{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-169d2b9bb9205fe8", "name": "`truncate` class without `title=` for hover reveal \u2014 resources/js/components/app-logo.tsx:10", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 resources/js/components/app-logo.tsx:10"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-18020345fa7378ce", "name": "`truncate` class without `title=` for hover reveal \u2014 resources/js/components/user-info.tsx:23", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 resources/js/components/user-info.tsx:23"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-cd8c6f2b7304925e", "name": "`truncate` class without `title=` for hover reveal \u2014 resources/js/components/compliance/denuncia-form.tsx:398", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 resources/js/components/compliance/denuncia-form.tsx:398"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-1426845d96e6511c", "name": "`truncate` class without `title=` for hover reveal \u2014 resources/js/pages/admin/vehicle-versions/form.tsx:1015", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 resources/js/pages/admin/vehicle-versions/form.tsx:1015"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-07f039d2aa4cee03", "name": "`truncate` class without `title=` for hover reveal \u2014 resources/js/pages/admin/vehicle-models/form.tsx:560", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 resources/js/pages/admin/vehicle-models/form.tsx:560"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-561e0f5c3c95d176", "name": "`dangerouslySetInnerHTML` used in a React component \u2014 resources/js/pages/noticias/show.tsx:155", "shortDescription": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 resources/js/pages/noticias/show.tsx:155"}, "fullDescription": {"text": "Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library.\n\nWhy: OWASP basics. Already partially flagged by the security analyzer.\nRule id: fq.dangerous-html"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-138f642c2ab75b5a", "name": "`truncate` class without `title=` for hover reveal \u2014 resources/js/pages/seminuevos/compare.tsx:532", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 resources/js/pages/seminuevos/compare.tsx:532"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-34bc97d5a03bf072", "name": "Insecure pattern 'dangerous_innerhtml' in resources/js/pages/noticias/show.tsx:155", "shortDescription": {"text": "Insecure pattern 'dangerous_innerhtml' in resources/js/pages/noticias/show.tsx:155"}, "fullDescription": {"text": "Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1a50467f36b413ec", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-534fa55f278ac0c4", "name": "Very large file: resources/js/pages/kinto.tsx (948 lines)", "shortDescription": {"text": "Very large file: resources/js/pages/kinto.tsx (948 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-13786473c1fd9df9", "name": "Very large file: resources/js/pages/nuevos/show.tsx (1392 lines)", "shortDescription": {"text": "Very large file: resources/js/pages/nuevos/show.tsx (1392 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-aa6caa8e606978f6", "name": "Very large file: resources/js/pages/admin/vehicle-versions/form.tsx (1074 lines)", "shortDescription": {"text": "Very large file: resources/js/pages/admin/vehicle-versions/form.tsx (1074 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1d60d4cfcf6e7df3", "name": "Very large file: resources/js/pages/admin/vehicle-models/form.tsx (1109 lines)", "shortDescription": {"text": "Very large file: resources/js/pages/admin/vehicle-models/form.tsx (1109 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a06906296e7aa2c6", "name": "Very large file: resources/js/pages/post-venta/agendar-mantencion.tsx (809 lines)", "shortDescription": {"text": "Very large file: resources/js/pages/post-venta/agendar-mantencion.tsx (809 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6893a6c8b0861585", "name": "Very low test-to-source ratio", "shortDescription": {"text": "Very low test-to-source ratio"}, "fullDescription": {"text": "0 test file(s) for 232 source file(s) (ratio 0.00). Consider adding integration or unit tests for critical paths."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-141b30a41e03817b", "name": "No license file detected", "shortDescription": {"text": "No license file detected"}, "fullDescription": {"text": "No LICENSE/COPYING/NOTICE file was found. Generated repositories often omit licensing, which blocks reuse and automated intake."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-faccb9061e9b52a0", "name": "No README detected", "shortDescription": {"text": "No README detected"}, "fullDescription": {"text": "No README file was found. Generated repos without README context are hard to operate, validate, or safely hand off."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-72b2a6250083a784", "name": "Placeholder or mock-heavy implementation detected", "shortDescription": {"text": "Placeholder or mock-heavy implementation detected"}, "fullDescription": {"text": "Found 301 placeholder/mock markers across 64 source files. This often means the repo looks complete while core flows still use generated scaffolding or fake data."