{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-bc1306f4ae2c51c9", "name": "`dangerouslySetInnerHTML` used in a React component \u2014 apps/web/src/components/ui/chart.tsx:93", "shortDescription": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 apps/web/src/components/ui/chart.tsx:93"}, "fullDescription": {"text": "Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library.\n\nWhy: OWASP basics. Already partially flagged by the security analyzer.\nRule id: fq.dangerous-html"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "medium", "confidence": 0.8}}, {"id": "scanner-e8851e62e82437f1", "name": "CVE-2026-42199: grid 0.18.0 \u2014 Cargo.lock", "shortDescription": {"text": "CVE-2026-42199: grid 0.18.0 \u2014 Cargo.lock"}, "fullDescription": {"text": "Grid: Integer Overflow in Grid::expand_rows Leads to Safe-API Undefined Behavior\n\nGrid is a data structure grid for rust. From version 0.17.0 to before version 1.0.1, an integer overflow in Grid::expand_rows() can corrupt the relationship between the grid\u2019s logical dimensions and its backing storage. After the internal invariant is broken, the safe API get() may invoke get_unchecked() with an invalid index, resulting in Undefined Behavior. This issue has been patched in version 1.0.1.\n\nPackage: grid\nInstalled: 0.18.0\nFixed in: 1.0.1\nSeverity: MEDIUM\nFix: Upgrade grid to 1.0.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-aef9872ebbd2b160", "name": "Agent authority lacks a verifier contract: .github/copilot-instructions.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .github/copilot-instructions.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f3321f3de07fb846", "name": "SkillSpector EA3 (excessive-agency) in LICENSE", "shortDescription": {"text": "SkillSpector EA3 (excessive-agency) in LICENSE"}, "fullDescription": {"text": "NOT LIMITED TO\n\nSkill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.\n\nSkill: unknown\nRule: EA3  Category: excessive-agency\nSeverity: LOW  Confidence: 0.70\n\nRemediation: Limit the skill's scope to its documented purpose. Remove instructions that enable the agent to perform actions outside its stated functionality."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 0.7}}, {"id": "scanner-66c131ab98cf4c98", "name": "SkillSpector OH1 (output-handling) in apps/web/src/components/ui/chart.tsx", "shortDescription": {"text": "SkillSpector OH1 (output-handling) in apps/web/src/components/ui/chart.tsx"}, "fullDescription": {"text": "dangerouslySetInnerHTML={\n\nModel output is used without validation or sanitization. Unvalidated output injected into downstream contexts (SQL, shell, HTML) enables injection attacks and arbitrary code execution.\n\nSkill: unknown\nRule: OH1  Category: output-handling\nSeverity: HIGH  Confidence: 0.65\n\nRemediation: Validate and sanitize all model output before using it in downstream contexts. Use parameterized queries for SQL, shell quoting for commands, and HTML encoding for web output."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.65}}, {"id": "scanner-a6d8863645157de9", "name": "SkillSpector PE3 (priv-esc) in moon.yml", "shortDescription": {"text": "SkillSpector PE3 (priv-esc) in moon.yml"}, "fullDescription": {"text": ".env.local\"\n\nCode accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.\n\nSkill: unknown\nRule: PE3  Category: priv-esc\nSeverity: HIGH  Confidence: 0.60\n\nRemediation: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.6}}, {"id": "scanner-7c3d1a99717c2130", "name": "SkillSpector SC1 (supply-chain) in apps/api/package.json", "shortDescription": {"text": "SkillSpector SC1 (supply-chain) in apps/api/package.json"}, "fullDescription": {"text": "\"elysia\": \"latest\"\n\nDependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.\n\nSkill: unknown\nRule: SC1  Category: supply-chain\nSeverity: LOW  Confidence: 0.70\n\nRemediation: Pin all dependency versions in requirements.txt or pyproject.toml. Use exact versions (==) or compatible ranges. Run pip-audit regularly."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 0.7}}, {"id": "scanner-90bbed042b9f3cd6", "name": "SkillSpector SC1 (supply-chain) in apps/web/package.json", "shortDescription": {"text": "SkillSpector SC1 (supply-chain) in apps/web/package.json"}, "fullDescription": {"text": "\"@tanstack/react-devtools\": \"latest\"\n\nDependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.\n\nSkill: unknown\nRule: SC1  Category: supply-chain\nSeverity: LOW  Confidence: 0.70\n\nRemediation: Pin all dependency versions in requirements.txt or pyproject.toml. Use exact versions (==) or compatible ranges. Run pip-audit regularly."