{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-be01e170ace8f561", "name": "Truncated text has no discoverable full-value affordance \u2014 app/landingtest.tsx:757", "shortDescription": {"text": "Truncated text has no discoverable full-value affordance \u2014 app/landingtest.tsx:757"}, "fullDescription": {"text": "A visibly truncated value should expose its full text through an accessible tooltip, description, or equivalent interaction. Native `title=` is one option, but it is not the only valid implementation.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 0.65}}, {"id": "scanner-aba49ad7cd83f75f", "name": "Debug `console.log` remains in browser-facing code \u2014 app/sign-up/page.tsx:142", "shortDescription": {"text": "Debug `console.log` remains in browser-facing code \u2014 app/sign-up/page.tsx:142"}, "fullDescription": {"text": "Remove debug output or route intentional diagnostics through the project's structured logger. Browser console output can expose state and create noise; server and CLI output are outside this rule's scope.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 0.85}}, {"id": "scanner-b3c74c724684b8e4", "name": "Debug `console.log` remains in browser-facing code \u2014 app/login/page.tsx:124", "shortDescription": {"text": "Debug `console.log` remains in browser-facing code \u2014 app/login/page.tsx:124"}, "fullDescription": {"text": "Remove debug output or route intentional diagnostics through the project's structured logger. Browser console output can expose state and create noise; server and CLI output are outside this rule's scope.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 0.85}}, {"id": "scanner-172b1659ff5fc229", "name": "Debug `console.log` remains in browser-facing code \u2014 app/dashboard/processing/page.tsx:136", "shortDescription": {"text": "Debug `console.log` remains in browser-facing code \u2014 app/dashboard/processing/page.tsx:136"}, "fullDescription": {"text": "Remove debug output or route intentional diagnostics through the project's structured logger. Browser console output can expose state and create noise; server and CLI output are outside this rule's scope.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 0.85}}, {"id": "scanner-f616c0d2fffbdaa5", "name": "Truncated text has no discoverable full-value affordance \u2014 app/dashboard/projects/page.tsx:734", "shortDescription": {"text": "Truncated text has no discoverable full-value affordance \u2014 app/dashboard/projects/page.tsx:734"}, "fullDescription": {"text": "A visibly truncated value should expose its full text through an accessible tooltip, description, or equivalent interaction. Native `title=` is one option, but it is not the only valid implementation.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 0.65}}, {"id": "scanner-f72638e4cf6548e5", "name": "Debug `console.log` remains in browser-facing code \u2014 app/dashboard/projects/page.tsx:185", "shortDescription": {"text": "Debug `console.log` remains in browser-facing code \u2014 app/dashboard/projects/page.tsx:185"}, "fullDescription": {"text": "Remove debug output or route intentional diagnostics through the project's structured logger. Browser console output can expose state and create noise; server and CLI output are outside this rule's scope.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 0.85}}, {"id": "scanner-e31f9070c63a6624", "name": "Truncated text has no discoverable full-value affordance \u2014 app/dashboard/components/DashboardHeader.tsx:454", "shortDescription": {"text": "Truncated text has no discoverable full-value affordance \u2014 app/dashboard/components/DashboardHeader.tsx:454"}, "fullDescription": {"text": "A visibly truncated value should expose its full text through an accessible tooltip, description, or equivalent interaction. Native `title=` is one option, but it is not the only valid implementation.