{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-8bd957d322d118b1", "name": "Stray `console.log` in TS/JS \u2014 scripts/db-setup.ts:84", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 scripts/db-setup.ts:84"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-770f1c30c32fe694", "name": "Stray `console.log` in TS/JS \u2014 scripts/create-user.ts:91", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 scripts/create-user.ts:91"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-43e496167fde2f4c", "name": "Runtime dotenv file present in repo: .env.test", "shortDescription": {"text": "Runtime dotenv file present in repo: .env.test"}, "fullDescription": {"text": "`.env.test` looks like a runtime dotenv file. It contains secret-looking assignments for NEXT_PUBLIC_SUPABASE_ANON_KEY, SUPABASE_SERVICE_ROLE_KEY. Move real values to a secret manager and keep only `.env.example` style templates in source control."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-8745b655f5577dd3", "name": "Insecure pattern 'direct_innerhtml_assignment' in docs/html/add-a-feature.html:645", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in docs/html/add-a-feature.html:645"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-27924aa79fa4a517", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/cache@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-141b30a41e03817b", "name": "No license file detected", "shortDescription": {"text": "No license file detected"}, "fullDescription": {"text": "No LICENSE/COPYING/NOTICE file was found. Generated repositories often omit licensing, which blocks reuse and automated intake."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 5 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-749d4bc1bd66df5f", "name": "Agent instructions exist but release-hardening basics are missing", "shortDescription": {"text": "Agent instructions exist but release-hardening basics are missing"}, "fullDescription": {"text": "AI-coder instruction files were found, but the repo is missing license. Treat this as a contract gap: the agent is guided, but the generated output is not yet guarded by the controls that make it repeatable."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e725d2ab884fbd49", "name": "Multiple root agent instruction files without precedence", "shortDescription": {"text": "Multiple root agent instruction files without precedence"}, "fullDescription": {"text": "The repo has multiple top-level AI-coder instruction files. Without precedence rules, different agents may follow different policies."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-11179998d397a9bf", "name": "Commented-code block (5 lines) in eslint.config.mjs:9", "shortDescription": {"text": "Commented-code block (5 lines) in eslint.config.mjs:9"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-e2ecd96407d141b1", "name": "Commented-code block (7 lines) in proxy.test.ts:5", "shortDescription": {"text": "Commented-code block (7 lines) in proxy.test.ts:5"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-cca7d714484157ce", "name": "Commented-code block (7 lines) in app/_features/landing/LandingPage.test.tsx:3", "shortDescription": {"text": "Commented-code block (7 lines) in app/_features/landing/LandingPage.test.tsx:3"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-aaae4a26a08a1739", "name": "Commented-code block (5 lines) in app/_features/notes/nav.test.ts:3", "shortDescription": {"text": "Commented-code block (5 lines) in app/_features/notes/nav.test.ts:3"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-bec8455586030367", "name": "Commented-code block (5 lines) in app/_features/notes/use-notes-realtime.test.tsx:3", "shortDescription": {"text": "Commented-code block (5 lines) in app/_features/notes/use-notes-realtime.test.tsx:3"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-4fc1f778c3e17c0e", "name": "Commented-code block (5 lines) in app/_features/notes/permissions.test.ts:6", "shortDescription": {"text": "Commented-code block (5 lines) in app/_features/notes/permissions.test.ts:6"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-3d1045cb5f619450", "name": "Commented-code block (6 lines) in app/_features/notes/actions.test.ts:5", "shortDescription": {"text": "Commented-code block (6 lines) in app/_features/notes/actions.test.ts:5"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-8105b2df54598eb4", "name": "Commented-code