{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-828350dc3243cc29", "name": "Stray `console.log` in TS/JS \u2014 thaiprompt/stores/authStore.ts:139", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 thaiprompt/stores/authStore.ts:139"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3f3315da159a3175", "name": "Stray `console.log` in TS/JS \u2014 thaiprompt/app/checkout.tsx:235", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 thaiprompt/app/checkout.tsx:235"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f0c705801c7c4449", "name": "TODO/FIXME marker in shipping code \u2014 thaiprompt/app/services.tsx:558", "shortDescription": {"text": "TODO/FIXME marker in shipping code \u2014 thaiprompt/app/services.tsx:558"}, "fullDescription": {"text": "Track in /reviews or /issues, not as a code comment that rots.\n\nWhy: Drift control \u2014 shouldn't be the same as Quality TODO scanner.\nRule id: fq.todo-marker"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-ba5997d11e840860", "name": "TODO/FIXME marker in shipping code \u2014 thaiprompt/app/notification-settings.tsx:188", "shortDescription": {"text": "TODO/FIXME marker in shipping code \u2014 thaiprompt/app/notification-settings.tsx:188"}, "fullDescription": {"text": "Track in /reviews or /issues, not as a code comment that rots.\n\nWhy: Drift control \u2014 shouldn't be the same as Quality TODO scanner.\nRule id: fq.todo-marker"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-9a8af5067060bf26", "name": "Stray `console.log` in TS/JS \u2014 thaiprompt/app/notification-settings.tsx:106", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 thaiprompt/app/notification-settings.tsx:106"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-96ffcfa12c76e13c", "name": "Stray `console.log` in TS/JS \u2014 thaiprompt/app/kyc.tsx:57", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 thaiprompt/app/kyc.tsx:57"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-071e601efc16d0f9", "name": "TODO/FIXME marker in shipping code \u2014 thaiprompt/app/watch-earn.tsx:354", "shortDescription": {"text": "TODO/FIXME marker in shipping code \u2014 thaiprompt/app/watch-earn.tsx:354"}, "fullDescription": {"text": "Track in /reviews or /issues, not as a code comment that rots.\n\nWhy: Drift control \u2014 shouldn't be the same as Quality TODO scanner.\nRule id: fq.todo-marker"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-95d04bf0354f1b81", "name": "Stray `console.log` in TS/JS \u2014 thaiprompt/app/watch-earn.tsx:219", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 thaiprompt/app/watch-earn.tsx:219"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-249668445fcd5251", "name": "Stray `console.log` in TS/JS \u2014 thaiprompt/app/qr-scanner.tsx:115", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 thaiprompt/app/qr-scanner.tsx:115"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0506cf4768bcdd2e", "name": "TODO/FIXME marker in shipping code \u2014 thaiprompt/app/rider-services.tsx:379", "shortDescription": {"text": "TODO/FIXME marker in shipping code \u2014 thaiprompt/app/rider-services.tsx:379"}, "fullDescription": {"text": "Track in /reviews or /issues, not as a code comment that rots.\n\nWhy: Drift control \u2014 shouldn't be the same as Quality TODO scanner.\nRule id: fq.todo-marker"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-e0f23c3cb1e6b3a9", "name": "TODO/FIXME marker in shipping code \u2014 thaiprompt/app/academy.tsx:138", "shortDescription": {"text": "TODO/FIXME marker in shipping code \u2014 thaiprompt/app/academy.tsx:138"}, "fullDescription": {"text": "Track in /reviews or /issues, not as a code comment that rots.\n\nWhy: Drift control \u2014 shouldn't be the same as Quality TODO scanner.\nRule id: fq.todo-marker"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-af2b0fa3d985ff74", "name": "Stray `console.log` in TS/JS \u2014 thaiprompt/app/_layout.tsx:195", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 thaiprompt/app/_layout.tsx:195"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c338551e41055567", "name": "Stray `console.log` in TS/JS \u2014 thaiprompt/app/wallet-topup.tsx:110", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 thaiprompt/app/wallet-topup.tsx:110"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-72ee7b7903acc40d", "name": "Stray `console.log` in TS/JS \u2014 thaiprompt/app/edit-profile.tsx:54", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 thaiprompt/app/edit-profile.tsx:54"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5dbe5830bd9b2f9a", "name": "Stray `console.log` in TS/JS \u2014 thaiprompt/app/(tabs)/profile.tsx:179", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 thaiprompt/app/(tabs)/profile.tsx:179"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-01251f4438602a1e", "name": "Stray `console.log` in TS/JS \u2014 thaiprompt/app/(tabs)/index.tsx:92", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 thaiprompt/app/(tabs)/index.tsx:92"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cf2a6addbe4c2f68", "name": "Stray `console.log` in TS/JS \u2014 thaiprompt/app/(tabs)/_layout.tsx:454", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 thaiprompt/app/(tabs)/_layout.tsx:454"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-bf16b72dc148c160", "name": "Stray `console.log` in TS/JS \u2014 thaiprompt/services/api.ts:1166", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 thaiprompt/services/api.ts:1166"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-260bdeb14e88b720", "name": "Stray `console.log` in TS/JS \u2014 thaiprompt/services/deviceService.ts:85", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 thaiprompt/services/deviceService.ts:85"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b5acf0c0c4120fca", "name": "Stray `console.log` in TS/JS \u2014 thaiprompt/services/notifications.ts:51", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 thaiprompt/services/notifications.ts:51"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-aae0f51e91851972", "name": "Stray `console.log` in TS/JS \u2014 thaiprompt/services/location.ts:143", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 thaiprompt/services/location.ts:143"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1504cc992dbe22cf", "name": "Stray `console.log` in TS/JS \u2014 thaiprompt/services/bannerCache.ts:125", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 thaiprompt/services/bannerCache.ts:125"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-bbd1e394ae1085b9", "name": "TODO/FIXME marker in shipping code \u2014 thaiprompt/services/pushNotificationService.ts:224", "shortDescription": {"text": "TODO/FIXME marker in shipping code \u2014 thaiprompt/services/pushNotificationService.ts:224"}, "fullDescription": {"text": "Track in /reviews or /issues, not as a code comment that rots.\n\nWhy: Drift control \u2014 shouldn't be the same as Quality TODO scanner.\nRule id: fq.todo-marker"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-d4f61a073765ddf2", "name": "Stray `console.log` in TS/JS \u2014 thaiprompt/services/pushNotificationService.ts:73", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 thaiprompt/services/pushNotificationService.ts:73"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8c809ea88f9e4385", "name": "TODO/FIXME marker in shipping code \u2014 thaiprompt/services/network.ts:189", "shortDescription": {"text": "TODO/FIXME marker in shipping code \u2014 thaiprompt/services/network.ts:189"}, "fullDescription": {"text": "Track in /reviews or /issues, not as a code comment that rots.\n\nWhy: Drift control \u2014 shouldn't be the same as Quality TODO scanner.\nRule id: fq.todo-marker"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-0eb7d1f6132b23e9", "name": "Stray `console.log` in TS/JS \u2014 thaiprompt/services/network.ts:141", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 thaiprompt/services/network.ts:141"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3308dfdf280ebf1a", "name": "Stray `console.log` in TS/JS \u2014 thaiprompt/services/sync.ts:72", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 thaiprompt/services/sync.ts:72"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e69b753cb4a5b91a", "name": "Stray `console.log` in TS/JS \u2014 thaiprompt/services/fileService.ts:292", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 thaiprompt/services/fileService.ts:292"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-156d5935ef7f06d4", "name": "Icon-only button without accessible name \u2014 resources/js/mlm-genealogy-v3.js:238", "shortDescription": {"text": "Icon-only button without accessible name \u2014 resources/js/mlm-genealogy-v3.js:238"}, "fullDescription": {"text": "A `<button>` whose only child is a single glyph or symbol needs `title=` or `aria-label=` so screen readers (and tooltips on hover) work.\n\nWhy: P3 in CHECKLIST.md \u2014 icon-only buttons skipped a title.