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 0.65}}, {"id": "scanner-fd6dcb51b78b85c9", "name": "Debug `console.log` remains in browser-facing code \u2014 app/dashboard/components/DashboardHeader.tsx:34", "shortDescription": {"text": "Debug `console.log` remains in browser-facing code \u2014 app/dashboard/components/DashboardHeader.tsx:34"}, "fullDescription": {"text": "Remove debug output or route intentional diagnostics through the project's structured logger. Browser console output can expose state and create noise; server and CLI output are outside this rule's scope.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 0.85}}, {"id": "scanner-3e2d26e1c000f814", "name": "Truncated text has no discoverable full-value affordance \u2014 app/dashboard/components/DashboardContent.tsx:744", "shortDescription": {"text": "Truncated text has no discoverable full-value affordance \u2014 app/dashboard/components/DashboardContent.tsx:744"}, "fullDescription": {"text": "A visibly truncated value should expose its full text through an accessible tooltip, description, or equivalent interaction. Native `title=` is one option, but it is not the only valid implementation.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 0.65}}, {"id": "scanner-a292d53b21cbd357", "name": "Truncated text has no discoverable full-value affordance \u2014 app/dashboard/project_details/[videoId]/page.tsx:445", "shortDescription": {"text": "Truncated text has no discoverable full-value affordance \u2014 app/dashboard/project_details/[videoId]/page.tsx:445"}, "fullDescription": {"text": "A visibly truncated value should expose its full text through an accessible tooltip, description, or equivalent interaction. Native `title=` is one option, but it is not the only valid implementation.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 0.65}}, {"id": "scanner-7765f372f92aaa79", "name": "Truncated text has no discoverable full-value affordance \u2014 app/dashboard/clip-setup/page.tsx:569", "shortDescription": {"text": "Truncated text has no discoverable full-value affordance \u2014 app/dashboard/clip-setup/page.tsx:569"}, "fullDescription": {"text": "A visibly truncated value should expose its full text through an accessible tooltip, description, or equivalent interaction. Native `title=` is one option, but it is not the only valid implementation.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 0.65}}, {"id": "scanner-d425a4b666aebdcc", "name": "Debug `console.log` remains in browser-facing code \u2014 app/dashboard/preview/page.tsx:115", "shortDescription": {"text": "Debug `console.log` remains in browser-facing code \u2014 app/dashboard/preview/page.tsx:115"}, "fullDescription": {"text": "Remove debug output or route intentional diagnostics through the project's structured logger. Browser console output can expose state and create noise; server and CLI output are outside this rule's scope.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 0.85}}, {"id": "scanner-e9a838219d6841cc", "name": "Debug `console.log` remains in browser-facing code \u2014 app/components/tesxt.tsx:42", "shortDescription": {"text": "Debug `console.log` remains in browser-facing code \u2014 app/components/tesxt.tsx:42"}, "fullDescription": {"text": "Remove debug output or route intentional diagnostics through the project's structured logger. Browser console output can expose state and create noise; server and CLI output are outside this rule's scope.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 0.85}}, {"id": "scanner-02c5042c41f06de2", "name": "Icon-only button without accessible name \u2014 app/components/LoginCard.tsx:63", "shortDescription": {"text": "Icon-only button without accessible name \u2014 app/components/LoginCard.tsx:63"}, "fullDescription": {"text": "A `<button>` whose only child is a single glyph or symbol needs `title=` or `aria-label=` so screen readers (and tooltips on hover) work.\n\nWhy: P3 in CHECKLIST.md \u2014 icon-only buttons skipped a title.\nRule id: fq.button.no-label"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 0.85}}, {"id": "scanner-22f58cff492ec615", "name": "Debug `console.log` remains in browser-facing code \u2014 app/components/LoginCard.tsx:25", "shortDescription": {"text": "Debug `console.log` remains in browser-facing code \u2014 app/components/LoginCard.tsx:25"}, "fullDescription": {"text": "Remove debug output or route intentional diagnostics through the project's structured logger. Browser console output can expose state and create noise; server and CLI output are outside this rule's scope.