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 0.7}}, {"id": "scanner-b0f535a4f000ac50", "name": "SkillSpector SC4 (supply-chain) in apps/api/package.json", "shortDescription": {"text": "SkillSpector SC4 (supply-chain) in apps/api/package.json"}, "fullDescription": {"text": "elysia\n\nDependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.\n\nSkill: unknown\nRule: SC4  Category: supply-chain\nSeverity: CRITICAL  Confidence: 0.90\n\nRemediation: Update the dependency to a patched version that addresses the known CVE. Check OSV (osv.dev) or NVD for details on the vulnerability."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 0.9}}, {"id": "scanner-c852ccf9deb6e70b", "name": "SkillSpector SC4 (supply-chain) in apps/web/package.json", "shortDescription": {"text": "SkillSpector SC4 (supply-chain) in apps/web/package.json"}, "fullDescription": {"text": "@tanstack/react-router\n\nDependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.\n\nSkill: unknown\nRule: SC4  Category: supply-chain\nSeverity: CRITICAL  Confidence: 0.90\n\nRemediation: Update the dependency to a patched version that addresses the known CVE. Check OSV (osv.dev) or NVD for details on the vulnerability."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 0.9}}, {"id": "scanner-f28e5cfcd7afa141", "name": "SkillSpector SC6 (supply-chain) in apps/web/package.json", "shortDescription": {"text": "SkillSpector SC6 (supply-chain) in apps/web/package.json"}, "fullDescription": {"text": "vaul\n\nPackage name closely resembles a popular package, suggesting possible typosquatting. Attackers publish malicious packages with similar names to trick developers into installing them.\n\nSkill: unknown\nRule: SC6  Category: supply-chain\nSeverity: HIGH  Confidence: 0.70\n\nRemediation: Verify the package name is correct and not a typosquatting variant. Compare against the official package name on PyPI or npm."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.7}}, {"id": "scanner-e637c415447867e4", "name": "Run SkillSpector's LLM-backed analysis in your own pipeline", "shortDescription": {"text": "Run SkillSpector's LLM-backed analysis in your own pipeline"}, "fullDescription": {"text": "Repobility ran SkillSpector's static rules server-side. The deeper LLM-backed analyzers \u2014 tool-poisoning (TP*), semantic security discovery (SSD*), developer-intent mismatch (SDI*) \u2014 are meant to run on YOUR machine with YOUR model; repobility never sends your code to an LLM. Recipe:\n\n# 1. Install SkillSpector in your own isolated env\npipx install \"skillspector @ git+https://github.com/NVIDIA/SkillSpector.git\"\n\n# 2. Point it at YOUR LLM pipeline (pick one) - your code stays on your machine\nexport SKILLSPECTOR_PROVIDER=anthropic && export ANTHROPIC_API_KEY=sk-ant-...\n# export SKILLSPECTOR_PROVIDER=openai   && export OPENAI_API_KEY=sk-...\n# export SKILLSPECTOR_PROVIDER=openai OPENAI_API_KEY=ollama OPENAI_BASE_URL=http://localhost:11434/v1 SKILLSPECTOR_MODEL=llama3.1:8b\n# export SKILLSPECTOR_PROVIDER=nv_build && export NVIDIA_INFERENCE_KEY=nvapi-...\n\n# 3. Run the LLM-backed scan per skill (omit --no-llm to enable the LLM analyzers)\nskillspector scan . --format sarif --output skillspector-"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "info", "confidence": 1.0}}, {"id": "scanner-eb55f681b095413b", "name": "Insecure pattern 'dangerous_innerhtml' in apps/web/src/components/ui/chart.tsx:93", "shortDescription": {"text": "Insecure pattern 'dangerous_innerhtml' in apps/web/src/components/ui/chart.tsx:93"}, "fullDescription": {"text": "Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.65}}, {"id": "scanner-6372cebde0220094", "name": "No auth library detected", "shortDescription": {"text": "No auth library detected"}, "fullDescription": {"text": "The scanner did not find any standard auth library (JWT, OAuth, NextAuth, Auth0, etc.). The repo has auth/admin/session surface indicators, so auth may live in custom code, in a separate service, or be missing."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-dda02cf78cc47a1e", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6893a6c8b0861585", "name": "Very low test-to-source ratio", "shortDescription": {"text": "Very low test-to-source ratio"}, "fullDescription": {"text": "0 test file(s) for 65 source file(s) (ratio 0.00). Consider adding integration or unit tests for critical paths."