{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-f4301a123c63219e", "name": "Stray `console.log` in TS/JS \u2014 apps/api/scripts/grant-guest-dust.ts:27", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 apps/api/scripts/grant-guest-dust.ts:27"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-bbc173363f383783", "name": "Stray `console.log` in TS/JS \u2014 apps/api/scripts/smoke-starter-flow.ts:35", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 apps/api/scripts/smoke-starter-flow.ts:35"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a8aced5697984567", "name": "Stray `console.log` in TS/JS \u2014 apps/api/scripts/grant-cosmetic.ts:32", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 apps/api/scripts/grant-cosmetic.ts:32"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5d225b8866b81105", "name": "Stray `console.log` in TS/JS \u2014 apps/api/scripts/db-state.ts:40", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 apps/api/scripts/db-state.ts:40"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c36d321627e24f01", "name": "TODO/FIXME marker in shipping code \u2014 apps/game-server/tests/auras.integration.test.ts:217", "shortDescription": {"text": "TODO/FIXME marker in shipping code \u2014 apps/game-server/tests/auras.integration.test.ts:217"}, "fullDescription": {"text": "Track in /reviews or /issues, not as a code comment that rots.\n\nWhy: Drift control \u2014 shouldn't be the same as Quality TODO scanner.\nRule id: fq.todo-marker"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-ee188bf3655d75ec", "name": "TODO/FIXME marker in shipping code \u2014 apps/game-server/tests/triggered.integration.test.ts:109", "shortDescription": {"text": "TODO/FIXME marker in shipping code \u2014 apps/game-server/tests/triggered.integration.test.ts:109"}, "fullDescription": {"text": "Track in /reviews or /issues, not as a code comment that rots.\n\nWhy: Drift control \u2014 shouldn't be the same as Quality TODO scanner.\nRule id: fq.todo-marker"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-f512ed4405bd9bf8", "name": "Stray `console.log` in TS/JS \u2014 apps/game-server/scripts/smoke-pve-client.ts:13", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 apps/game-server/scripts/smoke-pve-client.ts:13"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-baeaf501edc0e29a", "name": "TODO/FIXME marker in shipping code \u2014 apps/game-server/src/cards/parts/index.ts:16", "shortDescription": {"text": "TODO/FIXME marker in shipping code \u2014 apps/game-server/src/cards/parts/index.ts:16"}, "fullDescription": {"text": "Track in /reviews or /issues, not as a code comment that rots.\n\nWhy: Drift control \u2014 shouldn't be the same as Quality TODO scanner.\nRule id: fq.todo-marker"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-105601d12cb4bc1f", "name": "Icon-only button without accessible name \u2014 apps/web/src/app/play/pve/page.tsx:3136", "shortDescription": {"text": "Icon-only button without accessible name \u2014 apps/web/src/app/play/pve/page.tsx:3136"}, "fullDescription": {"text": "A `<button>` whose only child is a single glyph or symbol needs `title=` or `aria-label=` so screen readers (and tooltips on hover) work.\n\nWhy: P3 in CHECKLIST.md \u2014 icon-only buttons skipped a title.\nRule id: fq.button.no-label"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c7047407f226a019", "name": "`dangerouslySetInnerHTML` used in a React component \u2014 apps/web/src/app/login/page.tsx:148", "shortDescription": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 apps/web/src/app/login/page.tsx:148"}, "fullDescription": {"text": "Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library.\n\nWhy: OWASP basics. Already partially flagged by the security analyzer.\nRule id: fq.dangerous-html"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-531c48507268bbae", "name": "Icon-only button without accessible name \u2014 apps/web/src/components/battle/HandActionMenu.tsx:35", "shortDescription": {"text": "Icon-only button without accessible name \u2014 apps/web/src/components/battle/HandActionMenu.tsx:35"}, "fullDescription": {"text": "A `<button>` whose only child is a single glyph or symbol needs `title=` or `aria-label=` so screen readers (and tooltips on hover) work.\n\nWhy: P3 in CHECKLIST.md \u2014 icon-only buttons skipped a title.\nRule id: fq.button.no-label"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5d74f6690ceb2bdf", "name": "Icon-only button without accessible name \u2014 apps/web/src/components/battle/FieldCardMenu.tsx:42", "shortDescription": {"text": "Icon-only button without accessible name \u2014 apps/web/src/components/battle/FieldCardMenu.tsx:42"}, "fullDescription": {"text": "A `<button>` whose only child is a single glyph or symbol needs `title=` or `aria-label=` so screen readers (and tooltips on hover) work.\n\nWhy: P3 in CHECKLIST.md \u2014 icon-only buttons skipped a title.\nRule id: fq.button.no-label"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d9980d9104825b19", "name": "Dockerfile runs as root: apps/api/Dockerfile", "shortDescription": {"text": "Dockerfile runs as root: apps/api/Dockerfile"}, "fullDescription": {"text": "No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3d70dcd36b57a39a", "name": "Docker base image is tag-pinned but not digest-pinned: node:20-alpine", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: node:20-alpine"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-58174f25de7d6c92", "name": "Dockerfile runs as root: apps/game-server/Dockerfile", "shortDescription": {"text": "Dockerfile runs as root: apps/game-server/Dockerfile"}, "fullDescription": {"text": "No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3b79f4970e4d097c", "name": "Docker base image is tag-pinned but not digest-pinned: node:20-alpine", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: node:20-alpine"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f6379020dfc8f82b", "name": "Insecure pattern 'insert_adjacent_html' in scripts/smoke-visual-mobile-modals.mjs:86", "shortDescription": {"text": "Insecure pattern 'insert_adjacent_html' in scripts/smoke-visual-mobile-modals.mjs:86"}, "fullDescription": {"text": "Found a known-risky pattern (insert_adjacent_html). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9f3e9670ff82a590", "name": "Insecure pattern 'node_child_process' in scripts/record-teaser.mjs:11", "shortDescription": {"text": "Insecure pattern 'node_child_process' in scripts/record-teaser.mjs:11"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1cc1a292bd889fee", "name": "Insecure pattern 'node_child_process' in scripts/export-docs.mjs:10", "shortDescription": {"text": "Insecure pattern 'node_child_process' in scripts/export-docs.mjs:10"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9b7fed44cecdd6c2", "name": "Insecure pattern 'dangerous_innerhtml' in apps/web/src/app/login/page.tsx:148", "shortDescription": {"text": "Insecure pattern 'dangerous_innerhtml' in apps/web/src/app/login/page.tsx:148"}, "fullDescription": {"text": "Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0211e26b24b0ccb9", "name": "Very large file: apps/game-server/src/rooms/DuelRoom.ts (1093 lines)", "shortDescription": {"text": "Very large file: apps/game-server/src/rooms/DuelRoom.ts (1093 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7242a72dff4299ed", "name": "Very large file: apps/game-server/src/rooms/PvERoom.ts (1103 lines)", "shortDescription": {"text": "Very large file: apps/game-server/src/rooms/PvERoom.ts (1103 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ead768d7710070c2", "name": "Very large file: apps/web/src/app/play/pve/page.tsx (3668 lines)", "shortDescription": {"text": "Very large file: apps/web/src/app/play/pve/page.tsx (3668 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9d7b7ae0b28ea340", "name": "Very large file: apps/web/src/app/play/pvp/page.tsx (2431 lines)", "shortDescription": {"text": "Very large file: apps/web/src/app/play/pvp/page.tsx (2431 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-bd72dc37b5478894", "name": "Very large file: apps/web/src/app/dashboard/page.tsx (1247 lines)", "shortDescription": {"text": "Very large file: apps/web/src/app/dashboard/page.tsx (1247 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9652af95dfe876cc", "name": "Very large file: apps/web/src/app/store/page.tsx (1644 lines)", "shortDescription": {"text": "Very large file: apps/web/src/app/store/page.tsx (1644 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d9ce7cf77eb189f3", "name": "Very large file: apps/web/src/app/decks/builder/page.tsx (1526 lines)", "shortDescription": {"text": "Very large file: apps/web/src/app/decks/builder/page.tsx (1526 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ea3b5e389d8c9c0f", "name": "Low test-to-source ratio", "shortDescription": {"text": "Low test-to-source ratio"}, "fullDescription": {"text": "40 tests / 233 src (ratio 0.17)."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-141b30a41e03817b", "name": "No license file detected", "shortDescription": {"text": "No license file detected"}, "fullDescription": {"text": "No LICENSE/COPYING/NOTICE file was found. Generated repositories often omit licensing, which blocks reuse and automated intake."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-526a53ac2db6e202", "name": "Node manifest has dependencies but no lockfile: packages/shared-types/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: packages/shared-types/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f85d8f0719e22fa8", "name": "Node manifest has dependencies but no lockfile: packages/contracts/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: packages/contracts/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3f65e1ca9b00183a", "name": "Node manifest has dependencies but no lockfile: packages/eslint-config/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: packages/eslint-config/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-63ebb2065358643c", "name": "Node manifest has dependencies but no lockfile: packages/card-database/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: packages/card-database/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e34bdf89118817cf", "name": "Node manifest has dependencies but no lockfile: packages/game-rules/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: packages/game-rules/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b06b8d86f24c77f9", "name": "Node manifest has dependencies but no lockfile: apps/api/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: apps/api/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-221d14543cd9a764", "name": "Node manifest has dependencies but no lockfile: apps/game-server/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: apps/game-server/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4a9eb7dc7c6e3880", "name": "Node manifest has dependencies but no lockfile: apps/web/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: apps/web/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 166 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-72b2a6250083a784", "name": "Placeholder or mock-heavy implementation detected", "shortDescription": {"text": "Placeholder or mock-heavy implementation detected"}, "fullDescription": {"text": "Found 23 placeholder/mock markers across 13 source files. This often means the repo looks complete while core flows still use generated scaffolding or fake data."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b9088664ace7f748", "name": "Composite production-readiness gap", "shortDescription": {"text": "Composite production-readiness gap"}, "fullDescription": {"text": "Multiple low-cost hardening controls are missing together: license, lockfile. Opus verification showed these co-occurring gaps are a better readiness signal than reading each flag in isolation."