{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-fffa50bd059816c3", "name": "Possibly dead Python function: do_POST", "shortDescription": {"text": "Possibly dead Python function: do_POST"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9d19ba69f130237b", "name": "Possibly dead Python function: log_message", "shortDescription": {"text": "Possibly dead Python function: log_message"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-339ab36e6d7f5852", "name": "Possibly dead Python function: image_exists", "shortDescription": {"text": "Possibly dead Python function: image_exists"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8e334d622fecaee3", "name": "Possibly dead Python function: do_GET", "shortDescription": {"text": "Possibly dead Python function: do_GET"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c52e99fc2cc4dae0", "name": "Possibly dead Python function: log_message", "shortDescription": {"text": "Possibly dead Python function: log_message"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-bca0c13c47b1c290", "name": "Possibly dead Python function: deferrer", "shortDescription": {"text": "Possibly dead Python function: deferrer"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-615e4793ffc74cbc", "name": "Possibly dead Python function: get_terrain3d_bucket", "shortDescription": {"text": "Possibly dead Python function: get_terrain3d_bucket"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-54a28ea9b66749e0", "name": "Possibly dead Python function: deferrer", "shortDescription": {"text": "Possibly dead Python function: deferrer"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-09891cf1069fbdd2", "name": "Possibly dead Python function: deferrer", "shortDescription": {"text": "Possibly dead Python function: deferrer"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b9fd9b4fbcb3c4c7", "name": "Possibly dead Python function: deferrer", "shortDescription": {"text": "Possibly dead Python function: deferrer"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1e02392fb088c491", "name": "Possibly dead Python function: guarded_get", "shortDescription": {"text": "Possibly dead Python function: guarded_get"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c77e48080591e402", "name": "Possibly dead Python function: deferrer", "shortDescription": {"text": "Possibly dead Python function: deferrer"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-60d347bc4ec0ed63", "name": "Possibly dead Python function: get_s3_client", "shortDescription": {"text": "Possibly dead Python function: get_s3_client"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f3f6053600ec26f8", "name": "Possibly dead Python function: get_s3_client", "shortDescription": {"text": "Possibly dead Python function: get_s3_client"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-78e0ef6b1ba75e39", "name": "Possibly dead Python function: deferrer", "shortDescription": {"text": "Possibly dead Python function: deferrer"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2e91991b5f61428c", "name": "React Flow edge with `label=` but no project-wide edge-label CSS override \u2014 shell/src/api/domains/extensionsAdminTools.t", "shortDescription": {"text": "React Flow edge with `label=` but no project-wide edge-label CSS override \u2014 shell/src/api/domains/extensionsAdminTools.ts:53"}, "fullDescription": {"text": "React Flow edge labels render with a white rectangle behind the text by default, which scatters bright boxes across a dark canvas. Either drop the label, or override `.react-flow__edge-textbg` and `.react-flow__edge-text` in your stylesheet.\n\nWhy: P-H in CHECKLIST.md \u2014 vendor edge labels bleed white through a dark canvas.\nRule id: fq.edge-label.no-bg"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 0.85}}, {"id": "scanner-173bb79850ca7f75", "name": "Icon-only button without accessible name \u2014 shell/src/ui/kit/Tooltip.test.tsx:50", "shortDescription": {"text": "Icon-only button without accessible name \u2014 shell/src/ui/kit/Tooltip.test.tsx:50"}, "fullDescription": {"text": "A `<button>` whose only child is a single glyph or symbol needs `title=` or `aria-label=` so screen readers (and tooltips on hover) work.\n\nWhy: P3 in CHECKLIST.md \u2014 icon-only buttons skipped a title.\nRule id: fq.button.no-label"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 0.85}}, {"id": "scanner-8d9389c060e3ec05", "name": "React Flow <Controls> without dark theming \u2014 shell/src/builder/AnalyticsContextIndicator.test.tsx:33", "shortDescription": {"text": "React Flow <Controls> without dark theming \u2014 shell/src/builder/AnalyticsContextIndicator.test.tsx:33"}, "fullDescription": {"text": "`<Controls>` ships with white buttons. Override `.react-flow__controls` and `.react-flow__controls-button` in your stylesheet or pass a styled wrapper.\n\nWhy: P1 in CHECKLIST.md \u2014 vendor defaults bleed light through.\nRule id: fq.controls.no-bg"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 0.85}}, {"id": "scanner-ad4cd4da74d67293", "name": "Truncated text has no discoverable full-value affordance \u2014 shell/src/builder/widgets/data.tsx:99", "shortDescription": {"text": "Truncated text has no discoverable full-value affordance \u2014 shell/src/builder/widgets/data.tsx:99"}, "fullDescription": {"text": "A visibly truncated value should expose its full text through an accessible tooltip, description, or equivalent interaction. Native `title=` is one option, but it is not the only valid implementation.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 0.65}}, {"id": "scanner-37d18e2e13f0fc3f", "name": "`dangerouslySetInnerHTML` used in a React component \u2014 shell/src/builder/widgets/richSection.tsx:47", "shortDescription": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 shell/src/builder/widgets/richSection.tsx:47"}, "fullDescription": {"text": "Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library.\n\nWhy: OWASP basics. Already partially flagged by the security analyzer.\nRule id: fq.dangerous-html"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "medium", "confidence": 0.8}}, {"id": "scanner-70fef64e5f48526b", "name": "React Flow <MiniMap> without dark background \u2014 shell/src/builder/pipeline/PipelineCanvas.tsx:438", "shortDescription": {"text": "React Flow <MiniMap> without dark background \u2014 shell/src/builder/pipeline/PipelineCanvas.tsx:438"}, "fullDescription": {"text": "A bare <MiniMap> renders with the vendor's white default in dark themes. Wrap the canvas in a class that overrides `.react-flow__minimap` background, or pass an explicit `style`/`maskColor`/`bgColor`.\n\nWhy: P1 in CHECKLIST.md \u2014 vendor defaults bleed light through.\nRule id: fq.minimap.no-bg"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 0.85}}, {"id": "scanner-14f2efd4b759e76d", "name": "React Flow <Controls> without dark theming \u2014 shell/src/builder/pipeline/PipelineCanvas.tsx:437", "shortDescription": {"text": "React Flow <Controls> without dark theming \u2014 shell/src/builder/pipeline/PipelineCanvas.tsx:437"}, "fullDescription": {"text": "`<Controls>` ships with white buttons. Override `.react-flow__controls` and `.react-flow__controls-button` in your stylesheet or pass a styled wrapper.\n\nWhy: P1 in CHECKLIST.md \u2014 vendor defaults bleed light through.\nRule id: fq.controls.no-bg"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 0.85}}, {"id": "scanner-63d8ca64ac9c27b2", "name": "`dangerouslySetInnerHTML` used in a React component \u2014 shell/src/map/MapPopup.tsx:57", "shortDescription": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 shell/src/map/MapPopup.tsx:57"}, "fullDescription": {"text": "Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library.\n\nWhy: OWASP basics. Already partially flagged by the security analyzer.\nRule id: fq.dangerous-html"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "medium", "confidence": 0.8}}, {"id": "scanner-29e72124b8be24cd", "name": "Truncated text has no discoverable full-value affordance \u2014 shell/src/map/LayersPanel.tsx:243", "shortDescription": {"text": "Truncated text has no discoverable full-value affordance \u2014 shell/src/map/LayersPanel.tsx:243"}, "fullDescription": {"text": "A visibly truncated value should expose its full text through an accessible tooltip, description, or equivalent interaction. Native `title=` is one option, but it is not the only valid implementation.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 0.65}}, {"id": "scanner-3bafb79a65f70bcb", "name": "Truncated text has no discoverable full-value affordance \u2014 shell/src/map/PopupEditor.tsx:117", "shortDescription": {"text": "Truncated text has no discoverable full-value affordance \u2014 shell/src/map/PopupEditor.tsx:117"}, "fullDescription": {"text": "A visibly truncated value should expose its full text through an accessible tooltip, description, or equivalent interaction. Native `title=` is one option, but it is not the only valid implementation.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 0.65}}, {"id": "scanner-f67395c14a6b505b", "name": "use defused xml \u2014 core/app/harvest/connectors/ows.py:10", "shortDescription": {"text": "use defused xml \u2014 core/app/harvest/connectors/ows.py:10"}, "fullDescription": {"text": "The Python documentation recommends using `defusedxml` instead of `xml` because the native Python `xml` library is vulnerable to XML External Entity (XXE) attacks. These attacks can leak confidential data and \"XML bombs\" can cause denial of service.\n\nRule: python.lang.security.use-defused-xml.use-defused-xml\nSeverity: ERROR\nOWASP: A04:2017 - XML External Entities (XXE), A05:2021 - Security Misconfiguration, A02:2025 - Security Misconfiguration\nCWE: CWE-611: Improper Restriction of XML External Entity Reference\nCategory: security\nContext: production"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.55}}, {"id": "scanner-cb6ef8a959658680", "name": "use defused xml \u2014 core/app/mapicons/svg.py:30", "shortDescription": {"text": "use defused xml \u2014 core/app/mapicons/svg.py:30"}, "fullDescription": {"text": "The Python documentation recommends using `defusedxml` instead of `xml` because the native Python `xml` library is vulnerable to XML External Entity (XXE) attacks. These attacks can leak confidential data and \"XML bombs\" can cause denial of service.\n\nRule: python.lang.security.use-defused-xml.use-defused-xml\nSeverity: ERROR\nOWASP: A04:2017 - XML External Entities (XXE), A05:2021 - Security Misconfiguration, A02:2025 - Security Misconfiguration\nCWE: CWE-611: Improper Restriction of XML External Entity Reference\nCategory: security\nContext: production"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.55}}, {"id": "scanner-83eb53bf1e2f0b1c", "name": "use defused xml \u2014 core/app/public/routes.py:4", "shortDescription": {"text": "use defused xml \u2014 core/app/public/routes.py:4"}, "fullDescription": {"text": "The Python documentation recommends using `defusedxml` instead of `xml` because the native Python `xml` library is vulnerable to XML External Entity (XXE) attacks. These attacks can leak confidential data and \"XML bombs\" can cause denial of service.\n\nRule: python.lang.security.use-defused-xml.use-defused-xml\nSeverity: ERROR\nOWASP: A04:2017 - XML External Entities (XXE), A05:2021 - Security Misconfiguration, A02:2025 - Security Misconfiguration\nCWE: CWE-611: Improper Restriction of XML External Entity Reference\nCategory: security\nContext: production"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.55}}, {"id": "scanner-a30f105d1edd1d27", "name": "use defused xml \u2014 core/scripts/check_coverage.py:2", "shortDescription": {"text": "use defused xml \u2014 core/scripts/check_coverage.py:2"}, "fullDescription": {"text": "The Python documentation recommends using `defusedxml` instead of `xml` because the native Python `xml` library is vulnerable to XML External Entity (XXE) attacks. These attacks can leak confidential data and \"XML bombs\" can cause denial of service.\n\nRule: python.lang.security.use-defused-xml.use-defused-xml\nSeverity: ERROR\nOWASP: A04:2017 - XML External Entities (XXE), A05:2021 - Security Misconfiguration, A02:2025 - Security Misconfiguration\nCWE: CWE-611: Improper Restriction of XML External Entity Reference\nCategory: security\nContext: production"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.55}}, {"id": "scanner-8277006a6aa03958", "name": "dynamic urllib use detected \u2014 core/scripts/check_published_images.py:46", "shortDescription": {"text": "dynamic urllib use detected \u2014 core/scripts/check_published_images.py:46"}, "fullDescription": {"text": "Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead.\n\nRule: python.lang.security.audit.dynamic-urllib-use-detected.dynamic-urllib-use-detected\nSeverity: WARNING\nOWASP: A01:2017 - Injection\nCWE: CWE-939: Improper Authorization in Handler for Custom URL Scheme\nCategory: security\nContext: production"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.55}}, {"id": "scanner-700231421f36b376", "name": "use defused xml \u2014 core/scripts/feature_health/coverage_facts.py:36", "shortDescription": {"text": "use defused xml \u2014 core/scripts/feature_health/coverage_facts.py:36"}, "fullDescription": {"text": "The Python documentation recommends using `defusedxml` instead of `xml` because the native Python `xml` library is vulnerable to XML External Entity (XXE) attacks. These attacks can leak confidential data and \"XML bombs\" can cause denial of service.\n\nRule: python.lang.security.use-defused-xml.use-defused-xml\nSeverity: ERROR\nOWASP: A04:2017 - XML External Entities (XXE), A05:2021 - Security Misconfiguration, A02:2025 - Security Misconfiguration\nCWE: CWE-611: Improper Restriction of XML External Entity Reference\nCategory: security\nContext: production"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.55}}, {"id": "scanner-bd4b7c2f8c144215", "name": "var in script tag \u2014 docs/revue/bilan-fonctionnalites.html:505", "shortDescription": {"text": "var in script tag \u2014 docs/revue/bilan-fonctionnalites.html:505"}, "fullDescription": {"text": "Detected a template variable used in a script tag. Although template variables are HTML escaped, HTML escaping does not always prevent cross-site scripting (XSS) attacks when used directly in JavaScript. If you need this data on the rendered page, consider placing it in the HTML portion (outside of a script tag). Alternatively, use a JavaScript-specific encoder, such as the one available in OWASP ESAPI. For Django, you may also consider using the 'json_script' template tag and retrieving the data in your script by using the element ID (e.g., `document.getElementById`).\n\nRule: generic.html-templates.security.var-in-script-tag.var-in-script-tag\nSeverity: WARNING\nOWASP: A07:2017 - Cross-Site Scripting (XSS), A03:2021 - Injection, A05:2025 - Injection\nCWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')\nCategory: security\nContext: production"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.55}}, {"id": "scanner-c86e9bcaeb353be4", "name": "CVE-2026-19693: extract-zip 2.0.1 \u2014 desktop-etl/e2e/package-lock.json", "shortDescription": {"text": "CVE-2026-19693: extract-zip 2.0.1 \u2014 desktop-etl/e2e/package-lock.json"}, "fullDescription": {"text": "extract-zip: extract-zip: Arbitrary file write via symlink in archive\n\nextract-zip through 2.0.1 containment-checks only the parent directory of each archive entry and never the entry's own final path component, so an archive containing two entries with identical names - a symlink whose target is outside the destination, followed by a regular file - writes through the planted symlink and yields an arbitrary file write outside the destination directory.