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-36a70142ea707354", "name": "Node manifest has dependencies but no lockfile: apps/api/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: apps/api/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f73c8ff17174db57", "name": "Node manifest has dependencies but no lockfile: apps/web/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: apps/web/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "low", "confidence": 1.0}}, {"id": "scanner-11825279136b53a3", "name": "CI is configured but no tests are detected", "shortDescription": {"text": "CI is configured but no tests are detected"}, "fullDescription": {"text": "A CI pipeline exists, but the scan found no test files to gate. Opus labeled this generated-code pattern as config theater: release machinery exists, but it has little behavioral signal."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b9088664ace7f748", "name": "Composite production-readiness gap", "shortDescription": {"text": "Composite production-readiness gap"}, "fullDescription": {"text": "Multiple low-cost hardening controls are missing together: tests, lockfile. Opus verification showed these co-occurring gaps are a better readiness signal than reading each flag in isolation."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-749d4bc1bd66df5f", "name": "Agent instructions exist but release-hardening basics are missing", "shortDescription": {"text": "Agent instructions exist but release-hardening basics are missing"}, "fullDescription": {"text": "AI-coder instruction files were found, but the repo is missing tests, lockfile. Treat this as a contract gap: the agent is guided, but the generated output is not yet guarded by the controls that make it repeatable."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f8dfec0225ef5c93", "name": "Vulnerable dependency vite 8.0.0: GHSA-4w7w-66w2-5vf9", "shortDescription": {"text": "Vulnerable dependency vite 8.0.0: GHSA-4w7w-66w2-5vf9"}, "fullDescription": {"text": "OSV.dev reports `vite` at version `8.0.0` (declared in `apps/web/package.json`) is affected by GHSA-4w7w-66w2-5vf9 (aka CVE-2026-39365).\nNote: `8.0.0` is the declared floor of a range \u2014 the installed version may be newer.\n\nVite Vulnerable to Path Traversal in Optimized Deps `.map` Handling\n\nAliases: CVE-2026-39365\nAdvisory: https://osv.dev/vulnerability/GHSA-4w7w-66w2-5vf9\nFix: upgrade `vite` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.7}}, {"id": "scanner-4c76bfc6063d7588", "name": "Vulnerable dependency vite 8.0.0: GHSA-fx2h-pf6j-xcff", "shortDescription": {"text": "Vulnerable dependency vite 8.0.0: GHSA-fx2h-pf6j-xcff"}, "fullDescription": {"text": "OSV.dev reports `vite` at version `8.0.0` (declared in `apps/web/package.json`) is affected by GHSA-fx2h-pf6j-xcff (aka CVE-2026-53571).\nNote: `8.0.0` is the declared floor of a range \u2014 the installed version may be newer.\n\nvite: `server.fs.deny` bypass on Windows alternate paths\n\nAliases: CVE-2026-53571\nAdvisory: https://osv.dev/vulnerability/GHSA-fx2h-pf6j-xcff\nFix: upgrade `vite` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 0.7}}, {"id": "scanner-6f7c843dedcde22c", "name": "Vulnerable dependency vite 8.0.0: GHSA-p9ff-h696-f583", "shortDescription": {"text": "Vulnerable dependency vite 8.0.0: GHSA-p9ff-h696-f583"}, "fullDescription": {"text": "OSV.dev reports `vite` at version `8.0.0` (declared in `apps/web/package.json`) is affected by GHSA-p9ff-h696-f583 (aka CVE-2026-39363).\nNote: `8.0.0` is the declared floor of a range \u2014 the installed version may be newer.\n\nVite Vulnerable to Arbitrary File Read via Vite Dev Server WebSocket\n\nAliases: CVE-2026-39363\nAdvisory: https://osv.dev/vulnerability/GHSA-p9ff-h696-f583\nFix: upgrade `vite` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 0.7}}, {"id": "scanner-932f4f86c3f313ae", "name": "Vulnerable dependency vite 8.0.0: GHSA-v2wj-q39q-566r", "shortDescription": {"text": "Vulnerable dependency vite 8.0.0: GHSA-v2wj-q39q-566r"}, "fullDescription": {"text": "OSV.dev reports `vite` at version `8.0.0` (declared in `apps/web/package.json`) is affected by GHSA-v2wj-q39q-566r (aka CVE-2026-39364).\nNote: `8.0.0` is the declared floor of a range \u2014 the installed version may be newer.\n\nVite: `server.fs.deny` bypassed with queries\n\nAliases: CVE-2026-39364\nAdvisory: https://osv.dev/vulnerability/GHSA-v2wj-q39q-566r\nFix: upgrade `vite` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 0.7}}, {"id": "scanner-94935da7e075b61c", "name": "Vulnerable dependency vite 8.0.0: GHSA-v6wh-96g9-6wx3", "shortDescription": {"text": "Vulnerable dependency vite 8.0.0: GHSA-v6wh-96g9-6wx3"}, "fullDescription": {"text": "OSV.dev reports `vite` at version `8.0.0` (declared in `apps/web/package.json`) is affected by GHSA-v6wh-96g9-6wx3 (aka CVE-2026-53632).\nNote: `8.0.0` is the declared floor of a range \u2014 the installed version may be newer.