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-11825279136b53a3", "name": "CI is configured but no tests are detected", "shortDescription": {"text": "CI is configured but no tests are detected"}, "fullDescription": {"text": "A CI pipeline exists, but the scan found no test files to gate. Opus labeled this generated-code pattern as config theater: release machinery exists, but it has little behavioral signal."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b9088664ace7f748", "name": "Composite production-readiness gap", "shortDescription": {"text": "Composite production-readiness gap"}, "fullDescription": {"text": "Multiple low-cost hardening controls are missing together: license, tests, operator-readme. Opus verification showed these co-occurring gaps are a better readiness signal than reading each flag in isolation."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-749d4bc1bd66df5f", "name": "Agent instructions exist but release-hardening basics are missing", "shortDescription": {"text": "Agent instructions exist but release-hardening basics are missing"}, "fullDescription": {"text": "AI-coder instruction files were found, but the repo is missing license, tests, operator-readme. Treat this as a contract gap: the agent is guided, but the generated output is not yet guarded by the controls that make it repeatable."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-17a6d73621ee96f8", "name": "Agent instruction/config may expose a secret: .claude/settings.json", "shortDescription": {"text": "Agent instruction/config may expose a secret: .claude/settings.json"}, "fullDescription": {"text": "Agent-facing files are routinely pasted into LLM/tool contexts. Move literal tokens, keys, and passwords into a secret manager or document them as placeholders only."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-122f91b7f2906dc4", "name": "Agent authority lacks a verifier contract: .claude/settings.json", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/settings.json"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ef5deef47ee763a0", "name": "Commented-code block (5 lines) in resources/js/components/ui/lazy-image.tsx:43", "shortDescription": {"text": "Commented-code block (5 lines) in resources/js/components/ui/lazy-image.tsx:43"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-026498ae8dcea1af", "name": "Commented-code block (8 lines) in resources/js/lib/image-upload.ts:33", "shortDescription": {"text": "Commented-code block (8 lines) in resources/js/lib/image-upload.ts:33"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-3630402fda5db7ff", "name": "`fetch()` without try/.catch or AbortSignal \u2014 resources/js/lib/video-upload.ts:34", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 resources/js/lib/video-upload.ts:34"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d969d30964c6fd5d", "name": "Commented-code block (6 lines) in resources/js/pages/nuevos/show.tsx:874", "shortDescription": {"text": "Commented-code block (6 lines) in resources/js/pages/nuevos/show.tsx:874"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-f044be576a857365", "name": "Legacy-named symbol `ownsOld` in resources/js/pages/admin/home/section-about.tsx:82", "shortDescription": {"text": "Legacy-named symbol `ownsOld` in resources/js/pages/admin/home/section-about.tsx:82"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9558d0c9ddafff49", "name": "Commented-code block (5 lines) in resources/js/pages/admin/vehicle-versions/bulk-import.tsx:66", "shortDescription": {"text": "Commented-code block (5 lines) in resources/js/pages/admin/vehicle-versions/bulk-import.tsx:66"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-dea41c8e76e8cd31", "name": "Commented-code block (7 lines) in resources/js/pages/admin/paginas/_section.tsx:325", "shortDescription": {"text": "Commented-code block (7 lines) in resources/js/pages/admin/paginas/_section.tsx:325"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-d1d157b5b5851d78", "name": "Commented-code block (6 lines) in resources/js/pages/admin/vehicle-models/form.tsx:269", "shortDescription": {"text": "Commented-code block (6 lines) in resources/js/pages/admin/vehicle-models/form.tsx:269"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-cc40aaf627fbfc8c", "name": "Commented-code block (6 lines) in resources/js/pages/post-venta/agendar-mantencion.tsx:137", "shortDescription": {"text": "Commented-code block (6 lines) in resources/js/pages/post-venta/agendar-mantencion.tsx:137"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-ab5977cdfbc9d8c2", "name": "`fetch()` without try/.catch or AbortSignal \u2014 resources/js/hooks/use-two-factor-auth.ts:22", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 resources/js/hooks/use-two-factor-auth.ts:22"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-91134516fbc9a437", "name": "Dangling fetch: POST /admin/upload-image (resources/js/lib/image-upload.ts:55)", "shortDescription": {"text": "Dangling fetch: POST /admin/upload-image (resources/js/lib/image-upload.ts:55)"}, "fullDescription": {"text": "`resources/js/lib/image-upload.ts:55` calls `POST /admin/upload-image` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/admin/upload-image`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-0602fabb339db490", "name": "Dangling fetch: POST /admin/upload-video (resources/js/lib/video-upload.ts:34)", "shortDescription": {"text": "Dangling fetch: POST /admin/upload-video (resources/js/lib/video-upload.ts:34)"}, "fullDescription": {"text": "`resources/js/lib/video-upload.ts:34` calls `POST /admin/upload-video` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/admin/upload-video`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-38a9521b29471dbf", "name": "Dangling fetch: POST /admin/vehicle-versions/bulk-import/preview (resources/js/pages/admin/vehicle-versions/bulk-import.", "shortDescription": {"text": "Dangling fetch: POST /admin/vehicle-versions/bulk-import/preview (resources/js/pages/admin/vehicle-versions/bulk-import.tsx:82)"}, "fullDescription": {"text": "`resources/js/pages/admin/vehicle-versions/bulk-import.tsx:82` calls `POST /admin/vehicle-versions/bulk-import/preview` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/admin/vehicle-versions/bulk-import/preview`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-1d213d98b756f375", "name": "Dangling fetch: POST /admin/vehicle-versions/${version!.id}/media (resources/js/pages/admin/vehicle-versions/form.tsx:30", "shortDescription": {"text": "Dangling fetch: POST /admin/vehicle-versions/${version!.id}/media (resources/js/pages/admin/vehicle-versions/form.tsx:304)"}, "fullDescription": {"text": "`resources/js/pages/admin/vehicle-versions/form.tsx:304` calls `POST /admin/vehicle-versions/${version!.id}/media` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/admin/vehicle-versions/<p>/media`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-392aa70ef1d3cf0c", "name": "Unused endpoint: POST /admin/logout", "shortDescription": {"text": "Unused endpoint: POST /admin/logout"}, "fullDescription": {"text": "`resources/js/components/admin/admin-sidebar.tsx` declares `POST /admin/logout` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b1057813136fa4ae", "name": "Unused endpoint: POST /admin/cross-reference/import", "shortDescription": {"text": "Unused endpoint: POST /admin/cross-reference/import"}, "fullDescription": {"text": "`resources/js/components/admin/cross-reference-sync.tsx` declares `POST /admin/cross-reference/import` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d49ea95c239a1ec8", "name": "Unused endpoint: POST /kinto/solicitud", "shortDescription": {"text": "Unused endpoint: POST /kinto/solicitud"}, "fullDescription": {"text": "`resources/js/pages/kinto.tsx` declares `POST /kinto/solicitud` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-bbebe144b5d38e25", "name": "Unused endpoint: POST /cotizaciones/vehiculo", "shortDescription": {"text": "Unused endpoint: POST /cotizaciones/vehiculo"}, "fullDescription": {"text": "`resources/js/pages/nuevos/cotizar.tsx` declares `POST /cotizaciones/vehiculo` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fe6794834c095ea9", "name": "Unused endpoint: GET /compliance/seguimiento", "shortDescription": {"text": "Unused endpoint: GET /compliance/seguimiento"}, "fullDescription": {"text": "`resources/js/pages/compliance/seguimiento.tsx` declares `GET /compliance/seguimiento` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a411798705f09d04", "name": "Unused endpoint: GET /admin/cotizaciones-vehiculos", "shortDescription": {"text": "Unused endpoint: GET /admin/cotizaciones-vehiculos"}, "fullDescription": {"text": "`resources/js/pages/admin/cotizaciones-vehiculos/index.tsx` declares `GET /admin/cotizaciones-vehiculos` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f6936d77488590a5", "name": "Unused endpoint: POST /admin/brands", "shortDescription": {"text": "Unused endpoint: POST /admin/brands"}, "fullDescription": {"text": "`resources/js/pages/admin/brands/form.tsx` declares `POST /admin/brands` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7bf107b49536c07f", "name": "Unused endpoint: GET /admin/compliance/denuncias", "shortDescription": {"text": "Unused endpoint: GET /admin/compliance/denuncias"}, "fullDescription": {"text": "`resources/js/pages/admin/compliance/index.tsx` declares `GET /admin/compliance/denuncias` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4a35f9bd96205db4", "name": "Unused endpoint: POST /admin/home/footer", "shortDescription": {"text": "Unused endpoint: POST /admin/home/footer"}, "fullDescription": {"text": "`resources/js/pages/admin/home/section-footer.tsx` declares `POST /admin/home/footer` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c3a271c5e8cce7a0", "name": "Unused endpoint: POST /admin/home/shorts", "shortDescription": {"text": "Unused endpoint: POST /admin/home/shorts"}, "fullDescription": {"text": "`resources/js/pages/admin/home/section-shorts.tsx` declares `POST /admin/home/shorts` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-aedac3d35ca7756a", "name": "Unused endpoint: POST /admin/home/features", "shortDescription": {"text": "Unused endpoint: POST /admin/home/features"}, "fullDescription": {"text": "`resources/js/pages/admin/home/section-features.tsx` declares `POST /admin/home/features` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-235918e9d7aab01a", "name": "Unused endpoint: POST /admin/home/seminuevos", "shortDescription": {"text": "Unused endpoint: POST /admin/home/seminuevos"}, "fullDescription": {"text": "`resources/js/pages/admin/home/section-seminuevos.tsx` declares `POST /admin/home/seminuevos` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b031a26e78b8e59a", "name": "Unused endpoint: POST /admin/home/programas", "shortDescription": {"text": "Unused endpoint: POST /admin/home/programas"}, "fullDescription": {"text": "`resources/js/pages/admin/home/section-programas.tsx` declares `POST /admin/home/programas` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-de5cce1f9ebcfdc2", "name": "Unused endpoint: POST /admin/home/hero", "shortDescription": {"text": "Unused endpoint: POST /admin/home/hero"}, "fullDescription": {"text": "`resources/js/pages/admin/home/section-hero.tsx` declares `POST /admin/home/hero` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-58de979030adc390", "name": "Unused endpoint: POST /admin/noticias", "shortDescription": {"text": "Unused endpoint: POST /admin/noticias"}, "fullDescription": {"text": "`resources/js/pages/admin/noticias/form.tsx` declares `POST /admin/noticias` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1d742d2f15bd1421", "name": "Unused endpoint: POST /admin/vehicle-versions/bulk-import", "shortDescription": {"text": "Unused endpoint: POST /admin/vehicle-versions/bulk-import"}, "fullDescription": {"text": "`resources/js/pages/admin/vehicle-versions/bulk-import.tsx` declares `POST /admin/vehicle-versions/bulk-import` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e08c716d0d7a5978", "name": "Unused endpoint: GET /admin/vehicle-versions", "shortDescription": {"text": "Unused endpoint: GET /admin/vehicle-versions"}, "fullDescription": {"text": "`resources/js/pages/admin/vehicle-versions/index.tsx` declares `GET /admin/vehicle-versions` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-dee9280d014c9867", "name": "Unused endpoint: POST /admin/repuestos", "shortDescription": {"text": "Unused endpoint: POST /admin/repuestos"}, "fullDescription": {"text": "`resources/js/pages/admin/repuestos/form.tsx` declares `POST /admin/repuestos` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8188a65aed794678", "name": "Unused endpoint: POST /admin/mantenimiento", "shortDescription": {"text": "Unused endpoint: POST /admin/mantenimiento"}, "fullDescription": {"text": "`resources/js/pages/admin/maintenance/index.tsx` declares `POST /admin/mantenimiento` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c6ed5d48297f2aba", "name": "Unused endpoint: POST /admin/accesorios", "shortDescription": {"text": "Unused endpoint: POST /admin/accesorios"}, "fullDescription": {"text": "`resources/js/pages/admin/accesorios/form.tsx` declares `POST /admin/accesorios` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e24e03c1aa393154", "name": "Unused endpoint: POST /admin/branches", "shortDescription": {"text": "Unused endpoint: POST /admin/branches"}, "fullDescription": {"text": "`resources/js/pages/admin/branches/form.tsx` declares `POST /admin/branches` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a268d43e11f00edc", "name": "Unused endpoint: POST /admin/merch", "shortDescription": {"text": "Unused endpoint: POST /admin/merch"}, "fullDescription": {"text": "`resources/js/pages/admin/merch/form.tsx` declares `POST /admin/merch` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b2d9697643289a1a", "name": "Unused endpoint: POST /admin/formulario-mantencion/services", "shortDescription": {"text": "Unused endpoint: POST /admin/formulario-mantencion/services"}, "fullDescription": {"text": "`resources/js/pages/admin/formulario-mantencion/index.tsx` declares `POST /admin/formulario-mantencion/services` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b71022d45ea07322", "name": "Unused endpoint: POST /admin/formulario-mantencion/vehicle-models", "shortDescription": {"text": "Unused endpoint: POST /admin/formulario-mantencion/vehicle-models"}, "fullDescription": {"text": "`resources/js/pages/admin/formulario-mantencion/index.tsx` declares `POST /admin/formulario-mantencion/vehicle-models` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5be9b0fee01e2386", "name": "Unused endpoint: POST /admin/features", "shortDescription": {"text": "Unused endpoint: POST /admin/features"}, "fullDescription": {"text": "`resources/js/pages/admin/features/form.tsx` declares `POST /admin/features` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7a4f3460932ea8ea", "name": "Unused endpoint: POST /post-venta/agendar-mantencion", "shortDescription": {"text": "Unused endpoint: POST /post-venta/agendar-mantencion"}, "fullDescription": {"text": "`resources/js/pages/post-venta/agendar-mantencion.tsx` declares `POST /post-venta/agendar-mantencion` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-52a25d37c50a21cd", "name": "Unused