block (8 lines) in app/_features/notes/actions.integration.test.ts:3", "shortDescription": {"text": "Commented-code block (8 lines) in app/_features/notes/actions.integration.test.ts:3"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-ef3e6f121a58e61c", "name": "Commented-code block (5 lines) in app/_features/notes/__tests__/notes-rls.integration.test.ts:89", "shortDescription": {"text": "Commented-code block (5 lines) in app/_features/notes/__tests__/notes-rls.integration.test.ts:89"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-997b7394b62001c9", "name": "Commented-code block (5 lines) in app/_features/auth/LoginForm.test.tsx:3", "shortDescription": {"text": "Commented-code block (5 lines) in app/_features/auth/LoginForm.test.tsx:3"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-30409706ea7874ac", "name": "Commented-code block (5 lines) in app/_features/activity/permissions.test.ts:6", "shortDescription": {"text": "Commented-code block (5 lines) in app/_features/activity/permissions.test.ts:6"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-e83b07752c1dd122", "name": "Commented-code block (6 lines) in app/_features/activity/getSignInLog.test.ts:5", "shortDescription": {"text": "Commented-code block (6 lines) in app/_features/activity/getSignInLog.test.ts:5"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-4764c0c15073832a", "name": "Commented-code block (6 lines) in app/_features/shell/DashboardNav.test.tsx:3", "shortDescription": {"text": "Commented-code block (6 lines) in app/_features/shell/DashboardNav.test.tsx:3"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-2a83f47ad8de84e4", "name": "Commented-code block (5 lines) in app/_features/shell/ChunkErrorReloader.tsx:5", "shortDescription": {"text": "Commented-code block (5 lines) in app/_features/shell/ChunkErrorReloader.tsx:5"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-40f5a288b4908e48", "name": "Commented-code block (7 lines) in app/_features/shell/ChunkErrorReloader.test.tsx:3", "shortDescription": {"text": "Commented-code block (7 lines) in app/_features/shell/ChunkErrorReloader.test.tsx:3"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-46b738d287c9d9ea", "name": "Commented-code block (5 lines) in app/_features/shell/PageHeader.test.tsx:3", "shortDescription": {"text": "Commented-code block (5 lines) in app/_features/shell/PageHeader.test.tsx:3"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-a91be56e69a069b0", "name": "Commented-code block (6 lines) in scripts/generate-feature-surfaces.mjs:3", "shortDescription": {"text": "Commented-code block (6 lines) in scripts/generate-feature-surfaces.mjs:3"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-ee299ed117def9f5", "name": "Commented-code block (6 lines) in scripts/generate-feature-surfaces.test.ts:3", "shortDescription": {"text": "Commented-code block (6 lines) in scripts/generate-feature-surfaces.test.ts:3"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-ea6afbf72361560a", "name": "Commented-code block (7 lines) in lib/security-headers.test.ts:8", "shortDescription": {"text": "Commented-code block (7 lines) in lib/security-headers.test.ts:8"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-4c4d92c1a323630c", "name": "Commented-code block (5 lines) in lib/logger.test.ts:8", "shortDescription": {"text": "Commented-code block (5 lines) in lib/logger.test.ts:8"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-950fe0a52fb3a1df", "name": "Commented-code block (5 lines) in lib/rate-limit.test.ts:6", "shortDescription": {"text": "Commented-code block (5 lines) in lib/rate-limit.test.ts:6"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-74fe14af9fc83440", "name": "Commented-code block (8 lines) in lib/security-headers.ts:5", "shortDescription": {"text": "Commented-code block (8 lines) in lib/security-headers.ts:5"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-63f16c2c600c22f1", "name": "Commented-code block (6 lines) in lib/audit/record-sign-in.test.ts:3", "shortDescription": {"text": "Commented-code block (6 lines) in lib/audit/record-sign-in.test.ts:3"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-47de62c101eca4f5", "name": "Commented-code block (8 lines) in lib/registry/schema.ts:1", "shortDescription": {"text": "Commented-code block (8 lines) in lib/registry/schema.ts:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-94c0ee7c7b19ad23", "name": "Commented-code