\n\nlaunch-editor: NTLMv2 hash disclosure via UNC path handling on Windows\n\nAliases: CVE-2026-53632\nAdvisory: https://osv.dev/vulnerability/GHSA-v6wh-96g9-6wx3\nFix: upgrade `vite` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.7}}, {"id": "scanner-55c9f03141b32d8c", "name": "Vulnerable dependency async-std 1.13.2: RUSTSEC-2025-0052", "shortDescription": {"text": "Vulnerable dependency async-std 1.13.2: RUSTSEC-2025-0052"}, "fullDescription": {"text": "OSV.dev reports `async-std` at version `1.13.2` (resolved in `Cargo.lock`) is affected by RUSTSEC-2025-0052.\nNote: `async-std` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nasync-std has been discontinued\n\nAdvisory: https://osv.dev/vulnerability/RUSTSEC-2025-0052\nFix: upgrade `async-std` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-72795afd3f435bfa", "name": "Vulnerable dependency grid 0.18.0: GHSA-38c5-483c-4qqp", "shortDescription": {"text": "Vulnerable dependency grid 0.18.0: GHSA-38c5-483c-4qqp"}, "fullDescription": {"text": "OSV.dev reports `grid` at version `0.18.0` (resolved in `Cargo.lock`) is affected by GHSA-38c5-483c-4qqp (aka CVE-2026-42199).\nNote: `grid` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nGrid: Integer Overflow in Grid::expand_rows Leads to Safe-API Undefined Behavior\n\nAliases: CVE-2026-42199\nAdvisory: https://osv.dev/vulnerability/GHSA-38c5-483c-4qqp\nFix: upgrade `grid` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-a69f21eb55810617", "name": "Vulnerable dependency instant 0.1.13: RUSTSEC-2024-0384", "shortDescription": {"text": "Vulnerable dependency instant 0.1.13: RUSTSEC-2024-0384"}, "fullDescription": {"text": "OSV.dev reports `instant` at version `0.1.13` (resolved in `Cargo.lock`) is affected by RUSTSEC-2024-0384.\nNote: `instant` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\n`instant` is unmaintained\n\nAdvisory: https://osv.dev/vulnerability/RUSTSEC-2024-0384\nFix: upgrade `instant` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-e4a678d5c13de400", "name": "Vulnerable dependency paste 1.0.15: RUSTSEC-2024-0436", "shortDescription": {"text": "Vulnerable dependency paste 1.0.15: RUSTSEC-2024-0436"}, "fullDescription": {"text": "OSV.dev reports `paste` at version `1.0.15` (resolved in `Cargo.lock`) is affected by RUSTSEC-2024-0436.\nNote: `paste` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\npaste - no longer maintained\n\nAdvisory: https://osv.dev/vulnerability/RUSTSEC-2024-0436\nFix: upgrade `paste` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-ede99024dd72191d", "name": "Vulnerable dependency proc-macro-error2 2.0.1: RUSTSEC-2026-0173", "shortDescription": {"text": "Vulnerable dependency proc-macro-error2 2.0.1: RUSTSEC-2026-0173"}, "fullDescription": {"text": "OSV.dev reports `proc-macro-error2` at version `2.0.1` (resolved in `Cargo.lock`) is affected by RUSTSEC-2026-0173.\nNote: `proc-macro-error2` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nproc-macro-error2 is unmaintained\n\nAdvisory: https://osv.dev/vulnerability/RUSTSEC-2026-0173\nFix: upgrade `proc-macro-error2` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-299ca1e3cd060a62", "name": "Vulnerable dependency quick-xml 0.30.0: RUSTSEC-2026-0194", "shortDescription": {"text": "Vulnerable dependency quick-xml 0.30.0: RUSTSEC-2026-0194"}, "fullDescription": {"text": "OSV.dev reports `quick-xml` at version `0.30.0` (resolved in `Cargo.lock`) is affected by RUSTSEC-2026-0194.\nNote: `quick-xml` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nQuadratic run time when checking a start tag for duplicate attribute names\n\nAdvisory: https://osv.dev/vulnerability/RUSTSEC-2026-0194\nFix: upgrade `quick-xml` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 0.9}}, {"id": "scanner-444d057cbbe35a20", "name": "Vulnerable dependency quick-xml 0.30.0: RUSTSEC-2026-0195", "shortDescription": {"text": "Vulnerable dependency quick-xml 0.30.0: RUSTSEC-2026-0195"}, "fullDescription": {"text": "OSV.dev reports `quick-xml` at version `0.30.0` (resolved in `Cargo.lock`) is affected by RUSTSEC-2026-0195.\nNote: `quick-xml` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nUnbounded namespace-declaration allocation in `NsReader` enables memory-exhaustion denial of service\n\nAdvisory: https://osv.dev/vulnerability/RUSTSEC-2026-0195\nFix: upgrade `quick-xml` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 0.9}}, {"id": "scanner-5afd38b3d577e8b2", "name": "Vulnerable dependency quick-xml 0.39.4: RUSTSEC-2026-0194", "shortDescription": {"text": "Vulnerable dependency quick-xml 0.39.4: RUSTSEC-2026-0194"}, "fullDescription": {"text": "OSV.dev reports `quick-xml` at version `0.39.4` (resolved in `Cargo.lock`) is affected by RUSTSEC-2026-0194.