\nRule id: fq.button.no-label"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1187082a9781bcfa", "name": "Stray `console.log` in TS/JS \u2014 resources/js/crypto/charts.js:39", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 resources/js/crypto/charts.js:39"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ac6a7340b8e55d51", "name": "Stray `console.log` in TS/JS \u2014 resources/js/crypto/wallet-connector.js:447", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 resources/js/crypto/wallet-connector.js:447"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ea2be1011f6d5d96", "name": "Stray `console.log` in TS/JS \u2014 resources/js/crypto/animations.js:365", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 resources/js/crypto/animations.js:365"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-95332d445f7e6fae", "name": "Stray `console.log` in TS/JS \u2014 resources/js/crypto/app.js:21", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 resources/js/crypto/app.js:21"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2b6d792dc1ae90c7", "name": "Stray `console.log` in TS/JS \u2014 resources/js/alpine/stores/language.js:48", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 resources/js/alpine/stores/language.js:48"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-39dd8124c93a616d", "name": "Stray `console.log` in TS/JS \u2014 public/pos-sw.js:44", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 public/pos-sw.js:44"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-388e7f899e35100d", "name": "Stray `console.log` in TS/JS \u2014 public/js/qr-scanner.js:44", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 public/js/qr-scanner.js:44"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-29c93d862d1a8d41", "name": "Stray `console.log` in TS/JS \u2014 public/js/optimized-touch-input.js:48", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 public/js/optimized-touch-input.js:48"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2978df4267af03d0", "name": "Stray `console.log` in TS/JS \u2014 public/js/snake-websocket-client.js:128", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 public/js/snake-websocket-client.js:128"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-271933dd6aa1fb05", "name": "Icon-only button without accessible name \u2014 public/assets/js/org-chart-viewer.js:1327", "shortDescription": {"text": "Icon-only button without accessible name \u2014 public/assets/js/org-chart-viewer.js:1327"}, "fullDescription": {"text": "A `<button>` whose only child is a single glyph or symbol needs `title=` or `aria-label=` so screen readers (and tooltips on hover) work.\n\nWhy: P3 in CHECKLIST.md \u2014 icon-only buttons skipped a title.\nRule id: fq.button.no-label"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-76fb884693d1f142", "name": "Stray `console.log` in TS/JS \u2014 public/assets/js/org-chart-viewer.js:665", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 public/assets/js/org-chart-viewer.js:665"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b1ed90843e2d394a", "name": "Icon-only button without accessible name \u2014 public/assets/js/workflow-diagram.js:1701", "shortDescription": {"text": "Icon-only button without accessible name \u2014 public/assets/js/workflow-diagram.js:1701"}, "fullDescription": {"text": "A `<button>` whose only child is a single glyph or symbol needs `title=` or `aria-label=` so screen readers (and tooltips on hover) work.\n\nWhy: P3 in CHECKLIST.md \u2014 icon-only buttons skipped a title.\nRule id: fq.button.no-label"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f2d5f4efd2cf3f41", "name": "Stray `console.log` in TS/JS \u2014 tpix-blockchain/scripts/verify-contracts.js:6", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 tpix-blockchain/scripts/verify-contracts.js:6"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3629c5866dc77089", "name": "Stray `console.log` in TS/JS \u2014 tpix-blockchain/scripts/deploy-all.js:16", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 tpix-blockchain/scripts/deploy-all.js:16"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1e823cfcb9898253", "name": "Stray `console.log` in TS/JS \u2014 tpix-blockchain/scripts/setup-pools.js:6", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 tpix-blockchain/scripts/setup-pools.js:6"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ab2d9786972e84ac", "name": "Stray `console.log` in TS/JS \u2014 tpix-blockchain/scripts/test-deployment.js:6", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 tpix-blockchain/scripts/test-deployment.js:6"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b3280020065da801", "name": "Privileged port 13 in use", "shortDescription": {"text": "Privileged port 13 in use"}, "fullDescription": {"text": "Port 13 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4cf45e3adbe1e1e7", "name": "Privileged port 18 in use", "shortDescription": {"text": "Privileged port 18 in use"}, "fullDescription": {"text": "Port 18 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1633e5d8c4a3ed9b", "name": "Privileged port 30 in use", "shortDescription": {"text": "Privileged port 30 in use"}, "fullDescription": {"text": "Port 30 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-aa5acaa49eb8315b", "name": "Containers defined but no K8s/orchestration manifest found", "shortDescription": {"text": "Containers defined but no K8s/orchestration manifest found"}, "fullDescription": {"text": "Repo has Dockerfiles/compose but no Kubernetes/Nomad manifests. If the target deployment is K8s, the manifests may live in a separate ops repo."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3c5c533aa0862623", "name": "Runtime dotenv file present in repo: .env.testing", "shortDescription": {"text": "Runtime dotenv file present in repo: .env.testing"}, "fullDescription": {"text": "`.env.testing` looks like a runtime dotenv file. It contains secret-looking assignments for DB_PASSWORD. Move real values to a secret manager and keep only `.env.example` style templates in source control."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-b83d55a5a9e3316f", "name": "Possible secret in deploy-pro.sh", "shortDescription": {"text": "Possible secret in deploy-pro.sh"}, "fullDescription": {"text": "Detected pattern matching password_literal. Rotate the credential and move to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-fc02496302f7a235", "name": "Possible secret in deploy.sh", "shortDescription": {"text": "Possible secret in deploy.sh"}, "fullDescription": {"text": "Detected pattern matching password_literal. Rotate the credential and move to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-c42c6bd56fd74747", "name": "Possible secret in run-migrations.sh", "shortDescription": {"text": "Possible secret in run-migrations.sh"}, "fullDescription": {"text": "Detected pattern matching password_literal. Rotate the credential and move to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-52db1ceabe31c747", "name": "Possible secret in thaiprompt/constants/index.ts", "shortDescription": {"text": "Possible secret in thaiprompt/constants/index.ts"}, "fullDescription": {"text": "Detected pattern matching password_literal. Rotate the credential and move to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-97a888e675c84d8f", "name": "Insecure pattern 'direct_innerhtml_assignment' in resources/js/wealth-3d-mindmap.js:525", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in resources/js/wealth-3d-mindmap.js:525"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a7bb8dbfa5d76817", "name": "Insecure pattern 'direct_innerhtml_assignment' in resources/js/mlm-genealogy-v3.js:59", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in resources/js/mlm-genealogy-v3.js:59"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9949c72e6a50c83e", "name": "Insecure pattern 'direct_innerhtml_assignment' in resources/js/mlm-genealogy-premium.js:44", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in resources/js/mlm-genealogy-premium.js:44"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4f4dd6be2a3d03bf", "name": "Insecure pattern 'direct_innerhtml_assignment' in resources/js/wealth-guide-pro.js:103", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in resources/js/wealth-guide-pro.js:103"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a1d50250482e8e92", "name": "Insecure pattern 'direct_innerhtml_assignment' in resources/js/wealth-3d-income-flow.js:313", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in resources/js/wealth-3d-income-flow.js:313"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e2a6395a8d3cca25", "name": "Insecure pattern 'direct_innerhtml_assignment' in resources/js/crypto/toast-notifications.js:63", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in resources/js/crypto/toast-notifications.js:63"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-39c266895ff747c0", "name": "Insecure pattern 'direct_innerhtml_assignment' in public/js/qr-barcode-generator.js:351", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in public/js/qr-barcode-generator.js:351"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-16f0aa6b9af6e2db", "name": "Insecure pattern 'direct_innerhtml_assignment' in public/js/qr-scanner.js:297", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in public/js/qr-scanner.js:297"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-5d950e5ebb154b0f", "name": "Insecure pattern 'direct_innerhtml_assignment' in public/assets/js/org-chart-viewer.js:86", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in public/assets/js/org-chart-viewer.js:86"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-eb1aa8b1ec53ae43", "name": "Insecure pattern 'direct_innerhtml_assignment' in public/assets/js/genealogy-nexus.js:68", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in public/assets/js/genealogy-nexus.js:68"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f5848d3bf77b235c", "name": "Insecure pattern 'direct_innerhtml_assignment' in public/assets/js/workflow-diagram.js:100", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in public/assets/js/workflow-diagram.js:100"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-27924aa79fa4a517", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v4.2.2 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-64192a3c67110d01", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7185ee538707c7d8", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-46c644c6227e4d4a", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1838a141491ce38c", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-74d7335befa145c1", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "appleboy/ssh-action@v1 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-868cae63259e1333", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "appleboy/ssh-action@v1 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-fedc8413f37a017e", "name": "Very large file: deploy-pro.sh (1628 lines)", "shortDescription": {"text": "Very large file: deploy-pro.sh (1628 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-35a724c22b9ae8ba", "name": "Very large file: install.sh (2585 lines)", "shortDescription": {"text": "Very large file: install.sh (2585 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3f25e3c0da0463a5", "name": "Very large file: deploy.sh (2125 lines)", "shortDescription": {"text": "Very large file: deploy.sh (2125 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d52f047e97038889", "name": "Very large file: thaiprompt/services/api.ts (4032 lines)", "shortDescription": {"text": "Very large file: thaiprompt/services/api.ts (4032 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e6e66aa848b97fec", "name": "Very large file: public/assets/js/org-chart-viewer.js (1725 lines)", "shortDescription": {"text": "Very large file: public/assets/js/org-chart-viewer.js (1725 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0f4a975e8bdfbdbb", "name": "Very large file: public/assets/js/workflow-diagram.js (2215 lines)", "shortDescription": {"text": "Very large file: public/assets/js/workflow-diagram.js (2215 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6893a6c8b0861585", "name": "Very low test-to-source ratio", "shortDescription": {"text": "Very low test-to-source ratio"}, "fullDescription": {"text": "1 test file(s) for 169 source file(s) (ratio 0.01). Consider adding integration or unit tests for critical paths."