\n\nPackage: extract-zip\nInstalled: 2.0.1\nFixed in: \u2014\nSeverity: HIGH\nFix: No fix version published yet"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-dafc71b9f096533f", "name": "CVE-2026-56876: extract-zip 2.0.1 \u2014 desktop-etl/e2e/package-lock.json", "shortDescription": {"text": "CVE-2026-56876: extract-zip 2.0.1 \u2014 desktop-etl/e2e/package-lock.json"}, "fullDescription": {"text": "extract-zip: github.com/maxogden/extract-zip: extract-zip: Arbitrary file write and information disclosure via symlink validation bypass\n\nextract-zip does not validate symlink targets when extracting zip archives. When processing a malicious zip file containing a symlink with a relative path like '../../../../etc/passwd', extract-zip will extract the symlink without validation, allowing it to point outside the extraction directory. Depending on how extract-zip is used, an attacker could read or write to arbitrary files.\n\nPackage: extract-zip\nInstalled: 2.0.1\nFixed in: \u2014\nSeverity: HIGH\nFix: No fix version published yet"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-deec8a82c608477c", "name": "GHSA-wrw7-89jp-8q8g: glib 0.18.5 \u2014 desktop-etl/src-tauri/Cargo.lock", "shortDescription": {"text": "GHSA-wrw7-89jp-8q8g: glib 0.18.5 \u2014 desktop-etl/src-tauri/Cargo.lock"}, "fullDescription": {"text": "Unsoundness in `Iterator` and `DoubleEndedIterator` impls for `glib::VariantStrIter`\n\nThe `VariantStrIter::impl_get` function (called internally by implementations of the `Iterator` and `DoubleEndedIterator` traits for this type) was unsound, resulting in undefined behaviour.\n\nAn immutable reference `&p` to a `*mut libc::c_char` pointer initialized to `NULL` was passed as an argument to a C function that that mutates the pointer behind `&p` in-place (i.e. as an out-argument), which was unsound. After changes in recent versions of the Rust compiler, these unsound writes through `&\n\nPackage: glib\nInstalled: 0.18.5\nFixed in: 0.20.0\nSeverity: MEDIUM\nFix: Upgrade glib to 0.20.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-336ff7f20e8946ed", "name": "GHSA-55q2-fjhq-7xh7: dompurify 3.4.12 \u2014 shell/package-lock.json", "shortDescription": {"text": "GHSA-55q2-fjhq-7xh7: dompurify 3.4.12 \u2014 shell/package-lock.json"}, "fullDescription": {"text": "DOMPurify: IN_PLACE hook removal leaves a detached subtree executable, causing XSS\n\n### Summary\n\nDuring `IN_PLACE` sanitization, a hook that removes an element can leave that element's detached descendants executable. A descendant image can retain its attacker-provided `onload` handler and fire after `sanitize()` returns, even though the returned root is clean and the image remains disconnected from the document.\n\n### Details\n\nIn DOMPurify 3.4.12, `_sanitizeElements()` in `src/purify.ts:1862-1904` runs the `beforeSanitizeElements` or `uponSanitizeElement` hook and returns immed\n\nPackage: dompurify\nInstalled: 3.4.12\nFixed in: 3.4.13\nSeverity: MEDIUM\nFix: Upgrade dompurify to 3.4.13"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c95f045263ae339d", "name": "CVE-2026-45820: fflate 0.7.4 \u2014 shell/package-lock.json", "shortDescription": {"text": "CVE-2026-45820: fflate 0.7.4 \u2014 shell/package-lock.json"}, "fullDescription": {"text": "fflate: fflate: Denial of Service via crafted ZIP archives\n\nfflate through 0.8.2 is vulnerable to denial of service via an infinite loop in unzipSync(). A crafted ZIP archive with a central directory entry declaring compressed_size=0xFFFFFFFF (ZIP64 sentinel) but missing the required ZIP64 extra field tag 0x0001 causes z64e() to loop indefinitely due to out-of-bounds reads returning undefined, which coerces to 0, keeping the loop condition permanently true.\n\nPackage: fflate\nInstalled: 0.7.4\nFixed in: 0.4.9, 0.5.4, 0.6.11, 0.7.5, 0.8.3\nSeverity: MEDIUM\nFix: Upgrade fflate to 0.4.9, 0.5.4, 0.6.11, 0.7.5, 0.8.3"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d821f286e5b61182", "name": "CVE-2025-71329: image-size 0.7.5 \u2014 shell/package-lock.json", "shortDescription": {"text": "CVE-2025-71329: image-size 0.7.5 \u2014 shell/package-lock.json"}, "fullDescription": {"text": "image-size: image-size: Denial of Service via crafted image buffer with zero-valued size field\n\nimage-size through 2.0.2 contains a denial of service vulnerability that allows remote attackers to permanently block the Node.js event loop by supplying a specially crafted image buffer with a zero-valued size field in a recognized box-type. Attackers can trigger an infinite loop in the JXL or HEIF image parsers by providing a crafted image containing a box with a size of zero, causing the offset to never advance and permanently hanging the application.\n\nPackage: image-size\nInstalled: 0.7.5\nFixed in: \u2014\nSeverity: HIGH\nFix: No fix version published yet"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-ea5b84648796574b", "name": "CVE-2025-71330: image-size 0.7.5 \u2014 shell/package-lock.json", "shortDescription": {"text": "CVE-2025-71330: image-size 0.7.5 \u2014 shell/package-lock.json"}, "fullDescription": {"text": "image-size: image-size: Denial of Service via crafted ICNS image buffer\n\nimage-size through 2.0.2 contains a denial of service vulnerability that allows remote attackers to permanently block the Node.js event loop by supplying a specially crafted ICNS image buffer. Attackers can craft an ICNS buffer containing valid magic bytes and a zero-valued entry length field to trigger an infinite loop in the ICNS parser, as the offset is never incremented when the entry length field is 0, causing the while loop condition to remain true indefinitely.\n\nPackage: image-size\nInstalled: 0.7.5\nFixed in: \u2014\nSeverity: HIGH\nFix: No fix version published yet"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-1aa0a7bc58050c1f", "name": "CVE-2026-4800: lodash-es 4.17.21 \u2014 shell/package-lock.json", "shortDescription": {"text": "CVE-2026-4800: lodash-es 4.17.21 \u2014 shell/package-lock.json"}, "fullDescription": {"text": "lodash: lodash: Arbitrary code execution via untrusted input in template imports\n\nImpact:\n\nThe fix for CVE-2021-23337 (https://github.com/advisories/GHSA-35jh-r3h4-6jhm) added validation for the variable option in _.template but did not apply the same validation to options.imports key names. Both paths flow into the same Function() constructor sink.\n\nWhen an application passes untrusted input as options.imports key names, an attacker can inject default-parameter expressions that execute arbitrary code at template compilation time.\n\nAdditionally, _.template uses assignInWith t\n\nPackage: lodash-es\nInstalled: 4.17.21\nFixed in: 4.18.0\nSeverity: HIGH\nFix: Upgrade lodash-es to 4.18.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-d56fe516fb63dfd4", "name": "CVE-2025-13465: lodash-es 4.17.21 \u2014 shell/package-lock.json", "shortDescription": {"text": "CVE-2025-13465: lodash-es 4.17.21 \u2014 shell/package-lock.json"}, "fullDescription": {"text": "lodash: prototype pollution in _.unset and _.omit functions\n\nLodash versions 4.0.0 through 4.17.22 are vulnerable to prototype pollution in the _.unset\u00a0and _.omit\u00a0functions. An attacker can pass crafted paths which cause Lodash to delete methods from global prototypes.\n\nThe issue permits deletion of properties but does not allow overwriting their original behavior.\n\nThis issue is patched on 4.17.23\n\nPackage: lodash-es\nInstalled: 4.17.21\nFixed in: 4.17.23\nSeverity: MEDIUM\nFix: Upgrade lodash-es to 4.17.23"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6e39e26e29a4c685", "name": "CVE-2026-2950: lodash-es 4.17.21 \u2014 shell/package-lock.json", "shortDescription": {"text": "CVE-2026-2950: lodash-es 4.17.21 \u2014 shell/package-lock.json"}, "fullDescription": {"text": "lodash: Lodash: Prototype pollution allows deletion of built-in prototype properties via array path bypass\n\nImpact:\n\nLodash versions 4.17.23 and earlier are vulnerable to prototype pollution in the _.unset and _.omit functions. The fix for (CVE-2025-13465: https://github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg) only guards against string key members, so an attacker can bypass the check by passing array-wrapped path segments. This allows deletion of properties from built-in prototypes such as Object.prototype, Number.prototype, and String.prototype.\n\nThe issue permits deletion of prot\n\nPackage: lodash-es\nInstalled: 4.17.21\nFixed in: 4.18.0\nSeverity: MEDIUM\nFix: Upgrade lodash-es to 4.18.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7095bd6ebada452d", "name": "CVE-2026-53666: react-router 6.30.4 \u2014 shell/package-lock.json", "shortDescription": {"text": "CVE-2026-53666: react-router 6.30.4 \u2014 shell/package-lock.json"}, "fullDescription": {"text": "react-router: React Router: Information disclosure via client-side constructor execution\n\nReact Router is a router for React. In versions 6.4.0 through 7.17.0, if application code was written in a way that allows attacker-supplied input to overwrite certain aspects of errors caught by the SSR process, then it was possible for an attacker to trigger unexpected constructor execution on the client, which would in turn trigger an outbound network request. This is only possible with very specific (and unlikely) application-layer code. Note that this does not impact an application if it is\n\nPackage: react-router\nInstalled: 6.30.4\nFixed in: 7.18.0\nSeverity: MEDIUM\nFix: Upgrade react-router to 7.18.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4062ee02b42a702e", "name": "CVE-2026-53669: react-router 6.30.4 \u2014 shell/package-lock.json", "shortDescription": {"text": "CVE-2026-53669: react-router 6.30.4 \u2014 shell/package-lock.json"}, "fullDescription": {"text": "react-router: React Router: Open Redirect vulnerability via backslashes in navigation components\n\nReact Router is a router for React. Versions 6.0.0 through 7.17.0 are vulnerable to Open Redirtect through use of backslashes in <Link> and useNavigate. This issue is a follow up to CVE-2025-68470 and has been fixed in version 7.18.0.\n\nPackage: react-router\nInstalled: 6.30.4\nFixed in: 7.18.0\nSeverity: MEDIUM\nFix: Upgrade react-router to 7.18.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b022e31fce756abe", "name": "CVE-2026-53668: react-router-dom 6.30.4 \u2014 shell/package-lock.json", "shortDescription": {"text": "CVE-2026-53668: react-router-dom 6.30.4 \u2014 shell/package-lock.json"}, "fullDescription": {"text": "react-router: react-router-dom: React Router: Cross-Site Scripting (XSS) via open redirects\n\nReact Router is a router for React. In versions 6.30.2 through 6.30.4 and 7.9.6 through 7.12.0, applications that allow open redirects are vulnerable to XSS. An attacker could craft a malicious link that redirects users to an unexpected external site or that exploits an XSS vector.This issue has been fixed in version 7.13.0.\n\nPackage: react-router-dom\nInstalled: 6.30.4\nFixed in: 6.30.6\nSeverity: MEDIUM\nFix: Upgrade react-router-dom to 6.30.6"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2918a0bfbc02dde9", "name": "DS-0026: No HEALTHCHECK defined \u2014 core/Dockerfile", "shortDescription": {"text": "DS-0026: No HEALTHCHECK defined \u2014 core/Dockerfile"}, "fullDescription": {"text": "No HEALTHCHECK defined\n\nAdd HEALTHCHECK instruction in your Dockerfile\n\nRule: DS-0026\nSeverity: LOW\nTarget: core/Dockerfile"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-627028c9196b8838", "name": "DS-0026: No HEALTHCHECK defined \u2014 deploy/appexport-runtime-builder/Dockerfile", "shortDescription": {"text": "DS-0026: No HEALTHCHECK defined \u2014 deploy/appexport-runtime-builder/Dockerfile"}, "fullDescription": {"text": "No HEALTHCHECK defined\n\nAdd HEALTHCHECK instruction in your Dockerfile\n\nRule: DS-0026\nSeverity: LOW\nTarget: deploy/appexport-runtime-builder/Dockerfile"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-78e24293c1288c1b", "name": "DS-0026: No HEALTHCHECK defined \u2014 deploy/appexport-standalone/Dockerfile", "shortDescription": {"text": "DS-0026: No HEALTHCHECK defined \u2014 deploy/appexport-standalone/Dockerfile"}, "fullDescription": {"text": "No HEALTHCHECK defined\n\nAdd HEALTHCHECK instruction in your Dockerfile\n\nRule: DS-0026\nSeverity: LOW\nTarget: deploy/appexport-standalone/Dockerfile"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1039b169b74bd251", "name": "DS-0026: No HEALTHCHECK defined \u2014 deploy/backup/Dockerfile", "shortDescription": {"text": "DS-0026: No HEALTHCHECK defined \u2014 deploy/backup/Dockerfile"}, "fullDescription": {"text": "No HEALTHCHECK defined\n\nAdd HEALTHCHECK instruction in your Dockerfile\n\nRule: DS-0026\nSeverity: LOW\nTarget: deploy/backup/Dockerfile"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8c4ac3b54af1d46b", "name": "DS-0026: No HEALTHCHECK defined \u2014 deploy/export-worker/Dockerfile", "shortDescription": {"text": "DS-0026: No HEALTHCHECK defined \u2014 deploy/export-worker/Dockerfile"}, "fullDescription": {"text": "No HEALTHCHECK defined\n\nAdd HEALTHCHECK instruction in your Dockerfile\n\nRule: DS-0026\nSeverity: LOW\nTarget: deploy/export-worker/Dockerfile"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1322198f7b34bcc8", "name": "DS-0002: Image user should not be 'root' \u2014 deploy/postgis/Dockerfile", "shortDescription": {"text": "DS-0002: Image user should not be 'root' \u2014 deploy/postgis/Dockerfile"}, "fullDescription": {"text": "Image user should not be 'root'\n\nSpecify at least 1 USER command in Dockerfile with non-root user as argument\n\nRule: DS-0002\nSeverity: HIGH\nTarget: deploy/postgis/Dockerfile"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-2180190774be9ef6", "name": "DS-0026: No HEALTHCHECK defined \u2014 deploy/postgis/Dockerfile", "shortDescription": {"text": "DS-0026: No HEALTHCHECK defined \u2014 deploy/postgis/Dockerfile"}, "fullDescription": {"text": "No HEALTHCHECK defined\n\nAdd HEALTHCHECK instruction in your Dockerfile\n\nRule: DS-0026\nSeverity: LOW\nTarget: deploy/postgis/Dockerfile"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a7218540a9eff49b", "name": "DS-0026: No HEALTHCHECK defined \u2014 deploy/qgis-worker/Dockerfile", "shortDescription": {"text": "DS-0026: No HEALTHCHECK defined \u2014 deploy/qgis-worker/Dockerfile"}, "fullDescription": {"text": "No HEALTHCHECK defined\n\nAdd HEALTHCHECK instruction in your Dockerfile\n\nRule: DS-0026\nSeverity: LOW\nTarget: deploy/qgis-worker/Dockerfile"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8ebc5fcd71e44445", "name": "DS-0002: Image user should not be 'root' \u2014 deploy/titiler/Dockerfile", "shortDescription": {"text": "DS-0002: Image user should not be 'root' \u2014 deploy/titiler/Dockerfile"}, "fullDescription": {"text": "Image user should not be 'root'\n\nSpecify at least 1 USER command in Dockerfile with non-root user as argument\n\nRule: DS-0002\nSeverity: HIGH\nTarget: deploy/titiler/Dockerfile"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-22acd6cccf11ab0b", "name": "DS-0026: No HEALTHCHECK defined \u2014 deploy/titiler/Dockerfile", "shortDescription": {"text": "DS-0026: No HEALTHCHECK defined \u2014 deploy/titiler/Dockerfile"}, "fullDescription": {"text": "No HEALTHCHECK defined\n\nAdd HEALTHCHECK instruction in your Dockerfile\n\nRule: DS-0026\nSeverity: LOW\nTarget: deploy/titiler/Dockerfile"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-01d9f4c975e7ab1e", "name": "DS-0026: No HEALTHCHECK defined \u2014 shell/Dockerfile", "shortDescription": {"text": "DS-0026: No HEALTHCHECK defined \u2014 shell/Dockerfile"}, "fullDescription": {"text": "No HEALTHCHECK defined\n\nAdd HEALTHCHECK instruction in your Dockerfile\n\nRule: DS-0026\nSeverity: LOW\nTarget: shell/Dockerfile"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-17d866d91a7c451e", "name": "Agent instruction/config may expose a secret: CLAUDE.md", "shortDescription": {"text": "Agent instruction/config may expose a secret: CLAUDE.md"}, "fullDescription": {"text": "Agent-facing files are routinely pasted into LLM/tool contexts. Move literal tokens, keys, and passwords into a secret manager or document them as placeholders only."