block (6 lines) in lib/registry/nav.ts:3", "shortDescription": {"text": "Commented-code block (6 lines) in lib/registry/nav.ts:3"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-bdf52bd89dfeb125", "name": "Commented-code block (6 lines) in lib/auth/session.test.ts:7", "shortDescription": {"text": "Commented-code block (6 lines) in lib/auth/session.test.ts:7"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-37f5cf9ff71c6b30", "name": "Commented-code block (5 lines) in lib/supabase/browser.test.ts:3", "shortDescription": {"text": "Commented-code block (5 lines) in lib/supabase/browser.test.ts:3"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-a7dfd57b83c8082e", "name": "Commented-code block (7 lines) in lib/supabase/server.test.ts:7", "shortDescription": {"text": "Commented-code block (7 lines) in lib/supabase/server.test.ts:7"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-78259d3f96da13ab", "name": "Commented-code block (5 lines) in lib/db/with-user-context.test.ts:3", "shortDescription": {"text": "Commented-code block (5 lines) in lib/db/with-user-context.test.ts:3"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-981dfee64d2e6812", "name": "Commented-code block (6 lines) in lib/db/__tests__/profiles-rls.integration.test.ts:85", "shortDescription": {"text": "Commented-code block (6 lines) in lib/db/__tests__/profiles-rls.integration.test.ts:85"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-46a5d4f009adbb30", "name": "Commented-code block (6 lines) in lib/db/__tests__/live-db.test.ts:3", "shortDescription": {"text": "Commented-code block (6 lines) in lib/db/__tests__/live-db.test.ts:3"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-65725f593405dca9", "name": "Commented-code block (8 lines) in lib/permissions/guard.test.ts:11", "shortDescription": {"text": "Commented-code block (8 lines) in lib/permissions/guard.test.ts:11"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-db9f81ca6b3aea04", "name": "Commented-code block (7 lines) in lib/permissions/ability.test.ts:5", "shortDescription": {"text": "Commented-code block (7 lines) in lib/permissions/ability.test.ts:5"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-7feb851d53ac1d41", "name": "Commented-code block (7 lines) in lib/permissions/ability.ts:4", "shortDescription": {"text": "Commented-code block (7 lines) in lib/permissions/ability.ts:4"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-b890b029c86889d0", "name": "Commented-code block (7 lines) in lib/realtime/use-topic.test.tsx:3", "shortDescription": {"text": "Commented-code block (7 lines) in lib/realtime/use-topic.test.tsx:3"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-b3dce79581ae0897", "name": "Commented-code block (8 lines) in lib/verification/feature-confinement.test.ts:5", "shortDescription": {"text": "Commented-code block (8 lines) in lib/verification/feature-confinement.test.ts:5"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-1e9c98d13143ab10", "name": "Commented-code block (15 lines) in lib/verification/import-boundaries.test.ts:9", "shortDescription": {"text": "Commented-code block (15 lines) in lib/verification/import-boundaries.test.ts:9"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/23963"}, "properties": {"repository": "AhmedKhan-GH/polaris", "repoUrl": "https://github.com/AhmedKhan-GH/polaris", "branch": "main"}, "results": [{"ruleId": "scanner-8bd957d322d118b1", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 scripts/db-setup.ts:84"}, "properties": {"repobilityId": "af90315eaf41d539", "scanner": "scanner-primary", "fingerprint": "8bd957d322d118b1", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-770f1c30c32fe694", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 scripts/create-user.ts:91"}, "properties": {"repobilityId": "006d8cc91454845b", "scanner": "scanner-primary", "fingerprint": "770f1c30c32fe694", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-43e496167fde2f4c", "level": "error", "message": {"text": "Runtime dotenv file present in repo: .env.test"}, "properties": {"repobilityId": "25baea8a4d77c75a", "scanner": "scanner-primary", "fingerprint": "43e496167fde2f4c", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets", "config", "env-file", "runtime-env", "env_file_with_secret"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".env.test"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-8745b655f5577dd3", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in