{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-de5497e976f2027c", "name": "Possibly dead Python function: os", "shortDescription": {"text": "Possibly dead Python function: os"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-908c4066e3c36e21", "name": "Possibly dead Python function: reassign_site", "shortDescription": {"text": "Possibly dead Python function: reassign_site"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f4bdc6979311597f", "name": "Possibly dead Python function: lookup", "shortDescription": {"text": "Possibly dead Python function: lookup"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-45b013eb8f4f2f25", "name": "Possibly dead Python function: healthz", "shortDescription": {"text": "Possibly dead Python function: healthz"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-00be8910c67aa45b", "name": "Possibly dead Python function: healthz_db", "shortDescription": {"text": "Possibly dead Python function: healthz_db"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-91ddb0d364cd2a91", "name": "Possibly dead Python function: hero_stats", "shortDescription": {"text": "Possibly dead Python function: hero_stats"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fa67d0bd3e022c2e", "name": "Possibly dead Python function: sporsmal", "shortDescription": {"text": "Possibly dead Python function: sporsmal"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fbd04ee6fb6d5177", "name": "Possibly dead Python function: strip_stats", "shortDescription": {"text": "Possibly dead Python function: strip_stats"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6853fc0556b7a7aa", "name": "Possibly dead Python function: assist_js", "shortDescription": {"text": "Possibly dead Python function: assist_js"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1bfb89ef091bf93b", "name": "Possibly dead Python function: assist_api", "shortDescription": {"text": "Possibly dead Python function: assist_api"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9044b672a96e3455", "name": "Possibly dead Python function: favicon", "shortDescription": {"text": "Possibly dead Python function: favicon"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c06c1cba64f24886", "name": "Possibly dead Python function: favicon_ico", "shortDescription": {"text": "Possibly dead Python function: favicon_ico"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9cc0b0161db32ecf", "name": "Possibly dead Python function: apple_icon", "shortDescription": {"text": "Possibly dead Python function: apple_icon"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ce4b087fd3dae51f", "name": "Possibly dead Python function: webmanifest", "shortDescription": {"text": "Possibly dead Python function: webmanifest"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9c53b9eead87f233", "name": "Possibly dead Python function: brand_font", "shortDescription": {"text": "Possibly dead Python function: brand_font"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f408a47c9f762a1b", "name": "Possibly dead Python function: og_image", "shortDescription": {"text": "Possibly dead Python function: og_image"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8d714443ac692c4d", "name": "Possibly dead Python function: landing", "shortDescription": {"text": "Possibly dead Python function: landing"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a9fe3e40d25dc6f6", "name": "Possibly dead Python function: signup", "shortDescription": {"text": "Possibly dead Python function: signup"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-558dbeda12ff820d", "name": "Possibly dead Python function: unsubscribe", "shortDescription": {"text": "Possibly dead Python function: unsubscribe"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9491c6e06452e827", "name": "Possibly dead Python function: verify_email", "shortDescription": {"text": "Possibly dead Python function: verify_email"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-581388fa7481ee34", "name": "Possibly dead Python function: resend_verify", "shortDescription": {"text": "Possibly dead Python function: resend_verify"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-18b12a2a3f70bf03", "name": "Possibly dead Python function: forgot", "shortDescription": {"text": "Possibly dead Python function: forgot"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-91c0801ee14f2354", "name": "Possibly dead Python function: logout", "shortDescription": {"text": "Possibly dead Python function: logout"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8ff3dcab520554c3", "name": "Possibly dead Python function: google_login", "shortDescription": {"text": "Possibly dead Python function: google_login"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d5aaf79bd3631e63", "name": "Possibly dead Python function: billing_checkout", "shortDescription": {"text": "Possibly dead Python function: billing_checkout"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3f1835bac5f5197b", "name": "Docker base image is tag-pinned but not digest-pinned: python:3.13-slim", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: python:3.13-slim"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9710c8d059e53154", "name": "No frontend routes/components detected", "shortDescription": {"text": "No frontend routes/components detected"}, "fullDescription": {"text": "No React/Vue/Next routes were found. This is fine for backend-only repos."