\nNote: `quick-xml` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nQuadratic run time when checking a start tag for duplicate attribute names\n\nAdvisory: https://osv.dev/vulnerability/RUSTSEC-2026-0194\nFix: upgrade `quick-xml` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 0.9}}, {"id": "scanner-70439d42cc8f26b1", "name": "Vulnerable dependency quick-xml 0.39.4: RUSTSEC-2026-0195", "shortDescription": {"text": "Vulnerable dependency quick-xml 0.39.4: RUSTSEC-2026-0195"}, "fullDescription": {"text": "OSV.dev reports `quick-xml` at version `0.39.4` (resolved in `Cargo.lock`) is affected by RUSTSEC-2026-0195.\nNote: `quick-xml` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nUnbounded namespace-declaration allocation in `NsReader` enables memory-exhaustion denial of service\n\nAdvisory: https://osv.dev/vulnerability/RUSTSEC-2026-0195\nFix: upgrade `quick-xml` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 0.9}}, {"id": "scanner-5626c823371e0d1a", "name": "Vulnerable dependency rustls-pemfile 2.2.0: RUSTSEC-2025-0134", "shortDescription": {"text": "Vulnerable dependency rustls-pemfile 2.2.0: RUSTSEC-2025-0134"}, "fullDescription": {"text": "OSV.dev reports `rustls-pemfile` at version `2.2.0` (resolved in `Cargo.lock`) is affected by RUSTSEC-2025-0134.\nNote: `rustls-pemfile` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nrustls-pemfile is unmaintained\n\nAdvisory: https://osv.dev/vulnerability/RUSTSEC-2025-0134\nFix: upgrade `rustls-pemfile` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-1ce3d84822ee1090", "name": "Vulnerable dependency rustybuzz 0.14.1: RUSTSEC-2026-0206", "shortDescription": {"text": "Vulnerable dependency rustybuzz 0.14.1: RUSTSEC-2026-0206"}, "fullDescription": {"text": "OSV.dev reports `rustybuzz` at version `0.14.1` (resolved in `Cargo.lock`) is affected by RUSTSEC-2026-0206.\nNote: `rustybuzz` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\n`rustybuzz` is unmaintained\n\nAdvisory: https://osv.dev/vulnerability/RUSTSEC-2026-0206\nFix: upgrade `rustybuzz` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-adc8f0749b773db9", "name": "Vulnerable dependency rustybuzz 0.20.1: RUSTSEC-2026-0206", "shortDescription": {"text": "Vulnerable dependency rustybuzz 0.20.1: RUSTSEC-2026-0206"}, "fullDescription": {"text": "OSV.dev reports `rustybuzz` at version `0.20.1` (resolved in `Cargo.lock`) is affected by RUSTSEC-2026-0206.\nNote: `rustybuzz` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\n`rustybuzz` is unmaintained\n\nAdvisory: https://osv.dev/vulnerability/RUSTSEC-2026-0206\nFix: upgrade `rustybuzz` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}]}}, "automationDetails": {"id": "repobility/30768"}, "properties": {"repository": "OpenCut-app/OpenCut", "repoUrl": "https://github.com/OpenCut-app/OpenCut", "branch": "main"}, "results": [{"ruleId": "scanner-bc1306f4ae2c51c9", "level": "warning", "message": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 apps/web/src/components/ui/chart.tsx:93"}, "properties": {"repobilityId": "a3f6aa8e227cbb83", "scanner": "scanner-primary", "fingerprint": "bc1306f4ae2c51c9", "layer": "frontend", "severity": "medium", "confidence": 0.8, "tags": ["frontend-quality", "fq.dangerous-html"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/web/src/components/ui/chart.tsx"}, "region": {"startLine": 93}}}]}, {"ruleId": "scanner-e8851e62e82437f1", "level": "warning", "message": {"text": "CVE-2026-42199: grid 0.18.0 \u2014 Cargo.lock"}, "properties": {"repobilityId": "606e83d978d7a064", "scanner": "scanner-primary", "fingerprint": "e8851e62e82437f1", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-42199"]}}, {"ruleId": "scanner-aef9872ebbd2b160", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .github/copilot-instructions.md"}, "properties": {"repobilityId": "0f079956bea4eb94", "scanner": "scanner-primary", "fingerprint": "aef9872ebbd2b160", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "agent_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/copilot-instructions.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f3321f3de07fb846", "level": "note", "message": {"text": "SkillSpector EA3 (excessive-agency) in LICENSE"}, "properties": {"repobilityId": "1b29968a80e56e5c", "scanner": "scanner-primary", "fingerprint": "f3321f3de07fb846", "layer": "security", "severity": "low", "confidence": 0.7, "tags": ["skillspector", "mcp-skill", "excessive-agency", "EA3"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "LICENSE"}, "region": {"startLine": 7}}}]}, {"ruleId": "scanner-66c131ab98cf4c98", "level": "error", "message": {"text": "SkillSpector OH1 (output-handling) in apps/web/src/components/ui/chart.tsx"}, "properties": {"repobilityId": "690cfb0a6c25e258", "scanner": "scanner-primary", "fingerprint": "66c131ab98cf4c98", "layer": "security", "severity": "high", "confidence": 