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-141b30a41e03817b", "name": "No license file detected", "shortDescription": {"text": "No license file detected"}, "fullDescription": {"text": "No LICENSE/COPYING/NOTICE file was found. Generated repositories often omit licensing, which blocks reuse and automated intake."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-222d232d962d1c5c", "name": "Node manifest has dependencies but no lockfile: tpix-blockchain/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: tpix-blockchain/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 547 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-72b2a6250083a784", "name": "Placeholder or mock-heavy implementation detected", "shortDescription": {"text": "Placeholder or mock-heavy implementation detected"}, "fullDescription": {"text": "Found 2882 placeholder/mock markers across 791 source files. This often means the repo looks complete while core flows still use generated scaffolding or fake data."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9d79c4077342a7d0", "name": "Runtime service client appears to use placeholder configuration", "shortDescription": {"text": "Runtime service client appears to use placeholder configuration"}, "fullDescription": {"text": "A runtime source file appears to wire Supabase/Firebase/AI/payment-style clients to placeholder URLs, keys, or fallback values. In the Fable corpus this often means the UI/API shape is present while the backend service is not actually configured."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-11825279136b53a3", "name": "CI is configured but no tests are detected", "shortDescription": {"text": "CI is configured but no tests are detected"}, "fullDescription": {"text": "A CI pipeline exists, but the scan found no test files to gate. Opus labeled this generated-code pattern as config theater: release machinery exists, but it has little behavioral signal."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b9088664ace7f748", "name": "Composite production-readiness gap", "shortDescription": {"text": "Composite production-readiness gap"}, "fullDescription": {"text": "Multiple low-cost hardening controls are missing together: license, tests, lockfile. Opus verification showed these co-occurring gaps are a better readiness signal than reading each flag in isolation."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-749d4bc1bd66df5f", "name": "Agent instructions exist but release-hardening basics are missing", "shortDescription": {"text": "Agent instructions exist but release-hardening basics are missing"}, "fullDescription": {"text": "AI-coder instruction files were found, but the repo is missing license, tests, lockfile. Treat this as a contract gap: the agent is guided, but the generated output is not yet guarded by the controls that make it repeatable."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-17d866d91a7c451e", "name": "Agent instruction/config may expose a secret: CLAUDE.md", "shortDescription": {"text": "Agent instruction/config may expose a secret: CLAUDE.md"}, "fullDescription": {"text": "Agent-facing files are routinely pasted into LLM/tool contexts. Move literal tokens, keys, and passwords into a secret manager or document them as placeholders only."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-aa733dfbfbb42f2b", "name": "Agent instruction/config may expose a secret: .claude/seeder-guidelines.md", "shortDescription": {"text": "Agent instruction/config may expose a secret: .claude/seeder-guidelines.md"}, "fullDescription": {"text": "Agent-facing files are routinely pasted into LLM/tool contexts. Move literal tokens, keys, and passwords into a secret manager or document them as placeholders only."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-122f91b7f2906dc4", "name": "Agent authority lacks a verifier contract: .claude/settings.json", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/settings.json"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2b6d39115a95358a", "name": "Agent authority lacks a verifier contract: .claude/MENU_SYSTEM_V3_REFACTOR_PLAN.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/MENU_SYSTEM_V3_REFACTOR_PLAN.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ecb0d2c55ed6875d", "name": "Agent authority lacks a verifier contract: .claude/settings.local.json", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/settings.local.json"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f69ad08db336dfc2", "name": "Agent instruction/config may expose a secret: .claude/DATABASE_GUIDELINES.md", "shortDescription": {"text": "Agent instruction/config may expose a secret: .claude/DATABASE_GUIDELINES.md"}, "fullDescription": {"text": "Agent-facing files are routinely pasted into LLM/tool contexts. Move literal tokens, keys, and passwords into a secret manager or document them as placeholders only."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-2c1e4d33e73a3261", "name": "Agent authority lacks a verifier contract: .claude/templates/migrations/README.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/templates/migrations/README.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-48e2e26d540527aa", "name": "Agent instruction/config may expose a secret: .claude/plans/social-cross-poster.md", "shortDescription": {"text": "Agent instruction/config may expose a secret: .claude/plans/social-cross-poster.md"}, "fullDescription": {"text": "Agent-facing files are routinely pasted into LLM/tool contexts. Move literal tokens, keys, and passwords into a secret manager or document them as placeholders only."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-02fe9ca8f972c881", "name": "`fetch()` without try/.catch or AbortSignal \u2014 thaiprompt/app/kyc.tsx:96", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 thaiprompt/app/kyc.tsx:96"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-fa4ee150534b4f9a", "name": "`fetch()` without try/.catch or AbortSignal \u2014 thaiprompt/app/edit-profile.tsx:108", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 thaiprompt/app/edit-profile.tsx:108"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a7ed1d2a96b117a2", "name": "`fetch()` without try/.catch or AbortSignal \u2014 thaiprompt/services/api.ts:1169", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 thaiprompt/services/api.ts:1169"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-25497402ceb5a3ce", "name": "`fetch()` without try/.catch or AbortSignal \u2014 thaiprompt/services/network.ts:69", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 thaiprompt/services/network.ts:69"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f56d7fbf670245a9", "name": "`fetch()` without try/.catch or AbortSignal \u2014 resources/js/crypto/wallet-ui.js:257", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 resources/js/crypto/wallet-ui.js:257"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-250f57e8a1dbd3c5", "name": "4 env vars used in code but missing from .env.example", "shortDescription": {"text": "4 env vars used in code but missing from .env.example"}, "fullDescription": {"text": "Drift between code and config docs. The first few: `VITE_REVERB_APP_KEY`, `VITE_REVERB_HOST`, `VITE_REVERB_PORT`, `VITE_REVERB_SCHEME`. Add them (with a placeholder/comment) to .env.example so onboarding doesn't break."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-6431a78879620ea3", "name": "Near-duplicate function bodies in 21 places", "shortDescription": {"text": "Near-duplicate function bodies in 21 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nscripts/tarot/gen_pentacles_two.py:t, scripts/tarot/gen_pentacles_knight.py:t, scripts/tarot/gen_swords_eight.py:t, scripts/tarot/gen_pentacles_three.py:t\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9115e09bd996f179", "name": "Dangling fetch: POST /api/crypto/generate-nonce (resources/js/crypto/wallet-ui.js:257)", "shortDescription": {"text": "Dangling fetch: POST /api/crypto/generate-nonce (resources/js/crypto/wallet-ui.js:257)"}, "fullDescription": {"text": "`resources/js/crypto/wallet-ui.js:257` calls `POST /api/crypto/generate-nonce` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/crypto/generate-nonce`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-36affed3a3327ab3", "name": "Dangling fetch: POST /api/crypto/verify-signature (resources/js/crypto/wallet-ui.js:292)", "shortDescription": {"text": "Dangling fetch: POST /api/crypto/verify-signature (resources/js/crypto/wallet-ui.js:292)"}, "fullDescription": {"text": "`resources/js/crypto/wallet-ui.js:292` calls `POST /api/crypto/verify-signature` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/crypto/verify-signature`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-4a06d7a7d65cfb41", "name": "Dangling fetch: GET /user/crypto-wallet/prices (resources/js/crypto/charts.js:271)", "shortDescription": {"text": "Dangling fetch: GET /user/crypto-wallet/prices (resources/js/crypto/charts.js:271)"}, "fullDescription": {"text": "`resources/js/crypto/charts.js:271` calls `GET /user/crypto-wallet/prices` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/user/crypto-wallet/prices`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-6ea17d73c33994bc", "name": "Dangling fetch: GET /taladsod/api/listings?