endpoint: POST /post-venta/repuestos/encargo", "shortDescription": {"text": "Unused endpoint: POST /post-venta/repuestos/encargo"}, "fullDescription": {"text": "`resources/js/pages/post-venta/repuestos.tsx` declares `POST /post-venta/repuestos/encargo` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/23279"}, "properties": {"repository": "YohanRVVNexbu/camalmusalem", "repoUrl": "https://github.com/YohanRVVNexbu/camalmusalem", "branch": "main"}, "results": [{"ruleId": "scanner-169d2b9bb9205fe8", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 resources/js/components/app-logo.tsx:10"}, "properties": {"repobilityId": "26b37aa66d681c8d", "scanner": "scanner-primary", "fingerprint": "169d2b9bb9205fe8", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-18020345fa7378ce", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 resources/js/components/user-info.tsx:23"}, "properties": {"repobilityId": "f21bd2bff6a22fa9", "scanner": "scanner-primary", "fingerprint": "18020345fa7378ce", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-cd8c6f2b7304925e", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 resources/js/components/compliance/denuncia-form.tsx:398"}, "properties": {"repobilityId": "99d4d23d68fc1c15", "scanner": "scanner-primary", "fingerprint": "cd8c6f2b7304925e", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-1426845d96e6511c", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 resources/js/pages/admin/vehicle-versions/form.tsx:1015"}, "properties": {"repobilityId": "892972cb36325ce2", "scanner": "scanner-primary", "fingerprint": "1426845d96e6511c", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-07f039d2aa4cee03", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 resources/js/pages/admin/vehicle-models/form.tsx:560"}, "properties": {"repobilityId": "e93a984118c3a12a", "scanner": "scanner-primary", "fingerprint": "07f039d2aa4cee03", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-561e0f5c3c95d176", "level": "warning", "message": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 resources/js/pages/noticias/show.tsx:155"}, "properties": {"repobilityId": "e8f114de91f615f6", "scanner": "scanner-primary", "fingerprint": "561e0f5c3c95d176", "layer": "frontend", "severity": "medium", "confidence": 1.0, "tags": ["frontend-quality", "fq.dangerous-html"]}}, {"ruleId": "scanner-138f642c2ab75b5a", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 resources/js/pages/seminuevos/compare.tsx:532"}, "properties": {"repobilityId": "9d60a8725ac9781a", "scanner": "scanner-primary", "fingerprint": "138f642c2ab75b5a", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-34bc97d5a03bf072", "level": "warning", "message": {"text": "Insecure pattern 'dangerous_innerhtml' in resources/js/pages/noticias/show.tsx:155"}, "properties": {"repobilityId": "0c3c169f417416d8", "scanner": "scanner-primary", "fingerprint": "34bc97d5a03bf072", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "dangerous_innerhtml"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "resources/js/pages/noticias/show.tsx"}, "region": {"startLine": 155}}}]}, {"ruleId": "scanner-1a50467f36b413ec", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "0012dcb61ebb9413", "scanner": "scanner-primary", "fingerprint": "1a50467f36b413ec", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/tests.yml"}, "region": {"startLine": 26}}}]}, {"ruleId": "scanner-1a50467f36b413ec", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "bea9864abc705eec", "scanner": "scanner-primary", "fingerprint": "1a50467f36b413ec", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/tests.yml"}, "region": {"startLine": 29}}}]}, {"ruleId": "scanner-1a50467f36b413ec", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "fc166fcb4bb93c1b", "scanner": "scanner-primary", "fingerprint": "1a50467f36b413ec", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/tests.yml"}, "region": {"startLine": 36}}}]}, {"ruleId": "scanner-534fa55f278ac0c4", "level": "note", "message": {"text": "Very large file: resources/js/pages/kinto.tsx (948 lines)"}, "properties": {"repobilityId": "78e176b17a56b5ee", "scanner": "scanner-primary", "fingerprint": "534fa55f278ac0c4", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-13786473c1fd9df9", "level": "note", "message": {"text": "Very large file: resources/js/pages/nuevos/show.tsx (1392 lines)"}, "properties": {"repobilityId": "dff71e8b79b168fb", "scanner": "scanner-primary", "fingerprint": "13786473c1fd9df9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-aa6caa8e606978f6", "level": "note", "message": {"text": "Very large file: resources/js/pages/admin/vehicle-versions/form.tsx (1074 lines)"}, "properties": {"repobilityId": "fe8138e097ceed3f", "scanner": "scanner-primary", "fingerprint": "aa6caa8e606978f6", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-1d60d4cfcf6e7df3", "level": "note", "message": {"text": "Very large file: resources/js/pages/admin/vehicle-models/form.tsx (1109 lines)"}, "properties": {"repobilityId": "ed83bdfa69d85f72", "scanner": "scanner-primary", "fingerprint": "1d60d4cfcf6e7df3", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-a06906296e7aa2c6", "level": "note", "message": {"text": "Very