{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-5c065882e9de4720", "name": "Possibly dead Python function: worker", "shortDescription": {"text": "Possibly dead Python function: worker"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-727042d05782f05a", "name": "Possibly dead Python function: show_msg", "shortDescription": {"text": "Possibly dead Python function: show_msg"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cf048c4383428d53", "name": "Possibly dead Python function: done", "shortDescription": {"text": "Possibly dead Python function: done"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-77d8fe168b5cc027", "name": "Possibly dead Python function: vault_accounts", "shortDescription": {"text": "Possibly dead Python function: vault_accounts"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-32b6a5a37629c241", "name": "Possibly dead Python function: check_password_pwned", "shortDescription": {"text": "Possibly dead Python function: check_password_pwned"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7eed5d9c268890a8", "name": "Possibly dead Python function: sync_report", "shortDescription": {"text": "Possibly dead Python function: sync_report"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-753dc976b6971740", "name": "Possibly dead Python function: passkey_advice", "shortDescription": {"text": "Possibly dead Python function: passkey_advice"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ed405a1e11f782da", "name": "Possibly dead Python function: bitwarden_status", "shortDescription": {"text": "Possibly dead Python function: bitwarden_status"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-61c3f0af76b37130", "name": "Possibly dead Python function: done", "shortDescription": {"text": "Possibly dead Python function: done"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1242bb51ebb7a3ee", "name": "Possibly dead Python function: worker", "shortDescription": {"text": "Possibly dead Python function: worker"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-367e601ba817f13b", "name": "Possibly dead Python function: show_msg", "shortDescription": {"text": "Possibly dead Python function: show_msg"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-68cc86b046531f5b", "name": "Possibly dead Python function: work", "shortDescription": {"text": "Possibly dead Python function: work"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3fd68dedb08e99a1", "name": "Possibly dead Python function: gather", "shortDescription": {"text": "Possibly dead Python function: gather"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9bff52c4b29e252d", "name": "Privileged port 993 in use", "shortDescription": {"text": "Privileged port 993 in use"}, "fullDescription": {"text": "Port 993 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1afe2b86411d9681", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "softprops/action-gh-release@v2 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3be9df5c2de66493", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-cbe9b0d5cac66a90", "name": "Very large file: rphe/gui.py (1286 lines)", "shortDescription": {"text": "Very large file: rphe/gui.py (1286 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-141b30a41e03817b", "name": "No license file detected", "shortDescription": {"text": "No license file detected"}, "fullDescription": {"text": "No LICENSE/COPYING/NOTICE file was found. Generated repositories often omit licensing, which blocks reuse and automated intake."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 10 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f4acef31a75e0535", "name": "Network/subprocess call without timeout or try/except \u2014 packaging/make_icon.py:93", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 packaging/make_icon.py:93"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3ccd8dcd4383b054", "name": "Network/subprocess call without timeout or try/except \u2014 rphe/schedule.py:73", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 rphe/schedule.py:73"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0027e313ade46c8f", "name": "Near-duplicate function bodies in 7 places", "shortDescription": {"text": "Near-duplicate function bodies in 7 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nrphe/gui.py:done, rphe/gui.py:done, rphe/gui.py:done, rphe/gui.py:done\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/24237"}, "properties": {"repository": "Antman1526/RPHE", "repoUrl": "https://github.com/Antman1526/RPHE", "branch": "main"}, "results": [{"ruleId": "scanner-5c065882e9de4720", "level": "note", "message": {"text": "Possibly dead Python function: worker"}, "properties": {"repobilityId": "fbe2b50200068803", "scanner": "scanner-primary", "fingerprint": "5c065882e9de4720", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "rphe/gui_setup.py:83"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-727042d05782f05a", "level": "note", "message": {"text": "Possibly dead Python function: show_msg"}, "properties": {"repobilityId": "86fb4271f3f618c3", "scanner": "scanner-primary", "fingerprint": "727042d05782f05a", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "rphe/gui_setup.py:253"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-cf048c4383428d53", "level": "note", "message": {"text": "Possibly dead Python function: done"}, "properties": {"repobilityId": "b1718ccb36b0609a", "scanner": "scanner-primary", "fingerprint": "cf048c4383428d53", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "rphe/gui_setup.py:285"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-77d8fe168b5cc027", "level": "note", "message": {"text": "Possibly dead Python function: vault_accounts"}, "properties": {"repobilityId": "ab8e1fe7cc71d4dc", "scanner": "scanner-primary", "fingerprint": "77d8fe168b5cc027", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "rphe/engine.py:105"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-32b6a5a37629c241", "level": "note", "message": {"text": "Possibly