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d20d1902ffa333ec", "name": "Commented-code block (6 lines) in scripts/smoke-pvp-chain.mjs:1", "shortDescription": {"text": "Commented-code block (6 lines) in scripts/smoke-pvp-chain.mjs:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-979c2dce364dcae8", "name": "`fetch()` without try/.catch or AbortSignal \u2014 scripts/generate-missing-card-art.mjs:41", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 scripts/generate-missing-card-art.mjs:41"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-362b7adfd0d99391", "name": "Commented-code block (6 lines) in scripts/smoke-pve-statefilter.mjs:1", "shortDescription": {"text": "Commented-code block (6 lines) in scripts/smoke-pve-statefilter.mjs:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-9401b12a26838d8e", "name": "Commented-code block (6 lines) in scripts/smoke-pve-trap.mjs:1", "shortDescription": {"text": "Commented-code block (6 lines) in scripts/smoke-pve-trap.mjs:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-f9d751e6edf5bb31", "name": "`fetch()` without try/.catch or AbortSignal \u2014 trailer/src/lib/logoSrc.ts:3", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 trailer/src/lib/logoSrc.ts:3"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-488c19bb655bb364", "name": "Commented-code block (6 lines) in trailer/capture/gen-text-pngs.py:1", "shortDescription": {"text": "Commented-code block (6 lines) in trailer/capture/gen-text-pngs.py:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-e5d210fb2e893f27", "name": "Network/subprocess call without timeout or try/except \u2014 trailer/capture/gen-audio-mix.py:75", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 trailer/capture/gen-audio-mix.py:75"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-70b2a1159b08f112", "name": "Commented-code block (7 lines) in apps/api/tests/tournament.e2e.test.ts:149", "shortDescription": {"text": "Commented-code block (7 lines) in apps/api/tests/tournament.e2e.test.ts:149"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-4bdeb75a0dd74c20", "name": "`fetch()` without try/.catch or AbortSignal \u2014 apps/api/scripts/smoke-starter-flow.ts:52", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 apps/api/scripts/smoke-starter-flow.ts:52"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0d8a19c3a9e9c0d1", "name": "`fetch()` without try/.catch or AbortSignal \u2014 apps/api/scripts/demo-flow.ts:49", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 apps/api/scripts/demo-flow.ts:49"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6829492bc322e226", "name": "`fetch()` without try/.catch or AbortSignal \u2014 apps/api/src/services/SocialAuthService.ts:100", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 apps/api/src/services/SocialAuthService.ts:100"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-52b459af47e1762c", "name": "Legacy-named symbol `monthsOld` in apps/api/src/services/AxieCardSyncService.ts:18", "shortDescription": {"text": "Legacy-named symbol `monthsOld` in apps/api/src/services/AxieCardSyncService.ts:18"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a5690f314f407da6", "name": "Commented-code block (7 lines) in apps/api/src/services/AxieCardSyncService.ts:78", "shortDescription": {"text": "Commented-code block (7 lines) in apps/api/src/services/AxieCardSyncService.ts:78"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-095324d7b768b979", "name": "Commented-code block (5 lines) in apps/api/src/services/AccountService.ts:64", "shortDescription": {"text": "Commented-code block (5 lines) in apps/api/src/services/AccountService.ts:64"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-67c711f9ea2dbfc2", "name": "Commented-code block (9 lines) in apps/api/src/services/AxieGraphQLService.ts:130", "shortDescription": {"text": "Commented-code block (9 lines) in apps/api/src/services/AxieGraphQLService.ts:130"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-fd143b500a691299", "name": "Commented-code block (5 lines) in apps/api/src/services/StarterDeckService.ts:444", "shortDescription": {"text": "Commented-code block (5 lines) in apps/api/src/services/StarterDeckService.ts:444"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-ab3361bfdc4278dc", "name": "Commented-code block (6 lines) in apps/api/src/routes/deck.routes.ts:59", "shortDescription": {"text": "Commented-code block (6 lines) in apps/api/src/routes/deck.routes.ts:59"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-93da599c4add562a", "name": "Commented-code block (7 lines) in apps/api/src/routes/internal.routes.ts:162", "shortDescription": {"text": "Commented-code block (7 lines) in apps/api/src/routes/internal.routes.ts:162"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-f2b7abf00ec79172", "name": "Legacy-named symbol `inst_unused` in apps/game-server/tests/chainWindow.integration.test.ts:105", "shortDescription": {"text": "Legacy-named symbol `inst_unused` in apps/game-server/tests/chainWindow.integration.test.ts:105"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8b80899fea8251cb", "name": "Commented-code block (8 lines) in apps/game-server/src/index.ts:22", "shortDescription": {"text": "Commented-code block (8 lines) in apps/game-server/src/index.ts:22"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-970ccb5669a6c9c4", "name": "Commented-code block (5 lines) in apps/game-server/src/rooms/DuelRoom.ts:238", "shortDescription": {"text": "Commented-code block (5 lines) in apps/game-server/src/rooms/DuelRoom.ts:238"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-11fbf5ea99852d32", "name": "Commented-code block (5 lines) in apps/game-server/src/rooms/PvERoom.ts:260", "shortDescription": {"text": "Commented-code block (5 lines) in