scanner": "scanner-primary", "fingerprint": "3e86a656bbd67df7", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/ui/widgets.js"}, "region": {"startLine": 160}}}]}, {"ruleId": "scanner-b36064a62523df7c", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in src/ui/livefab.js:104"}, "properties": {"repobilityId": "a4bc9f07264acfad", "scanner": "scanner-primary", "fingerprint": "b36064a62523df7c", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/ui/livefab.js"}, "region": {"startLine": 104}}}]}, {"ruleId": "scanner-34e106e791a31fa6", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in src/ui/util.js:22"}, "properties": {"repobilityId": "7cacc7d3fbf4fa3e", "scanner": "scanner-primary", "fingerprint": "34e106e791a31fa6", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/ui/util.js"}, "region": {"startLine": 22}}}]}, {"ruleId": "scanner-f2dbbfac40664e00", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in src/app/shell.js:230"}, "properties": {"repobilityId": "0042b798346b9568", "scanner": "scanner-primary", "fingerprint": "f2dbbfac40664e00", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/app/shell.js"}, "region": {"startLine": 230}}}]}, {"ruleId": "scanner-2c9be90ae152e285", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in src/modules/overview.js:48"}, "properties": {"repobilityId": "86f3a448b19e9581", "scanner": "scanner-primary", "fingerprint": "2c9be90ae152e285", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/modules/overview.js"}, "region": {"startLine": 48}}}]}, {"ruleId": "scanner-549fdf17cf4137b0", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in src/modules/energy.js:48"}, "properties": {"repobilityId": "a1adb6ee4cd524c9", "scanner": "scanner-primary", "fingerprint": "549fdf17cf4137b0", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/modules/energy.js"}, "region": {"startLine": 48}}}]}, {"ruleId": "scanner-26afc437c7353ae2", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in src/modules/gas-exhaust.js:99"}, "properties": {"repobilityId": "402e354fce04fd94", "scanner": "scanner-primary", "fingerprint": "26afc437c7353ae2", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/modules/gas-exhaust.js"}, "region": {"startLine": 99}}}]}, {"ruleId": "scanner-d0b7734cbd2f8ccb", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in src/modules/upw.js:58"}, "properties": {"repobilityId": "3f1438889a30981a", "scanner": "scanner-primary", "fingerprint": "d0b7734cbd2f8ccb", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/modules/upw.js"}, "region": {"startLine": 58}}}]}, {"ruleId": "scanner-ad42c363ccc3ee1a", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in src/modules/cleanroom.js:50"}, "properties": {"repobilityId": "bbcfcde8486fbc38", "scanner": "scanner-primary", "fingerprint": "ad42c363ccc3ee1a", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/modules/cleanroom.js"}, "region": {"startLine": 50}}}]}, {"ruleId": "scanner-dc93c47ecef5b933", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in src/modules/masterdata.js:79"}, "properties": {"repobilityId": "f14f074306d44905", "scanner": "scanner-primary", "fingerprint": "dc93c47ecef5b933", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/modules/masterdata.js"}, "region": {"startLine": 79}}}]}, {"ruleId": "scanner-923b3301508ff2ef", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in src/modules/cooling.js:41"}, "properties": {"repobilityId": "4ead955fa0c03d79", "scanner": "scanner-primary", "fingerprint": "923b3301508ff2ef", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/modules/cooling.js"}, "region": {"startLine": 41}}}]}, {"ruleId": "scanner-4d2f39d01b5ca3b7", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in src/modules/production.js:40"}, "properties": {"repobilityId": "40245e6ab3c184bf", "scanner": "scanner-primary", "fingerprint": "4d2f39d01b5ca3b7", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/modules/production.js"}, "region": {"startLine": 40}}}]}, {"ruleId": "scanner-ac78de68e234e233", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in src/modules/sustainability.js:45"}, "properties": {"repobilityId": "27b2c28ab3ca8295", "scanner": "scanner-primary", "fingerprint": "ac78de68e234e233", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/modules/sustainability.js"}, "region": {"startLine": 45}}}]}, {"ruleId": "scanner-329ef34827da8c19", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in src/modules/trends.js:289"}, "properties": {"repobilityId": "1dc1e097cac1a59b", "scanner": "scanner-primary", "fingerprint": "329ef34827da8c19", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/modules/trends.js"}, "region": {"startLine": 289}}}]}, {"ruleId": "scanner-6372cebde0220094", "level": "warning", "message": {"text": "No auth library detected"}, "properties": {"repobilityId": "a5b6035a5bbf8054", "scanner": "scanner-primary", "fingerprint": "6372cebde0220094", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["coverage", "auth"]}}, {"ruleId": "scanner-7013afd263b6bbdb", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "12d8de5a974477d8", "scanner": "scanner-primary", "fingerprint": "7013afd263b6bbdb", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/static.yml"}, "region": {"startLine": 33}}}]}, {"ruleId": "scanner-7013afd263b6bbdb", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "54d505f52c76dc62", "scanner": "scanner-primary", "fingerprint": "7013afd263b6bbdb", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/static.yml"}, "region": {"startLine": 35}}}]}, {"ruleId": "scanner-7013afd263b6bbdb", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "80cb745587f46dff", "scanner": "scanner-primary", "fingerprint": "7013afd263b6bbdb", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/static.yml"}, "region": {"startLine": 41}}}]}, {"ruleId": "scanner-7013afd263b6bbdb", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "2f4fd9926657c54c", "scanner": "scanner-primary", "fingerprint": "7013afd263b6bbdb", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/static.yml"}, "region": {"startLine": 47}}}]}, {"ruleId": "scanner-1d9f4939256a7d20", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "cf2d0c0d4565b1e9", "scanner": "scanner-primary", "fingerprint": "1d9f4939256a7d20", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/static.