docs/html/add-a-feature.html:645"}, "properties": {"repobilityId": "4c3937c2b714c0d9", "scanner": "scanner-primary", "fingerprint": "8745b655f5577dd3", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docs/html/add-a-feature.html"}, "region": {"startLine": 645}}}]}, {"ruleId": "scanner-27924aa79fa4a517", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "54c8f1b47dd62535", "scanner": "scanner-primary", "fingerprint": "27924aa79fa4a517", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 39}}}]}, {"ruleId": "scanner-27924aa79fa4a517", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "54c8f1b47dd62535", "scanner": "scanner-primary", "fingerprint": "27924aa79fa4a517", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 81}}}]}, {"ruleId": "scanner-27924aa79fa4a517", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "54c8f1b47dd62535", "scanner": "scanner-primary", "fingerprint": "27924aa79fa4a517", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 96}}}]}, {"ruleId": "scanner-141b30a41e03817b", "level": "note", "message": {"text": "No license file detected"}, "properties": {"repobilityId": "33d553d243a2c930", "scanner": "scanner-primary", "fingerprint": "141b30a41e03817b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["license", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "5144c93a4b20d320", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-749d4bc1bd66df5f", "level": "warning", "message": {"text": "Agent instructions exist but release-hardening basics are missing"}, "properties": {"repobilityId": "791cd5a37c9db4ca", "scanner": "scanner-primary", "fingerprint": "749d4bc1bd66df5f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-e725d2ab884fbd49", "level": "note", "message": {"text": "Multiple root agent instruction files without precedence"}, "properties": {"repobilityId": "1953db6c89508d22", "scanner": "scanner-primary", "fingerprint": "e725d2ab884fbd49", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["agent-instructions", "governance"]}}, {"ruleId": "scanner-11179998d397a9bf", "level": "none", "message": {"text": "Commented-code block (5 lines) in eslint.config.mjs:9"}, "properties": {"repobilityId": "f52027bd68380965", "scanner": "scanner-primary", "fingerprint": "11179998d397a9bf", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-e2ecd96407d141b1", "level": "none", "message": {"text": "Commented-code block (7 lines) in proxy.test.ts:5"}, "properties": {"repobilityId": "d7531bedff1e531c", "scanner": "scanner-primary", "fingerprint": "e2ecd96407d141b1", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-cca7d714484157ce", "level": "none", "message": {"text": "Commented-code block (7 lines) in app/_features/landing/LandingPage.test.tsx:3"}, "properties": {"repobilityId": "514b57b5e56dd9f0", "scanner": "scanner-primary", "fingerprint": "cca7d714484157ce", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-aaae4a26a08a1739", "level": "none", "message": {"text": "Commented-code block (5 lines) in app/_features/notes/nav.test.ts:3"}, "properties": {"repobilityId": "7752b98e9cbc2120", "scanner": "scanner-primary", "fingerprint": "aaae4a26a08a1739", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-bec8455586030367", "level": "none", "message": {"text": "Commented-code block (5 lines) in app/_features/notes/use-notes-realtime.test.tsx:3"}, "properties": {"repobilityId": "a8e56ea4b354a2e8", "scanner": "scanner-primary", "fingerprint": "bec8455586030367", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-4fc1f778c3e17c0e", "level": "none", "message": {"text": "Commented-code block (5 lines) in app/_features/notes/permissions.test.ts:6"}, "properties": {"repobilityId": "0f4aa30175bb37f2", "scanner": "scanner-primary", "fingerprint": "4fc1f778c3e17c0e", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-3d1045cb5f619450", "level": "none", "message": {"text": "Commented-code block (6 lines) in app/_features/notes/actions.test.ts:5"}, "properties": {"repobilityId": "7211c6710a4ff682", "scanner": "scanner-primary", "fingerprint": "3d1045cb5f619450", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-8105b2df54598eb4", "level": "none", "message": {"text": "Commented-code block (8 lines) in