${params} (resources/js/taladsod/app.js:103)", "shortDescription": {"text": "Dangling fetch: GET /taladsod/api/listings?${params} (resources/js/taladsod/app.js:103)"}, "fullDescription": {"text": "`resources/js/taladsod/app.js:103` calls `GET /taladsod/api/listings?${params}` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/taladsod/api/listings`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-b6265935e7375308", "name": "Dangling fetch: GET /pos/api/products/search?q=${barcode} (resources/js/pos/app.js:359)", "shortDescription": {"text": "Dangling fetch: GET /pos/api/products/search?q=${barcode} (resources/js/pos/app.js:359)"}, "fullDescription": {"text": "`resources/js/pos/app.js:359` calls `GET /pos/api/products/search?q=${barcode}` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/pos/api/products/search`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-dbf92802e6e18a3e", "name": "Dangling fetch: GET /pos/api/customers/search?q=${query} (resources/js/pos/app.js:709)", "shortDescription": {"text": "Dangling fetch: GET /pos/api/customers/search?q=${query} (resources/js/pos/app.js:709)"}, "fullDescription": {"text": "`resources/js/pos/app.js:709` calls `GET /pos/api/customers/search?q=${query}` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/pos/api/customers/search`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-e7ff7512c5784c22", "name": "Dangling fetch: POST /pos/api/display/cart/update (resources/js/pos/app.js:806)", "shortDescription": {"text": "Dangling fetch: POST /pos/api/display/cart/update (resources/js/pos/app.js:806)"}, "fullDescription": {"text": "`resources/js/pos/app.js:806` calls `POST /pos/api/display/cart/update` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/pos/api/display/cart/update`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-88ece8ade6cedf87", "name": "Dangling fetch: POST /pos/api/display/clear (resources/js/pos/app.js:832)", "shortDescription": {"text": "Dangling fetch: POST /pos/api/display/clear (resources/js/pos/app.js:832)"}, "fullDescription": {"text": "`resources/js/pos/app.js:832` calls `POST /pos/api/display/clear` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/pos/api/display/clear`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-859f84df9a48e9e4", "name": "Dangling fetch: GET /pos/api/products/all (public/pos-sw.js:658)", "shortDescription": {"text": "Dangling fetch: GET /pos/api/products/all (public/pos-sw.js:658)"}, "fullDescription": {"text": "`public/pos-sw.js:658` calls `GET /pos/api/products/all` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/pos/api/products/all`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-ee3fbff72f0edd8c", "name": "Dangling fetch: POST /qr-barcode/decode (public/js/qr-scanner.js:239)", "shortDescription": {"text": "Dangling fetch: POST /qr-barcode/decode (public/js/qr-scanner.js:239)"}, "fullDescription": {"text": "`public/js/qr-scanner.js:239` calls `POST /qr-barcode/decode` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/qr-barcode/decode`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-0e57cb5f59c25d47", "name": "Unused endpoint: GET /cart", "shortDescription": {"text": "Unused endpoint: GET /cart"}, "fullDescription": {"text": "`thaiprompt/services/api.ts` declares `GET /cart` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e09ebef6b04391e3", "name": "Unused endpoint: POST /cart/add", "shortDescription": {"text": "Unused endpoint: POST /cart/add"}, "fullDescription": {"text": "`thaiprompt/services/api.ts` declares `POST /cart/add` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cd177e32709a5c96", "name": "Unused endpoint: DELETE /cart/clear", "shortDescription": {"text": "Unused endpoint: DELETE /cart/clear"}, "fullDescription": {"text": "`thaiprompt/services/api.ts` declares `DELETE /cart/clear` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a695e18f48480f7d", "name": "Unused endpoint: POST /cart/promo", "shortDescription": {"text": "Unused endpoint: POST /cart/promo"}, "fullDescription": {"text": "`thaiprompt/services/api.ts` declares `POST /cart/promo` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f755c1b878c0a34c", "name": "Unused endpoint: POST /cart/checkout", "shortDescription": {"text": "Unused endpoint: POST /cart/checkout"}, "fullDescription": {"text": "`thaiprompt/services/api.ts` declares `POST /cart/checkout` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0328e9bdbb61fa68", "name": "Unused endpoint: GET /orders", "shortDescription": {"text": "Unused endpoint: GET /orders"}, "fullDescription": {"text": "`thaiprompt/services/api.ts` declares `GET /orders` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-94dafb7a01dbb059", "name": "Unused endpoint: GET /shipping-providers", "shortDescription": {"text": "Unused endpoint: GET /shipping-providers"}, "fullDescription": {"text": "`thaiprompt/services/api.ts` declares `GET /shipping-providers` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-92edfb35c68a6b8f", "name": "Unused endpoint: GET /orders/unread-messages", "shortDescription": {"text": "Unused endpoint: GET /orders/unread-messages"}, "fullDescription": {"text": "`thaiprompt/services/api.ts` declares `GET /orders/unread-messages` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c54ee3d20fada112", "name": "Unused endpoint: POST /web-session", "shortDescription": {"text": "Unused endpoint: POST /web-session"}, "fullDescription": {"text": "`thaiprompt/services/api.ts` declares `POST /web-session` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-68f7a2842c25818f", "name": "Unused endpoint: GET /payment/methods", "shortDescription": {"text": "Unused endpoint: GET /payment/methods"}, "fullDescription": {"text": "`thaiprompt/services/api.ts` declares `GET /payment/methods` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8e023b34f9e5bd78", "name": "Unused endpoint: GET /payment/deposit-methods", "shortDescription": {"text": "Unused endpoint: GET /payment/deposit-methods"}, "fullDescription": {"text": "`thaiprompt/services/api.ts` declares `GET /payment/deposit-methods` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-daaa2f8f821711bf", "name": "Unused endpoint: POST /wallet/topup", "shortDescription": {"text": "Unused endpoint: POST /wallet/topup"}, "fullDescription": {"text": "`thaiprompt/services/api.ts` declares `POST /wallet/topup` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-501561c0a955cbe7", "name": "Unused endpoint: GET /payment/history", "shortDescription": {"text": "Unused endpoint: GET /payment/history"}, "fullDescription": {"text": "`thaiprompt/services/api.ts` declares `GET /payment/history` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ea8b36e0fdad392f", "name": "Unused endpoint: GET /seller/orders", "shortDescription": {"text": "Unused endpoint: GET /seller/orders"}, "fullDescription": {"text": "`thaiprompt/services/api.ts` declares `GET /seller/orders` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-07e0fd1fe223375e", "name": "Unused endpoint: GET /seller/shipping-providers", "shortDescription": {"text": "Unused endpoint: GET /seller/shipping-providers"}, "fullDescription": {"text": "`thaiprompt/services/api.ts` declares `GET /seller/shipping-providers` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/23073"}, "properties": {"repository": "xjanova/Thaiprompt-Affiliate", "repoUrl": "https://github.com/xjanova/Thaiprompt-Affiliate", "branch": "main"}, "results": [{"ruleId": "scanner-828350dc3243cc29", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 thaiprompt/stores/authStore.ts:139"}, "properties": {"repobilityId": "77f7e316c6ab4f6c", "scanner": "scanner-primary", "fingerprint": "828350dc3243cc29", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-3f3315da159a3175", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 thaiprompt/app/checkout.tsx:235"}, "properties": {"repobilityId": "3c68bdc7b3bf8460", "scanner": "scanner-primary", "fingerprint": "3f3315da159a3175", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-f0c705801c7c4449", "level": "none", "message": {"text": "TODO/FIXME marker in shipping code \u2014 thaiprompt/app/services.tsx:558"}, "properties": {"repobilityId": "32556ce22cd3f2e7", "scanner": "scanner-primary", "fingerprint": "f0c705801c7c4449", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.todo-marker"]}}, {"ruleId": "scanner-ba5997d11e840860", "level": "none", "message": {"text": "TODO/FIXME marker in shipping code \u2014 thaiprompt/app/notification-settings.tsx:188"}, "properties": {"repobilityId": "2c9f601876648b29", "scanner": "scanner-primary", "fingerprint": "ba5997d11e840860", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.todo-marker"]}}, {"ruleId": "scanner-9a8af5067060bf26", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 thaiprompt/app/notification-settings.tsx:106"}, "properties": {"repobilityId": "c657fe6ebe06d710", "scanner": "scanner-primary", "fingerprint": "9a8af5067060bf26", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-96ffcfa12c76e13c", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 thaiprompt/app/kyc.tsx:57"}, "properties": {"repobilityId": "fc6023f7ff4b0e18", "scanner": "scanner-primary", "fingerprint": "96ffcfa12c76e13c", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-071e601efc16d0f9", "level": "none", "message": {"text": "TODO/FIXME marker in shipping code \u2014 thaiprompt/app/watch-earn.tsx:354"}, "properties": {"repobilityId": "9ca3b71f9f8e2d25", "scanner": "scanner-primary", "fingerprint": "071e601efc16d0f9", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.todo-marker"]}}, {"ruleId": "scanner-95d04bf0354f1b81", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 thaiprompt/app/watch-earn.tsx:219"}, "properties": {"repobilityId": "63ef0c9a75602a92", "scanner": "scanner-primary", "fingerprint": "95d04bf0354f1b81", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-249668445fcd5251", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 