apps/game-server/src/rooms/PvERoom.ts:260"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-656bb9763b4cc090", "name": "Commented-code block (5 lines) in apps/game-server/src/cards/triggered/registry.ts:558", "shortDescription": {"text": "Commented-code block (5 lines) in apps/game-server/src/cards/triggered/registry.ts:558"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-9e8cb4753c035071", "name": "Commented-code block (5 lines) in apps/game-server/src/cards/effects/BuffEffect.ts:56", "shortDescription": {"text": "Commented-code block (5 lines) in apps/game-server/src/cards/effects/BuffEffect.ts:56"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-ab7a0fe5c1e6c779", "name": "Commented-code block (5 lines) in apps/game-server/src/engine/EventBus.ts:108", "shortDescription": {"text": "Commented-code block (5 lines) in apps/game-server/src/engine/EventBus.ts:108"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-eab978b598412915", "name": "Commented-code block (5 lines) in apps/game-server/src/engine/atkLockdownHelper.ts:89", "shortDescription": {"text": "Commented-code block (5 lines) in apps/game-server/src/engine/atkLockdownHelper.ts:89"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-ca2b371aa771848c", "name": "Commented-code block (5 lines) in apps/game-server/src/engine/GameEngine.ts:335", "shortDescription": {"text": "Commented-code block (5 lines) in apps/game-server/src/engine/GameEngine.ts:335"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-561371a4e9aba426", "name": "Commented-code block (5 lines) in apps/game-server/src/engine/ActionValidator.ts:217", "shortDescription": {"text": "Commented-code block (5 lines) in apps/game-server/src/engine/ActionValidator.ts:217"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-8ec1a3af7385d4b6", "name": "Commented-code block (8 lines) in apps/web/src/app/play/pve/page.tsx:454", "shortDescription": {"text": "Commented-code block (8 lines) in apps/web/src/app/play/pve/page.tsx:454"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-627eccb9c09b4b05", "name": "`fetch()` without try/.catch or AbortSignal \u2014 apps/web/src/app/play/pve/page.tsx:375", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 apps/web/src/app/play/pve/page.tsx:375"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0c255809f2bfd7b1", "name": "Commented-code block (6 lines) in apps/web/src/app/play/pvp/page.tsx:827", "shortDescription": {"text": "Commented-code block (6 lines) in apps/web/src/app/play/pvp/page.tsx:827"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-f7b7d534d19cfd6a", "name": "`fetch()` without try/.catch or AbortSignal \u2014 apps/web/src/app/play/pvp/page.tsx:361", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 apps/web/src/app/play/pvp/page.tsx:361"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c713a6b49c5d2a82", "name": "`fetch()` without try/.catch or AbortSignal \u2014 apps/web/src/app/dashboard/page.tsx:72", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 apps/web/src/app/dashboard/page.tsx:72"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b851535303729ef4", "name": "Commented-code block (5 lines) in apps/web/src/app/decks/builder/page.tsx:313", "shortDescription": {"text": "Commented-code block (5 lines) in apps/web/src/app/decks/builder/page.tsx:313"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-1b4ed8e2293180d2", "name": "`fetch()` without try/.catch or AbortSignal \u2014 apps/web/src/components/WaypointSignIn.tsx:82", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 apps/web/src/components/WaypointSignIn.tsx:82"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-eee593b3f118e5c5", "name": "Legacy-named symbol `monthsOld` in apps/web/src/lib/axie-graphql-client.ts:72", "shortDescription": {"text": "Legacy-named symbol `monthsOld` in apps/web/src/lib/axie-graphql-client.ts:72"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b334d875f2339fa1", "name": "5 env vars used in code but missing from .env.example", "shortDescription": {"text": "5 env vars used in code but missing from .env.example"}, "fullDescription": {"text": "Drift between code and config docs. The first few: `CHROME_PATH`, `GAME_SERVER_URL`, `NEXT_PUBLIC_ACTIVE_SEASON`, `NEXT_PUBLIC_WAYPOINT_CLIENT_ID`, `TEASER_URL`. Add them (with a placeholder/comment) to .env.example so onboarding doesn't break."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/24246"}, "properties": {"repository": "anuarissa/axie-duel", "repoUrl": "https://github.com/anuarissa/axie-duel", "branch": "main"}, "results": [{"ruleId": "scanner-f4301a123c63219e", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 apps/api/scripts/grant-guest-dust.ts:27"}, "properties": {"repobilityId": "186f52c69f8000a6", "scanner": "scanner-primary", "fingerprint": "f4301a123c63219e", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-bbc173363f383783", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 apps/api/scripts/smoke-starter-flow.ts:35"}, "properties": {"repobilityId": "d13f2a59d3d5214b", "scanner": "scanner-primary", "fingerprint": "bbc173363f383783", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-a8aced5697984567", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 apps/api/scripts/grant-cosmetic.ts:32"}, "properties": {"repobilityId": "9fed79bc8945d497", "scanner": "scanner-primary", "fingerprint": "a8aced5697984567", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-5d225b8866b81105", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 apps/api/scripts/db-state.ts:40"}, "properties": {"repobilityId": "269c0d0f2142defe", "scanner": "scanner-primary", "fingerprint": "5d225b8866b81105", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-c36d321627e24f01", "level": "none", "message": {"text": "TODO/FIXME marker in shipping code \u2014 