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 0.85}}, {"id": "scanner-625962c62909a46a", "name": "Truncated text has no discoverable full-value affordance \u2014 app/components/UsedBy.tsx:108", "shortDescription": {"text": "Truncated text has no discoverable full-value affordance \u2014 app/components/UsedBy.tsx:108"}, "fullDescription": {"text": "A visibly truncated value should expose its full text through an accessible tooltip, description, or equivalent interaction. Native `title=` is one option, but it is not the only valid implementation.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 0.65}}, {"id": "scanner-307cf8cc330bf9c8", "name": "Truncated text has no discoverable full-value affordance \u2014 app/components/GenerateButton.tsx:340", "shortDescription": {"text": "Truncated text has no discoverable full-value affordance \u2014 app/components/GenerateButton.tsx:340"}, "fullDescription": {"text": "A visibly truncated value should expose its full text through an accessible tooltip, description, or equivalent interaction. Native `title=` is one option, but it is not the only valid implementation.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 0.65}}, {"id": "scanner-87c2a49c59f9a0eb", "name": "Debug `console.log` remains in browser-facing code \u2014 app/components/GenerateButton.tsx:236", "shortDescription": {"text": "Debug `console.log` remains in browser-facing code \u2014 app/components/GenerateButton.tsx:236"}, "fullDescription": {"text": "Remove debug output or route intentional diagnostics through the project's structured logger. Browser console output can expose state and create noise; server and CLI output are outside this rule's scope.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 0.85}}, {"id": "scanner-532c59555a3904d6", "name": "Debug `console.log` remains in browser-facing code \u2014 app/components/Hero.tsx:388", "shortDescription": {"text": "Debug `console.log` remains in browser-facing code \u2014 app/components/Hero.tsx:388"}, "fullDescription": {"text": "Remove debug output or route intentional diagnostics through the project's structured logger. Browser console output can expose state and create noise; server and CLI output are outside this rule's scope.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 0.85}}, {"id": "scanner-e725d2ab884fbd49", "name": "Multiple root agent instruction files without precedence", "shortDescription": {"text": "Multiple root agent instruction files without precedence"}, "fullDescription": {"text": "The repo has multiple top-level AI-coder instruction files. Without precedence rules, different agents may follow different policies."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-85a152e9aa0c3dbe", "name": "SkillSpector E1 (data-exfil) in app/api/login/route.ts", "shortDescription": {"text": "SkillSpector E1 (data-exfil) in app/api/login/route.ts"}, "fullDescription": {"text": "fetch(\n      \"https://clipgen-nogo.onrender.com/auth\",\n      {\n        method: \"POST\"\n\nData is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.\n\nSkill: unknown\nRule: E1  Category: data-exfil\nSeverity: MEDIUM  Confidence: 0.60\n\nRemediation: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.6}}, {"id": "scanner-1474af525032cfbf", "name": "SkillSpector SC1 (supply-chain) in package.json", "shortDescription": {"text": "SkillSpector SC1 (supply-chain) in package.json"}, "fullDescription": {"text": "\"@reduxjs/toolkit\": \"^2.12.0\"\n\nDependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.\n\nSkill: unknown\nRule: SC1  Category: supply-chain\nSeverity: LOW  Confidence: 0.40\n\nRemediation: Pin all dependency versions in requirements.txt or pyproject.toml. Use exact versions (==) or compatible ranges. Run pip-audit regularly."