{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-2c53b140b0f340e4", "name": "Stray `console.log` in TS/JS \u2014 scripts/generate-drawlist-writers.ts:253", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 scripts/generate-drawlist-writers.ts:253"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ba7a6eaf24350144", "name": "Stray `console.log` in TS/JS \u2014 packages/bench/src/run.ts:279", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 packages/bench/src/run.ts:279"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f4a53179a3535c2e", "name": "Stray `console.log` in TS/JS \u2014 packages/bench/src/report.ts:234", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 packages/bench/src/report.ts:234"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0c15a32c1ef56abd", "name": "Stray `console.log` in TS/JS \u2014 packages/bench/src/profile-phases.ts:64", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 packages/bench/src/profile-phases.ts:64"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7680b341e33398e1", "name": "Stray `console.log` in TS/JS \u2014 packages/bench/src/profile-construction.ts:38", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 packages/bench/src/profile-construction.ts:38"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6f1694807bb9d32d", "name": "Stray `console.log` in TS/JS \u2014 packages/bench/src/profile-packed-style.ts:96", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 packages/bench/src/profile-packed-style.ts:96"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f200ed6bdfd5aae9", "name": "Stray `console.log` in TS/JS \u2014 packages/bench/src/ratatui-runner.ts:40", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 packages/bench/src/ratatui-runner.ts:40"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-08aecdd838aaa2fa", "name": "Stray `console.log` in TS/JS \u2014 packages/core/src/widgets/__tests__/editors.test.ts:8", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 packages/core/src/widgets/__tests__/editors.test.ts:8"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6c390f8790553356", "name": "Stray `console.log` in TS/JS \u2014 examples/gallery/src/index.ts:74", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 examples/gallery/src/index.ts:74"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-469d10c77a79b209", "name": "Privileged port 256 in use", "shortDescription": {"text": "Privileged port 256 in use"}, "fullDescription": {"text": "Port 256 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4f8bd712a6b34917", "name": "Insecure pattern 'node_child_process' in scripts/verify-native-pack.mjs:2", "shortDescription": {"text": "Insecure pattern 'node_child_process' in scripts/verify-native-pack.mjs:2"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-cf0acd9c16a63208", "name": "Insecure pattern 'node_child_process' in scripts/testing-slices.mjs:3", "shortDescription": {"text": "Insecure pattern 'node_child_process' in scripts/testing-slices.mjs:3"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-5c5c802bffcb39c3", "name": "Insecure pattern 'node_child_process' in scripts/run-bench-ci.mjs:3", "shortDescription": {"text": "Insecure pattern 'node_child_process' in scripts/run-bench-ci.mjs:3"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0c4d9678c5ff77df", "name": "Insecure pattern 'node_child_process' in scripts/run-e2e.mjs:12", "shortDescription": {"text": "Insecure pattern 'node_child_process' in scripts/run-e2e.mjs:12"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c2737412afdfde5e", "name": "Insecure pattern 'node_child_process' in scripts/run-api-extractor.mjs:3", "shortDescription": {"text": "Insecure pattern 'node_child_process' in scripts/run-api-extractor.mjs:3"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9a58860a950735d5", "name": "Insecure pattern 'node_child_process' in scripts/check-native-vendor-integrity.mjs:14", "shortDescription": {"text": "Insecure pattern 'node_child_process' in scripts/check-native-vendor-integrity.mjs:14"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-dcb2a245c24821c1", "name": "Insecure pattern 'node_child_process' in scripts/record-hsr-gif.mjs:2", "shortDescription": {"text": "Insecure pattern 'node_child_process' in scripts/record-hsr-gif.mjs:2"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9d4aa55ec55ae414", "name": "Insecure pattern 'node_child_process' in scripts/__tests__/check-native-vendor-integrity.test.mjs:6", "shortDescription": {"text": "Insecure pattern 'node_child_process' in scripts/__tests__/check-native-vendor-integrity.test.mjs:6"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-5243337b82c6b35b", "name": "Insecure pattern 'node_child_process' in scripts/__tests__/testing-slices.test.mjs:2", "shortDescription": {"text": "Insecure pattern 'node_child_process' in scripts/__tests__/testing-slices.test.mjs:2"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-001d21b80cd4557b", "name": "Insecure pattern 'node_child_process' in scripts/hsr/record-runner.mjs:2", "shortDescription": {"text": "Insecure pattern 'node_child_process' in scripts/hsr/record-runner.mjs:2"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6fea948c03a98940", "name": "Insecure pattern 'node_child_process' in packages/bench/src/run.ts:30", "shortDescription": {"text": "Insecure pattern 'node_child_process' in packages/bench/src/run.ts:30"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-37073115373ca5df", "name": "Insecure pattern 'node_child_process' in packages/bench/src/ratatui-runner.ts:9", "shortDescription": {"text": "Insecure pattern 'node_child_process' in packages/bench/src/ratatui-runner.ts:9"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-68f7134b14fdca67", "name": "Insecure pattern 'node_child_process' in packages/bench/src/frameworks/opentui.ts:1", "shortDescription": {"text": "Insecure pattern 'node_child_process' in packages/bench/src/frameworks/opentui.ts:1"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7fe05bd9eaeb297b", "name": "Insecure pattern 'node_child_process' in packages/bench/src/frameworks/ratatui.ts:1", "shortDescription": {"text": "Insecure pattern 'node_child_process' in packages/bench/src/frameworks/ratatui.ts:1"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0f5b02a3ff36b2e7", "name": "Insecure pattern 'node_child_process' in packages/bench/src/frameworks/bubbletea.ts:1", "shortDescription": {"text": "Insecure pattern 'node_child_process' in packages/bench/src/frameworks/bubbletea.ts:1"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-adf5ef8ec5c48e22", "name": "Insecure pattern 'exec_used' in packages/bench/src/scenarios/content-update.ts:352", "shortDescription": {"text": "Insecure pattern 'exec_used' in packages/bench/src/scenarios/content-update.ts:352"}, "fullDescription": {"text": "Found a known-risky pattern (exec_used). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-cce278051a30887d", "name": "Insecure pattern 'exec_used' in packages/bench/src/scenarios/rerender.ts:191", "shortDescription": {"text": "Insecure pattern 'exec_used' in packages/bench/src/scenarios/rerender.ts:191"}, "fullDescription": {"text": "Found a known-risky pattern (exec_used). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-9ef77fe17e608cb7", "name": "Insecure pattern 'exec_used' in packages/bench/src/scenarios/construction.ts:128", "shortDescription": {"text": "Insecure pattern 'exec_used' in packages/bench/src/scenarios/construction.ts:128"}, "fullDescription": {"text": "Found a known-risky pattern (exec_used). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-4ae51ad74576baa1", "name": "Insecure pattern 'exec_used' in packages/bench/src/scenarios/memory.ts:371", "shortDescription": {"text": "Insecure pattern 'exec_used' in packages/bench/src/scenarios/memory.ts:371"}, "fullDescription": {"text": "Found a known-risky pattern (exec_used). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-23c91e9655c1d7aa", "name": "Insecure pattern 'exec_used' in packages/bench/src/scenarios/startup.ts:231", "shortDescription": {"text": "Insecure pattern 'exec_used' in packages/bench/src/scenarios/startup.ts:231"}, "fullDescription": {"text": "Found a known-risky pattern (exec_used). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-7db7dde70cda1840", "name": "Insecure pattern 'node_child_process' in packages/native/scripts/build-native.mjs:1", "shortDescription": {"text": "Insecure pattern 'node_child_process' in packages/native/scripts/build-native.mjs:1"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-65aa740cba4a4a73", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "github/codeql-action/init@v3 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c81cc290076339a0", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-27924aa79fa4a517", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/dependency-review-action@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0763d85002569570", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/setup-node@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-14ce8614dd03f409", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ce4edaa2bc26045f", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f8c0801f98c9d930", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/setup-node@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-46c644c6227e4d4a", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/setup-node@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1838a141491ce38c", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-be98a2e2a5bd9384", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "peter-evans/repository-dispatch@v3 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-567e8b5bc43d5c2d", "name": "Very large file: packages/bench/opentui-bench/run.ts (1958 lines)", "shortDescription": {"text": "Very large file: packages/bench/opentui-bench/run.ts (1958 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5cb2dd1adaa71c7a", "name": "Very large file: packages/core/src/app/widgetRenderer.ts (3808 lines)", "shortDescription": {"text": "Very large file: packages/core/src/app/widgetRenderer.ts (3808 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8b401b49ad14bc6f", "name": "Very large file: packages/core/src/app/__tests__/widgetRenderer.integration.test.ts (2957 lines)", "shortDescription": {"text": "Very large file: packages/core/src/app/__tests__/widgetRenderer.integration.test.ts (2957 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-40d8fa18775673ee", "name": "Very large file: packages/core/src/app/widgetRenderer/mouseRouting.ts (1875 lines)", "shortDescription": {"text": "Very large file: packages/core/src/app/widgetRenderer/mouseRouting.ts (1875 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b72076a8404cc122", "name": "Node manifest has dependencies but no lockfile: packages/node/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: packages/node/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-259a4842ff974b88", "name": "Node manifest has dependencies but no lockfile: packages/jsx/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: packages/jsx/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ce71fe63000afe35", "name": "Node manifest has dependencies but no lockfile: packages/bench/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: packages/bench/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-bd150f820012e9f0", "name": "Node manifest has dependencies but no lockfile: packages/create-rezi/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: packages/create-rezi/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-985e26e32ec2041b", "name": "Node manifest has dependencies but no lockfile: packages/create-rezi/templates/starship/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: packages/create-rezi/templates/starship/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a5644bde09aee923", "name": "Node manifest has dependencies but no lockfile: packages/create-rezi/templates/minimal/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: packages/create-rezi/templates/minimal/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-76a93657d0f0eb66", "name": "Node manifest has dependencies but no lockfile: packages/create-rezi/templates/cli-tool/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: packages/create-rezi/templates/cli-tool/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-28e92806c0db3cd2", "name": "Node manifest has dependencies but no lockfile: packages/core/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: packages/core/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d11871697a9b887a", "name": "Node manifest has dependencies but no lockfile: packages/native/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: packages/native/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fe6c68fbc620f7a5", "name": "Node manifest has dependencies but no lockfile: examples/regression-dashboard/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: examples/regression-dashboard/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ac8f57cdbff5a536", "name": "Node manifest has dependencies but no lockfile: examples/inline-status/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: examples/inline-status/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d8dab20cb2d8eab1", "name": "Node manifest has dependencies but no lockfile: examples/gallery/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: examples/gallery/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ea45b7e9b96ed8d1", "name": "Node manifest has dependencies but no lockfile: examples/hello-counter/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: examples/hello-counter/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f4f8dae4118b3b12", "name": "Node manifest has dependencies but no lockfile: examples/raw-draw-demo/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: examples/raw-draw-demo/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 81 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-72b2a6250083a784", "name": "Placeholder or mock-heavy implementation detected", "shortDescription": {"text": "Placeholder or mock-heavy implementation detected"}, "fullDescription": {"text": "Found 87 placeholder/mock markers across 21 source files. This often means the repo looks complete while core flows still use generated scaffolding or fake data."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-749d4bc1bd66df5f", "name": "Agent instructions exist but release-hardening basics are missing", "shortDescription": {"text": "Agent instructions exist but release-hardening basics are missing"}, "fullDescription": {"text": "AI-coder instruction files were found, but the repo is missing lockfile. Treat this as a contract gap: the agent is guided, but the generated output is not yet guarded by the controls that make it repeatable."