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ab9d4bd66f96e073", "level": "note", "message": {"text": "Very large file: src/i18n.js (1023 lines)"}, "properties": {"repobilityId": "b08ce07770db3a16", "scanner": "scanner-primary", "fingerprint": "ab9d4bd66f96e073", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-ea3b5e389d8c9c0f", "level": "note", "message": {"text": "Low test-to-source ratio"}, "properties": {"repobilityId": "ef7b2552cc00a375", "scanner": "scanner-primary", "fingerprint": "ea3b5e389d8c9c0f", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["tests"]}}, {"ruleId": "scanner-141b30a41e03817b", "level": "note", "message": {"text": "No license file detected"}, "properties": {"repobilityId": "504c7757cf9ff550", "scanner": "scanner-primary", "fingerprint": "141b30a41e03817b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["license", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "87e37c4f12ba2b33", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-11825279136b53a3", "level": "warning", "message": {"text": "CI is configured but no tests are detected"}, "properties": {"repobilityId": "2c826f180260129b", "scanner": "scanner-primary", "fingerprint": "11825279136b53a3", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["tests", "ci", "config-theater", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-b9088664ace7f748", "level": "note", "message": {"text": "Composite production-readiness gap"}, "properties": {"repobilityId": "957c02d5c9e1e310", "scanner": "scanner-primary", "fingerprint": "b9088664ace7f748", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["production-readiness", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-749d4bc1bd66df5f", "level": "warning", "message": {"text": "Agent instructions exist but release-hardening basics are missing"}, "properties": {"repobilityId": "01d3695556f1f3c7", "scanner": "scanner-primary", "fingerprint": "749d4bc1bd66df5f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "bf0cdc4ff84b072a", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "12ee07e5cda8eecd", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-7135162f33fe7cf4", "level": "none", "message": {"text": "Commented-code block (5 lines) in _upw_test.mjs:164"}, "properties": {"repobilityId": "ce44f5cd4fabbd84", "scanner": "scanner-primary", "fingerprint": "7135162f33fe7cf4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-ed2dbdd7b6124b5d", "level": "none", "message": {"text": "Commented-code block (5 lines) in _schematic_test.mjs:234"}, "properties": {"repobilityId": "aa961035d4289879", "scanner": "scanner-primary", "fingerprint": "ed2dbdd7b6124b5d", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-6c0e5f0d20db1cc9", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/ui/schematic.js:209"}, "properties": {"repobilityId": "e5f7cc300058dc12", "scanner": "scanner-primary", "fingerprint": "6c0e5f0d20db1cc9", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-d7c89c49aa0d4401", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/ui/ticker.js:42"}, "properties": {"repobilityId": "125482aeeb330fbd", "scanner": "scanner-primary", "fingerprint": "d7c89c49aa0d4401", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-9d1e623e8cbe9475", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/modules/overview.js:231"}, "properties": {"repobilityId": "b80ceffe609ee609", "scanner": "scanner-primary", "fingerprint": "9d1e623e8cbe9475", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-25adf85187fa0923", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/modules/upw.js:30"}, "properties": {"repobilityId": "b235bb232599f30b", "scanner": "scanner-primary", "fingerprint": "25adf85187fa0923", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-128a970405b1d5f0", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/modules/cleanroom.js:312"}, "properties": {"repobilityId": "109b624ba1ad87fa", "scanner": "scanner-primary", "fingerprint": "128a970405b1d5f0", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-16f07ebfe534488a", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/modules/cooling.js:94"}, "properties": {"repobilityId": "a9e8781ea002fe94", "scanner": "scanner-primary", "fingerprint": "16f07ebfe534488a", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-e19e18f66a94d73c", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/modules/trends.js:553"}, "properties": {"repobilityId": "b0905700e0aadbb3", "scanner": "scanner-primary", "fingerprint": "e19e18f66a94d73c", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-67f49e2645ec1017", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/engine/load-model.js:19"}, "properties": {"repobilityId": "da6f7caabcb8587d", "scanner": "scanner-primary", "fingerprint": "67f49e2645ec1017", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}]}]}