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-122f91b7f2906dc4", "name": "Agent authority lacks a verifier contract: .claude/settings.json", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/settings.json"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0aca8936cbf19284", "name": "Privileged port 1001 in use", "shortDescription": {"text": "Privileged port 1001 in use"}, "fullDescription": {"text": "Port 1001 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1fb191a2300a2803", "name": "Privileged port 100 in use", "shortDescription": {"text": "Privileged port 100 in use"}, "fullDescription": {"text": "Port 100 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-73b73c741152ad98", "name": "Privileged port 101 in use", "shortDescription": {"text": "Privileged port 101 in use"}, "fullDescription": {"text": "Port 101 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-070ae0290aa6f7f0", "name": "Privileged port 587 in use", "shortDescription": {"text": "Privileged port 587 in use"}, "fullDescription": {"text": "Port 587 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0a870c9fba3a5b2d", "name": "Privileged port 75 in use", "shortDescription": {"text": "Privileged port 75 in use"}, "fullDescription": {"text": "Port 75 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e8ccc9907229d392", "name": "Privileged port 59 in use", "shortDescription": {"text": "Privileged port 59 in use"}, "fullDescription": {"text": "Port 59 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e01f94b9980fbf52", "name": "Docker base image is tag-pinned but not digest-pinned: python:3.12-slim", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: python:3.12-slim"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f796bccf1c2887a5", "name": "Dockerfile runs as root: deploy/titiler/Dockerfile", "shortDescription": {"text": "Dockerfile runs as root: deploy/titiler/Dockerfile"}, "fullDescription": {"text": "No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c7940d94b26cadae", "name": "Docker base image is tag-pinned but not digest-pinned: ghcr.io/vincentsarago/uvicorn-gunicorn:${PYTHON_VERSION}", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: ghcr.io/vincentsarago/uvicorn-gunicorn:${PYTHON_VERSION}"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d07f8ad6b397544a", "name": "Docker base image is tag-pinned but not digest-pinned: alpine:3.20", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: alpine:3.20"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9aaaee96201091e3", "name": "Dockerfile runs as root: deploy/postgis/Dockerfile", "shortDescription": {"text": "Dockerfile runs as root: deploy/postgis/Dockerfile"}, "fullDescription": {"text": "No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-80ba7fa3a671acb7", "name": "Docker base image is tag-pinned but not digest-pinned: postgres:16-bookworm", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: postgres:16-bookworm"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2a75ab55834fc296", "name": "Docker base image is tag-pinned but not digest-pinned: node:20-slim", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: node:20-slim"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1d40083cfb237688", "name": "Docker base image is tag-pinned but not digest-pinned: python:3.12-slim", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: python:3.12-slim"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9584c83d6d8e3467", "name": "Docker base image is tag-pinned but not digest-pinned: node:20-slim", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: node:20-slim"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-087f7acdc73b53d5", "name": "Docker base image is tag-pinned but not digest-pinned: qgis/qgis:release-3_34", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: qgis/qgis:release-3_34"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7a7f90947a55907d", "name": "Docker base image is tag-pinned but not digest-pinned: python:3.12-slim", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: python:3.12-slim"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b24f8a2d0f323a51", "name": "Docker base image is tag-pinned but not digest-pinned: node:20-slim", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: node:20-slim"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c95fb9f802b80f23", "name": "Docker base image is tag-pinned but not digest-pinned: nginx:1.27-alpine", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: nginx:1.27-alpine"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-adf0c01633bb311c", "name": "Runtime dotenv file present in repo: shell/.env.e2e", "shortDescription": {"text": "Runtime dotenv file present in repo: shell/.env.e2e"}, "fullDescription": {"text": "`shell/.env.e2e` looks like a runtime dotenv file. No high-confidence secret value was matched, but runtime dotenv files often drift into live credentials. Move real values to a secret manager and keep only `.env.example` style templates in source control."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.65}}, {"id": "scanner-8a73d41dcd06b9ec", "name": "Insecure pattern 'direct_innerhtml_assignment' in docs/revue/bilan-fonctionnalites.html:598", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in docs/revue/bilan-fonctionnalites.html:598"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.65}}, {"id": "scanner-f873f06cf71a1caa", "name": "Insecure pattern 'dangerous_innerhtml' in docs/revue/2026-09-04-matrice-fonctionnalites.html:590", "shortDescription": {"text": "Insecure pattern 'dangerous_innerhtml' in docs/revue/2026-09-04-matrice-fonctionnalites.html:590"}, "fullDescription": {"text": "Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.65}}, {"id": "scanner-7bf057fd0ec9baf5", "name": "Insecure pattern 'direct_innerhtml_assignment' in docs/revue/2026-09-04-matrice-fonctionnalites.html:647", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in docs/revue/2026-09-04-matrice-fonctionnalites.html:647"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.65}}, {"id": "scanner-07045c9595e9ba3b", "name": "Possible secret in scripts/install.sh", "shortDescription": {"text": "Possible secret in scripts/install.sh"}, "fullDescription": {"text": "Detected 1 occurrence(s) matching password_literal. Rotate real credentials and move them to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.58}}, {"id": "scanner-c7ab3119a652af63", "name": "Insecure pattern 'node_child_process' in desktop-etl/scripts/prepare-sidecar-binary.mjs:4", "shortDescription": {"text": "Insecure pattern 'node_child_process' in desktop-etl/scripts/prepare-sidecar-binary.mjs:4"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.9}}, {"id": "scanner-dfd1bbe480f63709", "name": "Insecure pattern 'node_child_process' in desktop-etl/e2e/wdio.conf.js:5", "shortDescription": {"text": "Insecure pattern 'node_child_process' in desktop-etl/e2e/wdio.conf.js:5"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.9}}, {"id": "scanner-a23cbd1936fc2537", "name": "Insecure pattern 'direct_innerhtml_assignment' in core/scripts/feature_health/assets/bilan.js:93", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in core/scripts/feature_health/assets/bilan.js:93"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.65}}, {"id": "scanner-763c2fc5e6a69987", "name": "Insecure pattern 'cors_wildcard' in core/app/main.py:248", "shortDescription": {"text": "Insecure pattern 'cors_wildcard' in core/app/main.py:248"}, "fullDescription": {"text": "Found a known-risky pattern (cors_wildcard). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9860bee0a1df2068", "name": "Insecure pattern 'dangerous_innerhtml' in shell/eslint.config.js:83", "shortDescription": {"text": "Insecure pattern 'dangerous_innerhtml' in shell/eslint.config.js:83"}, "fullDescription": {"text": "Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.65}}, {"id": "scanner-7d698c29f3877836", "name": "Possible secret in shell/e2e-oidc/auth-oidc.spec.ts", "shortDescription": {"text": "Possible secret in shell/e2e-oidc/auth-oidc.spec.ts"}, "fullDescription": {"text": "Detected 1 occurrence(s) matching password_literal. Rotate real credentials and move them to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.58}}, {"id": "scanner-017a6d2c097f7130", "name": "Insecure pattern 'dangerous_innerhtml' in shell/src/builder/widgets/richSection.tsx:47", "shortDescription": {"text": "Insecure pattern 'dangerous_innerhtml' in shell/src/builder/widgets/richSection.tsx:47"}, "fullDescription": {"text": "Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.65}}, {"id": "scanner-63b5ba263e8883b4", "name": "Insecure pattern 'cors_wildcard' in shell/e2e/connected-export.spec.ts:60", "shortDescription": {"text": "Insecure pattern 'cors_wildcard' in shell/e2e/connected-export.spec.ts:60"}, "fullDescription": {"text": "Found a known-risky pattern (cors_wildcard). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-5d882d3552e1b0a3", "name": "Insecure pattern 'cors_wildcard' in shell/e2e/external-widget-server.mjs:27", "shortDescription": {"text": "Insecure pattern 'cors_wildcard' in shell/e2e/external-widget-server.mjs:27"}, "fullDescription": {"text": "Found a known-risky pattern (cors_wildcard). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-64192a3c67110d01", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7fba85d8cc2e26c4", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c8b1aab263862f67", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/upload-artifact@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1838a141491ce38c", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-05cad74ebaa9cf75", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "aquasecurity/trivy-action@v0.36.0 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-403609f2c2406173", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ee2081f52e38872b", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/upload-artifact@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1331667eac28f5e2", "name": "Very large file: core/tests/test_pipeline_runtime.py (2992 lines)", "shortDescription": {"text": "Very large file: core/tests/test_pipeline_runtime.py (2992 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a197ff3fa1a21193", "name": "Very large file: core/tests/test_deployability.py (1912 lines)", "shortDescription": {"text": "Very large file: core/tests/test_deployability.py (1912 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a25b2fce467c1de2", "name": "Very large file: shell/src/i18n/catalog.fr.ts (1723 lines)", "shortDescription": {"text": "Very large file: shell/src/i18n/catalog.fr.ts (1723 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2fc6cd02a8468222", "name": "Very large file: shell/src/api/itemClient.test.ts (4300 lines)", "shortDescription": {"text": "Very large file: shell/src/api/itemClient.test.ts (4300 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-90607450c74168e6", "name": "Very large file: shell/src/api/generated/core-schema.d.ts (7375 lines)", "shortDescription": {"text": "Very large file: shell/src/api/generated/core-schema.d.ts (7375 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4f8043640a22ac4e", "name": "Very large file: shell/src/map/MapView.test.tsx (2370 lines)", "shortDescription": {"text": "Very large file: shell/src/map/MapView.test.tsx (2370 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3a06fd120a4d84a8", "name": "Very large file: shell/src/map/MapView.tsx (1460 lines)", "shortDescription": {"text": "Very large file: shell/src/map/MapView.tsx (1460 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0037069270fc8a5f", "name": "Very large file: shell/e2e/analytics-context.spec.ts (2877 lines)", "shortDescription": {"text": "Very large file: shell/e2e/analytics-context.spec.ts (2877 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 112 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-72b2a6250083a784", "name": "Placeholder or mock-heavy implementation detected", "shortDescription": {"text": "Placeholder or mock-heavy implementation detected"}, "fullDescription": {"text": "Found 110 placeholder/mock markers across 47 source files. This often means the repo looks complete while core flows still use generated scaffolding or fake data."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-09a5536df11371dc", "name": "Network/subprocess call without timeout or try/except \u2014 scripts/generate_qgis_algorithm_schemas.py:82", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/generate_qgis_algorithm_schemas.py:82"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 0.85}}, {"id": "scanner-821b61b35c871185", "name": "Network/subprocess call without timeout or try/except \u2014 core/scripts/feature_health_cli.py:187", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 core/scripts/feature_health_cli.py:187"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 0.85}}, {"id": "scanner-7e87d93c00f623bd", "name": "Legacy-named symbol `model_copy` in core/app/appexport/freeze.py:67", "shortDescription": {"text": "Legacy-named symbol `model_copy` in core/app/appexport/freeze.py:67"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1a1a102827442d2f", "name": "Legacy-named symbol `model_copy` in core/app/mcp/tools/identity.py:37", "shortDescription": {"text": "Legacy-named symbol `model_copy` in core/app/mcp/tools/identity.py:37"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f522f3aea8b50670", "name": "Legacy-named symbol `model_copy` in core/app/pipelines/runtime.py:945", "shortDescription": {"text": "Legacy-named symbol `model_copy` in core/app/pipelines/runtime.py:945"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ef284e9b922c36c1", "name": "Legacy-named symbol `supports_copy` in core/app/harvest/routes.py:110", "shortDescription": {"text": "Legacy-named symbol `supports_copy` in core/app/harvest/routes.py:110"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-63aecc4efcfb25fd", "name": "Legacy-named symbol `_upsert_copy` in core/app/harvest/service.py:98", "shortDescription": {"text": "Legacy-named symbol `_upsert_copy` in core/app/harvest/service.py:98"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-dd1f7b0a9a51eb2f", "name": "Legacy-named symbol `supports_copy` in core/app/harvest/connectors/wfs.py:24", "shortDescription": {"text": "Legacy-named symbol `supports_copy` in core/app/harvest/connectors/wfs.py:24"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3daec0c0b706cdd8", "name": "Legacy-named symbol `supports_copy` in core/app/harvest/connectors/ogc_records.py:28", "shortDescription": {"text": "Legacy-named symbol `supports_copy` in core/app/harvest/connectors/ogc_records.py:28"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3e80376e0178aecc", "name": "Legacy-named symbol `supports_copy` in core/app/harvest/connectors/wmts.py:23", "shortDescription": {"text": "Legacy-named symbol `supports_copy` in core/app/harvest/connectors/wmts.py:23"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-28271809e45411d8", "name": "Stub function `fetch_copy_geojson` (body is just `pass`/`return`) \u2014 core/app/harvest/connectors/wmts.py:39", "shortDescription": {"text": "Stub function `fetch_copy_geojson` (body is just `pass`/`return`) \u2014 core/app/harvest/connectors/wmts.py:39"}, "fullDescription": {"text": "Likely an AI scaffold that was never filled in. Remove or implement."