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-5604c90add31e9d5", "name": "Agent authority lacks a verifier contract: docs/protocol/cursor.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: docs/protocol/cursor.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e725d2ab884fbd49", "name": "Multiple root agent instruction files without precedence", "shortDescription": {"text": "Multiple root agent instruction files without precedence"}, "fullDescription": {"text": "The repo has multiple top-level AI-coder instruction files. Without precedence rules, different agents may follow different policies."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f5f3886097494672", "name": "Commented-code block (5 lines) in scripts/run-e2e.mjs:6", "shortDescription": {"text": "Commented-code block (5 lines) in scripts/run-e2e.mjs:6"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-19856d287d144f6d", "name": "Legacy-named symbol `zrev_v1` in packages/core/src/index.ts:103", "shortDescription": {"text": "Legacy-named symbol `zrev_v1` in packages/core/src/index.ts:103"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ab64ab91026fa2d4", "name": "Legacy-named symbol `maxOld` in packages/core/src/renderer/renderToDrawlist/widgets/editors.ts:445", "shortDescription": {"text": "Legacy-named symbol `maxOld` in packages/core/src/renderer/renderToDrawlist/widgets/editors.ts:445"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-98bdbb2ee2f2566e", "name": "Legacy-named symbol `zrev_v1` in packages/core/src/testing/events.ts:199", "shortDescription": {"text": "Legacy-named symbol `zrev_v1` in packages/core/src/testing/events.ts:199"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b56cbc70a2b9c75b", "name": "Legacy-named symbol `zrev_v1` in packages/core/src/testing/__tests__/eventBuilder.test.ts:2", "shortDescription": {"text": "Legacy-named symbol `zrev_v1` in packages/core/src/testing/__tests__/eventBuilder.test.ts:2"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-07acc0d248a7fcce", "name": "Commented-code block (6 lines) in packages/core/src/widgets/__tests__/virtualList.golden.test.ts:139", "shortDescription": {"text": "Commented-code block (6 lines) in packages/core/src/widgets/__tests__/virtualList.golden.test.ts:139"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-e806ffa9417bcaa7", "name": "Legacy-named symbol `maxOld` in packages/core/src/app/widgetRenderer/renderCaches.ts:223", "shortDescription": {"text": "Legacy-named symbol `maxOld` in packages/core/src/app/widgetRenderer/renderCaches.ts:223"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8b72b0474ae8e7d3", "name": "Commented-code block (9 lines) in packages/core/src/app/widgetRenderer/submitFramePipeline.ts:246", "shortDescription": {"text": "Commented-code block (9 lines) in packages/core/src/app/widgetRenderer/submitFramePipeline.ts:246"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-b0525f5e3c7b03c8", "name": "Legacy-named symbol `zrev_v1` in packages/core/src/app/createApp/eventLoop.ts:10", "shortDescription": {"text": "Legacy-named symbol `zrev_v1` in packages/core/src/app/createApp/eventLoop.ts:10"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-91975aefa5292af2", "name": "Legacy-named symbol `computeDropdownGeometryLegacy` in packages/core/src/runtime/__tests__/overlayUnification.test.ts:78", "shortDescription": {"text": "Legacy-named symbol `computeDropdownGeometryLegacy` in packages/core/src/runtime/__tests__/overlayUnification.test.ts:78"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-17b833b4aa5aba73", "name": "Legacy-named symbol `zrev_v1` in packages/core/src/protocol/zrev_v1.ts:2", "shortDescription": {"text": "Legacy-named symbol `zrev_v1` in packages/core/src/protocol/zrev_v1.ts:2"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0cccbf9777758080", "name": "Legacy-named symbol `zrev_v1` in packages/core/src/protocol/__tests__/zrev_v1_invalid.test.ts:3", "shortDescription": {"text": "Legacy-named symbol `zrev_v1` in packages/core/src/protocol/__tests__/zrev_v1_invalid.test.ts:3"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f9ee0915c8635e10", "name": "Legacy-named symbol `zrev_v1` in packages/core/src/protocol/__tests__/zrev_v1_fuzz_lite.test.ts:2", "shortDescription": {"text": "Legacy-named symbol `zrev_v1` in packages/core/src/protocol/__tests__/zrev_v1_fuzz_lite.test.ts:2"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f2a1138d5b344972", "name": "Legacy-named symbol `zrev_v1` in packages/core/src/protocol/__tests__/zrev_v1_valid.test.ts:2", "shortDescription": {"text": "Legacy-named symbol `zrev_v1` in packages/core/src/protocol/__tests__/zrev_v1_valid.test.ts:2"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c43c9da1c72fbb90", "name": "Legacy-named symbol `zrev_v1` in packages/core/src/repro/replay.ts:25", "shortDescription": {"text": "Legacy-named symbol `zrev_v1` in packages/core/src/repro/replay.ts:25"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/18552"}, "properties": {"repository": "RtlZeroMemory/Rezi", "repoUrl": "https://github.com/RtlZeroMemory/Rezi", "branch": "main"}, "results": [{"ruleId": "scanner-2c53b140b0f340e4", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 scripts/generate-drawlist-writers.ts:253"}, "properties": {"repobilityId": "bb92419e474962a2", "scanner": "scanner-primary", "fingerprint": "2c53b140b0f340e4", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-ba7a6eaf24350144", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 packages/bench/src/run.ts:279"}, "properties": {"repobilityId": "8d4be01cabb136b2", "scanner": "scanner-primary", "fingerprint": "ba7a6eaf24350144", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-f4a53179a3535c2e", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 packages/bench/src/report.ts:234"}, "properties": {"repobilityId": "0d0aea81d11e926f", "scanner": "scanner-primary", "fingerprint": "f4a53179a3535c2e", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-0c15a32c1ef56abd", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 packages/bench/src/profile-phases.ts:64"}, "properties": {"repobilityId": "9b5496a3a76fc3e8", "scanner": "scanner-primary", "fingerprint": "0c15a32c1ef56abd", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-7680b341e33398e1", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 packages/bench/src/profile-construction.ts:38"}, "properties": {"repobilityId": "f1344b8cb8673ddd", "scanner": "scanner-primary", "fingerprint": "7680b341e33398e1", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-6f1694807bb9d32d", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 packages/bench/src/profile-packed-style.ts:96"}, "properties": {"repobilityId": "1cd68daca8c38ef2", "scanner": "scanner-primary", "fingerprint": "6f1694807bb9d32d", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-f200ed6bdfd5aae9", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 packages/bench/src/ratatui-runner.ts:40"}, "properties": {"repobilityId": "84b46f39049dd27a", "scanner": "scanner-primary", "fingerprint": "f200ed6bdfd5aae9", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-08aecdd838aaa2fa", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 