thaiprompt/app/qr-scanner.tsx:115"}, "properties": {"repobilityId": "0631c59ad0f33649", "scanner": "scanner-primary", "fingerprint": "249668445fcd5251", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-0506cf4768bcdd2e", "level": "none", "message": {"text": "TODO/FIXME marker in shipping code \u2014 thaiprompt/app/rider-services.tsx:379"}, "properties": {"repobilityId": "d0eac4bd62a916ed", "scanner": "scanner-primary", "fingerprint": "0506cf4768bcdd2e", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.todo-marker"]}}, {"ruleId": "scanner-e0f23c3cb1e6b3a9", "level": "none", "message": {"text": "TODO/FIXME marker in shipping code \u2014 thaiprompt/app/academy.tsx:138"}, "properties": {"repobilityId": "991d40e260b09e08", "scanner": "scanner-primary", "fingerprint": "e0f23c3cb1e6b3a9", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.todo-marker"]}}, {"ruleId": "scanner-af2b0fa3d985ff74", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 thaiprompt/app/_layout.tsx:195"}, "properties": {"repobilityId": "3b79bda4600ec19d", "scanner": "scanner-primary", "fingerprint": "af2b0fa3d985ff74", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-c338551e41055567", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 thaiprompt/app/wallet-topup.tsx:110"}, "properties": {"repobilityId": "ccb3a2e25fcff9e5", "scanner": "scanner-primary", "fingerprint": "c338551e41055567", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-72ee7b7903acc40d", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 thaiprompt/app/edit-profile.tsx:54"}, "properties": {"repobilityId": "a47c63aed2d9082f", "scanner": "scanner-primary", "fingerprint": "72ee7b7903acc40d", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-5dbe5830bd9b2f9a", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 thaiprompt/app/(tabs)/profile.tsx:179"}, "properties": {"repobilityId": "9b1750e6bd282a1c", "scanner": "scanner-primary", "fingerprint": "5dbe5830bd9b2f9a", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-01251f4438602a1e", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 thaiprompt/app/(tabs)/index.tsx:92"}, "properties": {"repobilityId": "57baa76f76e101dd", "scanner": "scanner-primary", "fingerprint": "01251f4438602a1e", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-cf2a6addbe4c2f68", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 thaiprompt/app/(tabs)/_layout.tsx:454"}, "properties": {"repobilityId": "4e0724af0d6856e7", "scanner": "scanner-primary", "fingerprint": "cf2a6addbe4c2f68", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-bf16b72dc148c160", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 thaiprompt/services/api.ts:1166"}, "properties": {"repobilityId": "bfbc8eb222335722", "scanner": "scanner-primary", "fingerprint": "bf16b72dc148c160", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-260bdeb14e88b720", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 thaiprompt/services/deviceService.ts:85"}, "properties": {"repobilityId": "10e43b76cf39110a", "scanner": "scanner-primary", "fingerprint": "260bdeb14e88b720", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-b5acf0c0c4120fca", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 thaiprompt/services/notifications.ts:51"}, "properties": {"repobilityId": "a7371749a38c9b86", "scanner": "scanner-primary", "fingerprint": "b5acf0c0c4120fca", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-aae0f51e91851972", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 thaiprompt/services/location.ts:143"}, "properties": {"repobilityId": "de94b78f22186c93", "scanner": "scanner-primary", "fingerprint": "aae0f51e91851972", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-1504cc992dbe22cf", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 thaiprompt/services/bannerCache.ts:125"}, "properties": {"repobilityId": "a1c9a4618c20dc2c", "scanner": "scanner-primary", "fingerprint": "1504cc992dbe22cf", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-bbd1e394ae1085b9", "level": "none", "message": {"text": "TODO/FIXME marker in shipping code \u2014 thaiprompt/services/pushNotificationService.ts:224"}, "properties": {"repobilityId": "78a31942e80be1a9", "scanner": "scanner-primary", "fingerprint": "bbd1e394ae1085b9", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.todo-marker"]}}, {"ruleId": "scanner-d4f61a073765ddf2", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 thaiprompt/services/pushNotificationService.ts:73"}, "properties": {"repobilityId": "55319bca8f339978", "scanner": "scanner-primary", "fingerprint": "d4f61a073765ddf2", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-8c809ea88f9e4385", "level": "none", "message": {"text": "TODO/FIXME marker in shipping code \u2014 thaiprompt/services/network.ts:189"}, "properties": {"repobilityId": "b27588cef30444cb", "scanner": "scanner-primary", "fingerprint": "8c809ea88f9e4385", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.todo-marker"]}}, {"ruleId": "scanner-0eb7d1f6132b23e9", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 thaiprompt/services/network.ts:141"}, "properties": {"repobilityId": "2e856b082994e560", "scanner": "scanner-primary", "fingerprint": "0eb7d1f6132b23e9", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-3308dfdf280ebf1a", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 thaiprompt/services/sync.ts:72"}, "properties": {"repobilityId": "c3905fd0ac199ab7", "scanner": "scanner-primary", "fingerprint": "3308dfdf280ebf1a", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-e69b753cb4a5b91a", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 thaiprompt/services/fileService.ts:292"}, "properties": {"repobilityId": "11df84961475451d", "scanner": "scanner-primary", "fingerprint": "e69b753cb4a5b91a", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-156d5935ef7f06d4", "level": "note", "message": {"text": "Icon-only button without accessible name \u2014 resources/js/mlm-genealogy-v3.js:238"}, "properties": {"repobilityId": "0882178cf49dac3a", "scanner": "scanner-primary", "fingerprint": "156d5935ef7f06d4", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.button.no-label"]}}, {"ruleId": "scanner-1187082a9781bcfa", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 resources/js/crypto/charts.js:39"}, "properties": {"repobilityId": "36f4a1af10c36564", "scanner": "scanner-primary", "fingerprint": "1187082a9781bcfa", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-ac6a7340b8e55d51", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 resources/js/crypto/wallet-connector.js:447"}, "properties": {"repobilityId": "0dc948319c1e2e2b", "scanner": "scanner-primary", "fingerprint": "ac6a7340b8e55d51", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-ea2be1011f6d5d96", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 resources/js/crypto/animations.js:365"}, "properties": {"repobilityId": "521c4ee838d91428", "scanner": "scanner-primary", "fingerprint": "ea2be1011f6d5d96", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-95332d445f7e6fae", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 resources/js/crypto/app.js:21"}, "properties": {"repobilityId": "2b84386c175ed820", "scanner": "scanner-primary", "fingerprint": "95332d445f7e6fae", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-2b6d792dc1ae90c7", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 resources/js/alpine/stores/language.js:48"}, "properties": {"repobilityId": "33279935c4e64632", "scanner": "scanner-primary", "fingerprint": "2b6d792dc1ae90c7", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-39dd8124c93a616d", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 public/pos-sw.js:44"}, "properties": {"repobilityId": "eaf24e5269a14850", "scanner": "scanner-primary", "fingerprint": "39dd8124c93a616d", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-388e7f899e35100d", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 public/js/qr-scanner.js:44"}, "properties": {"repobilityId": "db137cb91d30f756", "scanner": "scanner-primary", "fingerprint": "388e7f899e35100d", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-29c93d862d1a8d41", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 public/js/optimized-touch-input.js:48"}, "properties": {"repobilityId": "477ea3380bd084bd", "scanner": "scanner-primary", "fingerprint": "29c93d862d1a8d41", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-2978df4267af03d0", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 public/js/snake-websocket-client.js:128"}, "properties": {"repobilityId": "a85f6f15272866ab", "scanner": "scanner-primary", "fingerprint": "2978df4267af03d0", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-271933dd6aa1fb05", "level": "note", "message": {"text": "Icon-only button without accessible name \u2014 public/assets/js/org-chart-viewer.js:1327"}, "properties": {"repobilityId": "a1e1b38bd3f3c7c1", "scanner": "scanner-primary", "fingerprint": "271933dd6aa1fb05", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.button.no-label"]}}, {"ruleId": "scanner-76fb884693d1f142", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 public/assets/js/org-chart-viewer.js:665"}, "properties": {"repobilityId": "41ff6e017a3ec00d", "scanner": "scanner-primary", "fingerprint": "76fb884693d1f142", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-b1ed90843e2d394a", "level": "note", "message": {"text": "Icon-only button without accessible name \u2014 public/assets/js/workflow-diagram.js:1701"}, "properties": {"repobilityId": "d1d4e3582ff64208", "scanner": "scanner-primary", "fingerprint": "b1ed90843e2d394a", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.button.no-label"]}}, {"ruleId": "scanner-f2d5f4efd2cf3f41", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 tpix-blockchain/scripts/verify-contracts.js:6"}, "properties": {"repobilityId": "1f7178acc7e8459c", "scanner": "scanner-primary", "fingerprint": "f2d5f4efd2cf3f41", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-3629c5866dc77089", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 tpix-blockchain/scripts/deploy-all.js:16"}, "properties": {"repobilityId": "a7a39dd43ddc0188", "scanner": "scanner-primary", "fingerprint": "3629c5866dc77089", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-1e823cfcb9898253", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 