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1d718104bb13fd6b", "name": "Legacy-named symbol `supports_copy` in core/app/harvest/connectors/ckan.py:4", "shortDescription": {"text": "Legacy-named symbol `supports_copy` in core/app/harvest/connectors/ckan.py:4"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d3dcbc2fec807e44", "name": "Legacy-named symbol `supports_copy` in core/app/harvest/connectors/csw.py:27", "shortDescription": {"text": "Legacy-named symbol `supports_copy` in core/app/harvest/connectors/csw.py:27"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b90ed41dee131379", "name": "Legacy-named symbol `supports_copy` in core/app/harvest/connectors/base.py:35", "shortDescription": {"text": "Legacy-named symbol `supports_copy` in core/app/harvest/connectors/base.py:35"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-26a34cebc2b3e6a3", "name": "Legacy-named symbol `supports_copy` in core/app/harvest/connectors/wms.py:21", "shortDescription": {"text": "Legacy-named symbol `supports_copy` in core/app/harvest/connectors/wms.py:21"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-11983e81a825b61c", "name": "Legacy-named symbol `supports_copy` in core/app/harvest/connectors/stac.py:25", "shortDescription": {"text": "Legacy-named symbol `supports_copy` in core/app/harvest/connectors/stac.py:25"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5a9ae7cd5cfdc567", "name": "Legacy-named symbol `supports_copy` in core/app/harvest/connectors/arcgis.py:37", "shortDescription": {"text": "Legacy-named symbol `supports_copy` in core/app/harvest/connectors/arcgis.py:37"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-859124791f46dc62", "name": "Legacy-named symbol `list_objects_v2` in core/app/compliance/purge.py:70", "shortDescription": {"text": "Legacy-named symbol `list_objects_v2` in core/app/compliance/purge.py:70"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1ef15aa2e5059ed5", "name": "Legacy-named symbol `list_objects_v2` in core/app/quotas/service.py:53", "shortDescription": {"text": "Legacy-named symbol `list_objects_v2` in core/app/quotas/service.py:53"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-70d83b368309df34", "name": "Network/subprocess call without timeout or try/except \u2014 core/app/alerts/notify.py:8", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 core/app/alerts/notify.py:8"}, "fullDescription": {"text": "`requests.post(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 0.85}}, {"id": "scanner-55f54daf95da4e87", "name": "Legacy-named symbol `list_objects_v2` in core/app/cdc/storage.py:24", "shortDescription": {"text": "Legacy-named symbol `list_objects_v2` in core/app/cdc/storage.py:24"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-55ca8c97e6f08cd7", "name": "Fire-and-forget `fetch()` has no rejection handler \u2014 shell/src/map/MapView.tsx:1397", "shortDescription": {"text": "Fire-and-forget `fetch()` has no rejection handler \u2014 shell/src/map/MapView.tsx:1397"}, "fullDescription": {"text": "This fetch result is neither awaited, returned, assigned, nor followed by `.catch(...)`. A network failure can therefore become an unhandled promise rejection. Await/return the promise or attach an explicit rejection handler."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-ca395a18e146a116", "name": "38 env vars used in code but missing from .env.example", "shortDescription": {"text": "38 env vars used in code but missing from .env.example"}, "fullDescription": {"text": "Drift between code and config docs. The first few: `APPEXPORT_STANDALONE_DATA_DIR`, `APPEXPORT_STANDALONE_RUNTIME_DIR`, `CDC_DATABASE_URL`, `CI`, `CORE_PIPELINE_FILE_IO_ENABLED`, `CORE_QUOTA_MAX_COLLECTIONS_PER_TENANT`, `CORE_QUOTA_MAX_ITEMS_PER_TENANT`, `CORE_QUOTA_MAX_STORAGE_BYTES_PER_TENANT` + 30 more. Add them (with a placeholder/comment) to .env.example so onboarding doesn't break."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-02525d39071dd2c7", "name": "Near-duplicate function bodies in 5 places", "shortDescription": {"text": "Near-duplicate function bodies in 5 places"}, "fullDescription": {"text": "Functions with the same substantial AST body hash:\ncore/app/pipelines/egress.py:46:assert_egress_allowed, core/app/harvest/egress.py:61:assert_egress_allowed, core/app/search/egress.py:71:assert_egress_allowed, core/app/alerts/egress.py:43:assert_egress_allowed\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-49c98f7cedd9c977", "name": "Near-duplicate function bodies in 4 places", "shortDescription": {"text": "Near-duplicate function bodies in 4 places"}, "fullDescription": {"text": "Functions with the same substantial AST body hash:\ncore/app/harvest/connectors/wfs.py:29:fetch, core/app/harvest/connectors/wmts.py:28:fetch, core/app/harvest/connectors/csw.py:32:fetch, core/app/harvest/connectors/wms.py:26:fetch\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2c04133e54348533", "name": "Near-duplicate function bodies in 2 places", "shortDescription": {"text": "Near-duplicate function bodies in 2 places"}, "fullDescription": {"text": "Functions with the same substantial AST body hash:\ncore/app/harvest/connectors/ogc_records.py:33:fetch, core/app/harvest/connectors/arcgis.py:42:fetch\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2f2bf0012e59b7b6", "name": "Frontend route `/pipelines/:pk/edit` has no Link/navigate to it \u2014 shell/src/shell/routes.tsx", "shortDescription": {"text": "Frontend route `/pipelines/:pk/edit` has no Link/navigate to it \u2014 shell/src/shell/routes.tsx"}, "fullDescription": {"text": "The route is registered but no `<Link to=\u2026>` or `navigate(\u2026)` in the codebase navigates here. Either it's reachable only via direct URL (intentional), it's dead, or the link broke during a refactor."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8b3c1e5bcc98692c", "name": "Frontend route `/datasets/visual-query/:pipelinePk/edit` has no Link/navigate to it \u2014 shell/src/shell/routes.tsx", "shortDescription": {"text": "Frontend route `/datasets/visual-query/:pipelinePk/edit` has no Link/navigate to it \u2014 shell/src/shell/routes.tsx"}, "fullDescription": {"text": "The route is registered but no `<Link to=\u2026>` or `navigate(\u2026)` in the codebase navigates here. Either it's reachable only via direct URL (intentional), it's dead, or the link broke during a refactor."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-db4c2a8d09b2b206", "name": "Frontend route `/datasets/:pk/edit` has no Link/navigate to it \u2014 shell/src/shell/NewItemButton.test.tsx", "shortDescription": {"text": "Frontend route `/datasets/:pk/edit` has no Link/navigate to it \u2014 shell/src/shell/NewItemButton.test.tsx"}, "fullDescription": {"text": "The route is registered but no `<Link to=\u2026>` or `navigate(\u2026)` in the codebase navigates here. Either it's reachable only via direct URL (intentional), it's dead, or the link broke during a refactor."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7ac5841447c612b2", "name": "Frontend route `/items/:pk` has no Link/navigate to it \u2014 shell/src/shell/routes.tsx", "shortDescription": {"text": "Frontend route `/items/:pk` has no Link/navigate to it \u2014 shell/src/shell/routes.tsx"}, "fullDescription": {"text": "The route is registered but no `<Link to=\u2026>` or `navigate(\u2026)` in the codebase navigates here. Either it's reachable only via direct URL (intentional), it's dead, or the link broke during a refactor."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b26f3a6a7f3cb3f6", "name": "Frontend route `/maps/:pk` has no Link/navigate to it \u2014 shell/src/shell/NewItemButton.test.tsx", "shortDescription": {"text": "Frontend route `/maps/:pk` has no Link/navigate to it \u2014 shell/src/shell/NewItemButton.test.tsx"}, "fullDescription": {"text": "The route is registered but no `<Link to=\u2026>` or `navigate(\u2026)` in the codebase navigates here. Either it's reachable only via direct URL (intentional), it's dead, or the link broke during a refactor."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a92f42ed480fff5c", "name": "Frontend route `/bookmarks` has no Link/navigate to it \u2014 shell/src/shell/routes.tsx", "shortDescription": {"text": "Frontend route `/bookmarks` has no Link/navigate to it \u2014 shell/src/shell/routes.tsx"}, "fullDescription": {"text": "The route is registered but no `<Link to=\u2026>` or `navigate(\u2026)` in the codebase navigates here. Either it's reachable only via direct URL (intentional), it's dead, or the link broke during a refactor."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7092a931165da3a4", "name": "Frontend route `/apps/:pk/edit` has no Link/navigate to it \u2014 shell/src/shell/NewItemButton.test.tsx", "shortDescription": {"text": "Frontend route `/apps/:pk/edit` has no Link/navigate to it \u2014 shell/src/shell/NewItemButton.test.tsx"}, "fullDescription": {"text": "The route is registered but no `<Link to=\u2026>` or `navigate(\u2026)` in the codebase navigates here. Either it's reachable only via direct URL (intentional), it's dead, or the link broke during a refactor."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e28b52ac1b3542ad", "name": "Frontend route `/reports/:pk/edit` has no Link/navigate to it \u2014 shell/src/shell/routes.tsx", "shortDescription": {"text": "Frontend route `/reports/:pk/edit` has no Link/navigate to it \u2014 shell/src/shell/routes.tsx"}, "fullDescription": {"text": "The route is registered but no `<Link to=\u2026>` or `navigate(\u2026)` in the codebase navigates here. Either it's reachable only via direct URL (intentional), it's dead, or the link broke during a refactor."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4c313c058cd39aa6", "name": "Frontend route `/internal/kit-gallery` has no Link/navigate to it \u2014 shell/src/shell/routes.tsx", "shortDescription": {"text": "Frontend route `/internal/kit-gallery` has no Link/navigate to it \u2014 shell/src/shell/routes.tsx"}, "fullDescription": {"text": "The route is registered but no `<Link to=\u2026>` or `navigate(\u2026)` in the codebase navigates here. Either it's reachable only via direct URL (intentional), it's dead, or the link broke during a refactor."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2f465019aac95aeb", "name": "Frontend route `/apps/:pk/:pageId?` has no Link/navigate to it \u2014 shell/src/shell/routes.tsx", "shortDescription": {"text": "Frontend route `/apps/:pk/:pageId?` has no Link/navigate to it \u2014 shell/src/shell/routes.tsx"}, "fullDescription": {"text": "The route is registered but no `<Link to=\u2026>` or `navigate(\u2026)` in the codebase navigates here. Either it's reachable only via direct URL (intentional), it's dead, or the link broke during a refactor."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-39a17283265c9932", "name": "Frontend route `/embed/:token` has no Link/navigate to it \u2014 shell/src/shell/routes.tsx", "shortDescription": {"text": "Frontend route `/embed/:token` has no Link/navigate to it \u2014 shell/src/shell/routes.tsx"}, "fullDescription": {"text": "The route is registered but no `<Link to=\u2026>` or `navigate(\u2026)` in the codebase navigates here. Either it's reachable only via direct URL (intentional), it's dead, or the link broke during a refactor."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-eaed6e98d5143f30", "name": "Frontend route `/sites/:slug` has no Link/navigate to it \u2014 shell/src/shell/routes.tsx", "shortDescription": {"text": "Frontend route `/sites/:slug` has no Link/navigate to it \u2014 shell/src/shell/routes.tsx"}, "fullDescription": {"text": "The route is registered but no `<Link to=\u2026>` or `navigate(\u2026)` in the codebase navigates here. Either it's reachable only via direct URL (intentional), it's dead, or the link broke during a refactor."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a5eb6ed275cc8be1", "name": "Frontend route `/public/items/:pk` has no Link/navigate to it \u2014 shell/src/shell/routes.tsx", "shortDescription": {"text": "Frontend route `/public/items/:pk` has no Link/navigate to it \u2014 shell/src/shell/routes.tsx"}, "fullDescription": {"text": "The route is registered but no `<Link to=\u2026>` or `navigate(\u2026)` in the codebase navigates here. Either it's reachable only via direct URL (intentional), it's dead, or the link broke during a refactor."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e75f7d4b07206b15", "name": "Frontend route `/public/datasets/:collectionId` has no Link/navigate to it \u2014 shell/src/shell/routes.tsx", "shortDescription": {"text": "Frontend route `/public/datasets/:collectionId` has no Link/navigate to it \u2014 shell/src/shell/routes.tsx"}, "fullDescription": {"text": "The route is registered but no `<Link to=\u2026>` or `navigate(\u2026)` in the codebase navigates here. Either it's reachable only via direct URL (intentional), it's dead, or the link broke during a refactor."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ac459c162d509b52", "name": "Frontend route `/pipelines/:id/edit` has no Link/navigate to it \u2014 shell/src/shell/chrome/NotificationBell.test.tsx", "shortDescription": {"text": "Frontend route `/pipelines/:id/edit` has no Link/navigate to it \u2014 shell/src/shell/chrome/NotificationBell.test.tsx"}, "fullDescription": {"text": "The route is registered but no `<Link to=\u2026>` or `navigate(\u2026)` in the codebase navigates here. Either it's reachable only via direct URL (intentional), it's dead, or the link broke during a refactor."