0.65, "tags": ["skillspector", "mcp-skill", "output-handling", "OH1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/web/src/components/ui/chart.tsx"}, "region": {"startLine": 93}}}]}, {"ruleId": "scanner-a6d8863645157de9", "level": "error", "message": {"text": "SkillSpector PE3 (priv-esc) in moon.yml"}, "properties": {"repobilityId": "b1856e0b6f6ab6da", "scanner": "scanner-primary", "fingerprint": "a6d8863645157de9", "layer": "security", "severity": "high", "confidence": 0.6, "tags": ["skillspector", "mcp-skill", "priv-esc", "PE3"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "moon.yml"}, "region": {"startLine": 9}}}]}, {"ruleId": "scanner-7c3d1a99717c2130", "level": "note", "message": {"text": "SkillSpector SC1 (supply-chain) in apps/api/package.json"}, "properties": {"repobilityId": "f841752ff08187cc", "scanner": "scanner-primary", "fingerprint": "7c3d1a99717c2130", "layer": "security", "severity": "low", "confidence": 0.7, "tags": ["skillspector", "mcp-skill", "supply-chain", "SC1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/api/package.json"}, "region": {"startLine": 11}}}]}, {"ruleId": "scanner-90bbed042b9f3cd6", "level": "note", "message": {"text": "SkillSpector SC1 (supply-chain) in apps/web/package.json"}, "properties": {"repobilityId": "7b8a0d1fe6ec0f58", "scanner": "scanner-primary", "fingerprint": "90bbed042b9f3cd6", "layer": "security", "severity": "low", "confidence": 0.7, "tags": ["skillspector", "mcp-skill", "supply-chain", "SC1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/web/package.json"}, "region": {"startLine": 23}}}]}, {"ruleId": "scanner-b0f535a4f000ac50", "level": "error", "message": {"text": "SkillSpector SC4 (supply-chain) in apps/api/package.json"}, "properties": {"repobilityId": "313503280efdeb65", "scanner": "scanner-primary", "fingerprint": "b0f535a4f000ac50", "layer": "security", "severity": "critical", "confidence": 0.9, "tags": ["skillspector", "mcp-skill", "supply-chain", "SC4"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/api/package.json"}, "region": {"startLine": 11}}}]}, {"ruleId": "scanner-c852ccf9deb6e70b", "level": "error", "message": {"text": "SkillSpector SC4 (supply-chain) in apps/web/package.json"}, "properties": {"repobilityId": "39eb29aa6b174feb", "scanner": "scanner-primary", "fingerprint": "c852ccf9deb6e70b", "layer": "security", "severity": "critical", "confidence": 0.9, "tags": ["skillspector", "mcp-skill", "supply-chain", "SC4"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/web/package.json"}, "region": {"startLine": 24}}}]}, {"ruleId": "scanner-f28e5cfcd7afa141", "level": "error", "message": {"text": "SkillSpector SC6 (supply-chain) in apps/web/package.json"}, "properties": {"repobilityId": "4e32cd71ce2ae673", "scanner": "scanner-primary", "fingerprint": "f28e5cfcd7afa141", "layer": "security", "severity": "high", "confidence": 0.7, "tags": ["skillspector", "mcp-skill", "supply-chain", "SC6"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/web/package.json"}, "region": {"startLine": 49}}}]}, {"ruleId": "scanner-e637c415447867e4", "level": "none", "message": {"text": "Run SkillSpector's LLM-backed analysis in your own pipeline"}, "properties": {"repobilityId": "1936f198ff5212bf", "scanner": "scanner-primary", "fingerprint": "e637c415447867e4", "layer": "security", "severity": "info", "confidence": 1.0, "tags": ["skillspector", "mcp-skill", "llm-advisory", "ai-coder"]}}, {"ruleId": "scanner-eb55f681b095413b", "level": "warning", "message": {"text": "Insecure pattern 'dangerous_innerhtml' in apps/web/src/components/ui/chart.tsx:93"}, "properties": {"repobilityId": "96fca721b4362b9f", "scanner": "scanner-primary", "fingerprint": "eb55f681b095413b", "layer": "security", "severity": "medium", "confidence": 0.65, "tags": ["owasp", "dangerous_innerhtml"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/web/src/components/ui/chart.tsx"}, "region": {"startLine": 93}}}]}, {"ruleId": "scanner-6372cebde0220094", "level": "warning", "message": {"text": "No auth library detected"}, "properties": {"repobilityId": "a5b6035a5bbf8054", "scanner": "scanner-primary", "fingerprint": "6372cebde0220094", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["coverage", "auth"]}}, {"ruleId": "scanner-dda02cf78cc47a1e", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "78a0411daf30e3d7", "scanner": "scanner-primary", "fingerprint": "dda02cf78cc47a1e", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/bun-ci.yml"}, "region": {"startLine": 26}}}]}, {"ruleId": "scanner-6893a6c8b0861585", "level": "warning", "message": {"text": "Very low test-to-source