tpix-blockchain/scripts/setup-pools.js:6"}, "properties": {"repobilityId": "7b7237ea99028527", "scanner": "scanner-primary", "fingerprint": "1e823cfcb9898253", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-ab2d9786972e84ac", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 tpix-blockchain/scripts/test-deployment.js:6"}, "properties": {"repobilityId": "83ae45606eb8c1e9", "scanner": "scanner-primary", "fingerprint": "ab2d9786972e84ac", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-b3280020065da801", "level": "warning", "message": {"text": "Privileged port 13 in use"}, "properties": {"repobilityId": "79d721e4d6f64798", "scanner": "scanner-primary", "fingerprint": "b3280020065da801", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "deploy.sh"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-4cf45e3adbe1e1e7", "level": "warning", "message": {"text": "Privileged port 18 in use"}, "properties": {"repobilityId": "2d7b5e7d9c158e43", "scanner": "scanner-primary", "fingerprint": "4cf45e3adbe1e1e7", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "deploy.sh"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-1633e5d8c4a3ed9b", "level": "warning", "message": {"text": "Privileged port 30 in use"}, "properties": {"repobilityId": "54f172e7d16fc662", "scanner": "scanner-primary", "fingerprint": "1633e5d8c4a3ed9b", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "deploy.sh"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-aa5acaa49eb8315b", "level": "note", "message": {"text": "Containers defined but no K8s/orchestration manifest found"}, "properties": {"repobilityId": "b230ea9b68736081", "scanner": "scanner-primary", "fingerprint": "aa5acaa49eb8315b", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["coverage", "deployment"]}}, {"ruleId": "scanner-3c5c533aa0862623", "level": "error", "message": {"text": "Runtime dotenv file present in repo: .env.testing"}, "properties": {"repobilityId": "d64ee5696e603c0d", "scanner": "scanner-primary", "fingerprint": "3c5c533aa0862623", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets", "config", "env-file", "runtime-env", "env_file_with_secret"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".env.testing"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b83d55a5a9e3316f", "level": "error", "message": {"text": "Possible secret in deploy-pro.sh"}, "properties": {"repobilityId": "a76ce33e04cc1ecf", "scanner": "scanner-primary", "fingerprint": "b83d55a5a9e3316f", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "deploy-pro.sh"}, "region": {"startLine": 1267}}}]}, {"ruleId": "scanner-fc02496302f7a235", "level": "error", "message": {"text": "Possible secret in deploy.sh"}, "properties": {"repobilityId": "3dcb864369521e4d", "scanner": "scanner-primary", "fingerprint": "fc02496302f7a235", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "deploy.sh"}, "region": {"startLine": 749}}}]}, {"ruleId": "scanner-c42c6bd56fd74747", "level": "error", "message": {"text": "Possible secret in run-migrations.sh"}, "properties": {"repobilityId": "6a5bba29178693b0", "scanner": "scanner-primary", "fingerprint": "c42c6bd56fd74747", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "run-migrations.sh"}, "region": {"startLine": 84}}}]}, {"ruleId": "scanner-52db1ceabe31c747", "level": "error", "message": {"text": "Possible secret in thaiprompt/constants/index.ts"}, "properties": {"repobilityId": "d19102926a82cbae", "scanner": "scanner-primary", "fingerprint": "52db1ceabe31c747", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "thaiprompt/constants/index.ts"}, "region": {"startLine": 133}}}]}, {"ruleId": "scanner-97a888e675c84d8f", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in resources/js/wealth-3d-mindmap.js:525"}, "properties": {"repobilityId": "5216551e11f9175c", "scanner": "scanner-primary", "fingerprint": "97a888e675c84d8f", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "resources/js/wealth-3d-mindmap.js"}, "region": {"startLine": 525}}}]}, {"ruleId": "scanner-a7bb8dbfa5d76817", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in resources/js/mlm-genealogy-v3.js:59"}, "properties": {"repobilityId": "ea1815de74af7dd2", "scanner": "scanner-primary", "fingerprint": "a7bb8dbfa5d76817", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "resources/js/mlm-genealogy-v3.js"}, "region": {"startLine": 59}}}]}, {"ruleId": "scanner-9949c72e6a50c83e", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in resources/js/mlm-genealogy-premium.js:44"}, "properties": {"repobilityId": "cd02849ed2ab03b4", "scanner": "scanner-primary", "fingerprint": "9949c72e6a50c83e", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "resources/js/mlm-genealogy-premium.js"}, "region": {"startLine": 44}}}]}, {"ruleId": "scanner-4f4dd6be2a3d03bf", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in resources/js/wealth-guide-pro.js:103"}, "properties": {"repobilityId": "fd4f7ce694bfd973", "scanner": "scanner-primary", "fingerprint": "4f4dd6be2a3d03bf", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "resources/js/wealth-guide-pro.js"}, "region": {"startLine": 103}}}]}, {"ruleId": "scanner-a1d50250482e8e92", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in resources/js/wealth-3d-income-flow.js:313"}, "properties": {"repobilityId": "f21fc6af541a10e8", "scanner": "scanner-primary", "fingerprint": "a1d50250482e8e92", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "resources/js/wealth-3d-income-flow.js"}, "region": {"startLine": 313}}}]}, {"ruleId": "scanner-e2a6395a8d3cca25", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in resources/js/crypto/toast-notifications.js:63"}, "properties": {"repobilityId": "235d0545a0080665", "scanner": "scanner-primary", "fingerprint": "e2a6395a8d3cca25", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "resources/js/crypto/toast-notifications.js"}, "region": {"startLine": 63}}}]}, {"ruleId": "scanner-39c266895ff747c0", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in public/js/qr-barcode-generator.js:351"}, "properties": {"repobilityId": "5bcbc7c667d69042", "scanner": "scanner-primary", "fingerprint": "39c266895ff747c0", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "public/js/qr-barcode-generator.js"}, "region": {"startLine": 351}}}]}, {"ruleId": "scanner-16f0aa6b9af6e2db", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in public/js/qr-scanner.js:297"}, "properties": {"repobilityId": "808689f2a85846c5", "scanner": "scanner-primary", "fingerprint": "16f0aa6b9af6e2db", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "public/js/qr-scanner.js"}, "region": {"startLine": 297}}}]}, {"ruleId": "scanner-5d950e5ebb154b0f", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in public/assets/js/org-chart-viewer.js:86"}, "properties": {"repobilityId": "793418a51df62d3a", "scanner": "scanner-primary", "fingerprint": "5d950e5ebb154b0f", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "public/assets/js/org-chart-viewer.js"}, "region": {"startLine": 86}}}]}, {"ruleId": "scanner-eb1aa8b1ec53ae43", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in public/assets/js/genealogy-nexus.js:68"}, "properties": {"repobilityId": "65a6dce39fde9af8", "scanner": "scanner-primary", "fingerprint": "eb1aa8b1ec53ae43", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "public/assets/js/genealogy-nexus.js"}, "region": {"startLine": 68}}}]}, {"ruleId": "scanner-f5848d3bf77b235c", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in public/assets/js/workflow-diagram.js:100"}, "properties": {"repobilityId": "ce4b622e7bd2a4bd", "scanner": "scanner-primary", "fingerprint": "f5848d3bf77b235c", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "public/assets/js/workflow-diagram.js"}, "region": {"startLine": 100}}}]}, {"ruleId": "scanner-27924aa79fa4a517", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "7fa6dd0d36ec82bf", "scanner": "scanner-primary", "fingerprint": "27924aa79fa4a517", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 32}}}]}, {"ruleId": "scanner-27924aa79fa4a517", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "69a6781891a74b63", "scanner": "scanner-primary", "fingerprint": "27924aa79fa4a517", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 35}}}]}, {"ruleId": "scanner-27924aa79fa4a517", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "af225277b8f928c8", "scanner": "scanner-primary", "fingerprint": "27924aa79fa4a517", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 46}}}]}, {"ruleId": "scanner-27924aa79fa4a517", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "9808a84b62f5fc94", "scanner": "scanner-primary", "fingerprint": "27924aa79fa4a517", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 56}}}]}, {"ruleId": "scanner-27924aa79fa4a517", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "7fa6dd0d36ec82bf", "scanner": "scanner-primary", "fingerprint": "27924aa79fa4a517", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 120}}}]}, {"ruleId": "scanner-27924aa79fa4a517", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "69a6781891a74b63", "scanner": "scanner-primary", "fingerprint": "27924aa79fa4a517", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 125}}}]}, {"ruleId": "scanner-27924aa79fa4a517", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "af225277b8f928c8", "scanner": "scanner-primary", "fingerprint": "27924aa79fa4a517", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 135}}}]}, {"ruleId": "scanner-27924aa79fa4a517", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "7fa6dd0d36ec82bf", "scanner": "scanner-primary", "fingerprint": "27924aa79fa4a517", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 183}}}]}, {"ruleId": "scanner-27924aa79fa4a517", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "9808a84b62f5fc94", "scanner": "scanner-primary", "fingerprint": "27924aa79fa4a517", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 206}}}]}, {"ruleId": "scanner-27924aa79fa4a517", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "7764380fefaae110", "scanner": "scanner-primary", "fingerprint": "27924aa79fa4a517", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 