large file: resources/js/pages/post-venta/agendar-mantencion.tsx (809 lines)"}, "properties": {"repobilityId": "92f7bf06f8ca817b", "scanner": "scanner-primary", "fingerprint": "a06906296e7aa2c6", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-6893a6c8b0861585", "level": "warning", "message": {"text": "Very low test-to-source ratio"}, "properties": {"repobilityId": "54a7de3f06314bf0", "scanner": "scanner-primary", "fingerprint": "6893a6c8b0861585", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["tests", "coverage"]}}, {"ruleId": "scanner-141b30a41e03817b", "level": "note", "message": {"text": "No license file detected"}, "properties": {"repobilityId": "cc26a669db8a5fa0", "scanner": "scanner-primary", "fingerprint": "141b30a41e03817b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["license", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-faccb9061e9b52a0", "level": "note", "message": {"text": "No README detected"}, "properties": {"repobilityId": "99280bb354496df6", "scanner": "scanner-primary", "fingerprint": "faccb9061e9b52a0", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["docs", "readme", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-72b2a6250083a784", "level": "warning", "message": {"text": "Placeholder or mock-heavy implementation detected"}, "properties": {"repobilityId": "0a502c389f8dd094", "scanner": "scanner-primary", "fingerprint": "72b2a6250083a784", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "incomplete", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "9d16fe626717cd3e", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-11825279136b53a3", "level": "warning", "message": {"text": "CI is configured but no tests are detected"}, "properties": {"repobilityId": "ebf4ffad4cd40877", "scanner": "scanner-primary", "fingerprint": "11825279136b53a3", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["tests", "ci", "config-theater", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-b9088664ace7f748", "level": "warning", "message": {"text": "Composite production-readiness gap"}, "properties": {"repobilityId": "d5c527406f75fa70", "scanner": "scanner-primary", "fingerprint": "b9088664ace7f748", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["production-readiness", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-749d4bc1bd66df5f", "level": "warning", "message": {"text": "Agent instructions exist but release-hardening basics are missing"}, "properties": {"repobilityId": "870fdae20e298e0a", "scanner": "scanner-primary", "fingerprint": "749d4bc1bd66df5f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "b45eb94ce2aad1cf", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "d81767910030a0bf", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-17a6d73621ee96f8", "level": "error", "message": {"text": "Agent instruction/config may expose a secret: .claude/settings.json"}, "properties": {"repobilityId": "1464265ec8f68102", "scanner": "scanner-primary", "fingerprint": "17a6d73621ee96f8", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["agent-instructions", "secrets", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/settings.json"}, "region": {"startLine": 82}}}]}, {"ruleId": "scanner-122f91b7f2906dc4", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/settings.json"}, "properties": {"repobilityId": "a2967269048b6a9d", "scanner": "scanner-primary", "fingerprint": "122f91b7f2906dc4", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/settings.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ef5deef47ee763a0", "level": "none", "message": {"text": "Commented-code block (5 lines) in resources/js/components/ui/lazy-image.tsx:43"}, "properties": {"repobilityId": "c0b4a190e94cb67f", "scanner": "scanner-primary", "fingerprint": "ef5deef47ee763a0", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-026498ae8dcea1af", "level": "none", "message": {"text": "Commented-code block (8 lines) in resources/js/lib/image-upload.ts:33"}, "properties": {"repobilityId": "a475b78c7e8cac81", "scanner": "scanner-primary", "fingerprint": "026498ae8dcea1af", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-3630402fda5db7ff", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 resources/js/lib/video-upload.ts:34"}, "properties": {"repobilityId": "7e5691f4f34b79c4", "scanner": "scanner-primary", "fingerprint": "3630402fda5db7ff", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-d969d30964c6fd5d", "level": "none", "message": {"text": "Commented-code block (6 lines) in resources/js/pages/nuevos/show.tsx:874"}, "properties": {"repobilityId": "f45ebcd1ff1403d0", "scanner": "scanner-primary", "fingerprint": "d969d30964c6fd5d", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-f044be576a857365", "level": "note", "message": {"text": "Legacy-named symbol `ownsOld` in resources/js/pages/admin/home/section-about.tsx:82"}, "properties": {"repobilityId": "0162cdfe4cd706e5", "scanner": "scanner-primary", "fingerprint": "f044be576a857365", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-9558d0c9ddafff49", "level": "none", "message": {"text": "Commented-code