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-240ba8ff162ed97e", "name": "FastAPI POST `aggregate` without auth dependency \u2014 core/app/appexport/miniserver/main.py:156", "shortDescription": {"text": "FastAPI POST `aggregate` without auth dependency \u2014 core/app/appexport/miniserver/main.py:156"}, "fullDescription": {"text": "`@app.post` has no route-local auth dependency, and `app` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.75}}, {"id": "scanner-d620b167dd710d49", "name": "FastAPI PUT `put_pipeline` without auth dependency \u2014 core/app/pipelines/sidecar/app.py:97", "shortDescription": {"text": "FastAPI PUT `put_pipeline` without auth dependency \u2014 core/app/pipelines/sidecar/app.py:97"}, "fullDescription": {"text": "`@app.put` has no route-local auth dependency, and `app` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.75}}, {"id": "scanner-ae53389fd8a93b29", "name": "FastAPI POST `run_pipeline_route` without auth dependency \u2014 core/app/pipelines/sidecar/app.py:106", "shortDescription": {"text": "FastAPI POST `run_pipeline_route` without auth dependency \u2014 core/app/pipelines/sidecar/app.py:106"}, "fullDescription": {"text": "`@app.post` has no route-local auth dependency, and `app` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.75}}, {"id": "scanner-e8f1dfce24ef0774", "name": "FastAPI POST `preview_pipeline_route` without auth dependency \u2014 core/app/pipelines/sidecar/app.py:122", "shortDescription": {"text": "FastAPI POST `preview_pipeline_route` without auth dependency \u2014 core/app/pipelines/sidecar/app.py:122"}, "fullDescription": {"text": "`@app.post` has no route-local auth dependency, and `app` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.75}}, {"id": "scanner-9286598906e4b829", "name": "Vulnerable dependency dompurify 3.4.12: GHSA-55q2-fjhq-7xh7", "shortDescription": {"text": "Vulnerable dependency dompurify 3.4.12: GHSA-55q2-fjhq-7xh7"}, "fullDescription": {"text": "OSV.dev reports `dompurify` at version `3.4.12` (resolved in `shell/package-lock.json`) is affected by GHSA-55q2-fjhq-7xh7 (aka CVE-2026-75838).\n\nDOMPurify: IN_PLACE hook removal leaves a detached subtree executable, causing XSS\n\nAliases: CVE-2026-75838\nAdvisory: https://osv.dev/vulnerability/GHSA-55q2-fjhq-7xh7\nFix: upgrade `dompurify` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ceef513b9d359a67", "name": "Vulnerable dependency react-router-dom 6.30.4: GHSA-jjmj-jmhj-qwj2", "shortDescription": {"text": "Vulnerable dependency react-router-dom 6.30.4: GHSA-jjmj-jmhj-qwj2"}, "fullDescription": {"text": "OSV.dev reports `react-router-dom` at version `6.30.4` (resolved in `shell/package-lock.json`) is affected by GHSA-jjmj-jmhj-qwj2 (aka CVE-2026-53668).\n\nReact Router: Open redirect leading to XSS\n\nAliases: CVE-2026-53668\nAdvisory: https://osv.dev/vulnerability/GHSA-jjmj-jmhj-qwj2\nFix: upgrade `react-router-dom` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-aff2a1212a755932", "name": "Vulnerable dependency extract-zip 2.0.1: GHSA-7pqw-9j4j-h8q3", "shortDescription": {"text": "Vulnerable dependency extract-zip 2.0.1: GHSA-7pqw-9j4j-h8q3"}, "fullDescription": {"text": "OSV.dev reports `extract-zip` at version `2.0.1` (resolved in `desktop-etl/e2e/package-lock.json`) is affected by GHSA-7pqw-9j4j-h8q3 (aka CVE-2026-19693).\nNote: `extract-zip` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nextract-zip allows arbitrary file writes through symlink archive entries\n\nAliases: CVE-2026-19693\nAdvisory: https://osv.dev/vulnerability/GHSA-7pqw-9j4j-h8q3\nFix: upgrade `extract-zip` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 0.9}}, {"id": "scanner-b609945b060679db", "name": "Vulnerable dependency extract-zip 2.0.1: GHSA-jmr9-qjv8-65gv", "shortDescription": {"text": "Vulnerable dependency extract-zip 2.0.1: GHSA-jmr9-qjv8-65gv"}, "fullDescription": {"text": "OSV.dev reports `extract-zip` at version `2.0.1` (resolved in `desktop-etl/e2e/package-lock.json`) is affected by GHSA-jmr9-qjv8-65gv (aka CVE-2026-56876).\nNote: `extract-zip` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nextract-zip unvalidated symlink path traversal\n\nAliases: CVE-2026-56876\nAdvisory: https://osv.dev/vulnerability/GHSA-jmr9-qjv8-65gv\nFix: upgrade `extract-zip` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 0.9}}]}}, "automationDetails": {"id": "repobility/30835"}, "properties": {"repository": "tlenenao/geostudio", "repoUrl": "https://github.com/tlenenao/geostudio", "branch": "main"}, "results": [{"ruleId": "scanner-fffa50bd059816c3", "level": "note", "message": {"text": "Possibly dead Python function: do_POST"}, "properties": {"repobilityId": "53357410ca9379a9", "scanner": "scanner-primary", "fingerprint": "fffa50bd059816c3", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "deploy/qgis-worker/server.py:27"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-9d19ba69f130237b", "level": "note", "message": {"text": "Possibly dead Python function: log_message"}, "properties": {"repobilityId": "965f3150b4af5b2e", "scanner": "scanner-primary", "fingerprint": "9d19ba69f130237b", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "deploy/qgis-worker/server.py:72"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-339ab36e6d7f5852", "level": "note", "message": {"text": "Possibly dead Python function: image_exists"}, "properties": {"repobilityId": "aa0b506c0b43031f", "scanner": "scanner-primary", "fingerprint": "339ab36e6d7f5852", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "core/scripts/check_published_images.py:50"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-8e334d622fecaee3", "level": "note", "message": {"text": "Possibly dead Python function: do_GET"}, "properties": {"repobilityId": "2d943bb45e4f13bd", "scanner": "scanner-primary", "fingerprint": "8e334d622fecaee3", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "core/scripts/pipeline_sidecar_spike.py:27"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c52e99fc2cc4dae0", "level": "note", "message": {"text": "Possibly dead Python function: log_message"}, "properties": {"repobilityId": "965f3150b4af5b2e", "scanner": "scanner-primary", "fingerprint": "c52e99fc2cc4dae0", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "core/scripts/pipeline_sidecar_spike.py:35"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-bca0c13c47b1c290", "level": "note", "message": {"text": "Possibly dead Python function: deferrer"}, "properties": {"repobilityId": "a7ca5d67e484e14d", "scanner": "scanner-primary", "fingerprint": "bca0c13c47b1c290", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "core/app/appexport/routes.py:55"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-615e4793ffc74cbc", "level": "note", "message": {"text": "Possibly dead Python function: get_terrain3d_bucket"}, "properties": {"repobilityId": "7517ebe7c6c8f74a", "scanner": "scanner-primary", "fingerprint": "615e4793ffc74cbc", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "core/app/terrain3d/routes.py:44"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-54a28ea9b66749e0", "level": "note", "message": {"text": "Possibly dead Python function: deferrer"}, "properties": {"repobilityId": "a7ca5d67e484e14d", "scanner": "scanner-primary", "fingerprint": "54a28ea9b66749e0", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "core/app/terrain3d/routes.py:49"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-09891cf1069fbdd2", "level": "note", "message": {"text": "Possibly dead Python function: deferrer"}, "properties": {"repobilityId": "a7ca5d67e484e14d", "scanner": "scanner-primary", "fingerprint": "09891cf1069fbdd2", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "core/app/pipelines/service.py:72"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b9fd9b4fbcb3c4c7", "level": "note", "message": {"text": "Possibly dead Python function: deferrer"}, "properties": {"repobilityId": "a7ca5d67e484e14d", "scanner": "scanner-primary", "fingerprint": "b9fd9b4fbcb3c4c7", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "core/app/harvest/routes.py:117"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-1e02392fb088c491", "level": "note", "message": {"text": "Possibly dead Python function: guarded_get"}, "properties": {"repobilityId": "53fa53860437c5ad", "scanner": "scanner-primary", "fingerprint": "1e02392fb088c491", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "core/app/harvest/egress.py:119"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c77e48080591e402", "level": "note", "message": {"text": "Possibly dead Python function: deferrer"}, "properties": {"repobilityId": "a7ca5d67e484e14d", "scanner": "scanner-primary", "fingerprint": "c77e48080591e402", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "core/app/compliance/routes.py:78"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-60d347bc4ec0ed63", "level": "note", "message": {"text": "Possibly dead Python function: get_s3_client"}, "properties": {"repobilityId": "ddaaafc0aa9e0825", "scanner": "scanner-primary", "fingerprint": "60d347bc4ec0ed63", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "core/app/quotas/routes.py:25"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f3f6053600ec26f8", "level": "note", "message": {"text": "Possibly dead Python function: get_s3_client"}, "properties": {"repobilityId": "ddaaafc0aa9e0825", "scanner": "scanner-primary", "fingerprint": "f3f6053600ec26f8", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "core/app/ingestion/routes.py:48"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-78e0ef6b1ba75e39", "level": "note", "message": {"text": "Possibly dead Python function: deferrer"}, "properties": {"repobilityId": "a7ca5d67e484e14d", "scanner": "scanner-primary", "fingerprint": "78e0ef6b1ba75e39", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "core/app/ingestion/routes.py:67"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-2e91991b5f61428c", "level": "note", "message": {"text": "React Flow edge with `label=` but no project-wide edge-label CSS override \u2014 shell/src/api/domains/extensionsAdminTools.ts:53"}, "properties": {"repobilityId": "ae06579d22ff2e53", "scanner": "scanner-primary", "fingerprint": "2e91991b5f61428c", "layer": "frontend", "severity": "low", "confidence": 0.85, "tags": ["frontend-quality", "fq.edge-label.no-bg"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "shell/src/api/domains/extensionsAdminTools.ts"}, "region": {"startLine": 53}}}]}, {"ruleId": "scanner-173bb79850ca7f75", "level": "note", "message": {"text": "Icon-only button without accessible name \u2014 shell/src/ui/kit/Tooltip.test.tsx:50"}, "properties": {"repobilityId": "fdfbf952c1a4baa9", "scanner": "scanner-primary", "fingerprint": "173bb79850ca7f75", "layer": "frontend", "severity": "low", "confidence": 0.85, "tags": ["frontend-quality", "fq.button.no-label"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "shell/src/ui/kit/Tooltip.test.tsx"}, "region": {"startLine": 50}}}]}, {"ruleId": "scanner-8d9389c060e3ec05", "level": "note", "message": {"text": "React Flow <Controls> without dark theming \u2014 shell/src/builder/AnalyticsContextIndicator.test.tsx:33"}, "properties": {"repobilityId": "b7061a15c5652095", "scanner": "scanner-primary", "fingerprint": "8d9389c060e3ec05", "layer": "frontend", "severity": "low", "confidence": 0.85, "tags": ["frontend-quality", "fq.controls.no-bg"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "shell/src/builder/AnalyticsContextIndicator.test.tsx"}, "region": {"startLine": 33}}}]}, {"ruleId": "scanner-ad4cd4da74d67293", "level": "none", "message": {"text": "Truncated text has no discoverable full-value affordance \u2014 shell/src/builder/widgets/data.tsx:99"}, "properties": {"repobilityId": "480bca983251da56", "scanner": "scanner-primary", "fingerprint": "ad4cd4da74d67293", "layer": "frontend", "severity": "info", "confidence": 0.65, "tags": ["frontend-quality", "fq.truncate.no-title"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "shell/src/builder/widgets/data.tsx"}, "region": {"startLine": 99}}}]}, {"ruleId": "scanner-37d18e2e13f0fc3f", "level": "warning", "message": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 shell/src/builder/widgets/richSection.tsx:47"}, "properties": {"repobilityId": "b3ab4482b9b0b106", "scanner": "scanner-primary", "fingerprint": "37d18e2e13f0fc3f", "layer": "frontend", "severity": "medium", "confidence": 0.8, "tags": ["frontend-quality", "fq.dangerous-html"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "shell/src/builder/widgets/richSection.tsx"}, "region": {"startLine": 47}}}]}, {"ruleId": "scanner-70fef64e5f48526b", "level": "note", "message": {"text": "React Flow <MiniMap> without dark background \u2014 shell/src/builder/pipeline/PipelineCanvas.tsx:438"}, "properties": {"repobilityId": "5dda5b6851eb6e81", "scanner": "scanner-primary", "fingerprint": "70fef64e5f48526b", "layer": "frontend", "severity": "low", "confidence": 0.85, "tags": ["frontend-quality", "fq.minimap.no-bg"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "shell/src/builder/pipeline/PipelineCanvas.tsx"}, "region": {"startLine": 438}}}]}, {"ruleId": "scanner-14f2efd4b759e76d", "level": "note", "message": {"text": "React Flow <Controls> without dark theming \u2014 shell/src/builder/pipeline/PipelineCanvas.tsx:437"}, "properties": {"repobilityId": "78da1bc63fab6206", "scanner": "scanner-primary", "fingerprint": "14f2efd4b759e76d", "layer": "frontend", "severity": "low", "confidence": 0.85, "tags": ["frontend-quality", "fq.controls.no-bg"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "shell/src/builder/pipeline/PipelineCanvas.tsx"}, "region": {"startLine": 437}}}]}, {"ruleId": "scanner-63d8ca64ac9c27b2", "level": "warning", "message": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 shell/src/map/MapPopup.tsx:57"}, "properties": {"repobilityId": "c109eb668b08b550", "scanner": "scanner-primary", "fingerprint": "63d8ca64ac9c27b2", "layer": "frontend", "severity": "medium", "confidence": 0.8, "tags": ["frontend-quality", "fq.dangerous-html"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "shell/src/map/MapPopup.tsx"}, "region": {"startLine": 57}}}]}, {"ruleId": "scanner-29e72124b8be24cd", "level": "none", "message": {"text": "Truncated text has no discoverable full-value affordance \u2014 shell/src/map/LayersPanel.tsx:243"}, "properties": {"repobilityId": "0a9c73671bd59d8f", "scanner": "scanner-primary", "fingerprint": "29e72124b8be24cd", "layer": "frontend", "severity": "info", "confidence": 0.65, "tags": ["frontend-quality", "fq.truncate.no-title"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "shell/src/map/LayersPanel.tsx"}, "region": {"startLine": 243}}}]}, {"ruleId": "scanner-3bafb79a65f70bcb", "level": "none", "message": {"text": "Truncated text has no discoverable full-value affordance \u2014 shell/src/map/PopupEditor.tsx:117"}, "properties": {"repobilityId": "1b3189d5dd6bd321", "scanner": "scanner-primary", "fingerprint": "3bafb79a65f70bcb", "layer": "frontend", "severity": "info", "confidence": 0.65, "tags": ["frontend-quality", "fq.truncate.no-title"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "shell/src/map/PopupEditor.tsx"}, "region": {"startLine": 117}}}]}, {"ruleId": "scanner-f67395c14a6b505b", "level": "warning", "message": {"text": "use defused xml \u2014 core/app/harvest/connectors/ows.py:10"}, "properties": {"repobilityId": "cc213a5252e2a87f", "scanner": "scanner-primary", "fingerprint": "f67395c14a6b505b", "layer": "security", "severity": "medium", "confidence": 0.55, "tags": ["semgrep", "security", "python"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "core/app/harvest/connectors/ows.py"}, "region": {"startLine": 10}}}]}, {"ruleId": "scanner-cb6ef8a959658680", "level": "warning", "message": {"text": "use defused xml \u2014 core/app/mapicons/svg.py:30"}, "properties": {"repobilityId": "c085b9bdd97636a9", "scanner": "scanner-primary", "fingerprint": "cb6ef8a959658680", "layer": "security", "severity": "medium", "confidence": 0.55, "tags": ["semgrep", "security", "python"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "core/app/mapicons/svg.py"}, "region": {"startLine": 30}}}]}, {"ruleId": "scanner-83eb53bf1e2f0b1c", "level": "warning", "message": {"text": "use defused xml \u2014 core/app/public/routes.py:4"}, "properties": {"repobilityId": "cf46a98b042cf759", "scanner": "scanner-primary", "fingerprint": "83eb53bf1e2f0b1c", "layer": "security", "severity": "medium", "confidence": 