ratio"}, "properties": {"repobilityId": "54a7de3f06314bf0", "scanner": "scanner-primary", "fingerprint": "6893a6c8b0861585", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["tests", "coverage"]}}, {"ruleId": "scanner-36a70142ea707354", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: apps/api/package.json"}, "properties": {"repobilityId": "ce77cd34ed0306d4", "scanner": "scanner-primary", "fingerprint": "36a70142ea707354", "layer": "dependencies", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/api/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f73c8ff17174db57", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: apps/web/package.json"}, "properties": {"repobilityId": "6c1704bf24cf19ac", "scanner": "scanner-primary", "fingerprint": "f73c8ff17174db57", "layer": "dependencies", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/web/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-11825279136b53a3", "level": "warning", "message": {"text": "CI is configured but no tests are detected"}, "properties": {"repobilityId": "39726ea1b6e85fe8", "scanner": "scanner-primary", "fingerprint": "11825279136b53a3", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["tests", "ci", "config-theater", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-b9088664ace7f748", "level": "note", "message": {"text": "Composite production-readiness gap"}, "properties": {"repobilityId": "9b7cb05ed6d83b59", "scanner": "scanner-primary", "fingerprint": "b9088664ace7f748", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["production-readiness", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-749d4bc1bd66df5f", "level": "warning", "message": {"text": "Agent instructions exist but release-hardening basics are missing"}, "properties": {"repobilityId": "9a1565c73470b294", "scanner": "scanner-primary", "fingerprint": "749d4bc1bd66df5f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-f8dfec0225ef5c93", "level": "warning", "message": {"text": "Vulnerable dependency vite 8.0.0: GHSA-4w7w-66w2-5vf9"}, "properties": {"repobilityId": "d7595103e2e3a548", "scanner": "scanner-primary", "fingerprint": "f8dfec0225ef5c93", "layer": "dependencies", "severity": "medium", "confidence": 0.7, "tags": ["dependency", "sca", "osv", "GHSA-4w7w-66w2-5vf9", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/web/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-4c76bfc6063d7588", "level": "error", "message": {"text": "Vulnerable dependency vite 8.0.0: GHSA-fx2h-pf6j-xcff"}, "properties": {"repobilityId": "52e143bbf7b6bd2d", "scanner": "scanner-primary", "fingerprint": "4c76bfc6063d7588", "layer": "dependencies", "severity": "high", "confidence": 0.7, "tags": ["dependency", "sca", "osv", "GHSA-fx2h-pf6j-xcff", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/web/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6f7c843dedcde22c", "level": "error", "message": {"text": "Vulnerable dependency vite 8.0.0: GHSA-p9ff-h696-f583"}, "properties": {"repobilityId": "c64cf25288ec79a6", "scanner": "scanner-primary", "fingerprint": "6f7c843dedcde22c", "layer": "dependencies", "severity": "high", "confidence": 0.7, "tags": ["dependency", "sca", "osv", "GHSA-p9ff-h696-f583", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/web/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-932f4f86c3f313ae", "level": "error", "message": {"text": "Vulnerable dependency vite 8.0.0: GHSA-v2wj-q39q-566r"}, "properties": {"repobilityId": "ed7cf635aa7d7148", "scanner": "scanner-primary", "fingerprint": "932f4f86c3f313ae", "layer": "dependencies", "severity": "high", "confidence": 0.7, "tags": ["dependency", "sca", "osv", "GHSA-v2wj-q39q-566r", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/web/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-94935da7e075b61c", "level": "warning", "message": {"text": "Vulnerable dependency vite 8.0.0: GHSA-v6wh-96g9-6wx3"}, "properties": {"repobilityId": "12390bc62d4ba858", "scanner": "scanner-primary", "fingerprint": "94935da7e075b61c", "layer": "dependencies", "severity": "medium", "confidence": 0.7, "tags": ["dependency", "sca", "osv", "GHSA-v6wh-96g9-6wx3", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/web/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-55c9f03141b32d8c", "level": "warning", "message": {"text": "Vulnerable dependency async-std 1.13.2: RUSTSEC-2025-0052"}, "properties": {"repobilityId": "79cd0fe8896c5207", "scanner": "scanner-primary", "fingerprint": "55c9f03141b32d8c", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "RUSTSEC-2025-0052", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Cargo.