{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-b30647f6e2375e97", "name": "Possibly dead Python function: step1_check_python", "shortDescription": {"text": "Possibly dead Python function: step1_check_python"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-85e18b94693ee08f", "name": "Possibly dead Python function: step2_install_deps", "shortDescription": {"text": "Possibly dead Python function: step2_install_deps"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-357db131ec8074f5", "name": "Possibly dead Python function: step3_configure_env", "shortDescription": {"text": "Possibly dead Python function: step3_configure_env"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3d46532cd6670b5e", "name": "Possibly dead Python function: step4_start_redis", "shortDescription": {"text": "Possibly dead Python function: step4_start_redis"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-80ba62788271b3fb", "name": "Possibly dead Python function: step5_setup_database", "shortDescription": {"text": "Possibly dead Python function: step5_setup_database"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-11a4474ce46e89f6", "name": "Possibly dead Python function: step6_load_references", "shortDescription": {"text": "Possibly dead Python function: step6_load_references"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6d1517cfce7c9bda", "name": "Possibly dead Python function: step7_pilot_ingestion", "shortDescription": {"text": "Possibly dead Python function: step7_pilot_ingestion"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-83ea2622d7b08b32", "name": "Possibly dead Python function: step8_dbt_build", "shortDescription": {"text": "Possibly dead Python function: step8_dbt_build"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fbc725efb6ecc893", "name": "Possibly dead Python function: step9_validate_marts", "shortDescription": {"text": "Possibly dead Python function: step9_validate_marts"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0d9e948de275d278", "name": "Possibly dead Python function: step10_start_api", "shortDescription": {"text": "Possibly dead Python function: step10_start_api"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c3b868cfd2d448a2", "name": "Possibly dead Python function: step11_open_dashboard", "shortDescription": {"text": "Possibly dead Python function: step11_open_dashboard"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-645ce1e2beed4621", "name": "Insecure pattern 'subprocess_shell_true' in bootstrap.py:75", "shortDescription": {"text": "Insecure pattern 'subprocess_shell_true' in bootstrap.py:75"}, "fullDescription": {"text": "Found a known-risky pattern (subprocess_shell_true). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-6372cebde0220094", "name": "No auth library detected", "shortDescription": {"text": "No auth library detected"}, "fullDescription": {"text": "The scanner did not find any standard auth library (JWT, OAuth, NextAuth, Auth0, etc.). The repo has auth/admin/session surface indicators, so auth may live in custom code, in a separate service, or be missing."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 23 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7880fa90f265ed84", "name": "Network/subprocess call without timeout or try/except \u2014 bootstrap.py:79", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 bootstrap.py:79"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/28599"}, "properties": {"repository": "pedropaulofernandes88-stack/saude-publica-br", "repoUrl": "https://github.com/pedropaulofernandes88-stack/saude-publica-br", "branch": "main"}, "results": [{"ruleId": "scanner-b30647f6e2375e97", "level": "note", "message": {"text": "Possibly dead Python function: step1_check_python"}, "properties": {"repobilityId": "3621eeec9fcd3a07", "scanner": "scanner-primary", "fingerprint": "b30647f6e2375e97", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "bootstrap.py:93"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-85e18b94693ee08f", "level": "note", "message": {"text": "Possibly dead Python function: step2_install_deps"}, "properties": {"repobilityId": "3fa9efd2a33ab661", "scanner": "scanner-primary", "fingerprint": "85e18b94693ee08f", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "bootstrap.py:111"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-357db131ec8074f5", "level": "note", "message": {"text": "Possibly dead Python function: step3_configure_env"}, "properties": {"repobilityId": "def308776b4d8e29", "scanner": "scanner-primary", "fingerprint": "357db131ec8074f5", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "bootstrap.py:139"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3d46532cd6670b5e", "level": "note", "message": {"text": "Possibly dead Python function: step4_start_redis"}, "properties": {"repobilityId": "cb07cd5e7b4626f7", "scanner": "scanner-primary", "fingerprint": "3d46532cd6670b5e", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "bootstrap.py:253"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-80ba62788271b3fb", "level": "note", "message": {"text": "Possibly dead Python function: step5_setup_database"}, "properties": {"repobilityId": "638f15e9a552443a", "scanner": "scanner-primary", "fingerprint": "80ba62788271b3fb", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "bootstrap.py:287"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-11a4474ce46e89f6", "level": "note", "message": {"text": "Possibly dead Python function: step6_load_references"}, "properties": {"repobilityId": "a1d8d4c4bb55735e", "scanner": "scanner-primary", "fingerprint": "11a4474ce46e89f6", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "bootstrap.py:362"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6d1517cfce7c9bda", "level": "note", "message": {"text": "Possibly dead Python function: step7_pilot_ingestion"}, "properties": {"repobilityId": "b06af98257b6da94", "scanner": "scanner-primary", "fingerprint": "6d1517cfce7c9bda", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "bootstrap.py:498"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-83ea2622d7b08b32", "level": "note", "message": {"text": "Possibly dead Python function: step8_dbt_build"}, "properties": {"repobilityId": "234ce2269675ca8e", "scanner": "scanner-primary", "fingerprint": "83ea2622d7b08b32", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "bootstrap.py:524"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-fbc725efb6ecc893", "level": "note", "message": {"text": "Possibly dead Python function: step9_validate_marts"}, "properties": {"repobilityId": "bd56de8df7988433", "scanner": "scanner-primary", "fingerprint": "fbc725efb6ecc893", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "bootstrap.py:553"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-0d9e948de275d278", "level": "note", "message": {"text": "Possibly dead Python function: step10_start_api"}, "properties": {"repobilityId": "28fb49b8a4b389d9", "scanner": "scanner-primary", "fingerprint": "0d9e948de275d278", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "bootstrap.py:583"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c3b868cfd2d448a2", "level": "note", "message": {"text": "Possibly dead Python function: step11_open_dashboard"}, "properties": {"repobilityId": "ff38b11facfeca2c", "scanner": "scanner-primary", "fingerprint": "c3b868cfd2d448a2", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "bootstrap.py:625"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-645ce1e2beed4621", "level": "error", "message": {"text": "Insecure pattern 'subprocess_shell_true' in bootstrap.py:75"}, "properties": {"repobilityId": "32a3c8c882a5a069", "scanner": "scanner-primary", "fingerprint": "645ce1e2beed4621", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "subprocess_shell_true"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "bootstrap.py"}, "region": {"startLine": 75}}}]}, {"ruleId": "scanner-6372cebde0220094", "level": "warning", "message": {"text": "No auth library detected"}, "properties": {"repobilityId": "a5b6035a5bbf8054", "scanner": "scanner-primary", "fingerprint": "6372cebde0220094", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["coverage", "auth"]}}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "f5c40f5e190e6080", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-7880fa90f265ed84", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 bootstrap.py:79"}, "properties": {"repobilityId": "8e204bda90a842d1", "scanner": "scanner-primary", "fingerprint": "7880fa90f265ed84", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}]}]}