app/_features/notes/actions.integration.test.ts:3"}, "properties": {"repobilityId": "f7cebece40ee6db7", "scanner": "scanner-primary", "fingerprint": "8105b2df54598eb4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-ef3e6f121a58e61c", "level": "none", "message": {"text": "Commented-code block (5 lines) in app/_features/notes/__tests__/notes-rls.integration.test.ts:89"}, "properties": {"repobilityId": "d7892d9747c1c73d", "scanner": "scanner-primary", "fingerprint": "ef3e6f121a58e61c", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-997b7394b62001c9", "level": "none", "message": {"text": "Commented-code block (5 lines) in app/_features/auth/LoginForm.test.tsx:3"}, "properties": {"repobilityId": "3dd4e04ac4d6c5ee", "scanner": "scanner-primary", "fingerprint": "997b7394b62001c9", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-30409706ea7874ac", "level": "none", "message": {"text": "Commented-code block (5 lines) in app/_features/activity/permissions.test.ts:6"}, "properties": {"repobilityId": "77f5311b64e25827", "scanner": "scanner-primary", "fingerprint": "30409706ea7874ac", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-e83b07752c1dd122", "level": "none", "message": {"text": "Commented-code block (6 lines) in app/_features/activity/getSignInLog.test.ts:5"}, "properties": {"repobilityId": "4f081cf3dfed1ce6", "scanner": "scanner-primary", "fingerprint": "e83b07752c1dd122", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-4764c0c15073832a", "level": "none", "message": {"text": "Commented-code block (6 lines) in app/_features/shell/DashboardNav.test.tsx:3"}, "properties": {"repobilityId": "64bdf5aa9a2ad79d", "scanner": "scanner-primary", "fingerprint": "4764c0c15073832a", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-2a83f47ad8de84e4", "level": "none", "message": {"text": "Commented-code block (5 lines) in app/_features/shell/ChunkErrorReloader.tsx:5"}, "properties": {"repobilityId": "d0ba2c5ba7dc80e2", "scanner": "scanner-primary", "fingerprint": "2a83f47ad8de84e4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-40f5a288b4908e48", "level": "none", "message": {"text": "Commented-code block (7 lines) in app/_features/shell/ChunkErrorReloader.test.tsx:3"}, "properties": {"repobilityId": "5ca92af8637dce41", "scanner": "scanner-primary", "fingerprint": "40f5a288b4908e48", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-46b738d287c9d9ea", "level": "none", "message": {"text": "Commented-code block (5 lines) in app/_features/shell/PageHeader.test.tsx:3"}, "properties": {"repobilityId": "381b82bf4ddd04d0", "scanner": "scanner-primary", "fingerprint": "46b738d287c9d9ea", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-a91be56e69a069b0", "level": "none", "message": {"text": "Commented-code block (6 lines) in scripts/generate-feature-surfaces.mjs:3"}, "properties": {"repobilityId": "76ceeb2de0517ef9", "scanner": "scanner-primary", "fingerprint": "a91be56e69a069b0", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-ee299ed117def9f5", "level": "none", "message": {"text": "Commented-code block (6 lines) in scripts/generate-feature-surfaces.test.ts:3"}, "properties": {"repobilityId": "87a466e0fcdd6947", "scanner": "scanner-primary", "fingerprint": "ee299ed117def9f5", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-ea6afbf72361560a", "level": "none", "message": {"text": "Commented-code block (7 lines) in lib/security-headers.test.ts:8"}, "properties": {"repobilityId": "5467f6a3fc7d333d", "scanner": "scanner-primary", "fingerprint": "ea6afbf72361560a", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-4c4d92c1a323630c", "level": "none", "message": {"text": "Commented-code block (5 lines) in lib/logger.test.ts:8"}, "properties": {"repobilityId": "75124965512e21bb", "scanner": "scanner-primary", "fingerprint": "4c4d92c1a323630c", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-950fe0a52fb3a1df", "level": "none", "message": {"text": "Commented-code block (5 lines) in lib/rate-limit.test.ts:6"}, "properties": {"repobilityId": "6d0e2a3b8d39bb63", "scanner": "scanner-primary", "fingerprint": "950fe0a52fb3a1df", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-74fe14af9fc83440", "level": "none", "message": {"text": "Commented-code block (8 lines) in lib/security-headers.ts:5"}, "properties": {"repobilityId": "5c963bebea173718", "scanner": "scanner-primary", "fingerprint": "74fe14af9fc83440", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-63f16c2c600c22f1", "level": "none", "message": {"text": "Commented-code