packages/core/src/widgets/__tests__/editors.test.ts:8"}, "properties": {"repobilityId": "3320019cab57f3cc", "scanner": "scanner-primary", "fingerprint": "08aecdd838aaa2fa", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-6c390f8790553356", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 examples/gallery/src/index.ts:74"}, "properties": {"repobilityId": "be7f321494dec03e", "scanner": "scanner-primary", "fingerprint": "6c390f8790553356", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-469d10c77a79b209", "level": "warning", "message": {"text": "Privileged port 256 in use"}, "properties": {"repobilityId": "0ec1f2d0c9e6da94", "scanner": "scanner-primary", "fingerprint": "469d10c77a79b209", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/core/src/widgets/__tests__/colorScales.test.ts"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-4f8bd712a6b34917", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in scripts/verify-native-pack.mjs:2"}, "properties": {"repobilityId": "2cf2734892e6cdf7", "scanner": "scanner-primary", "fingerprint": "4f8bd712a6b34917", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/verify-native-pack.mjs"}, "region": {"startLine": 2}}}]}, {"ruleId": "scanner-cf0acd9c16a63208", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in scripts/testing-slices.mjs:3"}, "properties": {"repobilityId": "1064e0795d460a61", "scanner": "scanner-primary", "fingerprint": "cf0acd9c16a63208", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/testing-slices.mjs"}, "region": {"startLine": 3}}}]}, {"ruleId": "scanner-5c5c802bffcb39c3", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in scripts/run-bench-ci.mjs:3"}, "properties": {"repobilityId": "e19b19fdfae8ba65", "scanner": "scanner-primary", "fingerprint": "5c5c802bffcb39c3", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/run-bench-ci.mjs"}, "region": {"startLine": 3}}}]}, {"ruleId": "scanner-0c4d9678c5ff77df", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in scripts/run-e2e.mjs:12"}, "properties": {"repobilityId": "6f3f0290bcb74670", "scanner": "scanner-primary", "fingerprint": "0c4d9678c5ff77df", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/run-e2e.mjs"}, "region": {"startLine": 12}}}]}, {"ruleId": "scanner-c2737412afdfde5e", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in scripts/run-api-extractor.mjs:3"}, "properties": {"repobilityId": "be838628555f02cf", "scanner": "scanner-primary", "fingerprint": "c2737412afdfde5e", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/run-api-extractor.mjs"}, "region": {"startLine": 3}}}]}, {"ruleId": "scanner-9a58860a950735d5", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in scripts/check-native-vendor-integrity.mjs:14"}, "properties": {"repobilityId": "efebdb1d1f634d74", "scanner": "scanner-primary", "fingerprint": "9a58860a950735d5", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/check-native-vendor-integrity.mjs"}, "region": {"startLine": 14}}}]}, {"ruleId": "scanner-dcb2a245c24821c1", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in scripts/record-hsr-gif.mjs:2"}, "properties": {"repobilityId": "3112909107c71cc6", "scanner": "scanner-primary", "fingerprint": "dcb2a245c24821c1", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/record-hsr-gif.mjs"}, "region": {"startLine": 2}}}]}, {"ruleId": "scanner-9d4aa55ec55ae414", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in scripts/__tests__/check-native-vendor-integrity.test.mjs:6"}, "properties": {"repobilityId": "04e207f438062179", "scanner": "scanner-primary", "fingerprint": "9d4aa55ec55ae414", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/__tests__/check-native-vendor-integrity.test.mjs"}, "region": {"startLine": 6}}}]}, {"ruleId": "scanner-5243337b82c6b35b", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in scripts/__tests__/testing-slices.test.mjs:2"}, "properties": {"repobilityId": "2649f18dd431c978", "scanner": "scanner-primary", "fingerprint": "5243337b82c6b35b", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/__tests__/testing-slices.test.mjs"}, "region": {"startLine": 2}}}]}, {"ruleId": "scanner-001d21b80cd4557b", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in scripts/hsr/record-runner.mjs:2"}, "properties": {"repobilityId": "b682edb62330b005", "scanner": "scanner-primary", "fingerprint": "001d21b80cd4557b", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/hsr/record-runner.mjs"}, "region": {"startLine": 2}}}]}, {"ruleId": "scanner-6fea948c03a98940", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in packages/bench/src/run.ts:30"}, "properties": {"repobilityId": "6a234f4298fa630f", "scanner": "scanner-primary", "fingerprint": "6fea948c03a98940", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/bench/src/run.ts"}, "region": {"startLine": 30}}}]}, {"ruleId": "scanner-37073115373ca5df", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in packages/bench/src/ratatui-runner.ts:9"}, "properties": {"repobilityId": "a6fa75ded4743ef2", "scanner": "scanner-primary", "fingerprint": "37073115373ca5df", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/bench/src/ratatui-runner.ts"}, "region": {"startLine": 9}}}]}, {"ruleId": "scanner-68f7134b14fdca67", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in packages/bench/src/frameworks/opentui.ts:1"}, "properties": {"repobilityId": "259211cf54824eea", "scanner": "scanner-primary", "fingerprint": "68f7134b14fdca67", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/bench/src/frameworks/opentui.ts"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-7fe05bd9eaeb297b", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in packages/bench/src/frameworks/ratatui.ts:1"}, "properties": {"repobilityId": "4f804145f9ed2a31", "scanner": "scanner-primary", "fingerprint": "7fe05bd9eaeb297b", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/bench/src/frameworks/ratatui.ts"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-0f5b02a3ff36b2e7", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in packages/bench/src/frameworks/bubbletea.ts:1"}, "properties": {"repobilityId": "8bad4f05a63c0724", "scanner": "scanner-primary", "fingerprint": "0f5b02a3ff36b2e7", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/bench/src/frameworks/bubbletea.ts"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-adf5ef8ec5c48e22", "level": "error", "message": {"text": "Insecure pattern 'exec_used' in packages/bench/src/scenarios/content-update.ts:352"}, "properties": {"repobilityId": "c464eab68330d14f", "scanner": "scanner-primary", "fingerprint": "adf5ef8ec5c48e22", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "exec_used"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/bench/src/scenarios/content-update.ts"}, "region": {"startLine": 352}}}]}, {"ruleId": "scanner-cce278051a30887d", "level": "error", "message": {"text": "Insecure pattern 'exec_used' in packages/bench/src/scenarios/rerender.ts:191"}, "properties": {"repobilityId": "48c6f2128cb37337", "scanner": "scanner-primary", "fingerprint": "cce278051a30887d", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "exec_used"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/bench/src/scenarios/rerender.ts"}, "region": {"startLine": 