}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-462e57aaa8345552", "name": "Insecure pattern 'direct_innerhtml_assignment' in app/main.py:842", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in app/main.py:842"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7f83313b16dcc7dd", "name": "Insecure pattern 'cors_wildcard' in app/main.py:2831", "shortDescription": {"text": "Insecure pattern 'cors_wildcard' in app/main.py:2831"}, "fullDescription": {"text": "Found a known-risky pattern (cors_wildcard). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-755f371a151f4e68", "name": "Insecure pattern 'direct_innerhtml_assignment' in assist/widget.js:51", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in assist/widget.js:51"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4601e3ad3bb28677", "name": "No CI/CD pipelines detected", "shortDescription": {"text": "No CI/CD pipelines detected"}, "fullDescription": {"text": "No GitHub Actions, GitLab CI, or CircleCI configs found. Without CI you can't gate deploys on tests/lints."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-acd4bd485d5bf90c", "name": "Very large file: app/store.py (1299 lines)", "shortDescription": {"text": "Very large file: app/store.py (1299 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-af8a4e11fd8a20f8", "name": "Very large file: app/main.py (2843 lines)", "shortDescription": {"text": "Very large file: app/main.py (2843 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6893a6c8b0861585", "name": "Very low test-to-source ratio", "shortDescription": {"text": "Very low test-to-source ratio"}, "fullDescription": {"text": "0 test file(s) for 29 source file(s) (ratio 0.00). Consider adding integration or unit tests for critical paths."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 31 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b9088664ace7f748", "name": "Composite production-readiness gap", "shortDescription": {"text": "Composite production-readiness gap"}, "fullDescription": {"text": "Multiple low-cost hardening controls are missing together: ci, tests. Opus verification showed these co-occurring gaps are a better readiness signal than reading each flag in isolation."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-bae00f47ef3e56a3", "name": "Commented-code block (5 lines) in app/store.py:148", "shortDescription": {"text": "Commented-code block (5 lines) in app/store.py:148"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-5cc83525aa6bf82e", "name": "`fetch()` without try/.catch or AbortSignal \u2014 tracker/sporlos.js:37", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 tracker/sporlos.js:37"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-22d713a2c2a66418", "name": "`fetch()` without try/.catch or AbortSignal \u2014 integrations/shopify/sporlos-pixel.js:67", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 integrations/shopify/sporlos-pixel.js:67"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-513deb56397e54b0", "name": "`fetch()` without try/.catch or AbortSignal \u2014 integrations/shopify/app/extensions/sporlos-pixel/src/index.js:58", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 integrations/shopify/app/extensions/sporlos-pixel/src/index.js:58"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-65df07ab4020db79", "name": "18 env vars used in code but missing from .env.example", "shortDescription": {"text": "18 env vars used in code but missing from .env.example"}, "fullDescription": {"text": "Drift between code and config docs. The first few: `ASN_DB`, `ASSIST_GLOBAL_LIMIT`, `ASSIST_VISITOR_LIMIT`, `DATABASE_URL`, `GEOIP_DB`, `MAIL_FROM`, `SESSION_SECRET`, `SMTP_HOST` + 10 more. Add them (with a placeholder/comment) to .env.example so onboarding doesn't break."