block (6 lines) in lib/audit/record-sign-in.test.ts:3"}, "properties": {"repobilityId": "1edba9094c4a59b0", "scanner": "scanner-primary", "fingerprint": "63f16c2c600c22f1", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-47de62c101eca4f5", "level": "none", "message": {"text": "Commented-code block (8 lines) in lib/registry/schema.ts:1"}, "properties": {"repobilityId": "b7ae92e500e88b8f", "scanner": "scanner-primary", "fingerprint": "47de62c101eca4f5", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-94c0ee7c7b19ad23", "level": "none", "message": {"text": "Commented-code block (6 lines) in lib/registry/nav.ts:3"}, "properties": {"repobilityId": "631ccc5cd2058afc", "scanner": "scanner-primary", "fingerprint": "94c0ee7c7b19ad23", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-bdf52bd89dfeb125", "level": "none", "message": {"text": "Commented-code block (6 lines) in lib/auth/session.test.ts:7"}, "properties": {"repobilityId": "97e680c6e3a35732", "scanner": "scanner-primary", "fingerprint": "bdf52bd89dfeb125", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-37f5cf9ff71c6b30", "level": "none", "message": {"text": "Commented-code block (5 lines) in lib/supabase/browser.test.ts:3"}, "properties": {"repobilityId": "b39f816899345673", "scanner": "scanner-primary", "fingerprint": "37f5cf9ff71c6b30", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-a7dfd57b83c8082e", "level": "none", "message": {"text": "Commented-code block (7 lines) in lib/supabase/server.test.ts:7"}, "properties": {"repobilityId": "e63b6f99ce96306d", "scanner": "scanner-primary", "fingerprint": "a7dfd57b83c8082e", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-78259d3f96da13ab", "level": "none", "message": {"text": "Commented-code block (5 lines) in lib/db/with-user-context.test.ts:3"}, "properties": {"repobilityId": "c61ccabc807a5b65", "scanner": "scanner-primary", "fingerprint": "78259d3f96da13ab", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-981dfee64d2e6812", "level": "none", "message": {"text": "Commented-code block (6 lines) in lib/db/__tests__/profiles-rls.integration.test.ts:85"}, "properties": {"repobilityId": "66558ed9a0608de1", "scanner": "scanner-primary", "fingerprint": "981dfee64d2e6812", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-46a5d4f009adbb30", "level": "none", "message": {"text": "Commented-code block (6 lines) in lib/db/__tests__/live-db.test.ts:3"}, "properties": {"repobilityId": "40111e9d49fac326", "scanner": "scanner-primary", "fingerprint": "46a5d4f009adbb30", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-65725f593405dca9", "level": "none", "message": {"text": "Commented-code block (8 lines) in lib/permissions/guard.test.ts:11"}, "properties": {"repobilityId": "0e8156f50d1fab0f", "scanner": "scanner-primary", "fingerprint": "65725f593405dca9", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-db9f81ca6b3aea04", "level": "none", "message": {"text": "Commented-code block (7 lines) in lib/permissions/ability.test.ts:5"}, "properties": {"repobilityId": "b75ef6c58c778683", "scanner": "scanner-primary", "fingerprint": "db9f81ca6b3aea04", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-7feb851d53ac1d41", "level": "none", "message": {"text": "Commented-code block (7 lines) in lib/permissions/ability.ts:4"}, "properties": {"repobilityId": "cb322a305fa94d9d", "scanner": "scanner-primary", "fingerprint": "7feb851d53ac1d41", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-b890b029c86889d0", "level": "none", "message": {"text": "Commented-code block (7 lines) in lib/realtime/use-topic.test.tsx:3"}, "properties": {"repobilityId": "07cd56894b833da3", "scanner": "scanner-primary", "fingerprint": "b890b029c86889d0", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-b3dce79581ae0897", "level": "none", "message": {"text": "Commented-code block (8 lines) in lib/verification/feature-confinement.test.ts:5"}, "properties": {"repobilityId": "3b3c88e0aaf147a7", "scanner": "scanner-primary", "fingerprint": "b3dce79581ae0897", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-1e9c98d13143ab10", "level": "none", "message": {"text": "Commented-code block (15 lines) in lib/verification/import-boundaries.test.ts:9"}, "properties": {"repobilityId": "d358f284ccdc121d", "scanner": "scanner-primary", "fingerprint": "1e9c98d13143ab10", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}]}]}