apps/game-server/tests/auras.integration.test.ts:217"}, "properties": {"repobilityId": "21355030bc94084a", "scanner": "scanner-primary", "fingerprint": "c36d321627e24f01", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.todo-marker"]}}, {"ruleId": "scanner-ee188bf3655d75ec", "level": "none", "message": {"text": "TODO/FIXME marker in shipping code \u2014 apps/game-server/tests/triggered.integration.test.ts:109"}, "properties": {"repobilityId": "e427a00d44d43dc3", "scanner": "scanner-primary", "fingerprint": "ee188bf3655d75ec", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.todo-marker"]}}, {"ruleId": "scanner-f512ed4405bd9bf8", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 apps/game-server/scripts/smoke-pve-client.ts:13"}, "properties": {"repobilityId": "8f3d7293bd661891", "scanner": "scanner-primary", "fingerprint": "f512ed4405bd9bf8", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-baeaf501edc0e29a", "level": "none", "message": {"text": "TODO/FIXME marker in shipping code \u2014 apps/game-server/src/cards/parts/index.ts:16"}, "properties": {"repobilityId": "5d48ebe5c1f6800d", "scanner": "scanner-primary", "fingerprint": "baeaf501edc0e29a", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.todo-marker"]}}, {"ruleId": "scanner-105601d12cb4bc1f", "level": "note", "message": {"text": "Icon-only button without accessible name \u2014 apps/web/src/app/play/pve/page.tsx:3136"}, "properties": {"repobilityId": "55ad560e2ccfee28", "scanner": "scanner-primary", "fingerprint": "105601d12cb4bc1f", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.button.no-label"]}}, {"ruleId": "scanner-c7047407f226a019", "level": "warning", "message": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 apps/web/src/app/login/page.tsx:148"}, "properties": {"repobilityId": "09dc3fdcd78e344c", "scanner": "scanner-primary", "fingerprint": "c7047407f226a019", "layer": "frontend", "severity": "medium", "confidence": 1.0, "tags": ["frontend-quality", "fq.dangerous-html"]}}, {"ruleId": "scanner-531c48507268bbae", "level": "note", "message": {"text": "Icon-only button without accessible name \u2014 apps/web/src/components/battle/HandActionMenu.tsx:35"}, "properties": {"repobilityId": "caff774b1966983f", "scanner": "scanner-primary", "fingerprint": "531c48507268bbae", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.button.no-label"]}}, {"ruleId": "scanner-5d74f6690ceb2bdf", "level": "note", "message": {"text": "Icon-only button without accessible name \u2014 apps/web/src/components/battle/FieldCardMenu.tsx:42"}, "properties": {"repobilityId": "a0d0323ccb9646f9", "scanner": "scanner-primary", "fingerprint": "5d74f6690ceb2bdf", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.button.no-label"]}}, {"ruleId": "scanner-d9980d9104825b19", "level": "warning", "message": {"text": "Dockerfile runs as root: apps/api/Dockerfile"}, "properties": {"repobilityId": "e591b11d8a0c1fe7", "scanner": "scanner-primary", "fingerprint": "d9980d9104825b19", "layer": "hardware", "severity": "medium", "confidence": 1.0, "tags": ["security", "container"]}}, {"ruleId": "scanner-3d70dcd36b57a39a", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: node:20-alpine"}, "properties": {"repobilityId": "5d9dbe3fe4b54883", "scanner": "scanner-primary", "fingerprint": "3d70dcd36b57a39a", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/api/Dockerfile"}, "region": {"startLine": 6}}}]}, {"ruleId": "scanner-3d70dcd36b57a39a", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: node:20-alpine"}, "properties": {"repobilityId": "60cae93b529b518d", "scanner": "scanner-primary", "fingerprint": "3d70dcd36b57a39a", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/api/Dockerfile"}, "region": {"startLine": 31}}}]}, {"ruleId": "scanner-58174f25de7d6c92", "level": "warning", "message": {"text": "Dockerfile runs as root: apps/game-server/Dockerfile"}, "properties": {"repobilityId": "45f52bc80a0a5457", "scanner": "scanner-primary", "fingerprint": "58174f25de7d6c92", "layer": "hardware", "severity": "medium", "confidence": 1.0, "tags": ["security", "container"]}}, {"ruleId": "scanner-3b79f4970e4d097c", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: node:20-alpine"}, "properties": {"repobilityId": "4f903067cbceb9cf", "scanner": "scanner-primary", "fingerprint": "3b79f4970e4d097c", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/game-server/Dockerfile"}, "region": {"startLine": 2}}}]}, {"ruleId": "scanner-3b79f4970e4d097c", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: node:20-alpine"}, "properties": {"repobilityId": "e8db51b1d5ec67e9", "scanner": "scanner-primary", "fingerprint": "3b79f4970e4d097c", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/game-server/Dockerfile"}, "region": {"startLine": 23}}}]}, {"ruleId": "scanner-f6379020dfc8f82b", "level": "warning", "message": {"text": "Insecure pattern 'insert_adjacent_html' in scripts/smoke-visual-mobile-modals.mjs:86"}, "properties": {"repobilityId": "67f90c248496ff8a", "scanner": "scanner-primary", "fingerprint": "f6379020dfc8f82b", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "insert_adjacent_html"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/smoke-visual-mobile-modals.mjs"}, "region": {"startLine": 86}}}]}, {"ruleId": "scanner-9f3e9670ff82a590", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in scripts/record-teaser.mjs:11"}, "properties": {"repobilityId": "37805a0cc42606f1", "scanner": "scanner-primary", "fingerprint": "9f3e9670ff82a590", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/record-teaser.mjs"}, "region": {"startLine": 11}}}]}, {"ruleId": "scanner-1cc1a292bd889fee", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in scripts/export-docs.mjs:10"}, "properties": {"repobilityId": "6c84d5a203afbd2b", "scanner": "scanner-primary", "fingerprint": "1cc1a292bd889fee", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/export-docs.mjs"}, "region": {"startLine": 10}}}]}, {"ruleId": "scanner-9b7fed44cecdd6c2", "level": "warning", "message": {"text": "Insecure