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 0.4}}, {"id": "scanner-c48d54072d7b9202", "name": "SkillSpector SC6 (supply-chain) in package.json", "shortDescription": {"text": "SkillSpector SC6 (supply-chain) in package.json"}, "fullDescription": {"text": "next\n\nPackage name closely resembles a popular package, suggesting possible typosquatting. Attackers publish malicious packages with similar names to trick developers into installing them.\n\nSkill: unknown\nRule: SC6  Category: supply-chain\nSeverity: HIGH  Confidence: 0.70\n\nRemediation: Verify the package name is correct and not a typosquatting variant. Compare against the official package name on PyPI or npm."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.7}}, {"id": "scanner-81a64805f05bb695", "name": "SkillSpector TM1 (tool-misuse) in app/landingtest.tsx", "shortDescription": {"text": "SkillSpector TM1 (tool-misuse) in app/landingtest.tsx"}, "fullDescription": {"text": "DELETE /clip/videos/{\n\nTool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).\n\nSkill: unknown\nRule: TM1  Category: tool-misuse\nSeverity: HIGH  Confidence: 0.80\n\nRemediation: Validate all tool parameters against an allowlist. Reject dangerous parameter values (shell=True, --force, -rf /) and use safe defaults."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.8}}, {"id": "scanner-7cbbdcade7d3ae01", "name": "SkillSpector TM1 (tool-misuse) in package-lock.json", "shortDescription": {"text": "SkillSpector TM1 (tool-misuse) in package-lock.json"}, "fullDescription": {"text": "RMnFX7YQsMoh7lWfcM4NEHHymBX/\n\nTool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).\n\nSkill: unknown\nRule: TM1  Category: tool-misuse\nSeverity: HIGH  Confidence: 0.85\n\nRemediation: Validate all tool parameters against an allowlist. Reject dangerous parameter values (shell=True, --force, -rf /) and use safe defaults."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.85}}, {"id": "scanner-e637c415447867e4", "name": "Run SkillSpector's LLM-backed analysis in your own pipeline", "shortDescription": {"text": "Run SkillSpector's LLM-backed analysis in your own pipeline"}, "fullDescription": {"text": "Repobility ran SkillSpector's static rules server-side. The deeper LLM-backed analyzers \u2014 tool-poisoning (TP*), semantic security discovery (SSD*), developer-intent mismatch (SDI*) \u2014 are meant to run on YOUR machine with YOUR model; repobility never sends your code to an LLM. Recipe:\n\n# 1. Install SkillSpector in your own isolated env\npipx install \"skillspector @ git+https://github.com/NVIDIA/SkillSpector.git\"\n\n# 2. Point it at YOUR LLM pipeline (pick one) - your code stays on your machine\nexport SKILLSPECTOR_PROVIDER=anthropic && export ANTHROPIC_API_KEY=sk-ant-...\n# export SKILLSPECTOR_PROVIDER=openai   && export OPENAI_API_KEY=sk-...\n# export SKILLSPECTOR_PROVIDER=openai OPENAI_API_KEY=ollama OPENAI_BASE_URL=http://localhost:11434/v1 SKILLSPECTOR_MODEL=llama3.1:8b\n# export SKILLSPECTOR_PROVIDER=nv_build && export NVIDIA_INFERENCE_KEY=nvapi-...\n\n# 3. Run the LLM-backed scan per skill (omit --no-llm to enable the LLM analyzers)\nskillspector scan . --format sarif --output skillspector-"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "info", "confidence": 1.0}}, {"id": "scanner-6372cebde0220094", "name": "No auth library detected", "shortDescription": {"text": "No auth library detected"}, "fullDescription": {"text": "The scanner did not find any standard auth library (JWT, OAuth, NextAuth, Auth0, etc.). The repo has auth/admin/session surface indicators, so auth may live in custom code, in a separate service, or be missing."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6893a6c8b0861585", "name": "Very low test-to-source ratio", "shortDescription": {"text": "Very low test-to-source ratio"}, "fullDescription": {"text": "2 test file(s) for 39 source file(s) (ratio 0.05). Consider adding integration or unit tests for critical paths."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-141b30a41e03817b", "name": "No license file detected", "shortDescription": {"text": "No license file detected"}, "fullDescription": {"text": "No LICENSE/COPYING/NOTICE file was found. Generated repositories often omit licensing, which blocks reuse and automated intake."