0.55, "tags": ["semgrep", "security", "python"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "core/app/public/routes.py"}, "region": {"startLine": 4}}}]}, {"ruleId": "scanner-a30f105d1edd1d27", "level": "warning", "message": {"text": "use defused xml \u2014 core/scripts/check_coverage.py:2"}, "properties": {"repobilityId": "d15e3c6e23f384c1", "scanner": "scanner-primary", "fingerprint": "a30f105d1edd1d27", "layer": "security", "severity": "medium", "confidence": 0.55, "tags": ["semgrep", "security", "python"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "core/scripts/check_coverage.py"}, "region": {"startLine": 2}}}]}, {"ruleId": "scanner-8277006a6aa03958", "level": "warning", "message": {"text": "dynamic urllib use detected \u2014 core/scripts/check_published_images.py:46"}, "properties": {"repobilityId": "61dd2be599224299", "scanner": "scanner-primary", "fingerprint": "8277006a6aa03958", "layer": "security", "severity": "medium", "confidence": 0.55, "tags": ["semgrep", "security", "python"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "core/scripts/check_published_images.py"}, "region": {"startLine": 46}}}]}, {"ruleId": "scanner-700231421f36b376", "level": "warning", "message": {"text": "use defused xml \u2014 core/scripts/feature_health/coverage_facts.py:36"}, "properties": {"repobilityId": "08a7350098b993bc", "scanner": "scanner-primary", "fingerprint": "700231421f36b376", "layer": "security", "severity": "medium", "confidence": 0.55, "tags": ["semgrep", "security", "python"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "core/scripts/feature_health/coverage_facts.py"}, "region": {"startLine": 36}}}]}, {"ruleId": "scanner-bd4b7c2f8c144215", "level": "warning", "message": {"text": "var in script tag \u2014 docs/revue/bilan-fonctionnalites.html:505"}, "properties": {"repobilityId": "586e3e8da33e9d40", "scanner": "scanner-primary", "fingerprint": "bd4b7c2f8c144215", "layer": "security", "severity": "medium", "confidence": 0.55, "tags": ["semgrep", "security", "html-templates"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docs/revue/bilan-fonctionnalites.html"}, "region": {"startLine": 505}}}]}, {"ruleId": "scanner-c86e9bcaeb353be4", "level": "error", "message": {"text": "CVE-2026-19693: extract-zip 2.0.1 \u2014 desktop-etl/e2e/package-lock.json"}, "properties": {"repobilityId": "174c3175db346430", "scanner": "scanner-primary", "fingerprint": "c86e9bcaeb353be4", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-19693"]}}, {"ruleId": "scanner-dafc71b9f096533f", "level": "error", "message": {"text": "CVE-2026-56876: extract-zip 2.0.1 \u2014 desktop-etl/e2e/package-lock.json"}, "properties": {"repobilityId": "d7e5060a5eed1b61", "scanner": "scanner-primary", "fingerprint": "dafc71b9f096533f", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-56876"]}}, {"ruleId": "scanner-deec8a82c608477c", "level": "warning", "message": {"text": "GHSA-wrw7-89jp-8q8g: glib 0.18.5 \u2014 desktop-etl/src-tauri/Cargo.lock"}, "properties": {"repobilityId": "abb1647289a0968d", "scanner": "scanner-primary", "fingerprint": "deec8a82c608477c", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-wrw7-89jp-8q8g"]}}, {"ruleId": "scanner-336ff7f20e8946ed", "level": "warning", "message": {"text": "GHSA-55q2-fjhq-7xh7: dompurify 3.4.12 \u2014 shell/package-lock.json"}, "properties": {"repobilityId": "d0e0fb544b715910", "scanner": "scanner-primary", "fingerprint": "336ff7f20e8946ed", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-55q2-fjhq-7xh7"]}}, {"ruleId": "scanner-c95f045263ae339d", "level": "warning", "message": {"text": "CVE-2026-45820: fflate 0.7.4 \u2014 shell/package-lock.json"}, "properties": {"repobilityId": "44779d331ba2aa56", "scanner": "scanner-primary", "fingerprint": "c95f045263ae339d", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-45820"]}}, {"ruleId": "scanner-d821f286e5b61182", "level": "error", "message": {"text": "CVE-2025-71329: image-size 0.7.5 \u2014 shell/package-lock.json"}, "properties": {"repobilityId": "08a8737c56f74f83", "scanner": "scanner-primary", "fingerprint": "d821f286e5b61182", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-71329"]}}, {"ruleId": "scanner-ea5b84648796574b", "level": "error", "message": {"text": "CVE-2025-71330: image-size 0.7.5 \u2014 shell/package-lock.json"}, "properties": {"repobilityId": "7454258842503fc2", "scanner": "scanner-primary", "fingerprint": "ea5b84648796574b", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-71330"]}}, {"ruleId": "scanner-1aa0a7bc58050c1f", "level": "error", "message": {"text": "CVE-2026-4800: lodash-es 4.17.21 \u2014 shell/package-lock.json"}, "properties": {"repobilityId": "5e9b800f87f480d0", "scanner": "scanner-primary", "fingerprint": "1aa0a7bc58050c1f", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-4800"]}}, {"ruleId": "scanner-d56fe516fb63dfd4", "level": "warning", "message": {"text": "CVE-2025-13465: lodash-es 4.17.21 \u2014 shell/package-lock.json"}, "properties": {"repobilityId": "22a3992dafebc74a", "scanner": "scanner-primary", "fingerprint": "d56fe516fb63dfd4", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-13465"]}}, {"ruleId": "scanner-6e39e26e29a4c685", "level": "warning", "message": {"text": "CVE-2026-2950: lodash-es 4.17.21 \u2014 shell/package-lock.json"}, "properties": {"repobilityId": "e581cea75b16b420", "scanner": "scanner-primary", "fingerprint": "6e39e26e29a4c685", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-2950"]}}, {"ruleId": "scanner-7095bd6ebada452d", "level": "warning", "message": {"text": "CVE-2026-53666: react-router 6.30.4 \u2014 shell/package-lock.json"}, "properties": {"repobilityId": "ae2c1d89ae180c3b", "scanner": "scanner-primary", "fingerprint": "7095bd6ebada452d", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-53666"]}}, {"ruleId": "scanner-4062ee02b42a702e", "level": "warning", "message": {"text": "CVE-2026-53669: react-router 6.30.4 \u2014 shell/package-lock.json"}, "properties": {"repobilityId": "daa65a256c4aa89c", "scanner": "scanner-primary", "fingerprint": "4062ee02b42a702e", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-53669"]}}, {"ruleId": "scanner-b022e31fce756abe", "level": "warning", "message": {"text": "CVE-2026-53668: react-router-dom 6.30.4 \u2014 shell/package-lock.json"}, "properties": {"repobilityId": "403c918e1c4a66ac", "scanner": "scanner-primary", "fingerprint": "b022e31fce756abe", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-53668"]}}, {"ruleId": "scanner-2918a0bfbc02dde9", "level": "note", "message": {"text": "DS-0026: No HEALTHCHECK defined \u2014 core/Dockerfile"}, "properties": {"repobilityId": "b30142c5a72093e9", "scanner": "scanner-primary", "fingerprint": "2918a0bfbc02dde9", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "misconfig"]}}, {"ruleId": "scanner-627028c9196b8838", "level": "note", "message": {"text": "DS-0026: No HEALTHCHECK defined \u2014 deploy/appexport-runtime-builder/Dockerfile"}, "properties": {"repobilityId": "6137e7ca49b286cb", "scanner": "scanner-primary", "fingerprint": "627028c9196b8838", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "misconfig"]}}, {"ruleId": "scanner-78e24293c1288c1b", "level": "note", "message": {"text": "DS-0026: No HEALTHCHECK defined \u2014 deploy/appexport-standalone/Dockerfile"}, "properties": {"repobilityId": "3f6d308509963ad5", "scanner": "scanner-primary", "fingerprint": "78e24293c1288c1b", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "misconfig"]}}, {"ruleId": "scanner-1039b169b74bd251", "level": "note", "message": {"text": "DS-0026: No HEALTHCHECK defined \u2014 deploy/backup/Dockerfile"}, "properties": {"repobilityId": "25f0d8764d3e367c", "scanner": "scanner-primary", "fingerprint": "1039b169b74bd251", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "misconfig"]}}, {"ruleId": "scanner-8c4ac3b54af1d46b", "level": "note", "message": {"text": "DS-0026: No HEALTHCHECK defined \u2014 deploy/export-worker/Dockerfile"}, "properties": {"repobilityId": "d1e305d134a880c7", "scanner": "scanner-primary", "fingerprint": "8c4ac3b54af1d46b", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "misconfig"]}}, {"ruleId": "scanner-1322198f7b34bcc8", "level": "error", "message": {"text": "DS-0002: Image user should not be 'root' \u2014 deploy/postgis/Dockerfile"}, "properties": {"repobilityId": "bb7d6fd034dcae50", "scanner": "scanner-primary", "fingerprint": "1322198f7b34bcc8", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "misconfig"]}}, {"ruleId": "scanner-2180190774be9ef6", "level": "note", "message": {"text": "DS-0026: No HEALTHCHECK defined \u2014 deploy/postgis/Dockerfile"}, "properties": {"repobilityId": "cfd5a8ef2019a8ff", "scanner": "scanner-primary", "fingerprint": "2180190774be9ef6", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "misconfig"]}}, {"ruleId": "scanner-a7218540a9eff49b", "level": "note", "message": {"text": "DS-0026: No HEALTHCHECK defined \u2014 deploy/qgis-worker/Dockerfile"}, "properties": {"repobilityId": "8fae0f80e62c5357", "scanner": "scanner-primary", "fingerprint": "a7218540a9eff49b", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "misconfig"]}}, {"ruleId": "scanner-8ebc5fcd71e44445", "level": "error", "message": {"text": "DS-0002: Image user should not be 'root' \u2014 deploy/titiler/Dockerfile"}, "properties": {"repobilityId": "46e07568a04f4d98", "scanner": "scanner-primary", "fingerprint": "8ebc5fcd71e44445", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "misconfig"]}}, {"ruleId": "scanner-22acd6cccf11ab0b", "level": "note", "message": {"text": "DS-0026: No HEALTHCHECK defined \u2014 deploy/titiler/Dockerfile"}, "properties": {"repobilityId": "b48f99a54710b608", "scanner": "scanner-primary", "fingerprint": "22acd6cccf11ab0b", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "misconfig"]}}, {"ruleId": "scanner-01d9f4c975e7ab1e", "level": "note", "message": {"text": "DS-0026: No HEALTHCHECK defined \u2014 shell/Dockerfile"}, "properties": {"repobilityId": "5603cfd27188c1b1", "scanner": "scanner-primary", "fingerprint": "01d9f4c975e7ab1e", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "misconfig"]}}, {"ruleId": "scanner-17d866d91a7c451e", "level": "error", "message": {"text": "Agent instruction/config may expose a secret: CLAUDE.md"}, "properties": {"repobilityId": "ccce5984e58a48f0", "scanner": "scanner-primary", "fingerprint": "17d866d91a7c451e", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["agent-instructions", "secrets", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "CLAUDE.md"}, "region": {"startLine": 204}}}]}, {"ruleId": "scanner-122f91b7f2906dc4", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/settings.json"}, "properties": {"repobilityId": "a2967269048b6a9d", "scanner": "scanner-primary", "fingerprint": "122f91b7f2906dc4", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/settings.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-0aca8936cbf19284", "level": "warning", "message": {"text": "Privileged port 1001 in use"}, "properties": {"repobilityId": "eb126d41479634e4", "scanner": "scanner-primary", "fingerprint": "0aca8936cbf19284", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docker-compose.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-1fb191a2300a2803", "level": "warning", "message": {"text": "Privileged port 100 in use"}, "properties": {"repobilityId": "4bb90df3c0ac53b8", "scanner": "scanner-primary", "fingerprint": "1fb191a2300a2803", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "deploy/backup/Dockerfile"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-73b73c741152ad98", "level": "warning", "message": {"text": "Privileged port 101 in use"}, "properties": {"repobilityId": "f3a9dd0662da1329", "scanner": "scanner-primary", "fingerprint": "73b73c741152ad98", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "deploy/backup/Dockerfile"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-070ae0290aa6f7f0", "level": "warning", "message": {"text": "Privileged port 587 in use"}, "properties": {"repobilityId": "a87a96c3b2e62c08", "scanner": "scanner-primary", "fingerprint": "070ae0290aa6f7f0", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "core/tests/test_alert_notify.py"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-0a870c9fba3a5b2d", "level": "warning", "message": {"text": "Privileged port 75 in use"}, "properties": {"repobilityId": "d378eb1c9eebd8b0", "scanner": "scanner-primary", "fingerprint": "0a870c9fba3a5b2d", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e8ccc9907229d392", "level": "warning", "message": {"text": "Privileged port 59 in use"}, "properties": {"repobilityId": "6c14a9dab4958e92", "scanner": "scanner-primary", "fingerprint": "e8ccc9907229d392", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e01f94b9980fbf52", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: python:3.12-slim"}, "properties": {"repobilityId": "b4a1792514da0f18", "scanner": "scanner-primary", "fingerprint": "e01f94b9980fbf52", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "deploy/export-worker/Dockerfile"}, "region": {"startLine": 9}}}]}, {"ruleId": "scanner-f796bccf1c2887a5", "level": "warning", "message": {"text": "Dockerfile runs as root: deploy/titiler/Dockerfile"}, "properties": {"repobilityId": "86a127db19eb0137", "scanner": "scanner-primary", "fingerprint": "f796bccf1c2887a5", "layer": "hardware", "severity": "medium", "confidence": 1.0, "tags": ["security", "container"]}}, {"ruleId": "scanner-c7940d94b26cadae", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: ghcr.io/vincentsarago/uvicorn-gunicorn:${PYTHON_VERSION}"}, "properties": {"repobilityId": "da26cf40f8c867f8", "scanner": "scanner-primary", "fingerprint": "c7940d94b26cadae", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "deploy/titiler/Dockerfile"}, "region": {"startLine": 19}}}]}, {"ruleId": "scanner-d07f8ad6b397544a", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: alpine:3.20"}, "properties": {"repobilityId": "59ff966b69b830cb", "scanner": "scanner-primary", "fingerprint": "d07f8ad6b397544a", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "deploy/backup/Dockerfile"}, "region": {"startLine": 2}}}]}, {"ruleId": "scanner-9aaaee96201091e3", "level": "warning", "message": {"text": "Dockerfile runs as root: deploy/postgis/Dockerfile"}, "properties": {"repobilityId": "8bf6ecc529f6a414", "scanner": "scanner-primary", "fingerprint": "9aaaee96201091e3", "layer": "hardware", "severity": "medium", "confidence": 1.0, "tags": ["security", "container"]}}, {"ruleId": "scanner-80ba7fa3a671acb7", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: postgres:16-bookworm"}, "properties": {"repobilityId": "09811b99a81f8b7f", "scanner": "scanner-primary", "fingerprint": "80ba7fa3a671acb7", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "deploy/postgis/Dockerfile"}, "region": {"startLine": 10}}}]}, {"ruleId": "scanner-2a75ab55834fc296", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: node:20-slim"}, "properties": {"repobilityId": "3798114840eb7d40", "scanner": "scanner-primary", "fingerprint": "2a75ab55834fc296", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "deploy/appexport-standalone/Dockerfile"}, "region": {"startLine": 10}}}]}, {"ruleId": "scanner-1d40083cfb237688", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: python:3.12-slim"}, "properties": {"repobilityId": "516e565c56e7cfb4", "scanner": "scanner-primary", "fingerprint": "1d40083cfb237688", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "deploy/appexport-standalone/Dockerfile"}, "region": {"startLine": 