pattern 'dangerous_innerhtml' in apps/web/src/app/login/page.tsx:148"}, "properties": {"repobilityId": "3b8acb2860c29833", "scanner": "scanner-primary", "fingerprint": "9b7fed44cecdd6c2", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "dangerous_innerhtml"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/web/src/app/login/page.tsx"}, "region": {"startLine": 148}}}]}, {"ruleId": "scanner-0211e26b24b0ccb9", "level": "note", "message": {"text": "Very large file: apps/game-server/src/rooms/DuelRoom.ts (1093 lines)"}, "properties": {"repobilityId": "e287005de92d1881", "scanner": "scanner-primary", "fingerprint": "0211e26b24b0ccb9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-7242a72dff4299ed", "level": "note", "message": {"text": "Very large file: apps/game-server/src/rooms/PvERoom.ts (1103 lines)"}, "properties": {"repobilityId": "321175354cd088b0", "scanner": "scanner-primary", "fingerprint": "7242a72dff4299ed", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-ead768d7710070c2", "level": "note", "message": {"text": "Very large file: apps/web/src/app/play/pve/page.tsx (3668 lines)"}, "properties": {"repobilityId": "65af3e5106e2d012", "scanner": "scanner-primary", "fingerprint": "ead768d7710070c2", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-9d7b7ae0b28ea340", "level": "note", "message": {"text": "Very large file: apps/web/src/app/play/pvp/page.tsx (2431 lines)"}, "properties": {"repobilityId": "43bcb1ca9dcc6da9", "scanner": "scanner-primary", "fingerprint": "9d7b7ae0b28ea340", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-bd72dc37b5478894", "level": "note", "message": {"text": "Very large file: apps/web/src/app/dashboard/page.tsx (1247 lines)"}, "properties": {"repobilityId": "68cb21e9a189adc1", "scanner": "scanner-primary", "fingerprint": "bd72dc37b5478894", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-9652af95dfe876cc", "level": "note", "message": {"text": "Very large file: apps/web/src/app/store/page.tsx (1644 lines)"}, "properties": {"repobilityId": "e65d9b1554d70d57", "scanner": "scanner-primary", "fingerprint": "9652af95dfe876cc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-d9ce7cf77eb189f3", "level": "note", "message": {"text": "Very large file: apps/web/src/app/decks/builder/page.tsx (1526 lines)"}, "properties": {"repobilityId": "ad93a19d921eb669", "scanner": "scanner-primary", "fingerprint": "d9ce7cf77eb189f3", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-ea3b5e389d8c9c0f", "level": "note", "message": {"text": "Low test-to-source ratio"}, "properties": {"repobilityId": "ef7b2552cc00a375", "scanner": "scanner-primary", "fingerprint": "ea3b5e389d8c9c0f", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["tests"]}}, {"ruleId": "scanner-141b30a41e03817b", "level": "note", "message": {"text": "No license file detected"}, "properties": {"repobilityId": "a42baebe25b987ed", "scanner": "scanner-primary", "fingerprint": "141b30a41e03817b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["license", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-526a53ac2db6e202", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: packages/shared-types/package.json"}, "properties": {"repobilityId": "72479dbac9b1ad66", "scanner": "scanner-primary", "fingerprint": "526a53ac2db6e202", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/shared-types/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f85d8f0719e22fa8", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: packages/contracts/package.json"}, "properties": {"repobilityId": "9533b27beaa7d171", "scanner": "scanner-primary", "fingerprint": "f85d8f0719e22fa8", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/contracts/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3f65e1ca9b00183a", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: packages/eslint-config/package.json"}, "properties": {"repobilityId": "7374bbf66cd702ed", "scanner": "scanner-primary", "fingerprint": "3f65e1ca9b00183a", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/eslint-config/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-63ebb2065358643c", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: packages/card-database/package.json"}, "properties": {"repobilityId": "30b125896dfc24ae", "scanner": "scanner-primary", "fingerprint": "63ebb2065358643c", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/card-database/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e34bdf89118817cf", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: packages/game-rules/package.json"}, "properties": {"repobilityId": "e3f78b2431914bf0", "scanner": "scanner-primary", "fingerprint": "e34bdf89118817cf", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/game-rules/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b06b8d86f24c77f9", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: apps/api/package.json"}, "properties": {"repobilityId": "ce77cd34ed0306d4", "scanner": "scanner-primary", "fingerprint": "b06b8d86f24c77f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/api/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-221d14543cd9a764", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: apps/game-server/package.json"}, "properties": {"repobilityId": "be93fadbdfe86c6b", "scanner": "scanner-primary", "fingerprint": "221d14543cd9a764", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/game-server/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-4a9eb7dc7c6e3880", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: apps/web/package.json"}, "properties": {"repobilityId": "6c1704bf24cf19ac", "scanner": "scanner-primary", "fingerprint": "4a9eb7dc7c6e3880", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/web/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "362ab097c07d7941", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-72b2a6250083a784", "level": "warning", "message": {"text": "Placeholder