dead Python function: check_password_pwned"}, "properties": {"repobilityId": "8730fdf6a4384a7b", "scanner": "scanner-primary", "fingerprint": "32b6a5a37629c241", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "rphe/engine.py:109"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-7eed5d9c268890a8", "level": "note", "message": {"text": "Possibly dead Python function: sync_report"}, "properties": {"repobilityId": "ccbeb8e9d5c38f43", "scanner": "scanner-primary", "fingerprint": "7eed5d9c268890a8", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "rphe/engine.py:246"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-753dc976b6971740", "level": "note", "message": {"text": "Possibly dead Python function: passkey_advice"}, "properties": {"repobilityId": "d83a25e5a6d73c8c", "scanner": "scanner-primary", "fingerprint": "753dc976b6971740", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "rphe/engine.py:250"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ed405a1e11f782da", "level": "note", "message": {"text": "Possibly dead Python function: bitwarden_status"}, "properties": {"repobilityId": "042acc02d8033ec7", "scanner": "scanner-primary", "fingerprint": "ed405a1e11f782da", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "rphe/engine.py:267"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-61c3f0af76b37130", "level": "note", "message": {"text": "Possibly dead Python function: done"}, "properties": {"repobilityId": "b1718ccb36b0609a", "scanner": "scanner-primary", "fingerprint": "61c3f0af76b37130", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "rphe/gui.py:981"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-1242bb51ebb7a3ee", "level": "note", "message": {"text": "Possibly dead Python function: worker"}, "properties": {"repobilityId": "fbe2b50200068803", "scanner": "scanner-primary", "fingerprint": "1242bb51ebb7a3ee", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "rphe/gui.py:1265"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-367e601ba817f13b", "level": "note", "message": {"text": "Possibly dead Python function: show_msg"}, "properties": {"repobilityId": "86fb4271f3f618c3", "scanner": "scanner-primary", "fingerprint": "367e601ba817f13b", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "rphe/gui.py:827"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-68cc86b046531f5b", "level": "note", "message": {"text": "Possibly dead Python function: work"}, "properties": {"repobilityId": "c5b0e9acf413d08f", "scanner": "scanner-primary", "fingerprint": "68cc86b046531f5b", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "rphe/gui.py:974"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3fd68dedb08e99a1", "level": "note", "message": {"text": "Possibly dead Python function: gather"}, "properties": {"repobilityId": "907815e53ffddf89", "scanner": "scanner-primary", "fingerprint": "3fd68dedb08e99a1", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "rphe/gui.py:992"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-9bff52c4b29e252d", "level": "warning", "message": {"text": "Privileged port 993 in use"}, "properties": {"repobilityId": "a36e56a26353e9ee", "scanner": "scanner-primary", "fingerprint": "9bff52c4b29e252d", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "rphe/gui_setup.py"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-1afe2b86411d9681", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "b700817c8ada4d7b", "scanner": "scanner-primary", "fingerprint": "1afe2b86411d9681", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/build-installers.yml"}, "region": {"startLine": 63}}}]}, {"ruleId": "scanner-1afe2b86411d9681", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "b700817c8ada4d7b", "scanner": "scanner-primary", "fingerprint": "1afe2b86411d9681", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/build-installers.yml"}, "region": {"startLine": 96}}}]}, {"ruleId": "scanner-3be9df5c2de66493", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "683c583b86a6fc24", "scanner": "scanner-primary", "fingerprint": "3be9df5c2de66493", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/build-installers.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-cbe9b0d5cac66a90", "level": "note", "message": {"text": "Very large file: rphe/gui.py (1286 lines)"}, "properties": {"repobilityId": "3ae158d8b1041b1b", "scanner": "scanner-primary", "fingerprint": "cbe9b0d5cac66a90", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-141b30a41e03817b", "level": "note", "message": {"text": "No license file detected"}, "properties": {"repobilityId": "471a1e98fa889c39", "scanner": "scanner-primary", "fingerprint": "141b30a41e03817b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["license", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "5776f0f352039cde", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "f7c11ed034594b57", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-f4acef31a75e0535", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 packaging/make_icon.py:93"}, "properties": {"repobilityId": "f11a99668240ef99", "scanner": "scanner-primary", "fingerprint": "f4acef31a75e0535", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-3ccd8dcd4383b054", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 rphe/schedule.py:73"}, "properties": {"repobilityId": "72f8985eb63f44ba", "scanner": "scanner-primary", "fingerprint": "3ccd8dcd4383b054", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-0027e313ade46c8f", "level": "note", "message": {"text": "Near-duplicate function bodies in 7 places"}, "properties": {"repobilityId": "bc77cc69824d7081", "scanner": "scanner-primary", "fingerprint": "0027e313ade46c8f", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-0027e313ade46c8f", "level": "note", "message": {"text": "Near-duplicate function bodies in 7 places"}, "properties": {"repobilityId": "572eac83f75b2875", "scanner": "scanner-primary", "fingerprint": "0027e313ade46c8f", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}]}]}