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-72795afd3f435bfa", "level": "warning", "message": {"text": "Vulnerable dependency grid 0.18.0: GHSA-38c5-483c-4qqp"}, "properties": {"repobilityId": "2f58ff35b35220f3", "scanner": "scanner-primary", "fingerprint": "72795afd3f435bfa", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-38c5-483c-4qqp", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Cargo.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a69f21eb55810617", "level": "warning", "message": {"text": "Vulnerable dependency instant 0.1.13: RUSTSEC-2024-0384"}, "properties": {"repobilityId": "2293c350e3d51ad7", "scanner": "scanner-primary", "fingerprint": "a69f21eb55810617", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "RUSTSEC-2024-0384", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Cargo.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e4a678d5c13de400", "level": "warning", "message": {"text": "Vulnerable dependency paste 1.0.15: RUSTSEC-2024-0436"}, "properties": {"repobilityId": "de501cde0592e0b2", "scanner": "scanner-primary", "fingerprint": "e4a678d5c13de400", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "RUSTSEC-2024-0436", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Cargo.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ede99024dd72191d", "level": "warning", "message": {"text": "Vulnerable dependency proc-macro-error2 2.0.1: RUSTSEC-2026-0173"}, "properties": {"repobilityId": "d7ad8c219cae993b", "scanner": "scanner-primary", "fingerprint": "ede99024dd72191d", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "RUSTSEC-2026-0173", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Cargo.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-299ca1e3cd060a62", "level": "error", "message": {"text": "Vulnerable dependency quick-xml 0.30.0: RUSTSEC-2026-0194"}, "properties": {"repobilityId": "10102d52ca10d9ac", "scanner": "scanner-primary", "fingerprint": "299ca1e3cd060a62", "layer": "dependencies", "severity": "high", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "RUSTSEC-2026-0194", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Cargo.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-444d057cbbe35a20", "level": "error", "message": {"text": "Vulnerable dependency quick-xml 0.30.0: RUSTSEC-2026-0195"}, "properties": {"repobilityId": "ec68136c3c167abf", "scanner": "scanner-primary", "fingerprint": "444d057cbbe35a20", "layer": "dependencies", "severity": "high", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "RUSTSEC-2026-0195", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Cargo.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-5afd38b3d577e8b2", "level": "error", "message": {"text": "Vulnerable dependency quick-xml 0.39.4: RUSTSEC-2026-0194"}, "properties": {"repobilityId": "5755587ce549aec3", "scanner": "scanner-primary", "fingerprint": "5afd38b3d577e8b2", "layer": "dependencies", "severity": "high", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "RUSTSEC-2026-0194", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Cargo.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-70439d42cc8f26b1", "level": "error", "message": {"text": "Vulnerable dependency quick-xml 0.39.4: RUSTSEC-2026-0195"}, "properties": {"repobilityId": "9680ce51ca40d20b", "scanner": "scanner-primary", "fingerprint": "70439d42cc8f26b1", "layer": "dependencies", "severity": "high", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "RUSTSEC-2026-0195", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Cargo.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-5626c823371e0d1a", "level": "warning", "message": {"text": "Vulnerable dependency rustls-pemfile 2.2.0: RUSTSEC-2025-0134"}, "properties": {"repobilityId": "f018199bde6f9c86", "scanner": "scanner-primary", "fingerprint": "5626c823371e0d1a", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "RUSTSEC-2025-0134", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Cargo.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-1ce3d84822ee1090", "level": "warning", "message": {"text": "Vulnerable dependency rustybuzz 0.14.1: RUSTSEC-2026-0206"}, "properties": {"repobilityId": "6d7cce00413ad1a7", "scanner": "scanner-primary", "fingerprint": "1ce3d84822ee1090", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "RUSTSEC-2026-0206", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Cargo.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-adc8f0749b773db9", "level": "warning", "message": {"text": "Vulnerable dependency rustybuzz 0.20.1: RUSTSEC-2026-0206"}, "properties": {"repobilityId": "3e194289f474e259", "scanner": "scanner-primary", "fingerprint": "adc8f0749b773db9", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "RUSTSEC-2026-0206", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Cargo.lock"}, "region": {"startLine": 1}}}]}]}]}