302}}}]}, {"ruleId": "scanner-64192a3c67110d01", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "87338a8bfcb6f435", "scanner": "scanner-primary", "fingerprint": "64192a3c67110d01", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-7185ee538707c7d8", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "eee69f7c951f1f28", "scanner": "scanner-primary", "fingerprint": "7185ee538707c7d8", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/mobile-build.yml"}, "region": {"startLine": 61}}}]}, {"ruleId": "scanner-7185ee538707c7d8", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "87978ee931eaddfe", "scanner": "scanner-primary", "fingerprint": "7185ee538707c7d8", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/mobile-build.yml"}, "region": {"startLine": 64}}}]}, {"ruleId": "scanner-7185ee538707c7d8", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "f6a4a7f4d3e9269a", "scanner": "scanner-primary", "fingerprint": "7185ee538707c7d8", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/mobile-build.yml"}, "region": {"startLine": 74}}}]}, {"ruleId": "scanner-7185ee538707c7d8", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "eee69f7c951f1f28", "scanner": "scanner-primary", "fingerprint": "7185ee538707c7d8", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/mobile-build.yml"}, "region": {"startLine": 107}}}]}, {"ruleId": "scanner-7185ee538707c7d8", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "87978ee931eaddfe", "scanner": "scanner-primary", "fingerprint": "7185ee538707c7d8", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/mobile-build.yml"}, "region": {"startLine": 110}}}]}, {"ruleId": "scanner-7185ee538707c7d8", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "f6a4a7f4d3e9269a", "scanner": "scanner-primary", "fingerprint": "7185ee538707c7d8", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/mobile-build.yml"}, "region": {"startLine": 120}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "2644034c718fb80d", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 27}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "eeb76410cc935c30", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 66}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "f0dc584a111ffc00", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 219}}}]}, {"ruleId": "scanner-1838a141491ce38c", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "b8fd4f5048f96576", "scanner": "scanner-primary", "fingerprint": "1838a141491ce38c", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-74d7335befa145c1", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "d1c37a386cbf72b6", "scanner": "scanner-primary", "fingerprint": "74d7335befa145c1", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/server-maintenance.yml"}, "region": {"startLine": 40}}}]}, {"ruleId": "scanner-868cae63259e1333", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "4e535b6fd77c3d2c", "scanner": "scanner-primary", "fingerprint": "868cae63259e1333", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/server-logs.yml"}, "region": {"startLine": 37}}}]}, {"ruleId": "scanner-fedc8413f37a017e", "level": "note", "message": {"text": "Very large file: deploy-pro.sh (1628 lines)"}, "properties": {"repobilityId": "55fb32451196bded", "scanner": "scanner-primary", "fingerprint": "fedc8413f37a017e", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-35a724c22b9ae8ba", "level": "note", "message": {"text": "Very large file: install.sh (2585 lines)"}, "properties": {"repobilityId": "642d236e3dbb2bb8", "scanner": "scanner-primary", "fingerprint": "35a724c22b9ae8ba", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-3f25e3c0da0463a5", "level": "note", "message": {"text": "Very large file: deploy.sh (2125 lines)"}, "properties": {"repobilityId": "e5338c2bbf23c11c", "scanner": "scanner-primary", "fingerprint": "3f25e3c0da0463a5", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-d52f047e97038889", "level": "note", "message": {"text": "Very large file: thaiprompt/services/api.ts (4032 lines)"}, "properties": {"repobilityId": "e4b298c632191cd0", "scanner": "scanner-primary", "fingerprint": "d52f047e97038889", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-e6e66aa848b97fec", "level": "note", "message": {"text": "Very large file: public/assets/js/org-chart-viewer.js (1725 lines)"}, "properties": {"repobilityId": "c2567cb8812dcaf5", "scanner": "scanner-primary", "fingerprint": "e6e66aa848b97fec", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-0f4a975e8bdfbdbb", "level": "note", "message": {"text": "Very large file: public/assets/js/workflow-diagram.js (2215 lines)"}, "properties": {"repobilityId": "1d4732f89bbe0cde", "scanner": "scanner-primary", "fingerprint": "0f4a975e8bdfbdbb", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-6893a6c8b0861585", "level": "warning", "message": {"text": "Very low test-to-source ratio"}, "properties": {"repobilityId": "54a7de3f06314bf0", "scanner": "scanner-primary", "fingerprint": "6893a6c8b0861585", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["tests", "coverage"]}}, {"ruleId": "scanner-141b30a41e03817b", "level": "note", "message": {"text": "No license file detected"}, "properties": {"repobilityId": "f12b428944b55119", "scanner": "scanner-primary", "fingerprint": "141b30a41e03817b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["license", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-222d232d962d1c5c", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: tpix-blockchain/package.json"}, "properties": {"repobilityId": "e1c6a173566ddaac", "scanner": "scanner-primary", "fingerprint": "222d232d962d1c5c", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tpix-blockchain/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "0075c2242c5b3bdb", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-72b2a6250083a784", "level": "warning", "message": {"text": "Placeholder or mock-heavy implementation detected"}, "properties": {"repobilityId": "e116aa8955b7d47c", "scanner": "scanner-primary", "fingerprint": "72b2a6250083a784", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "incomplete", "generated-repo-pattern"]}}, {"ruleId": "scanner-9d79c4077342a7d0", "level": "warning", "message": {"text": "Runtime service client appears to use placeholder configuration"}, "properties": {"repobilityId": "2f7cc6258e221acd", "scanner": "scanner-primary", "fingerprint": "9d79c4077342a7d0", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "runtime-config", "service-client", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "59fdeab8e8b09544", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-11825279136b53a3", "level": "warning", "message": {"text": "CI is configured but no tests are detected"}, "properties": {"repobilityId": "6f6b08dc83118600", "scanner": "scanner-primary", "fingerprint": "11825279136b53a3", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["tests", "ci", "config-theater", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-b9088664ace7f748", "level": "warning", "message": {"text": "Composite production-readiness gap"}, "properties": {"repobilityId": "a46fdcab7665b05b", "scanner": "scanner-primary", "fingerprint": "b9088664ace7f748", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["production-readiness", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-749d4bc1bd66df5f", "level": "warning", "message": {"text": "Agent instructions exist but release-hardening basics are missing"}, "properties": {"repobilityId": "66ae30be827b3446", "scanner": "scanner-primary", "fingerprint": "749d4bc1bd66df5f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "5ec6972c747f61c0", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "5c21639182739c9b", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-17d866d91a7c451e", "level": "error", "message": {"text": "Agent instruction/config may expose a secret: CLAUDE.md"}, "properties": {"repobilityId": "ccce5984e58a48f0", "scanner": "scanner-primary", "fingerprint": "17d866d91a7c451e", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["agent-instructions", "secrets", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "CLAUDE.md"}, "region": {"startLine": 1551}}}]}, {"ruleId": "scanner-aa733dfbfbb42f2b", "level": "error", "message": {"text": "Agent instruction/config may expose a secret: .claude/seeder-guidelines.md"}, "properties": {"repobilityId": "4c918e78b6cb1ae6", "scanner": "scanner-primary", "fingerprint": "aa733dfbfbb42f2b", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["agent-instructions", "secrets", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/seeder-guidelines.md"}, "region": {"startLine": 194}}}]}, {"ruleId": "scanner-122f91b7f2906dc4", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/settings.json"}, "properties": {"repobilityId": "a2967269048b6a9d", "scanner": "scanner-primary", "fingerprint": "122f91b7f2906dc4", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/settings.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-2b6d39115a95358a", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/MENU_SYSTEM_V3_REFACTOR_PLAN.md"}, "properties": {"repobilityId": "12dbd4ec655fccbd", "scanner": "scanner-primary", "fingerprint": "2b6d39115a95358a", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/MENU_SYSTEM_V3_REFACTOR_PLAN.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ecb0d2c55ed6875d", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/settings.local.json"}, "properties": {"repobilityId": "d8bae33a6d517bf0", "scanner": "scanner-primary", "fingerprint": "ecb0d2c55ed6875d", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/settings.local.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f69ad08db336dfc2", "level": "error", "message": {"text": "Agent instruction/config may expose a secret: .claude/DATABASE_GUIDELINES.md"}, "properties": {"repobilityId": "21baf21c99104569", "scanner": "scanner-primary", "fingerprint": "f69ad08db336dfc2", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["agent-instructions", "secrets", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/DATABASE_GUIDELINES.md"}, "region": {"startLine": 515}}}]}, {"ruleId": "scanner-2c1e4d33e73a3261", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/templates/migrations/README.md"}, "properties": {"repobilityId": "cc86552831fbd248", "scanner": "scanner-primary", "fingerprint": "2c1e4d33e73a3261", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/templates/migrations/README.