{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-106e83ceda2a418b", "name": "Possibly dead Python function: launch_browser", "shortDescription": {"text": "Possibly dead Python function: launch_browser"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6372cebde0220094", "name": "No auth library detected", "shortDescription": {"text": "No auth library detected"}, "fullDescription": {"text": "The scanner did not find any standard auth library (JWT, OAuth, NextAuth, Auth0, etc.). The repo has auth/admin/session surface indicators, so auth may live in custom code, in a separate service, or be missing."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-748f9603c7a0fe13", "name": "Network/subprocess call without timeout or try/except \u2014 messages_desktop_app.py:55", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 messages_desktop_app.py:55"}, "fullDescription": {"text": "`subprocess.Popen(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2a7522e2a10f0abe", "name": "Flask mutation route `export` without `@login_required` \u2014 messages_desktop_app.py:150", "shortDescription": {"text": "Flask mutation route `export` without `@login_required` \u2014 messages_desktop_app.py:150"}, "fullDescription": {"text": "Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-9d5f202047f98ff3", "name": "Flask mutation route `send_to_phone` without `@login_required` \u2014 messages_desktop_app.py:168", "shortDescription": {"text": "Flask mutation route `send_to_phone` without `@login_required` \u2014 messages_desktop_app.py:168"}, "fullDescription": {"text": "Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/26764"}, "properties": {"repository": "jaydeverett/rematch-export", "repoUrl": "https://github.com/jaydeverett/rematch-export", "branch": "main"}, "results": [{"ruleId": "scanner-106e83ceda2a418b", "level": "note", "message": {"text": "Possibly dead Python function: launch_browser"}, "properties": {"repobilityId": "4633a8872ef91dc9", "scanner": "scanner-primary", "fingerprint": "106e83ceda2a418b", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "messages_desktop_app.py:223"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6372cebde0220094", "level": "warning", "message": {"text": "No auth library detected"}, "properties": {"repobilityId": "a5b6035a5bbf8054", "scanner": "scanner-primary", "fingerprint": "6372cebde0220094", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["coverage", "auth"]}}, {"ruleId": "scanner-748f9603c7a0fe13", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 messages_desktop_app.py:55"}, "properties": {"repobilityId": "3c0df0d4170232fb", "scanner": "scanner-primary", "fingerprint": "748f9603c7a0fe13", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-2a7522e2a10f0abe", "level": "error", "message": {"text": "Flask mutation route `export` without `@login_required` \u2014 messages_desktop_app.py:150"}, "properties": {"repobilityId": "5f399b5ae06f93d2", "scanner": "scanner-primary", "fingerprint": "2a7522e2a10f0abe", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.flask.unauth_route"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "messages_desktop_app.py"}, "region": {"startLine": 150}}}]}, {"ruleId": "scanner-9d5f202047f98ff3", "level": "error", "message": {"text": "Flask mutation route `send_to_phone` without `@login_required` \u2014 messages_desktop_app.py:168"}, "properties": {"repobilityId": "2a37d325d9f54e6a", "scanner": "scanner-primary", "fingerprint": "9d5f202047f98ff3", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.flask.unauth_route"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "messages_desktop_app.py"}, "region": {"startLine": 168}}}]}]}]}