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2c04133e54348533", "name": "Near-duplicate function bodies in 2 places", "shortDescription": {"text": "Near-duplicate function bodies in 2 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\napp/store.py:get_user_by_email, app/store.py:get_user\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-be46ea126aa5d8dc", "name": "Near-duplicate function bodies in 3 places", "shortDescription": {"text": "Near-duplicate function bodies in 3 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\napp/api.py:timeseries, app/api.py:breakdown, app/api.py:goals\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/25258"}, "properties": {"repository": "datamynt/sporlos", "repoUrl": "https://github.com/datamynt/sporlos", "branch": "main"}, "results": [{"ruleId": "scanner-de5497e976f2027c", "level": "note", "message": {"text": "Possibly dead Python function: os"}, "properties": {"repobilityId": "146b88c39c803f17", "scanner": "scanner-primary", "fingerprint": "de5497e976f2027c", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "app/icons.py:118"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-908c4066e3c36e21", "level": "note", "message": {"text": "Possibly dead Python function: reassign_site"}, "properties": {"repobilityId": "04922ff02c410fc6", "scanner": "scanner-primary", "fingerprint": "908c4066e3c36e21", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "app/store.py:577"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f4bdc6979311597f", "level": "note", "message": {"text": "Possibly dead Python function: lookup"}, "properties": {"repobilityId": "16e76142eb4f59a9", "scanner": "scanner-primary", "fingerprint": "f4bdc6979311597f", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "app/geo.py:76"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-45b013eb8f4f2f25", "level": "note", "message": {"text": "Possibly dead Python function: healthz"}, "properties": {"repobilityId": "b55412abe1fa1e6b", "scanner": "scanner-primary", "fingerprint": "45b013eb8f4f2f25", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "app/main.py:135"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-00be8910c67aa45b", "level": "note", "message": {"text": "Possibly dead Python function: healthz_db"}, "properties": {"repobilityId": "131aef2a00f5308e", "scanner": "scanner-primary", "fingerprint": "00be8910c67aa45b", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "app/main.py:139"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-91ddb0d364cd2a91", "level": "note", "message": {"text": "Possibly dead Python function: hero_stats"}, "properties": {"repobilityId": "e0c69eda257f05f6", "scanner": "scanner-primary", "fingerprint": "91ddb0d364cd2a91", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "app/main.py:159"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-fa67d0bd3e022c2e", "level": "note", "message": {"text": "Possibly dead Python function: sporsmal"}, "properties": {"repobilityId": "8a455df818cc34b6", "scanner": "scanner-primary", "fingerprint": "fa67d0bd3e022c2e", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "app/main.py:279"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-fbd04ee6fb6d5177", "level": "note", "message": {"text": "Possibly dead Python function: strip_stats"}, "properties": {"repobilityId": "52cc72c5b350aec1", "scanner": "scanner-primary", "fingerprint": "fbd04ee6fb6d5177", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "app/main.py:335"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6853fc0556b7a7aa", "level": "note", "message": {"text": "Possibly dead Python function: assist_js"}, "properties": {"repobilityId": "d90fa7d536cdef47", "scanner": "scanner-primary", "fingerprint": "6853fc0556b7a7aa", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "app/main.py:347"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-1bfb89ef091bf93b", "level": "note", "message": {"text": "Possibly dead Python function: assist_api"}, "properties": {"repobilityId": "acceb58ca484ba03", "scanner": "scanner-primary", "fingerprint": "1bfb89ef091bf93b", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "app/main.py:357"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-9044b672a96e3455", "level": "note", "message": {"text": "Possibly dead Python function: favicon"}, "properties": {"repobilityId": "0e230d107327395d", "scanner": "scanner-primary", "fingerprint": "9044b672a96e3455", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "app/main.py:542"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c06c1cba64f24886", "level": "note", "message": {"text": "Possibly dead Python function: favicon_ico"}, "properties": {"repobilityId": "0feefde443f05faf", "scanner": "scanner-primary", "fingerprint": "c06c1cba64f24886", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "app/main.py:547"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-9cc0b0161db32ecf", "level": "note", "message": {"text": "Possibly dead Python function: apple_icon"}, "properties": {"repobilityId": "19352acefa2c561b", "scanner": "scanner-primary", "fingerprint": "9cc0b0161db32ecf", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "app/main.py:553"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ce4b087fd3dae51f", "level": "note", "message": {"text": "Possibly