block (5 lines) in resources/js/pages/admin/vehicle-versions/bulk-import.tsx:66"}, "properties": {"repobilityId": "cc6c93fcfe095aff", "scanner": "scanner-primary", "fingerprint": "9558d0c9ddafff49", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-dea41c8e76e8cd31", "level": "none", "message": {"text": "Commented-code block (7 lines) in resources/js/pages/admin/paginas/_section.tsx:325"}, "properties": {"repobilityId": "dab07e76e15916e5", "scanner": "scanner-primary", "fingerprint": "dea41c8e76e8cd31", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-d1d157b5b5851d78", "level": "none", "message": {"text": "Commented-code block (6 lines) in resources/js/pages/admin/vehicle-models/form.tsx:269"}, "properties": {"repobilityId": "f80764df81122524", "scanner": "scanner-primary", "fingerprint": "d1d157b5b5851d78", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-cc40aaf627fbfc8c", "level": "none", "message": {"text": "Commented-code block (6 lines) in resources/js/pages/post-venta/agendar-mantencion.tsx:137"}, "properties": {"repobilityId": "cda6573aab8562f6", "scanner": "scanner-primary", "fingerprint": "cc40aaf627fbfc8c", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-ab5977cdfbc9d8c2", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 resources/js/hooks/use-two-factor-auth.ts:22"}, "properties": {"repobilityId": "1654f765feab0f85", "scanner": "scanner-primary", "fingerprint": "ab5977cdfbc9d8c2", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-91134516fbc9a437", "level": "error", "message": {"text": "Dangling fetch: POST /admin/upload-image (resources/js/lib/image-upload.ts:55)"}, "properties": {"repobilityId": "1a141e75ad5fe01a", "scanner": "scanner-primary", "fingerprint": "91134516fbc9a437", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-0602fabb339db490", "level": "error", "message": {"text": "Dangling fetch: POST /admin/upload-video (resources/js/lib/video-upload.ts:34)"}, "properties": {"repobilityId": "3d13190668e62154", "scanner": "scanner-primary", "fingerprint": "0602fabb339db490", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-38a9521b29471dbf", "level": "error", "message": {"text": "Dangling fetch: POST /admin/vehicle-versions/bulk-import/preview (resources/js/pages/admin/vehicle-versions/bulk-import.tsx:82)"}, "properties": {"repobilityId": "7ac3f4b0c9f6b2b0", "scanner": "scanner-primary", "fingerprint": "38a9521b29471dbf", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-1d213d98b756f375", "level": "error", "message": {"text": "Dangling fetch: POST /admin/vehicle-versions/${version!.id}/media (resources/js/pages/admin/vehicle-versions/form.tsx:304)"}, "properties": {"repobilityId": "7882ec2d0fbabded", "scanner": "scanner-primary", "fingerprint": "1d213d98b756f375", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-392aa70ef1d3cf0c", "level": "note", "message": {"text": "Unused endpoint: POST /admin/logout"}, "properties": {"repobilityId": "60f7e77578587d58", "scanner": "scanner-primary", "fingerprint": "392aa70ef1d3cf0c", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-b1057813136fa4ae", "level": "note", "message": {"text": "Unused endpoint: POST /admin/cross-reference/import"}, "properties": {"repobilityId": "f65afb7a646c72db", "scanner": "scanner-primary", "fingerprint": "b1057813136fa4ae", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-d49ea95c239a1ec8", "level": "note", "message": {"text": "Unused endpoint: POST /kinto/solicitud"}, "properties": {"repobilityId": "c9b0e75aca234079", "scanner": "scanner-primary", "fingerprint": "d49ea95c239a1ec8", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-bbebe144b5d38e25", "level": "note", "message": {"text": "Unused endpoint: POST /cotizaciones/vehiculo"}, "properties": {"repobilityId": "2d57453324fd546f", "scanner": "scanner-primary", "fingerprint": "bbebe144b5d38e25", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-fe6794834c095ea9", "level": "note", "message": {"text": "Unused endpoint: GET /compliance/seguimiento"}, "properties": {"repobilityId": "285bd6b257a51d86", "scanner": "scanner-primary", "fingerprint": "fe6794834c095ea9", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-a411798705f09d04", "level": "note", "message": {"text": "Unused endpoint: GET /admin/cotizaciones-vehiculos"}, "properties": {"repobilityId": "4707fd4bcb0e3215", "scanner": "scanner-primary", "fingerprint": "a411798705f09d04", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-f6936d77488590a5", "level": "note", "message": {"text": "Unused endpoint: POST /admin/brands"}, "properties": {"repobilityId": "825049850cbd3685", "scanner": "scanner-primary", "fingerprint": "f6936d77488590a5", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-7bf107b49536c07f", "level": "note", "message": {"text": "Unused endpoint: GET /admin/compliance/denuncias"}, "properties": {"repobilityId": "81dfffe8217956f5", "scanner": "scanner-primary", "fingerprint": "7bf107b49536c07f", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-4a35f9bd96205db4", "level": "note", "message": {"text": "Unused endpoint: POST /admin/home/footer"}, "properties": {"repobilityId": "d1cbe8145ea9f300", "scanner": "scanner-primary", "fingerprint": "4a35f9bd96205db4", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-c3a271c5e8cce7a0", "level": "note", "message": {"text": "Unused endpoint: POST /admin/home/shorts"}, "properties": {"repobilityId": "382f150908b854a7", "scanner": "scanner-primary", "fingerprint": "c3a271c5e8cce7a0", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-aedac3d35ca7756a", "level": "note", "message": {"text": "Unused endpoint: POST /admin/home/features"}, "properties": {"repobilityId": "eef073f0ab4376a0", "scanner": "scanner-primary", "fingerprint": "aedac3d35ca7756a", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-235918e9d7aab01a", "level": "note", "message": {"text": "Unused endpoint: POST /admin/home/seminuevos"}, "properties": {"repobilityId": "6fbd4fef911a2ebb", "scanner": "scanner-primary", "fingerprint": "235918e9d7aab01a", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-b031a26e78b8e59a", "level": "note", "message": {"text": "Unused endpoint: POST /admin/home/programas"}, "properties": {"repobilityId": "beafd8e621a4c780", "scanner": "scanner-primary", "fingerprint": "b031a26e78b8e59a", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-de5cce1f9ebcfdc2", "level": "note", "message": {"text": "Unused endpoint: POST /admin/home/hero"}, "properties": {"repobilityId": "c8f8784913a4fcf9", "scanner": "scanner-primary", "fingerprint": "de5cce1f9ebcfdc2", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-58de979030adc390", "level": "note", "message": {"text": "Unused endpoint: POST /admin/noticias"}, "properties": {"repobilityId": "c2cf7bba65bb8c7c", "scanner": "scanner-primary", "fingerprint": "58de979030adc390", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-1d742d2f15bd1421", "level": "note", "message": {"text": "Unused endpoint: POST /admin/vehicle-versions/bulk-import"}, "properties": {"repobilityId": "a0c5891a508f038e", "scanner": "scanner-primary", "fingerprint": "1d742d2f15bd1421", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-e08c716d0d7a5978", "level": "note", "message": {"text": "Unused endpoint: GET /admin/vehicle-versions"}, "properties": {"repobilityId": "ce9c65eeaac9618e", "scanner": "scanner-primary", "fingerprint": "e08c716d0d7a5978", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-dee9280d014c9867", "level": "note", "message": {"text": "Unused endpoint: POST /admin/repuestos"}, "properties": {"repobilityId": "232ca5abe81155dc", "scanner": "scanner-primary", "fingerprint": "dee9280d014c9867", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-8188a65aed794678", "level": "note", "message": {"text": "Unused endpoint: POST /admin/mantenimiento"}, "properties": {"repobilityId": "ef40d85342bb307d", "scanner": "scanner-primary", "fingerprint": "8188a65aed794678", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-c6ed5d48297f2aba", "level": "note", "message": {"text": "Unused endpoint: POST /admin/accesorios"}, "properties": {"repobilityId": "2fdcd8b3bffe49a4", "scanner": "scanner-primary", "fingerprint": "c6ed5d48297f2aba", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-e24e03c1aa393154", "level": "note", "message": {"text": "Unused endpoint: POST /admin/branches"}, "properties": {"repobilityId": "e31d734ef6e039e8", "scanner": "scanner-primary", "fingerprint": "e24e03c1aa393154", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-a268d43e11f00edc", "level": "note", "message": {"text": "Unused endpoint: POST /admin/merch"}, "properties": {"repobilityId": "ba1cafe6419d715b", "scanner": "scanner-primary", "fingerprint": "a268d43e11f00edc", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-b2d9697643289a1a", "level": "note", "message": {"text": "Unused endpoint: POST /admin/formulario-mantencion/services"}, "properties": {"repobilityId": "f6c025023aa137da", "scanner": "scanner-primary", "fingerprint": "b2d9697643289a1a", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-b71022d45ea07322", "level": "note", "message": {"text": "Unused endpoint: POST /admin/formulario-mantencion/vehicle-models"}, "properties": {"repobilityId": "311d5ac8e7d8fd0e", "scanner": "scanner-primary", "fingerprint": "b71022d45ea07322", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-5be9b0fee01e2386", "level": "note", "message": {"text": "Unused endpoint: POST /admin/features"}, "properties": {"repobilityId": "efea6fa43abf52b4", "scanner": "scanner-primary", "fingerprint": "5be9b0fee01e2386", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-7a4f3460932ea8ea", "level": "note", "message": {"text": "Unused endpoint: POST /post-venta/agendar-mantencion"}, "properties": {"repobilityId": "10d72bbcde88a50f", "scanner": "scanner-primary", "fingerprint": "7a4f3460932ea8ea", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-52a25d37c50a21cd", "level": "note", "message": {"text": "Unused endpoint: POST /post-venta/repuestos/encargo"}, "properties": {"repobilityId": "d0c605b23a240052", "scanner": "scanner-primary", "fingerprint": "52a25d37c50a21cd", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}]}]}