20}}}]}, {"ruleId": "scanner-9584c83d6d8e3467", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: node:20-slim"}, "properties": {"repobilityId": "ab133ae95c4307a3", "scanner": "scanner-primary", "fingerprint": "9584c83d6d8e3467", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "deploy/appexport-runtime-builder/Dockerfile"}, "region": {"startLine": 7}}}]}, {"ruleId": "scanner-087f7acdc73b53d5", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: qgis/qgis:release-3_34"}, "properties": {"repobilityId": "daf95d855c1bb766", "scanner": "scanner-primary", "fingerprint": "087f7acdc73b53d5", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "deploy/qgis-worker/Dockerfile"}, "region": {"startLine": 3}}}]}, {"ruleId": "scanner-7a7f90947a55907d", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: python:3.12-slim"}, "properties": {"repobilityId": "f9e6d4f35a0249c2", "scanner": "scanner-primary", "fingerprint": "7a7f90947a55907d", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "core/Dockerfile"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b24f8a2d0f323a51", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: node:20-slim"}, "properties": {"repobilityId": "1ae1fdd38736e880", "scanner": "scanner-primary", "fingerprint": "b24f8a2d0f323a51", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "shell/Dockerfile"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c95fb9f802b80f23", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: nginx:1.27-alpine"}, "properties": {"repobilityId": "14d9828dc965f1a1", "scanner": "scanner-primary", "fingerprint": "c95fb9f802b80f23", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "shell/Dockerfile"}, "region": {"startLine": 16}}}]}, {"ruleId": "scanner-adf0c01633bb311c", "level": "warning", "message": {"text": "Runtime dotenv file present in repo: shell/.env.e2e"}, "properties": {"repobilityId": "95e24286e69d4137", "scanner": "scanner-primary", "fingerprint": "adf0c01633bb311c", "layer": "security", "severity": "medium", "confidence": 0.65, "tags": ["secrets", "config", "env-file", "runtime-env"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "shell/.env.e2e"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-8a73d41dcd06b9ec", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in docs/revue/bilan-fonctionnalites.html:598"}, "properties": {"repobilityId": "cbf1d02c6b747cfa", "scanner": "scanner-primary", "fingerprint": "8a73d41dcd06b9ec", "layer": "security", "severity": "medium", "confidence": 0.65, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docs/revue/bilan-fonctionnalites.html"}, "region": {"startLine": 598}}}]}, {"ruleId": "scanner-f873f06cf71a1caa", "level": "warning", "message": {"text": "Insecure pattern 'dangerous_innerhtml' in docs/revue/2026-09-04-matrice-fonctionnalites.html:590"}, "properties": {"repobilityId": "4d2b9d26b94b6c74", "scanner": "scanner-primary", "fingerprint": "f873f06cf71a1caa", "layer": "security", "severity": "medium", "confidence": 0.65, "tags": ["owasp", "dangerous_innerhtml"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docs/revue/2026-09-04-matrice-fonctionnalites.html"}, "region": {"startLine": 590}}}]}, {"ruleId": "scanner-7bf057fd0ec9baf5", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in docs/revue/2026-09-04-matrice-fonctionnalites.html:647"}, "properties": {"repobilityId": "00ff56287134813a", "scanner": "scanner-primary", "fingerprint": "7bf057fd0ec9baf5", "layer": "security", "severity": "medium", "confidence": 0.65, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docs/revue/2026-09-04-matrice-fonctionnalites.html"}, "region": {"startLine": 647}}}]}, {"ruleId": "scanner-07045c9595e9ba3b", "level": "warning", "message": {"text": "Possible secret in scripts/install.sh"}, "properties": {"repobilityId": "42571046bbc55875", "scanner": "scanner-primary", "fingerprint": "07045c9595e9ba3b", "layer": "security", "severity": "medium", "confidence": 0.58, "tags": ["secrets", "password_literal"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/install.sh"}, "region": {"startLine": 356}}}]}, {"ruleId": "scanner-c7ab3119a652af63", "level": "error", "message": {"text": "Insecure pattern 'node_child_process' in desktop-etl/scripts/prepare-sidecar-binary.mjs:4"}, "properties": {"repobilityId": "845b67ef8920449e", "scanner": "scanner-primary", "fingerprint": "c7ab3119a652af63", "layer": "security", "severity": "high", "confidence": 0.9, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "desktop-etl/scripts/prepare-sidecar-binary.mjs"}, "region": {"startLine": 4}}}]}, {"ruleId": "scanner-dfd1bbe480f63709", "level": "error", "message": {"text": "Insecure pattern 'node_child_process' in desktop-etl/e2e/wdio.conf.js:5"}, "properties": {"repobilityId": "2201270d5262edc1", "scanner": "scanner-primary", "fingerprint": "dfd1bbe480f63709", "layer": "security", "severity": "high", "confidence": 0.9, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "desktop-etl/e2e/wdio.conf.js"}, "region": {"startLine": 5}}}]}, {"ruleId": "scanner-a23cbd1936fc2537", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in core/scripts/feature_health/assets/bilan.js:93"}, "properties": {"repobilityId": "69b8d45d0d5caf9e", "scanner": "scanner-primary", "fingerprint": "a23cbd1936fc2537", "layer": "security", "severity": "medium", "confidence": 0.65, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "core/scripts/feature_health/assets/bilan.js"}, "region": {"startLine": 93}}}]}, {"ruleId": "scanner-763c2fc5e6a69987", "level": "warning", "message": {"text": "Insecure pattern 'cors_wildcard' in core/app/main.py:248"}, "properties": {"repobilityId": "fe5e87a63ae13048", "scanner": "scanner-primary", "fingerprint": "763c2fc5e6a69987", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "cors_wildcard"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "core/app/main.py"}, "region": {"startLine": 248}}}]}, {"ruleId": "scanner-9860bee0a1df2068", "level": "warning", "message": {"text": "Insecure pattern 'dangerous_innerhtml' in shell/eslint.config.js:83"}, "properties": {"repobilityId": "e43162d6e56a6bcb", "scanner": "scanner-primary", "fingerprint": "9860bee0a1df2068", "layer": "security", "severity": "medium", "confidence": 0.65, "tags": ["owasp", "dangerous_innerhtml"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "shell/eslint.config.js"}, "region": {"startLine": 83}}}]}, {"ruleId": "scanner-7d698c29f3877836", "level": "warning", "message": {"text": "Possible secret in shell/e2e-oidc/auth-oidc.spec.ts"}, "properties": {"repobilityId": "b75252645b97bb1c", "scanner": "scanner-primary", "fingerprint": "7d698c29f3877836", "layer": "security", "severity": "medium", "confidence": 0.58, "tags": ["secrets", "password_literal"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "shell/e2e-oidc/auth-oidc.spec.ts"}, "region": {"startLine": 3}}}]}, {"ruleId": "scanner-017a6d2c097f7130", "level": "warning", "message": {"text": "Insecure pattern 'dangerous_innerhtml' in shell/src/builder/widgets/richSection.tsx:47"}, "properties": {"repobilityId": "29bd67f2c3ca663d", "scanner": "scanner-primary", "fingerprint": "017a6d2c097f7130", "layer": "security", "severity": "medium", "confidence": 0.65, "tags": ["owasp", "dangerous_innerhtml"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "shell/src/builder/widgets/richSection.tsx"}, "region": {"startLine": 47}}}]}, {"ruleId": "scanner-63b5ba263e8883b4", "level": "warning", "message": {"text": "Insecure pattern 'cors_wildcard' in shell/e2e/connected-export.spec.ts:60"}, "properties": {"repobilityId": "57123357c7feac72", "scanner": "scanner-primary", "fingerprint": "63b5ba263e8883b4", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "cors_wildcard"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "shell/e2e/connected-export.spec.ts"}, "region": {"startLine": 60}}}]}, {"ruleId": "scanner-5d882d3552e1b0a3", "level": "warning", "message": {"text": "Insecure pattern 'cors_wildcard' in shell/e2e/external-widget-server.mjs:27"}, "properties": {"repobilityId": "44d35c344eef414c", "scanner": "scanner-primary", "fingerprint": "5d882d3552e1b0a3", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "cors_wildcard"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "shell/e2e/external-widget-server.mjs"}, "region": {"startLine": 27}}}]}, {"ruleId": "scanner-64192a3c67110d01", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "87338a8bfcb6f435", "scanner": "scanner-primary", "fingerprint": "64192a3c67110d01", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-7fba85d8cc2e26c4", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "65c14143c7ca6b86", "scanner": "scanner-primary", "fingerprint": "7fba85d8cc2e26c4", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/publish-edge.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c8b1aab263862f67", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "30e629813fdd9a62", "scanner": "scanner-primary", "fingerprint": "c8b1aab263862f67", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/desktop-etl-webdriver.yml"}, "region": {"startLine": 63}}}]}, {"ruleId": "scanner-1838a141491ce38c", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "b8fd4f5048f96576", "scanner": "scanner-primary", "fingerprint": "1838a141491ce38c", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-05cad74ebaa9cf75", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "475281e65a56a46e", "scanner": "scanner-primary", "fingerprint": "05cad74ebaa9cf75", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/_build-and-push.yml"}, "region": {"startLine": 135}}}]}, {"ruleId": "scanner-403609f2c2406173", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "ea824bd2825532bd", "scanner": "scanner-primary", "fingerprint": "403609f2c2406173", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/_build-and-push.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ee2081f52e38872b", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "c3748b29fee43ecf", "scanner": "scanner-primary", "fingerprint": "ee2081f52e38872b", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/desktop-etl-sidecar-freeze.yml"}, "region": {"startLine": 35}}}]}, {"ruleId": "scanner-1331667eac28f5e2", "level": "note", "message": {"text": "Very large file: core/tests/test_pipeline_runtime.py (2992 lines)"}, "properties": {"repobilityId": "cd4457fd10b072ea", "scanner": "scanner-primary", "fingerprint": "1331667eac28f5e2", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-a197ff3fa1a21193", "level": "note", "message": {"text": "Very large file: core/tests/test_deployability.py (1912 lines)"}, "properties": {"repobilityId": "6d8fd9e54d79b5e1", "scanner": "scanner-primary", "fingerprint": "a197ff3fa1a21193", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-a25b2fce467c1de2", "level": "note", "message": {"text": "Very large file: shell/src/i18n/catalog.fr.ts (1723 lines)"}, "properties": {"repobilityId": "c58ec72fd01ccd67", "scanner": "scanner-primary", "fingerprint": "a25b2fce467c1de2", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-2fc6cd02a8468222", "level": "note", "message": {"text": "Very large file: shell/src/api/itemClient.test.ts (4300 lines)"}, "properties": {"repobilityId": "874560478cc00cec", "scanner": "scanner-primary", "fingerprint": "2fc6cd02a8468222", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-90607450c74168e6", "level": "note", "message": {"text": "Very large file: shell/src/api/generated/core-schema.d.ts (7375 lines)"}, "properties": {"repobilityId": "8d95f3087b09c8db", "scanner": "scanner-primary", "fingerprint": "90607450c74168e6", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-4f8043640a22ac4e", "level": "note", "message": {"text": "Very large file: shell/src/map/MapView.test.tsx (2370 lines)"}, "properties": {"repobilityId": "ea7ccc93112a0bcc", "scanner": "scanner-primary", "fingerprint": "4f8043640a22ac4e", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-3a06fd120a4d84a8", "level": "note", "message": {"text": "Very large file: shell/src/map/MapView.tsx (1460 lines)"}, "properties": {"repobilityId": "e716528a4d884138", "scanner": "scanner-primary", "fingerprint": "3a06fd120a4d84a8", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-0037069270fc8a5f", "level": "note", "message": {"text": "Very large file: shell/e2e/analytics-context.spec.ts (2877 lines)"}, "properties": {"repobilityId": "1796ac4bbd84788b", "scanner": "scanner-primary", "fingerprint": "0037069270fc8a5f", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "6a7e7295db8fe31d", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-72b2a6250083a784", "level": "warning", "message": {"text": "Placeholder or mock-heavy implementation detected"}, "properties": {"repobilityId": "53da5eeaa139ae7d", "scanner": "scanner-primary", "fingerprint": "72b2a6250083a784", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "incomplete", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "e7c8ff5bb07f1bcf", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-09a5536df11371dc", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/generate_qgis_algorithm_schemas.py:82"}, "properties": {"repobilityId": "737da1a8a47f0a67", "scanner": "scanner-primary", "fingerprint": "09a5536df11371dc", "layer": "quality", "severity": "medium", "confidence": 0.85, "tags": ["integrity", "fragile-runtime", "robustness"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/generate_qgis_algorithm_schemas.py"}, "region": {"startLine": 82}}}]}, {"ruleId": "scanner-821b61b35c871185", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 core/scripts/feature_health_cli.py:187"}, "properties": {"repobilityId": "d9c20e7371cce669", "scanner": "scanner-primary", "fingerprint": "821b61b35c871185", "layer": "quality", "severity": "medium", "confidence": 0.85, "tags": ["integrity", "fragile-runtime", "robustness"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "core/scripts/feature_health_cli.py"}, "region": {"startLine": 187}}}]}, {"ruleId": "scanner-7e87d93c00f623bd", "level": "note", "message": {"text": "Legacy-named symbol `model_copy` in core/app/appexport/freeze.py:67"}, "properties": {"repobilityId": "b964939e7182533e", "scanner": "scanner-primary", "fingerprint": "7e87d93c00f623bd", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-1a1a102827442d2f", "level": "note", "message": {"text": "Legacy-named symbol `model_copy` in core/app/mcp/tools/identity.py:37"}, "properties": {"repobilityId": "720cdab3bfe924c1", "scanner": "scanner-primary", "fingerprint": "1a1a102827442d2f", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-f522f3aea8b50670", "level": "note", "message": {"text": "Legacy-named symbol `model_copy` in core/app/pipelines/runtime.py:945"}, "properties": {"repobilityId": "279edaff5992092f", "scanner": "scanner-primary", "fingerprint": "f522f3aea8b50670", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-ef284e9b922c36c1", "level": "note", "message": {"text": "Legacy-named symbol `supports_copy` in core/app/harvest/routes.py:110"}, "properties": {"repobilityId": "8c60134068acc76b", "scanner": "scanner-primary", "fingerprint": "ef284e9b922c36c1", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-63aecc4efcfb25fd", "level": "note", "message": {"text": "Legacy-named symbol `_upsert_copy` in