or mock-heavy implementation detected"}, "properties": {"repobilityId": "f78de9bbe38219e3", "scanner": "scanner-primary", "fingerprint": "72b2a6250083a784", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "incomplete", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "f6b4420781c0e3e9", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-b9088664ace7f748", "level": "note", "message": {"text": "Composite production-readiness gap"}, "properties": {"repobilityId": "c59a73b40e8ee37b", "scanner": "scanner-primary", "fingerprint": "b9088664ace7f748", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["production-readiness", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-d20d1902ffa333ec", "level": "none", "message": {"text": "Commented-code block (6 lines) in scripts/smoke-pvp-chain.mjs:1"}, "properties": {"repobilityId": "a308d6b7584dd973", "scanner": "scanner-primary", "fingerprint": "d20d1902ffa333ec", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-979c2dce364dcae8", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 scripts/generate-missing-card-art.mjs:41"}, "properties": {"repobilityId": "bdfd9dcaa98bc203", "scanner": "scanner-primary", "fingerprint": "979c2dce364dcae8", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-362b7adfd0d99391", "level": "none", "message": {"text": "Commented-code block (6 lines) in scripts/smoke-pve-statefilter.mjs:1"}, "properties": {"repobilityId": "a3ca9b23c320af88", "scanner": "scanner-primary", "fingerprint": "362b7adfd0d99391", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-9401b12a26838d8e", "level": "none", "message": {"text": "Commented-code block (6 lines) in scripts/smoke-pve-trap.mjs:1"}, "properties": {"repobilityId": "926a8b9fb94d341b", "scanner": "scanner-primary", "fingerprint": "9401b12a26838d8e", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-f9d751e6edf5bb31", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 trailer/src/lib/logoSrc.ts:3"}, "properties": {"repobilityId": "d5efdaf8617304ce", "scanner": "scanner-primary", "fingerprint": "f9d751e6edf5bb31", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-488c19bb655bb364", "level": "none", "message": {"text": "Commented-code block (6 lines) in trailer/capture/gen-text-pngs.py:1"}, "properties": {"repobilityId": "7b692613196959b8", "scanner": "scanner-primary", "fingerprint": "488c19bb655bb364", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-e5d210fb2e893f27", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 trailer/capture/gen-audio-mix.py:75"}, "properties": {"repobilityId": "cb530b7ac0ca7f6b", "scanner": "scanner-primary", "fingerprint": "e5d210fb2e893f27", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-70b2a1159b08f112", "level": "none", "message": {"text": "Commented-code block (7 lines) in apps/api/tests/tournament.e2e.test.ts:149"}, "properties": {"repobilityId": "4644b4ce949b926a", "scanner": "scanner-primary", "fingerprint": "70b2a1159b08f112", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-4bdeb75a0dd74c20", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 apps/api/scripts/smoke-starter-flow.ts:52"}, "properties": {"repobilityId": "5a37eb80302c6257", "scanner": "scanner-primary", "fingerprint": "4bdeb75a0dd74c20", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-0d8a19c3a9e9c0d1", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 apps/api/scripts/demo-flow.ts:49"}, "properties": {"repobilityId": "a8e82d913b798277", "scanner": "scanner-primary", "fingerprint": "0d8a19c3a9e9c0d1", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-6829492bc322e226", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 apps/api/src/services/SocialAuthService.ts:100"}, "properties": {"repobilityId": "dbaa6b962c7c848f", "scanner": "scanner-primary", "fingerprint": "6829492bc322e226", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-52b459af47e1762c", "level": "note", "message": {"text": "Legacy-named symbol `monthsOld` in apps/api/src/services/AxieCardSyncService.ts:18"}, "properties": {"repobilityId": "d6f40a6a9d73540e", "scanner": "scanner-primary", "fingerprint": "52b459af47e1762c", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-a5690f314f407da6", "level": "none", "message": {"text": "Commented-code block (7 lines) in apps/api/src/services/AxieCardSyncService.ts:78"}, "properties": {"repobilityId": "d9300387c5985e10", "scanner": "scanner-primary", "fingerprint": "a5690f314f407da6", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-095324d7b768b979", "level": "none", "message": {"text": "Commented-code block (5 lines) in apps/api/src/services/AccountService.ts:64"}, "properties": {"repobilityId": "a1561dfa39195d10", "scanner": "scanner-primary", "fingerprint": "095324d7b768b979", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-67c711f9ea2dbfc2", "level": "none", "message": {"text": "Commented-code block (9 lines) in apps/api/src/services/AxieGraphQLService.ts:130"}, "properties": {"repobilityId": "260a0344460b5938", "scanner": "scanner-primary", "fingerprint": "67c711f9ea2dbfc2", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-fd143b500a691299", "level": "none", "message": {"text": "Commented-code block (5 lines) in apps/api/src/services/StarterDeckService.ts:444"}, "properties": {"repobilityId": "b65bc68b35c11c55", "scanner": "scanner-primary", "fingerprint": "fd143b500a691299", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-ab3361bfdc4278dc", "level": "none", "message": {"text": "Commented-code block (6 lines) in apps/api/src/routes/deck.routes.ts:59"}, "properties": {"repobilityId": "d86663d326c5611f", "scanner": "scanner-primary", "fingerprint": "ab3361bfdc4278dc", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-93da599c4add562a", "level": "none", "message": {"text": "Commented-code block (7 lines) in