191}}}]}, {"ruleId": "scanner-9ef77fe17e608cb7", "level": "error", "message": {"text": "Insecure pattern 'exec_used' in packages/bench/src/scenarios/construction.ts:128"}, "properties": {"repobilityId": "eed4832f81e80df1", "scanner": "scanner-primary", "fingerprint": "9ef77fe17e608cb7", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "exec_used"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/bench/src/scenarios/construction.ts"}, "region": {"startLine": 128}}}]}, {"ruleId": "scanner-4ae51ad74576baa1", "level": "error", "message": {"text": "Insecure pattern 'exec_used' in packages/bench/src/scenarios/memory.ts:371"}, "properties": {"repobilityId": "2955b6e6d0a5b925", "scanner": "scanner-primary", "fingerprint": "4ae51ad74576baa1", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "exec_used"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/bench/src/scenarios/memory.ts"}, "region": {"startLine": 371}}}]}, {"ruleId": "scanner-23c91e9655c1d7aa", "level": "error", "message": {"text": "Insecure pattern 'exec_used' in packages/bench/src/scenarios/startup.ts:231"}, "properties": {"repobilityId": "f176d1b89eb8e4d8", "scanner": "scanner-primary", "fingerprint": "23c91e9655c1d7aa", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "exec_used"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/bench/src/scenarios/startup.ts"}, "region": {"startLine": 231}}}]}, {"ruleId": "scanner-7db7dde70cda1840", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in packages/native/scripts/build-native.mjs:1"}, "properties": {"repobilityId": "309824701b3d537d", "scanner": "scanner-primary", "fingerprint": "7db7dde70cda1840", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/native/scripts/build-native.mjs"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-65aa740cba4a4a73", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "549a2de1ac0c3fa9", "scanner": "scanner-primary", "fingerprint": "65aa740cba4a4a73", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/codeql.yml"}, "region": {"startLine": 29}}}]}, {"ruleId": "scanner-65aa740cba4a4a73", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "a5721e15e3a54aa2", "scanner": "scanner-primary", "fingerprint": "65aa740cba4a4a73", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/codeql.yml"}, "region": {"startLine": 36}}}]}, {"ruleId": "scanner-65aa740cba4a4a73", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "549a2de1ac0c3fa9", "scanner": "scanner-primary", "fingerprint": "65aa740cba4a4a73", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/codeql.yml"}, "region": {"startLine": 47}}}]}, {"ruleId": "scanner-65aa740cba4a4a73", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "a5721e15e3a54aa2", "scanner": "scanner-primary", "fingerprint": "65aa740cba4a4a73", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/codeql.yml"}, "region": {"startLine": 54}}}]}, {"ruleId": "scanner-c81cc290076339a0", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "eb69e512f84a180f", "scanner": "scanner-primary", "fingerprint": "c81cc290076339a0", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/prebuild.yml"}, "region": {"startLine": 46}}}]}, {"ruleId": "scanner-c81cc290076339a0", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "6e22f5b5484ce9ea", "scanner": "scanner-primary", "fingerprint": "c81cc290076339a0", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/prebuild.yml"}, "region": {"startLine": 51}}}]}, {"ruleId": "scanner-c81cc290076339a0", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "3506268acfdf0c9a", "scanner": "scanner-primary", "fingerprint": "c81cc290076339a0", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/prebuild.yml"}, "region": {"startLine": 63}}}]}, {"ruleId": "scanner-c81cc290076339a0", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "f23d65139503f736", "scanner": "scanner-primary", "fingerprint": "c81cc290076339a0", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/prebuild.yml"}, "region": {"startLine": 69}}}]}, {"ruleId": "scanner-c81cc290076339a0", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "e076f53fef311e56", "scanner": "scanner-primary", "fingerprint": "c81cc290076339a0", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/prebuild.yml"}, "region": {"startLine": 85}}}]}, {"ruleId": "scanner-c81cc290076339a0", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "eb69e512f84a180f", "scanner": "scanner-primary", "fingerprint": "c81cc290076339a0", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/prebuild.yml"}, "region": {"startLine": 96}}}]}, {"ruleId": "scanner-c81cc290076339a0", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "e076f53fef311e56", "scanner": "scanner-primary", "fingerprint": "c81cc290076339a0", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/prebuild.yml"}, "region": {"startLine": 120}}}]}, {"ruleId": "scanner-c81cc290076339a0", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "eb69e512f84a180f", "scanner": "scanner-primary", "fingerprint": "c81cc290076339a0", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/prebuild.yml"}, "region": {"startLine": 134}}}]}, {"ruleId": "scanner-c81cc290076339a0", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "6e22f5b5484ce9ea", "scanner": "scanner-primary", "fingerprint": "c81cc290076339a0", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/prebuild.yml"}, "region": {"startLine": 139}}}]}, {"ruleId": "scanner-c81cc290076339a0", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "51c3f228b3a1bbf8", "scanner": "scanner-primary", "fingerprint": "c81cc290076339a0", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/prebuild.yml"}, "region": {"startLine": 151}}}]}, {"ruleId": "scanner-27924aa79fa4a517", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "f28bea84d363ff64", "scanner": "scanner-primary", "fingerprint": "27924aa79fa4a517", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 110}}}]}, {"ruleId": "scanner-27924aa79fa4a517", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "989a74409a402368", "scanner": "scanner-primary", "fingerprint": "27924aa79fa4a517", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 123}}}]}, {"ruleId": "scanner-27924aa79fa4a517", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "989a74409a402368", "scanner": "scanner-primary", "fingerprint": "27924aa79fa4a517", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 193}}}]}, {"ruleId": "scanner-27924aa79fa4a517", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "989a74409a402368", "scanner": "scanner-primary", "fingerprint": "27924aa79fa4a517", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 220}}}]}, {"ruleId": "scanner-27924aa79fa4a517", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "ae16880318b99912", "scanner": "scanner-primary", "fingerprint": "27924aa79fa4a517", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 260}}}]}, {"ruleId": "scanner-27924aa79fa4a517", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "989a74409a402368", "scanner": "scanner-primary", "fingerprint": "27924aa79fa4a517", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 265}}}]}, {"ruleId": "scanner-27924aa79fa4a517", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "ae83c03bfc0a4d34", "scanner": "scanner-primary", "fingerprint": "27924aa79fa4a517", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 