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 56 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-72b2a6250083a784", "name": "Placeholder or mock-heavy implementation detected", "shortDescription": {"text": "Placeholder or mock-heavy implementation detected"}, "fullDescription": {"text": "Found 33 placeholder/mock markers across 7 source files. This often means the repo looks complete while core flows still use generated scaffolding or fake data."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b9088664ace7f748", "name": "Composite production-readiness gap", "shortDescription": {"text": "Composite production-readiness gap"}, "fullDescription": {"text": "Multiple low-cost hardening controls are missing together: license, ci, tests. Opus verification showed these co-occurring gaps are a better readiness signal than reading each flag in isolation."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-749d4bc1bd66df5f", "name": "Agent instructions exist but release-hardening basics are missing", "shortDescription": {"text": "Agent instructions exist but release-hardening basics are missing"}, "fullDescription": {"text": "AI-coder instruction files were found, but the repo is missing license, ci, tests. Treat this as a contract gap: the agent is guided, but the generated output is not yet guarded by the controls that make it repeatable."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/30825"}, "properties": {"repository": "pradeeplodhi3001/cliphi-web-app", "repoUrl": "https://github.com/pradeeplodhi3001/cliphi-web-app", "branch": "main"}, "results": [{"ruleId": "scanner-be01e170ace8f561", "level": "none", "message": {"text": "Truncated text has no discoverable full-value affordance \u2014 app/landingtest.tsx:757"}, "properties": {"repobilityId": "75c92149ada461b3", "scanner": "scanner-primary", "fingerprint": "be01e170ace8f561", "layer": "frontend", "severity": "info", "confidence": 0.65, "tags": ["frontend-quality", "fq.truncate.no-title"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "app/landingtest.tsx"}, "region": {"startLine": 757}}}]}, {"ruleId": "scanner-aba49ad7cd83f75f", "level": "note", "message": {"text": "Debug `console.log` remains in browser-facing code \u2014 app/sign-up/page.tsx:142"}, "properties": {"repobilityId": "65406f309c62fef4", "scanner": "scanner-primary", "fingerprint": "aba49ad7cd83f75f", "layer": "frontend", "severity": "low", "confidence": 0.85, "tags": ["frontend-quality", "fq.console-leak"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "app/sign-up/page.tsx"}, "region": {"startLine": 142}}}]}, {"ruleId": "scanner-b3c74c724684b8e4", "level": "note", "message": {"text": "Debug `console.log` remains in browser-facing code \u2014 app/login/page.tsx:124"}, "properties": {"repobilityId": "ace8f7300b4b0e93", "scanner": "scanner-primary", "fingerprint": "b3c74c724684b8e4", "layer": "frontend", "severity": "low", "confidence": 0.85, "tags": ["frontend-quality", "fq.console-leak"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "app/login/page.tsx"}, "region": {"startLine": 124}}}]}, {"ruleId": "scanner-172b1659ff5fc229", "level": "note", "message": {"text": "Debug `console.log` remains in browser-facing code \u2014 app/dashboard/processing/page.tsx:136"}, "properties": {"repobilityId": "6c975e4b88b9ef21", "scanner": "scanner-primary", "fingerprint": "172b1659ff5fc229", "layer": "frontend", "severity": "low", "confidence": 0.85, "tags": ["frontend-quality", "fq.console-leak"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "app/dashboard/processing/page.tsx"}, "region": {"startLine": 136}}}]}, {"ruleId": "scanner-f616c0d2fffbdaa5", "level": "none", "message": {"text": "Truncated text has no discoverable full-value affordance \u2014 app/dashboard/projects/page.tsx:734"}, "properties": {"repobilityId": "e8c2a805e4189a2b", "scanner": "scanner-primary", "fingerprint": "f616c0d2fffbdaa5", "layer": "frontend", "severity": "info", "confidence": 0.65, "tags": ["frontend-quality", "fq.truncate.no-title"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "app/dashboard/projects/page.tsx"}, "region": {"startLine": 734}}}]}, {"ruleId": "scanner-f72638e4cf6548e5", "level": "note", "message": {"text": "Debug `console.log` remains in browser-facing code \u2014 app/dashboard/projects/page.tsx:185"}, "properties": {"repobilityId": "3efed5c7e2579def", "scanner": "scanner-primary", "fingerprint": "f72638e4cf6548e5", "layer": "frontend", "severity": "low", "confidence": 0.85, "tags": ["frontend-quality", "fq.console-leak"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "app/dashboard/projects/page.tsx"}, "region": {"startLine": 185}}}]}, {"ruleId": "scanner-e31f9070c63a6624", "level": "none", "message": {"text": "Truncated text has no discoverable full-value affordance \u2014 app/dashboard/components/DashboardHeader.tsx:454"}, "properties": {"repobilityId": "0eb444db1c42ffa1", "scanner": "scanner-primary", "fingerprint": "e31f9070c63a6624", "layer": "frontend", "severity": "info", "confidence": 0.65, "tags": ["frontend-quality", "fq.truncate.no-title"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "app/dashboard/components/DashboardHeader.tsx"}, "region": {"startLine": 454}}}]}, {"ruleId": "scanner-fd6dcb51b78b85c9", "level": "note", "message": {"text": "Debug `console.log` remains in browser-facing code \u2014 app/dashboard/components/DashboardHeader.tsx:34"}, "properties": {"repobilityId": "18f84a9d847564c4", "scanner": "scanner-primary", "fingerprint": "fd6dcb51b78b85c9", "layer": "frontend", "severity": "low", "confidence": 0.85, "tags": ["frontend-quality", "fq.console-leak"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "app/dashboard/components/DashboardHeader.tsx"}, "region": {"startLine": 34}}}]}, {"ruleId": "scanner-3e2d26e1c000f814", "level": "none", "message": {"text": "Truncated text has no discoverable full-value affordance \u2014 app/dashboard/components/DashboardContent.tsx:744"}, "properties": {"repobilityId": "68bbd44637ac4257", "scanner": "scanner-primary", "fingerprint": "3e2d26e1c000f814", "layer": "frontend", "severity": "info", "confidence": 0.65, "tags": ["frontend-quality", "fq.truncate.no-title"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "app/dashboard/components/DashboardContent.tsx"}, "region": {"startLine": 744}}}]}, {"ruleId": "scanner-a292d53b21cbd357", "level": "none", "message": {"text": "Truncated text has no discoverable full-value affordance \u2014 app/dashboard/project_details/[videoId]/page.tsx:445"}, "properties": {"repobilityId": "f94390796dbcf198", "scanner": "scanner-primary", "fingerprint": "a292d53b21cbd357", "layer": "frontend", "severity": "info", "confidence": 0.65, "tags": ["frontend-quality", "fq.truncate.no-title"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "app/dashboard/project_details/[videoId]/page.tsx"}, "region": {"startLine": 445}}}]}, {"ruleId": "scanner-7765f372f92aaa79", "level": "none", "message": {"text": "Truncated text has no discoverable full-value affordance \u2014 app/dashboard/clip-setup/page.tsx:569"}, "properties": {"repobilityId": "c50131deee60780c", "scanner": "scanner-primary", "fingerprint": "7765f372f92aaa79", "layer": "frontend", "severity": "info", "confidence": 0.65, "tags": ["frontend-quality", "fq.truncate.no-title"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "app/dashboard/clip-setup/page.tsx"}, "region": {"startLine": 569}}}]}, {"ruleId": "scanner-d425a4b666aebdcc", "level": "note", "message": {"text": "Debug `console.log` remains in browser-facing code \u2014 app/dashboard/preview/page.tsx:115"}, "properties": {"repobilityId": "b6ce4946780c3ba0", "scanner": "scanner-primary", "fingerprint": "d425a4b666aebdcc", "layer": "frontend", "severity": "low", "confidence": 0.85, "tags": ["frontend-quality", "fq.console-leak"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "app/dashboard/preview/page.tsx"}, "region": {"startLine": 115}}}]}, {"ruleId": "scanner-e9a838219d6841cc", "level": "note", "message": {"text": "Debug `console.log` remains in browser-facing code \u2014 app/components/tesxt.tsx:42"}, "properties": {"repobilityId": "6a3d6621657b75d2", "scanner": "scanner-primary", "fingerprint": "e9a838219d6841cc", "layer": "frontend", "severity": "low", "confidence": 