core/app/harvest/service.py:98"}, "properties": {"repobilityId": "261568ef0c9e77c8", "scanner": "scanner-primary", "fingerprint": "63aecc4efcfb25fd", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-dd1f7b0a9a51eb2f", "level": "note", "message": {"text": "Legacy-named symbol `supports_copy` in core/app/harvest/connectors/wfs.py:24"}, "properties": {"repobilityId": "c1c91ba22fc57077", "scanner": "scanner-primary", "fingerprint": "dd1f7b0a9a51eb2f", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-3daec0c0b706cdd8", "level": "note", "message": {"text": "Legacy-named symbol `supports_copy` in core/app/harvest/connectors/ogc_records.py:28"}, "properties": {"repobilityId": "395e16225e1cf0eb", "scanner": "scanner-primary", "fingerprint": "3daec0c0b706cdd8", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-3e80376e0178aecc", "level": "note", "message": {"text": "Legacy-named symbol `supports_copy` in core/app/harvest/connectors/wmts.py:23"}, "properties": {"repobilityId": "6ca5f7b81043ffae", "scanner": "scanner-primary", "fingerprint": "3e80376e0178aecc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-28271809e45411d8", "level": "note", "message": {"text": "Stub function `fetch_copy_geojson` (body is just `pass`/`return`) \u2014 core/app/harvest/connectors/wmts.py:39"}, "properties": {"repobilityId": "f006c06959ad7d04", "scanner": "scanner-primary", "fingerprint": "28271809e45411d8", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "empty-handler", "dead-code"]}}, {"ruleId": "scanner-1d718104bb13fd6b", "level": "note", "message": {"text": "Legacy-named symbol `supports_copy` in core/app/harvest/connectors/ckan.py:4"}, "properties": {"repobilityId": "b85a31115a700949", "scanner": "scanner-primary", "fingerprint": "1d718104bb13fd6b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-d3dcbc2fec807e44", "level": "note", "message": {"text": "Legacy-named symbol `supports_copy` in core/app/harvest/connectors/csw.py:27"}, "properties": {"repobilityId": "bad8d02d8073711c", "scanner": "scanner-primary", "fingerprint": "d3dcbc2fec807e44", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-b90ed41dee131379", "level": "note", "message": {"text": "Legacy-named symbol `supports_copy` in core/app/harvest/connectors/base.py:35"}, "properties": {"repobilityId": "3a498aa6b9a45730", "scanner": "scanner-primary", "fingerprint": "b90ed41dee131379", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-26a34cebc2b3e6a3", "level": "note", "message": {"text": "Legacy-named symbol `supports_copy` in core/app/harvest/connectors/wms.py:21"}, "properties": {"repobilityId": "4c8c64f236f1cbce", "scanner": "scanner-primary", "fingerprint": "26a34cebc2b3e6a3", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-11983e81a825b61c", "level": "note", "message": {"text": "Legacy-named symbol `supports_copy` in core/app/harvest/connectors/stac.py:25"}, "properties": {"repobilityId": "b50a2e4a443b885a", "scanner": "scanner-primary", "fingerprint": "11983e81a825b61c", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-5a9ae7cd5cfdc567", "level": "note", "message": {"text": "Legacy-named symbol `supports_copy` in core/app/harvest/connectors/arcgis.py:37"}, "properties": {"repobilityId": "089b981a945ccbc2", "scanner": "scanner-primary", "fingerprint": "5a9ae7cd5cfdc567", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-859124791f46dc62", "level": "note", "message": {"text": "Legacy-named symbol `list_objects_v2` in core/app/compliance/purge.py:70"}, "properties": {"repobilityId": "5ef20ef8b84e0b57", "scanner": "scanner-primary", "fingerprint": "859124791f46dc62", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-1ef15aa2e5059ed5", "level": "note", "message": {"text": "Legacy-named symbol `list_objects_v2` in core/app/quotas/service.py:53"}, "properties": {"repobilityId": "0da66f748ae36d25", "scanner": "scanner-primary", "fingerprint": "1ef15aa2e5059ed5", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-70d83b368309df34", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 core/app/alerts/notify.py:8"}, "properties": {"repobilityId": "7516de01f8f850e0", "scanner": "scanner-primary", "fingerprint": "70d83b368309df34", "layer": "quality", "severity": "medium", "confidence": 0.85, "tags": ["integrity", "fragile-runtime", "robustness"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "core/app/alerts/notify.py"}, "region": {"startLine": 8}}}]}, {"ruleId": "scanner-55f54daf95da4e87", "level": "note", "message": {"text": "Legacy-named symbol `list_objects_v2` in core/app/cdc/storage.py:24"}, "properties": {"repobilityId": "5035c1b4db9ddfdb", "scanner": "scanner-primary", "fingerprint": "55f54daf95da4e87", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-55ca8c97e6f08cd7", "level": "warning", "message": {"text": "Fire-and-forget `fetch()` has no rejection handler \u2014 shell/src/map/MapView.tsx:1397"}, "properties": {"repobilityId": "508c9cf8e8e7afdf", "scanner": "scanner-primary", "fingerprint": "55ca8c97e6f08cd7", "layer": "quality", "severity": "medium", "confidence": 0.9, "tags": ["integrity", "fragile-runtime", "robustness", "unhandled-promise"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "shell/src/map/MapView.tsx"}, "region": {"startLine": 1397}}}]}, {"ruleId": "scanner-ca395a18e146a116", "level": "note", "message": {"text": "38 env vars used in code but missing from .env.example"}, "properties": {"repobilityId": "44b4fc87d4005415", "scanner": "scanner-primary", "fingerprint": "ca395a18e146a116", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "config-drift"]}}, {"ruleId": "scanner-02525d39071dd2c7", "level": "note", "message": {"text": "Near-duplicate function bodies in 5 places"}, "properties": {"repobilityId": "89e9a94db7265d1c", "scanner": "scanner-primary", "fingerprint": "02525d39071dd2c7", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-49c98f7cedd9c977", "level": "note", "message": {"text": "Near-duplicate function bodies in 4 places"}, "properties": {"repobilityId": "22170e4390eb237b", "scanner": "scanner-primary", "fingerprint": "49c98f7cedd9c977", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "8b4963116d40fb47", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2f2bf0012e59b7b6", "level": "warning", "message": {"text": "Frontend route `/pipelines/:pk/edit` has no Link/navigate to it \u2014 shell/src/shell/routes.tsx"}, "properties": {"repobilityId": "54e20ac0d7ab2bcd", "scanner": "scanner-primary", "fingerprint": "2f2bf0012e59b7b6", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "orphan-page", "wiring"]}}, {"ruleId": "scanner-8b3c1e5bcc98692c", "level": "warning", "message": {"text": "Frontend route `/datasets/visual-query/:pipelinePk/edit` has no Link/navigate to it \u2014 shell/src/shell/routes.tsx"}, "properties": {"repobilityId": "5ecec91e3c7e4299", "scanner": "scanner-primary", "fingerprint": "8b3c1e5bcc98692c", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "orphan-page", "wiring"]}}, {"ruleId": "scanner-db4c2a8d09b2b206", "level": "warning", "message": {"text": "Frontend route `/datasets/:pk/edit` has no Link/navigate to it \u2014 shell/src/shell/NewItemButton.test.tsx"}, "properties": {"repobilityId": "f542fb03ab014af4", "scanner": "scanner-primary", "fingerprint": "db4c2a8d09b2b206", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "orphan-page", "wiring"]}}, {"ruleId": "scanner-7ac5841447c612b2", "level": "warning", "message": {"text": "Frontend route `/items/:pk` has no Link/navigate to it \u2014 shell/src/shell/routes.tsx"}, "properties": {"repobilityId": "1cb7e29a39b86592", "scanner": "scanner-primary", "fingerprint": "7ac5841447c612b2", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "orphan-page", "wiring"]}}, {"ruleId": "scanner-b26f3a6a7f3cb3f6", "level": "warning", "message": {"text": "Frontend route `/maps/:pk` has no Link/navigate to it \u2014 shell/src/shell/NewItemButton.test.tsx"}, "properties": {"repobilityId": "adb2f2040f1c769f", "scanner": "scanner-primary", "fingerprint": "b26f3a6a7f3cb3f6", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "orphan-page", "wiring"]}}, {"ruleId": "scanner-a92f42ed480fff5c", "level": "warning", "message": {"text": "Frontend route `/bookmarks` has no Link/navigate to it \u2014 shell/src/shell/routes.tsx"}, "properties": {"repobilityId": "b52091be2b80cf74", "scanner": "scanner-primary", "fingerprint": "a92f42ed480fff5c", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "orphan-page", "wiring"]}}, {"ruleId": "scanner-7092a931165da3a4", "level": "warning", "message": {"text": "Frontend route `/apps/:pk/edit` has no Link/navigate to it \u2014 shell/src/shell/NewItemButton.test.tsx"}, "properties": {"repobilityId": "580cbf6f83eeba15", "scanner": "scanner-primary", "fingerprint": "7092a931165da3a4", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "orphan-page", "wiring"]}}, {"ruleId": "scanner-e28b52ac1b3542ad", "level": "warning", "message": {"text": "Frontend route `/reports/:pk/edit` has no Link/navigate to it \u2014 shell/src/shell/routes.tsx"}, "properties": {"repobilityId": "fecb26210cb7be64", "scanner": "scanner-primary", "fingerprint": "e28b52ac1b3542ad", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "orphan-page", "wiring"]}}, {"ruleId": "scanner-4c313c058cd39aa6", "level": "warning", "message": {"text": "Frontend route `/internal/kit-gallery` has no Link/navigate to it \u2014 shell/src/shell/routes.tsx"}, "properties": {"repobilityId": "f1a73d402f7182ea", "scanner": "scanner-primary", "fingerprint": "4c313c058cd39aa6", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "orphan-page", "wiring"]}}, {"ruleId": "scanner-2f465019aac95aeb", "level": "warning", "message": {"text": "Frontend route `/apps/:pk/:pageId?` has no Link/navigate to it \u2014 shell/src/shell/routes.tsx"}, "properties": {"repobilityId": "408feefbbb020c68", "scanner": "scanner-primary", "fingerprint": "2f465019aac95aeb", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "orphan-page", "wiring"]}}, {"ruleId": "scanner-39a17283265c9932", "level": "warning", "message": {"text": "Frontend route `/embed/:token` has no Link/navigate to it \u2014 shell/src/shell/routes.tsx"}, "properties": {"repobilityId": "fdde0375873af842", "scanner": "scanner-primary", "fingerprint": "39a17283265c9932", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "orphan-page", "wiring"]}}, {"ruleId": "scanner-eaed6e98d5143f30", "level": "warning", "message": {"text": "Frontend route `/sites/:slug` has no Link/navigate to it \u2014 shell/src/shell/routes.tsx"}, "properties": {"repobilityId": "cfc406c435299f7c", "scanner": "scanner-primary", "fingerprint": "eaed6e98d5143f30", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "orphan-page", "wiring"]}}, {"ruleId": "scanner-a5eb6ed275cc8be1", "level": "warning", "message": {"text": "Frontend route `/public/items/:pk` has no Link/navigate to it \u2014 shell/src/shell/routes.tsx"}, "properties": {"repobilityId": "291ad3966b68946b", "scanner": "scanner-primary", "fingerprint": "a5eb6ed275cc8be1", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "orphan-page", "wiring"]}}, {"ruleId": "scanner-e75f7d4b07206b15", "level": "warning", "message": {"text": "Frontend route `/public/datasets/:collectionId` has no Link/navigate to it \u2014 shell/src/shell/routes.tsx"}, "properties": {"repobilityId": "d87d6923c9a5f2ec", "scanner": "scanner-primary", "fingerprint": "e75f7d4b07206b15", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "orphan-page", "wiring"]}}, {"ruleId": "scanner-ac459c162d509b52", "level": "warning", "message": {"text": "Frontend route `/pipelines/:id/edit` has no Link/navigate to it \u2014 shell/src/shell/chrome/NotificationBell.test.tsx"}, "properties": {"repobilityId": "efe316d901d0f575", "scanner": "scanner-primary", "fingerprint": "ac459c162d509b52", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "orphan-page", "wiring"]}}, {"ruleId": "scanner-240ba8ff162ed97e", "level": "error", "message": {"text": "FastAPI POST `aggregate` without auth dependency \u2014 core/app/appexport/miniserver/main.py:156"}, "properties": {"repobilityId": "6e1760aba6448f50", "scanner": "scanner-primary", "fingerprint": "240ba8ff162ed97e", "layer": "security", "severity": "high", "confidence": 0.75, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "core/app/appexport/miniserver/main.py"}, "region": {"startLine": 156}}}]}, {"ruleId": "scanner-d620b167dd710d49", "level": "error", "message": {"text": "FastAPI PUT `put_pipeline` without auth dependency \u2014 core/app/pipelines/sidecar/app.py:97"}, "properties": {"repobilityId": "50e9689795ee8739", "scanner": "scanner-primary", "fingerprint": "d620b167dd710d49", "layer": "security", "severity": "high", "confidence": 0.75, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "core/app/pipelines/sidecar/app.py"}, "region": {"startLine": 97}}}]}, {"ruleId": "scanner-ae53389fd8a93b29", "level": "error", "message": {"text": "FastAPI POST `run_pipeline_route` without auth dependency \u2014 core/app/pipelines/sidecar/app.py:106"}, "properties": {"repobilityId": "e2c3accdcb3947be", "scanner": "scanner-primary", "fingerprint": "ae53389fd8a93b29", "layer": "security", "severity": "high", "confidence": 0.75, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "core/app/pipelines/sidecar/app.py"}, "region": {"startLine": 106}}}]}, {"ruleId": "scanner-e8f1dfce24ef0774", "level": "error", "message": {"text": "FastAPI POST `preview_pipeline_route` without auth dependency \u2014 core/app/pipelines/sidecar/app.py:122"}, "properties": {"repobilityId": "66e2cba944bfb28a", "scanner": "scanner-primary", "fingerprint": "e8f1dfce24ef0774", "layer": "security", "severity": "high", "confidence": 0.75, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "core/app/pipelines/sidecar/app.py"}, "region": {"startLine": 122}}}]}, {"ruleId": "scanner-9286598906e4b829", "level": "warning", "message": {"text": "Vulnerable dependency dompurify 3.4.12: GHSA-55q2-fjhq-7xh7"}, "properties": {"repobilityId": "64fb95de17872020", "scanner": "scanner-primary", "fingerprint": "9286598906e4b829", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-55q2-fjhq-7xh7"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "shell/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ceef513b9d359a67", "level": "warning", "message": {"text": "Vulnerable dependency react-router-dom 6.30.4: GHSA-jjmj-jmhj-qwj2"}, "properties": {"repobilityId": "8faafa6975f0057e", "scanner": "scanner-primary", "fingerprint": "ceef513b9d359a67", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-jjmj-jmhj-qwj2"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "shell/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-aff2a1212a755932", "level": "error", "message": {"text": "Vulnerable dependency extract-zip 2.0.1: GHSA-7pqw-9j4j-h8q3"}, "properties": {"repobilityId": "2d85964ac4d67283", "scanner": "scanner-primary", "fingerprint": "aff2a1212a755932", "layer": "dependencies", "severity": "high", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-7pqw-9j4j-h8q3", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "desktop-etl/e2e/package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b609945b060679db", "level": "error", "message": {"text": "Vulnerable dependency extract-zip 2.0.1: GHSA-jmr9-qjv8-65gv"}, "properties": {"repobilityId": "cfc22cf7a4295d68", "scanner": "scanner-primary", "fingerprint": "b609945b060679db", "layer": "dependencies", "severity": "high", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-jmr9-qjv8-65gv", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "desktop-etl/e2e/package-lock.json"}, "region": {"startLine": 1}}}]}]}]}