286}}}]}, {"ruleId": "scanner-27924aa79fa4a517", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "ae16880318b99912", "scanner": "scanner-primary", "fingerprint": "27924aa79fa4a517", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 335}}}]}, {"ruleId": "scanner-27924aa79fa4a517", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "989a74409a402368", "scanner": "scanner-primary", "fingerprint": "27924aa79fa4a517", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 340}}}]}, {"ruleId": "scanner-27924aa79fa4a517", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "dcb6504096fc20e7", "scanner": "scanner-primary", "fingerprint": "27924aa79fa4a517", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 345}}}]}, {"ruleId": "scanner-27924aa79fa4a517", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "ae16880318b99912", "scanner": "scanner-primary", "fingerprint": "27924aa79fa4a517", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 368}}}]}, {"ruleId": "scanner-27924aa79fa4a517", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "989a74409a402368", "scanner": "scanner-primary", "fingerprint": "27924aa79fa4a517", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 373}}}]}, {"ruleId": "scanner-27924aa79fa4a517", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "bd7f3c1c34d83159", "scanner": "scanner-primary", "fingerprint": "27924aa79fa4a517", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 415}}}]}, {"ruleId": "scanner-0763d85002569570", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "4953002f92c6cb76", "scanner": "scanner-primary", "fingerprint": "0763d85002569570", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/docs.yml"}, "region": {"startLine": 27}}}]}, {"ruleId": "scanner-0763d85002569570", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "b7fbe10e69a41ea0", "scanner": "scanner-primary", "fingerprint": "0763d85002569570", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/docs.yml"}, "region": {"startLine": 47}}}]}, {"ruleId": "scanner-0763d85002569570", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "0ea595cee9e99258", "scanner": "scanner-primary", "fingerprint": "0763d85002569570", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/docs.yml"}, "region": {"startLine": 51}}}]}, {"ruleId": "scanner-0763d85002569570", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "4289fb2fbaf82766", "scanner": "scanner-primary", "fingerprint": "0763d85002569570", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/docs.yml"}, "region": {"startLine": 64}}}]}, {"ruleId": "scanner-14ce8614dd03f409", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "81c5c697653f94e8", "scanner": "scanner-primary", "fingerprint": "14ce8614dd03f409", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/docs.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ce4edaa2bc26045f", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "1192b1d84c4a7953", "scanner": "scanner-primary", "fingerprint": "ce4edaa2bc26045f", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/bench.yml"}, "region": {"startLine": 13}}}]}, {"ruleId": "scanner-ce4edaa2bc26045f", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "baec5a42b9b7a60c", "scanner": "scanner-primary", "fingerprint": "ce4edaa2bc26045f", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/bench.yml"}, "region": {"startLine": 18}}}]}, {"ruleId": "scanner-ce4edaa2bc26045f", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "72194a4d9085c1c2", "scanner": "scanner-primary", "fingerprint": "ce4edaa2bc26045f", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/bench.yml"}, "region": {"startLine": 27}}}]}, {"ruleId": "scanner-ce4edaa2bc26045f", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "452de1bac02c5ee3", "scanner": "scanner-primary", "fingerprint": "ce4edaa2bc26045f", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/bench.yml"}, "region": {"startLine": 65}}}]}, {"ruleId": "scanner-f8c0801f98c9d930", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "c73a6ee95aa6a0d7", "scanner": "scanner-primary", "fingerprint": "f8c0801f98c9d930", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/nightly.yml"}, "region": {"startLine": 25}}}]}, {"ruleId": "scanner-f8c0801f98c9d930", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "be2bcd27891404fc", "scanner": "scanner-primary", "fingerprint": "f8c0801f98c9d930", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/nightly.yml"}, "region": {"startLine": 43}}}]}, {"ruleId": "scanner-f8c0801f98c9d930", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "c73a6ee95aa6a0d7", "scanner": "scanner-primary", "fingerprint": "f8c0801f98c9d930", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/nightly.yml"}, "region": {"startLine": 60}}}]}, {"ruleId": "scanner-f8c0801f98c9d930", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "cb14b43dcd4f321c", "scanner": "scanner-primary", "fingerprint": "f8c0801f98c9d930", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/nightly.yml"}, "region": {"startLine": 85}}}]}, {"ruleId": "scanner-f8c0801f98c9d930", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "c73a6ee95aa6a0d7", "scanner": "scanner-primary", "fingerprint": "f8c0801f98c9d930", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/nightly.yml"}, "region": {"startLine": 90}}}]}, {"ruleId": "scanner-f8c0801f98c9d930", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "be2bcd27891404fc", "scanner": "scanner-primary", "fingerprint": "f8c0801f98c9d930", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/nightly.yml"}, "region": {"startLine": 111}}}]}, {"ruleId": "scanner-f8c0801f98c9d930", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "cb14b43dcd4f321c", "scanner": "scanner-primary", "fingerprint": "f8c0801f98c9d930", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/nightly.yml"}, "region": {"startLine": 159}}}]}, {"ruleId": "scanner-f8c0801f98c9d930", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "c73a6ee95aa6a0d7", "scanner": "scanner-primary", "fingerprint": "f8c0801f98c9d930", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/nightly.yml"}, "region": {"startLine": 164}}}]}, {"ruleId": "scanner-f8c0801f98c9d930", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "4435823a872a523e", "scanner": "scanner-primary", "fingerprint": "f8c0801f98c9d930", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/nightly.yml"}, "region": {"startLine": 169}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "eeb76410cc935c30", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 21}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "eeb76410cc935c30", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 94}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "9e54fac6c290138e", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 112}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "eeb76410cc935c30", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 130}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "2644034c718fb80d", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 156}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "eeb76410cc935c30", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 161}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "9e54fac6c290138e", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 183}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "2644034c718fb80d", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 