0.85, "tags": ["frontend-quality", "fq.console-leak"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "app/components/tesxt.tsx"}, "region": {"startLine": 42}}}]}, {"ruleId": "scanner-02c5042c41f06de2", "level": "note", "message": {"text": "Icon-only button without accessible name \u2014 app/components/LoginCard.tsx:63"}, "properties": {"repobilityId": "f312ce77851b81d0", "scanner": "scanner-primary", "fingerprint": "02c5042c41f06de2", "layer": "frontend", "severity": "low", "confidence": 0.85, "tags": ["frontend-quality", "fq.button.no-label"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "app/components/LoginCard.tsx"}, "region": {"startLine": 63}}}]}, {"ruleId": "scanner-22f58cff492ec615", "level": "note", "message": {"text": "Debug `console.log` remains in browser-facing code \u2014 app/components/LoginCard.tsx:25"}, "properties": {"repobilityId": "2c0cedc104101e86", "scanner": "scanner-primary", "fingerprint": "22f58cff492ec615", "layer": "frontend", "severity": "low", "confidence": 0.85, "tags": ["frontend-quality", "fq.console-leak"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "app/components/LoginCard.tsx"}, "region": {"startLine": 25}}}]}, {"ruleId": "scanner-625962c62909a46a", "level": "none", "message": {"text": "Truncated text has no discoverable full-value affordance \u2014 app/components/UsedBy.tsx:108"}, "properties": {"repobilityId": "55425ed66afab861", "scanner": "scanner-primary", "fingerprint": "625962c62909a46a", "layer": "frontend", "severity": "info", "confidence": 0.65, "tags": ["frontend-quality", "fq.truncate.no-title"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "app/components/UsedBy.tsx"}, "region": {"startLine": 108}}}]}, {"ruleId": "scanner-307cf8cc330bf9c8", "level": "none", "message": {"text": "Truncated text has no discoverable full-value affordance \u2014 app/components/GenerateButton.tsx:340"}, "properties": {"repobilityId": "9afa1e346029c898", "scanner": "scanner-primary", "fingerprint": "307cf8cc330bf9c8", "layer": "frontend", "severity": "info", "confidence": 0.65, "tags": ["frontend-quality", "fq.truncate.no-title"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "app/components/GenerateButton.tsx"}, "region": {"startLine": 340}}}]}, {"ruleId": "scanner-87c2a49c59f9a0eb", "level": "note", "message": {"text": "Debug `console.log` remains in browser-facing code \u2014 app/components/GenerateButton.tsx:236"}, "properties": {"repobilityId": "ffa6b1ff9cf428df", "scanner": "scanner-primary", "fingerprint": "87c2a49c59f9a0eb", "layer": "frontend", "severity": "low", "confidence": 0.85, "tags": ["frontend-quality", "fq.console-leak"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "app/components/GenerateButton.tsx"}, "region": {"startLine": 236}}}]}, {"ruleId": "scanner-532c59555a3904d6", "level": "note", "message": {"text": "Debug `console.log` remains in browser-facing code \u2014 app/components/Hero.tsx:388"}, "properties": {"repobilityId": "0e91b753fdc60d3d", "scanner": "scanner-primary", "fingerprint": "532c59555a3904d6", "layer": "frontend", "severity": "low", "confidence": 0.85, "tags": ["frontend-quality", "fq.console-leak"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "app/components/Hero.tsx"}, "region": {"startLine": 388}}}]}, {"ruleId": "scanner-e725d2ab884fbd49", "level": "note", "message": {"text": "Multiple root agent instruction files without precedence"}, "properties": {"repobilityId": "1953db6c89508d22", "scanner": "scanner-primary", "fingerprint": "e725d2ab884fbd49", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["agent-instructions", "governance"]}}, {"ruleId": "scanner-85a152e9aa0c3dbe", "level": "warning", "message": {"text": "SkillSpector E1 (data-exfil) in app/api/login/route.ts"}, "properties": {"repobilityId": "b718d72f22ef8a51", "scanner": "scanner-primary", "fingerprint": "85a152e9aa0c3dbe", "layer": "security", "severity": "medium", "confidence": 0.6, "tags": ["skillspector", "mcp-skill", "data-exfil", "E1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "app/api/login/route.ts"}, "region": {"startLine": 7}}}]}, {"ruleId": "scanner-1474af525032cfbf", "level": "note", "message": {"text": "SkillSpector SC1 (supply-chain) in