dead Python function: webmanifest"}, "properties": {"repobilityId": "037f7fec70157d71", "scanner": "scanner-primary", "fingerprint": "ce4b087fd3dae51f", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "app/main.py:558"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-9c53b9eead87f233", "level": "note", "message": {"text": "Possibly dead Python function: brand_font"}, "properties": {"repobilityId": "5864ce2fd2c48502", "scanner": "scanner-primary", "fingerprint": "9c53b9eead87f233", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "app/main.py:569"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f408a47c9f762a1b", "level": "note", "message": {"text": "Possibly dead Python function: og_image"}, "properties": {"repobilityId": "414e3fda28d29f80", "scanner": "scanner-primary", "fingerprint": "f408a47c9f762a1b", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "app/main.py:581"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-8d714443ac692c4d", "level": "note", "message": {"text": "Possibly dead Python function: landing"}, "properties": {"repobilityId": "c89d15e19e672e9b", "scanner": "scanner-primary", "fingerprint": "8d714443ac692c4d", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "app/main.py:600"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a9fe3e40d25dc6f6", "level": "note", "message": {"text": "Possibly dead Python function: signup"}, "properties": {"repobilityId": "b2c0467a2c2c941f", "scanner": "scanner-primary", "fingerprint": "a9fe3e40d25dc6f6", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "app/main.py:899"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-558dbeda12ff820d", "level": "note", "message": {"text": "Possibly dead Python function: unsubscribe"}, "properties": {"repobilityId": "c67fee6b30e76d20", "scanner": "scanner-primary", "fingerprint": "558dbeda12ff820d", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "app/main.py:982"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-9491c6e06452e827", "level": "note", "message": {"text": "Possibly dead Python function: verify_email"}, "properties": {"repobilityId": "07943d2401c05e8e", "scanner": "scanner-primary", "fingerprint": "9491c6e06452e827", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "app/main.py:1002"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-581388fa7481ee34", "level": "note", "message": {"text": "Possibly dead Python function: resend_verify"}, "properties": {"repobilityId": "ef11e940920398fd", "scanner": "scanner-primary", "fingerprint": "581388fa7481ee34", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "app/main.py:1020"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-18b12a2a3f70bf03", "level": "note", "message": {"text": "Possibly dead Python function: forgot"}, "properties": {"repobilityId": "3a0b59dd925ddb2e", "scanner": "scanner-primary", "fingerprint": "18b12a2a3f70bf03", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "app/main.py:1033"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-91c0801ee14f2354", "level": "note", "message": {"text": "Possibly dead Python function: logout"}, "properties": {"repobilityId": "8de76350e22b4132", "scanner": "scanner-primary", "fingerprint": "91c0801ee14f2354", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "app/main.py:1103"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-8ff3dcab520554c3", "level": "note", "message": {"text": "Possibly dead Python function: google_login"}, "properties": {"repobilityId": "2ad8d0d18872d6b9", "scanner": "scanner-primary", "fingerprint": "8ff3dcab520554c3", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "app/main.py:1108"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d5aaf79bd3631e63", "level": "note", "message": {"text": "Possibly dead Python function: billing_checkout"}, "properties": {"repobilityId": "97f7260d8c85d619", "scanner": "scanner-primary", "fingerprint": "d5aaf79bd3631e63", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "app/main.py:1136"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3f1835bac5f5197b", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: python:3.13-slim"}, "properties": {"repobilityId": "b49e4cfca3110979", "scanner": "scanner-primary", "fingerprint": "3f1835bac5f5197b", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Dockerfile"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-9710c8d059e53154", "level": "none", "message": {"text": "No frontend routes/components detected"}, "properties": {"repobilityId": "44ca61485762e494", "scanner": "scanner-primary", "fingerprint": "9710c8d059e53154", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-462e57aaa8345552", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in