232}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "eeb76410cc935c30", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 237}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "cedbda24771e393e", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 242}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "f0dc584a111ffc00", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 265}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "2644034c718fb80d", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 310}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "eeb76410cc935c30", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 315}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "9e54fac6c290138e", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 324}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "8ea30dae63815a3c", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 330}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "5ab0c5bd71e63ad8", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 343}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "2644034c718fb80d", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 355}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "5ab0c5bd71e63ad8", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 379}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "2644034c718fb80d", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 396}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "b28f2eb9ce3eea56", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 408}}}]}, {"ruleId": "scanner-1838a141491ce38c", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "b8fd4f5048f96576", "scanner": "scanner-primary", "fingerprint": "1838a141491ce38c", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-be98a2e2a5bd9384", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "46d7d6e97c66d5e4", "scanner": "scanner-primary", "fingerprint": "be98a2e2a5bd9384", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/docs-dispatch.yml"}, "region": {"startLine": 24}}}]}, {"ruleId": "scanner-567e8b5bc43d5c2d", "level": "note", "message": {"text": "Very large file: packages/bench/opentui-bench/run.ts (1958 lines)"}, "properties": {"repobilityId": "6c515faee4c52085", "scanner": "scanner-primary", "fingerprint": "567e8b5bc43d5c2d", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-5cb2dd1adaa71c7a", "level": "note", "message": {"text": "Very large file: packages/core/src/app/widgetRenderer.ts (3808 lines)"}, "properties": {"repobilityId": "539ceef41fba3f60", "scanner": "scanner-primary", "fingerprint": "5cb2dd1adaa71c7a", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-8b401b49ad14bc6f", "level": "note", "message": {"text": "Very large file: packages/core/src/app/__tests__/widgetRenderer.integration.test.ts (2957 lines)"}, "properties": {"repobilityId": "d13e48ec07e76349", "scanner": "scanner-primary", "fingerprint": "8b401b49ad14bc6f", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-40d8fa18775673ee", "level": "note", "message": {"text": "Very large file: packages/core/src/app/widgetRenderer/mouseRouting.ts (1875 lines)"}, "properties": {"repobilityId": "4685e21a175e73a6", "scanner": "scanner-primary", "fingerprint": "40d8fa18775673ee", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-b72076a8404cc122", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: packages/node/package.json"}, "properties": {"repobilityId": "35e1754552c6d493", "scanner": "scanner-primary", "fingerprint": "b72076a8404cc122", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/node/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-259a4842ff974b88", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: packages/jsx/package.json"}, "properties": {"repobilityId": "405450dec0a0a3cd", "scanner": "scanner-primary", "fingerprint": "259a4842ff974b88", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/jsx/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ce71fe63000afe35", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: packages/bench/package.json"}, "properties": {"repobilityId": "d71f611876671172", "scanner": "scanner-primary", "fingerprint": "ce71fe63000afe35", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/bench/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-bd150f820012e9f0", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: packages/create-rezi/package.json"}, "properties": {"repobilityId": "ec2aaf5e98dd7569", "scanner": "scanner-primary", "fingerprint": "bd150f820012e9f0", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/create-rezi/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-985e26e32ec2041b", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: packages/create-rezi/templates/starship/package.json"}, "properties": {"repobilityId": "07b9e86c9b715189", "scanner": "scanner-primary", "fingerprint": "985e26e32ec2041b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/create-rezi/templates/starship/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a5644bde09aee923", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: packages/create-rezi/templates/minimal/package.json"}, "properties": {"repobilityId": "b1b0776911dde797", "scanner": "scanner-primary", "fingerprint": "a5644bde09aee923", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/create-rezi/templates/minimal/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-76a93657d0f0eb66", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: packages/create-rezi/templates/cli-tool/package.json"}, "properties": {"repobilityId": "c976f55e6ca6749b", "scanner": "scanner-primary", "fingerprint": "76a93657d0f0eb66", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/create-rezi/templates/cli-tool/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-28e92806c0db3cd2", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: packages/core/package.json"}, "properties": {"repobilityId": "8640e46be7e3f9b2", "scanner": "scanner-primary", "fingerprint": "28e92806c0db3cd2", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/core/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d11871697a9b887a", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: packages/native/package.json"}, "properties": {"repobilityId": "0e96364285da5635", "scanner": "scanner-primary", "fingerprint": "d11871697a9b887a", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/native/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-fe6c68fbc620f7a5", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: examples/regression-dashboard/package.json"}, "properties": {"repobilityId": "8778b089ab07210b", "scanner": "scanner-primary", "fingerprint": "fe6c68fbc620f7a5", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "examples/regression-dashboard/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ac8f57cdbff5a536", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: examples/inline-status/package.json"}, "properties": {"repobilityId": "5f0725e02f137dbf", "scanner": "scanner-primary", "fingerprint": "ac8f57cdbff5a536", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "examples/inline-status/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d8dab20cb2d8eab1", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: examples/gallery/package.json"}, "properties": {"repobilityId": "90e1bbaaf1b6e27e", "scanner": "scanner-primary", "fingerprint": "d8dab20cb2d8eab1", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "examples/gallery/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ea45b7e9b96ed8d1", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: examples/hello-counter/package.json"}, "properties": {"repobilityId": "b7127f66f15bf4d6", "scanner": "scanner-primary", "fingerprint": "ea45b7e9b96ed8d1", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "examples/hello-counter/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f4f8dae4118b3b12", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: examples/raw-draw-demo/package.json"}, "properties": {"repobilityId": "b0d3a68497d3b474", "scanner": "scanner-primary", "fingerprint": "f4f8dae4118b3b12", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "examples/raw-draw-demo/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "5b43c508f9e240f6", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-72b2a6250083a784", "level": "warning", "message": {"text": "Placeholder or mock-heavy implementation detected"}, "properties": {"repobilityId": "ce33edfde76322b6", "scanner": "scanner-primary", "fingerprint": "72b2a6250083a784", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "incomplete", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "d9b35817a2d2b37b", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-749d4bc1bd66df5f", "level": "warning", "message": {"text": "Agent instructions exist but release-hardening basics are missing"}, "properties": {"repobilityId": "d3c7125e37bc440a", "scanner": "scanner-primary", "fingerprint": "749d4bc1bd66df5f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "f814d04b6d4f1b6e", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "01b62e868aebbc69", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-5604c90add31e9d5", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: docs/protocol/cursor.md"}, "properties": {"repobilityId": "66961201a78e7816", "scanner": "scanner-primary", "fingerprint": "5604c90add31e9d5", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "agent_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docs/protocol/cursor.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e725d2ab884fbd49", "level": "note", "message": {"text": "Multiple root agent instruction files without precedence"}, "properties": {"repobilityId": "1953db6c89508d22", "scanner": "scanner-primary", "fingerprint": "e725d2ab884fbd49", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["agent-instructions", "governance"]}}, {"ruleId": "scanner-f5f3886097494672", "level": "none", "message": {"text": "Commented-code block (5 lines) in scripts/run-e2e.mjs:6"}, "properties": {"repobilityId": "40fb29737304d99d", "scanner": "scanner-primary", "fingerprint": "f5f3886097494672", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-19856d287d144f6d", "level": "note", "message": {"text": "Legacy-named symbol `zrev_v1` in packages/core/src/index.ts:103"}, "properties": {"repobilityId": "68b6a452e11eaefe", "scanner": "scanner-primary", "fingerprint": "19856d287d144f6d", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-ab64ab91026fa2d4", "level": "note", "message": {"text": "Legacy-named symbol `maxOld` in packages/core/src/renderer/renderToDrawlist/widgets/editors.ts:445"}, "properties": {"repobilityId": "b0c483886580fe33", "scanner": "scanner-primary", "fingerprint": "ab64ab91026fa2d4", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-98bdbb2ee2f2566e", "level": "note", "message": {"text": "Legacy-named symbol `zrev_v1` in packages/core/src/testing/events.ts:199"}, "properties": {"repobilityId": "3d5829a05141e676", "scanner": "scanner-primary", "fingerprint": "98bdbb2ee2f2566e", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-b56cbc70a2b9c75b", "level": "note", "message": {"text": "Legacy-named symbol `zrev_v1` in packages/core/src/testing/__tests__/eventBuilder.test.ts:2"}, "properties": {"repobilityId": "1af47ae4b2dc061d", "scanner": "scanner-primary", "fingerprint": "b56cbc70a2b9c75b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-07acc0d248a7fcce", "level": "none", "message": {"text": "Commented-code block (6 lines) in packages/core/src/widgets/__tests__/virtualList.golden.test.ts:139"}, "properties": {"repobilityId": "60210499493facdf", "scanner": "scanner-primary", "fingerprint": "07acc0d248a7fcce", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-e806ffa9417bcaa7", "level": "note", "message": {"text": "Legacy-named symbol `maxOld` in packages/core/src/app/widgetRenderer/renderCaches.ts:223"}, "properties": {"repobilityId": "bf68ed5237fba866", "scanner": "scanner-primary", "fingerprint": "e806ffa9417bcaa7", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-8b72b0474ae8e7d3", "level": "none", "message": {"text": "Commented-code block (9 lines) in packages/core/src/app/widgetRenderer/submitFramePipeline.ts:246"}, "properties": {"repobilityId": "b3fab05e8326a2ea", "scanner": "scanner-primary", "fingerprint": "8b72b0474ae8e7d3", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-b0525f5e3c7b03c8", "level": "note", "message": {"text": "Legacy-named symbol `zrev_v1` in packages/core/src/app/createApp/eventLoop.ts:10"}, "properties": {"repobilityId": "cd3a29b318d29756", "scanner": "scanner-primary", "fingerprint": "b0525f5e3c7b03c8", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-91975aefa5292af2", "level": "note", "message": {"text": "Legacy-named symbol `computeDropdownGeometryLegacy` in packages/core/src/runtime/__tests__/overlayUnification.test.ts:78"}, "properties": {"repobilityId": "c704d742729bbe5d", "scanner": "scanner-primary", "fingerprint": "91975aefa5292af2", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-17b833b4aa5aba73", "level": "note", "message": {"text": "Legacy-named symbol `zrev_v1` in packages/core/src/protocol/zrev_v1.ts:2"}, "properties": {"repobilityId": "98ae381cc97c3619", "scanner": "scanner-primary", "fingerprint": "17b833b4aa5aba73", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-0cccbf9777758080", "level": "note", "message": {"text": "Legacy-named symbol `zrev_v1` in packages/core/src/protocol/__tests__/zrev_v1_invalid.test.ts:3"}, "properties": {"repobilityId": "a3f2007be151e57d", "scanner": "scanner-primary", "fingerprint": "0cccbf9777758080", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-f9ee0915c8635e10", "level": "note", "message": {"text": "Legacy-named symbol `zrev_v1` in packages/core/src/protocol/__tests__/zrev_v1_fuzz_lite.test.ts:2"}, "properties": {"repobilityId": "c62e73dd38468966", "scanner": "scanner-primary", "fingerprint": "f9ee0915c8635e10", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-f2a1138d5b344972", "level": "note", "message": {"text": "Legacy-named symbol `zrev_v1` in packages/core/src/protocol/__tests__/zrev_v1_valid.test.ts:2"}, "properties": {"repobilityId": "3a746724c114f2a4", "scanner": "scanner-primary", "fingerprint": "f2a1138d5b344972", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-c43c9da1c72fbb90", "level": "note", "message": {"text": "Legacy-named symbol `zrev_v1` in packages/core/src/repro/replay.ts:25"}, "properties": {"repobilityId": "d9277895605b0fa1", "scanner": "scanner-primary", "fingerprint": "c43c9da1c72fbb90", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}]}]}