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-48e2e26d540527aa", "level": "error", "message": {"text": "Agent instruction/config may expose a secret: .claude/plans/social-cross-poster.md"}, "properties": {"repobilityId": "e1d3295f3154edf0", "scanner": "scanner-primary", "fingerprint": "48e2e26d540527aa", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["agent-instructions", "secrets", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/plans/social-cross-poster.md"}, "region": {"startLine": 296}}}]}, {"ruleId": "scanner-02fe9ca8f972c881", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 thaiprompt/app/kyc.tsx:96"}, "properties": {"repobilityId": "27979a050c0a04c5", "scanner": "scanner-primary", "fingerprint": "02fe9ca8f972c881", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-fa4ee150534b4f9a", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 thaiprompt/app/edit-profile.tsx:108"}, "properties": {"repobilityId": "bfa7e353759396ee", "scanner": "scanner-primary", "fingerprint": "fa4ee150534b4f9a", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-a7ed1d2a96b117a2", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 thaiprompt/services/api.ts:1169"}, "properties": {"repobilityId": "1ff7da3a1db588fd", "scanner": "scanner-primary", "fingerprint": "a7ed1d2a96b117a2", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-25497402ceb5a3ce", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 thaiprompt/services/network.ts:69"}, "properties": {"repobilityId": "74520f6ef6a7d6da", "scanner": "scanner-primary", "fingerprint": "25497402ceb5a3ce", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-f56d7fbf670245a9", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 resources/js/crypto/wallet-ui.js:257"}, "properties": {"repobilityId": "067bda451951de93", "scanner": "scanner-primary", "fingerprint": "f56d7fbf670245a9", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-250f57e8a1dbd3c5", "level": "none", "message": {"text": "4 env vars used in code but missing from .env.example"}, "properties": {"repobilityId": "57584f22b735b5ee", "scanner": "scanner-primary", "fingerprint": "250f57e8a1dbd3c5", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "config-drift"]}}, {"ruleId": "scanner-6431a78879620ea3", "level": "note", "message": {"text": "Near-duplicate function bodies in 21 places"}, "properties": {"repobilityId": "c9c9c0dbc2b2bfca", "scanner": "scanner-primary", "fingerprint": "6431a78879620ea3", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-6431a78879620ea3", "level": "note", "message": {"text": "Near-duplicate function bodies in 21 places"}, "properties": {"repobilityId": "1c12c21d9a757326", "scanner": "scanner-primary", "fingerprint": "6431a78879620ea3", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-9115e09bd996f179", "level": "error", "message": {"text": "Dangling fetch: POST /api/crypto/generate-nonce (resources/js/crypto/wallet-ui.js:257)"}, "properties": {"repobilityId": "47aaeb656a12b1a9", "scanner": "scanner-primary", "fingerprint": "9115e09bd996f179", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-36affed3a3327ab3", "level": "error", "message": {"text": "Dangling fetch: POST /api/crypto/verify-signature (resources/js/crypto/wallet-ui.js:292)"}, "properties": {"repobilityId": "7cb55caf2b1f7db2", "scanner": "scanner-primary", "fingerprint": "36affed3a3327ab3", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-4a06d7a7d65cfb41", "level": "error", "message": {"text": "Dangling fetch: GET /user/crypto-wallet/prices (resources/js/crypto/charts.js:271)"}, "properties": {"repobilityId": "5c7aef32d53d9f15", "scanner": "scanner-primary", "fingerprint": "4a06d7a7d65cfb41", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-6ea17d73c33994bc", "level": "error", "message": {"text": "Dangling fetch: GET /taladsod/api/listings?${params} (resources/js/taladsod/app.js:103)"}, "properties": {"repobilityId": "3ce264313c73f7a0", "scanner": "scanner-primary", "fingerprint": "6ea17d73c33994bc", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-b6265935e7375308", "level": "error", "message": {"text": "Dangling fetch: GET /pos/api/products/search?q=${barcode} (resources/js/pos/app.js:359)"}, "properties": {"repobilityId": "3ad235ec3de84fea", "scanner": "scanner-primary", "fingerprint": "b6265935e7375308", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-dbf92802e6e18a3e", "level": "error", "message": {"text": "Dangling fetch: GET /pos/api/customers/search?q=${query} (resources/js/pos/app.js:709)"}, "properties": {"repobilityId": "d3d33fecda29c633", "scanner": "scanner-primary", "fingerprint": "dbf92802e6e18a3e", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-e7ff7512c5784c22", "level": "error", "message": {"text": "Dangling fetch: POST /pos/api/display/cart/update (resources/js/pos/app.js:806)"}, "properties": {"repobilityId": "e7a6b21134b91858", "scanner": "scanner-primary", "fingerprint": "e7ff7512c5784c22", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-88ece8ade6cedf87", "level": "error", "message": {"text": "Dangling fetch: POST /pos/api/display/clear (resources/js/pos/app.js:832)"}, "properties": {"repobilityId": "91a4a2e20535ef66", "scanner": "scanner-primary", "fingerprint": "88ece8ade6cedf87", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-859f84df9a48e9e4", "level": "error", "message": {"text": "Dangling fetch: GET /pos/api/products/all (public/pos-sw.js:658)"}, "properties": {"repobilityId": "fd1f4de25992b9f8", "scanner": "scanner-primary", "fingerprint": "859f84df9a48e9e4", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-ee3fbff72f0edd8c", "level": "error", "message": {"text": "Dangling fetch: POST /qr-barcode/decode (public/js/qr-scanner.js:239)"}, "properties": {"repobilityId": "d6d9d246f9a10380", "scanner": "scanner-primary", "fingerprint": "ee3fbff72f0edd8c", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-0e57cb5f59c25d47", "level": "note", "message": {"text": "Unused endpoint: GET /cart"}, "properties": {"repobilityId": "4a8f4a1c5587ada1", "scanner": "scanner-primary", "fingerprint": "0e57cb5f59c25d47", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-e09ebef6b04391e3", "level": "note", "message": {"text": "Unused endpoint: POST /cart/add"}, "properties": {"repobilityId": "73e7402d0dc54e05", "scanner": "scanner-primary", "fingerprint": "e09ebef6b04391e3", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-cd177e32709a5c96", "level": "note", "message": {"text": "Unused endpoint: DELETE /cart/clear"}, "properties": {"repobilityId": "b3cefb372b1bc829", "scanner": "scanner-primary", "fingerprint": "cd177e32709a5c96", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-a695e18f48480f7d", "level": "note", "message": {"text": "Unused endpoint: POST /cart/promo"}, "properties": {"repobilityId": "6f57473ea7ebce52", "scanner": "scanner-primary", "fingerprint": "a695e18f48480f7d", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-f755c1b878c0a34c", "level": "note", "message": {"text": "Unused endpoint: POST /cart/checkout"}, "properties": {"repobilityId": "c987e498de5f6775", "scanner": "scanner-primary", "fingerprint": "f755c1b878c0a34c", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-0328e9bdbb61fa68", "level": "note", "message": {"text": "Unused endpoint: GET /orders"}, "properties": {"repobilityId": "b18007b6e4bbb47e", "scanner": "scanner-primary", "fingerprint": "0328e9bdbb61fa68", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-94dafb7a01dbb059", "level": "note", "message": {"text": "Unused endpoint: GET /shipping-providers"}, "properties": {"repobilityId": "ffa473d2af3eb4d9", "scanner": "scanner-primary", "fingerprint": "94dafb7a01dbb059", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-92edfb35c68a6b8f", "level": "note", "message": {"text": "Unused endpoint: GET /orders/unread-messages"}, "properties": {"repobilityId": "afce73e3392c85a3", "scanner": "scanner-primary", "fingerprint": "92edfb35c68a6b8f", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-c54ee3d20fada112", "level": "note", "message": {"text": "Unused endpoint: POST /web-session"}, "properties": {"repobilityId": "9aa55538ea04b9f4", "scanner": "scanner-primary", "fingerprint": "c54ee3d20fada112", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-68f7a2842c25818f", "level": "note", "message": {"text": "Unused endpoint: GET /payment/methods"}, "properties": {"repobilityId": "0fc26151790471b0", "scanner": "scanner-primary", "fingerprint": "68f7a2842c25818f", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-8e023b34f9e5bd78", "level": "note", "message": {"text": "Unused endpoint: GET /payment/deposit-methods"}, "properties": {"repobilityId": "9ff3e57409ee0684", "scanner": "scanner-primary", "fingerprint": "8e023b34f9e5bd78", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-daaa2f8f821711bf", "level": "note", "message": {"text": "Unused endpoint: POST /wallet/topup"}, "properties": {"repobilityId": "9f65eeb789c14428", "scanner": "scanner-primary", "fingerprint": "daaa2f8f821711bf", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-501561c0a955cbe7", "level": "note", "message": {"text": "Unused endpoint: GET /payment/history"}, "properties": {"repobilityId": "561d5ec83d9c5f21", "scanner": "scanner-primary", "fingerprint": "501561c0a955cbe7", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-ea8b36e0fdad392f", "level": "note", "message": {"text": "Unused endpoint: GET /seller/orders"}, "properties": {"repobilityId": "996436e77eefddfe", "scanner": "scanner-primary", "fingerprint": "ea8b36e0fdad392f", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-07e0fd1fe223375e", "level": "note", "message": {"text": "Unused endpoint: GET /seller/shipping-providers"}, "properties": {"repobilityId": "3dcc4337f57a08a1", "scanner": "scanner-primary", "fingerprint": "07e0fd1fe223375e", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}]}]}