app/main.py:842"}, "properties": {"repobilityId": "0332662c2b6d40dc", "scanner": "scanner-primary", "fingerprint": "462e57aaa8345552", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "app/main.py"}, "region": {"startLine": 842}}}]}, {"ruleId": "scanner-7f83313b16dcc7dd", "level": "warning", "message": {"text": "Insecure pattern 'cors_wildcard' in app/main.py:2831"}, "properties": {"repobilityId": "6e34239fa74e6e6b", "scanner": "scanner-primary", "fingerprint": "7f83313b16dcc7dd", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "cors_wildcard"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "app/main.py"}, "region": {"startLine": 2831}}}]}, {"ruleId": "scanner-755f371a151f4e68", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in assist/widget.js:51"}, "properties": {"repobilityId": "118dd364674622b5", "scanner": "scanner-primary", "fingerprint": "755f371a151f4e68", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "assist/widget.js"}, "region": {"startLine": 51}}}]}, {"ruleId": "scanner-4601e3ad3bb28677", "level": "warning", "message": {"text": "No CI/CD pipelines detected"}, "properties": {"repobilityId": "c3ee439bce2bc51e", "scanner": "scanner-primary", "fingerprint": "4601e3ad3bb28677", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-acd4bd485d5bf90c", "level": "note", "message": {"text": "Very large file: app/store.py (1299 lines)"}, "properties": {"repobilityId": "7c4428735a4055cb", "scanner": "scanner-primary", "fingerprint": "acd4bd485d5bf90c", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-af8a4e11fd8a20f8", "level": "note", "message": {"text": "Very large file: app/main.py (2843 lines)"}, "properties": {"repobilityId": "566b37e8922cbe53", "scanner": "scanner-primary", "fingerprint": "af8a4e11fd8a20f8", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-6893a6c8b0861585", "level": "warning", "message": {"text": "Very low test-to-source ratio"}, "properties": {"repobilityId": "54a7de3f06314bf0", "scanner": "scanner-primary", "fingerprint": "6893a6c8b0861585", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["tests", "coverage"]}}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "db7333d146d235c2", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "f53b0dc6f1a15d3e", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-b9088664ace7f748", "level": "note", "message": {"text": "Composite production-readiness gap"}, "properties": {"repobilityId": "b2f100ce9d13a07d", "scanner": "scanner-primary", "fingerprint": "b9088664ace7f748", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["production-readiness", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-bae00f47ef3e56a3", "level": "none", "message": {"text": "Commented-code block (5 lines) in app/store.py:148"}, "properties": {"repobilityId": "55d0f65d598b39a2", "scanner": "scanner-primary", "fingerprint": "bae00f47ef3e56a3", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-5cc83525aa6bf82e", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 tracker/sporlos.js:37"}, "properties": {"repobilityId": "cc45589e0d821a32", "scanner": "scanner-primary", "fingerprint": "5cc83525aa6bf82e", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-22d713a2c2a66418", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 integrations/shopify/sporlos-pixel.js:67"}, "properties": {"repobilityId": "98888353be24edb1", "scanner": "scanner-primary", "fingerprint": "22d713a2c2a66418", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-513deb56397e54b0", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 integrations/shopify/app/extensions/sporlos-pixel/src/index.js:58"}, "properties": {"repobilityId": "6da9b48761a60b6d", "scanner": "scanner-primary", "fingerprint": "513deb56397e54b0", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-65df07ab4020db79", "level": "note", "message": {"text": "18 env vars used in code but missing from .env.example"}, "properties": {"repobilityId": "5e334d56f52c02e1", "scanner": "scanner-primary", "fingerprint": "65df07ab4020db79", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "config-drift"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "9fd2bf4ecda51784", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "cae59efa2c2fd16c", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-be46ea126aa5d8dc", "level": "note", "message": {"text": "Near-duplicate function bodies in 3 places"}, "properties": {"repobilityId": "8cc9a5c9eeead6aa", "scanner": "scanner-primary", "fingerprint": "be46ea126aa5d8dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-be46ea126aa5d8dc", "level": "note", "message": {"text": "Near-duplicate function bodies in 3 places"}, "properties": {"repobilityId": "651b2854744e24b2", "scanner": "scanner-primary", "fingerprint": "be46ea126aa5d8dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}]}]}