package.json"}, "properties": {"repobilityId": "3383129e33c8e7f0", "scanner": "scanner-primary", "fingerprint": "1474af525032cfbf", "layer": "security", "severity": "low", "confidence": 0.4, "tags": ["skillspector", "mcp-skill", "supply-chain", "SC1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 12}}}]}, {"ruleId": "scanner-c48d54072d7b9202", "level": "error", "message": {"text": "SkillSpector SC6 (supply-chain) in package.json"}, "properties": {"repobilityId": "0898d2a6b27a3a5c", "scanner": "scanner-primary", "fingerprint": "c48d54072d7b9202", "layer": "security", "severity": "high", "confidence": 0.7, "tags": ["skillspector", "mcp-skill", "supply-chain", "SC6"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 16}}}]}, {"ruleId": "scanner-81a64805f05bb695", "level": "error", "message": {"text": "SkillSpector TM1 (tool-misuse) in app/landingtest.tsx"}, "properties": {"repobilityId": "b288b46204fb9882", "scanner": "scanner-primary", "fingerprint": "81a64805f05bb695", "layer": "security", "severity": "high", "confidence": 0.8, "tags": ["skillspector", "mcp-skill", "tool-misuse", "TM1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "app/landingtest.tsx"}, "region": {"startLine": 816}}}]}, {"ruleId": "scanner-7cbbdcade7d3ae01", "level": "error", "message": {"text": "SkillSpector TM1 (tool-misuse) in package-lock.json"}, "properties": {"repobilityId": "aa03d253b8eee8af", "scanner": "scanner-primary", "fingerprint": "7cbbdcade7d3ae01", "layer": "security", "severity": "high", "confidence": 0.85, "tags": ["skillspector", "mcp-skill", "tool-misuse", "TM1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 543}}}]}, {"ruleId": "scanner-e637c415447867e4", "level": "none", "message": {"text": "Run SkillSpector's LLM-backed analysis in your own pipeline"}, "properties": {"repobilityId": "1936f198ff5212bf", "scanner": "scanner-primary", "fingerprint": "e637c415447867e4", "layer": "security", "severity": "info", "confidence": 1.0, "tags": ["skillspector", "mcp-skill", "llm-advisory", "ai-coder"]}}, {"ruleId": "scanner-6372cebde0220094", "level": "warning", "message": {"text": "No auth library detected"}, "properties": {"repobilityId": "a5b6035a5bbf8054", "scanner": "scanner-primary", "fingerprint": "6372cebde0220094", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["coverage", "auth"]}}, {"ruleId": "scanner-6893a6c8b0861585", "level": "warning", "message": {"text": "Very low test-to-source ratio"}, "properties": {"repobilityId": "54a7de3f06314bf0", "scanner": "scanner-primary", "fingerprint": "6893a6c8b0861585", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["tests", "coverage"]}}, {"ruleId": "scanner-141b30a41e03817b", "level": "note", "message": {"text": "No license file detected"}, "properties": {"repobilityId": "d90b5bcd3c82a520", "scanner": "scanner-primary", "fingerprint": "141b30a41e03817b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["license", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "0e52eb457e3cc95f", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-72b2a6250083a784", "level": "warning", "message": {"text": "Placeholder or mock-heavy implementation detected"}, "properties": {"repobilityId": "bdc3f98689ff2c7c", "scanner": "scanner-primary", "fingerprint": "72b2a6250083a784", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "incomplete", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "752b61e46b3f35d5", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-b9088664ace7f748", "level": "warning", "message": {"text": "Composite production-readiness gap"}, "properties": {"repobilityId": "3c7284210ef3265a", "scanner": "scanner-primary", "fingerprint": "b9088664ace7f748", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["production-readiness", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-749d4bc1bd66df5f", "level": "warning", "message": {"text": "Agent instructions exist but release-hardening basics are missing"}, "properties": {"repobilityId": "01184c0906d65227", "scanner": "scanner-primary", "fingerprint": "749d4bc1bd66df5f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "repo-hardening", "generated-repo-pattern"]}}]}]}