apps/api/src/routes/internal.routes.ts:162"}, "properties": {"repobilityId": "7ca7c0e35fcc18e5", "scanner": "scanner-primary", "fingerprint": "93da599c4add562a", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-f2b7abf00ec79172", "level": "note", "message": {"text": "Legacy-named symbol `inst_unused` in apps/game-server/tests/chainWindow.integration.test.ts:105"}, "properties": {"repobilityId": "ff1b48ae7c086c29", "scanner": "scanner-primary", "fingerprint": "f2b7abf00ec79172", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-8b80899fea8251cb", "level": "none", "message": {"text": "Commented-code block (8 lines) in apps/game-server/src/index.ts:22"}, "properties": {"repobilityId": "55b03c0ec2a88c32", "scanner": "scanner-primary", "fingerprint": "8b80899fea8251cb", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-970ccb5669a6c9c4", "level": "none", "message": {"text": "Commented-code block (5 lines) in apps/game-server/src/rooms/DuelRoom.ts:238"}, "properties": {"repobilityId": "68e6337414378b61", "scanner": "scanner-primary", "fingerprint": "970ccb5669a6c9c4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-11fbf5ea99852d32", "level": "none", "message": {"text": "Commented-code block (5 lines) in apps/game-server/src/rooms/PvERoom.ts:260"}, "properties": {"repobilityId": "47fb254d3379d26e", "scanner": "scanner-primary", "fingerprint": "11fbf5ea99852d32", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-656bb9763b4cc090", "level": "none", "message": {"text": "Commented-code block (5 lines) in apps/game-server/src/cards/triggered/registry.ts:558"}, "properties": {"repobilityId": "667c889977e7af69", "scanner": "scanner-primary", "fingerprint": "656bb9763b4cc090", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-9e8cb4753c035071", "level": "none", "message": {"text": "Commented-code block (5 lines) in apps/game-server/src/cards/effects/BuffEffect.ts:56"}, "properties": {"repobilityId": "9e920c61626f0fce", "scanner": "scanner-primary", "fingerprint": "9e8cb4753c035071", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-ab7a0fe5c1e6c779", "level": "none", "message": {"text": "Commented-code block (5 lines) in apps/game-server/src/engine/EventBus.ts:108"}, "properties": {"repobilityId": "7127b00299696dbc", "scanner": "scanner-primary", "fingerprint": "ab7a0fe5c1e6c779", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-eab978b598412915", "level": "none", "message": {"text": "Commented-code block (5 lines) in apps/game-server/src/engine/atkLockdownHelper.ts:89"}, "properties": {"repobilityId": "8068d29f91dd28bc", "scanner": "scanner-primary", "fingerprint": "eab978b598412915", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-ca2b371aa771848c", "level": "none", "message": {"text": "Commented-code block (5 lines) in apps/game-server/src/engine/GameEngine.ts:335"}, "properties": {"repobilityId": "be85e24dfe65e80a", "scanner": "scanner-primary", "fingerprint": "ca2b371aa771848c", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-561371a4e9aba426", "level": "none", "message": {"text": "Commented-code block (5 lines) in apps/game-server/src/engine/ActionValidator.ts:217"}, "properties": {"repobilityId": "fd3d25e2f25c433a", "scanner": "scanner-primary", "fingerprint": "561371a4e9aba426", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-8ec1a3af7385d4b6", "level": "none", "message": {"text": "Commented-code block (8 lines) in apps/web/src/app/play/pve/page.tsx:454"}, "properties": {"repobilityId": "9d354a2fe648bd9c", "scanner": "scanner-primary", "fingerprint": "8ec1a3af7385d4b6", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-627eccb9c09b4b05", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 apps/web/src/app/play/pve/page.tsx:375"}, "properties": {"repobilityId": "cb97d89bc7e7a57d", "scanner": "scanner-primary", "fingerprint": "627eccb9c09b4b05", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-0c255809f2bfd7b1", "level": "none", "message": {"text": "Commented-code block (6 lines) in apps/web/src/app/play/pvp/page.tsx:827"}, "properties": {"repobilityId": "a8dfda7ed0b0c47a", "scanner": "scanner-primary", "fingerprint": "0c255809f2bfd7b1", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-f7b7d534d19cfd6a", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 apps/web/src/app/play/pvp/page.tsx:361"}, "properties": {"repobilityId": "0191bc75d7521c9d", "scanner": "scanner-primary", "fingerprint": "f7b7d534d19cfd6a", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-c713a6b49c5d2a82", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 apps/web/src/app/dashboard/page.tsx:72"}, "properties": {"repobilityId": "23d78686809ffcd7", "scanner": "scanner-primary", "fingerprint": "c713a6b49c5d2a82", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-b851535303729ef4", "level": "none", "message": {"text": "Commented-code block (5 lines) in apps/web/src/app/decks/builder/page.tsx:313"}, "properties": {"repobilityId": "373ff924d04e0bd5", "scanner": "scanner-primary", "fingerprint": "b851535303729ef4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-1b4ed8e2293180d2", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 apps/web/src/components/WaypointSignIn.tsx:82"}, "properties": {"repobilityId": "05e4f9e0fc8ed166", "scanner": "scanner-primary", "fingerprint": "1b4ed8e2293180d2", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-eee593b3f118e5c5", "level": "note", "message": {"text": "Legacy-named symbol `monthsOld` in apps/web/src/lib/axie-graphql-client.ts:72"}, "properties": {"repobilityId": "5475711ee651de40", "scanner": "scanner-primary", "fingerprint": "eee593b3f118e5c5", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-b334d875f2339fa1", "level": "note", "message": {"text": "5 env vars used in code but missing from .env.example"}, "properties": {"repobilityId": "faa38682016f5d53", "scanner": "scanner-primary", "fingerprint": "b334d875f2339fa1", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "config-drift"]}}]}]}