{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-6a9728c1184ca458", "name": "Stray `console.log` in TS/JS \u2014 frontend/app-mobile/scripts/preview-faltantes-pdf.ts:31", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 frontend/app-mobile/scripts/preview-faltantes-pdf.ts:31"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a962476472fc988d", "name": "Stray `console.log` in TS/JS \u2014 frontend/app-mobile/src/features/geo/hooks/useCurrentPosition.ts:48", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 frontend/app-mobile/src/features/geo/hooks/useCurrentPosition.ts:48"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fe92bb525d8e08c6", "name": "`truncate` class without `title=` for hover reveal \u2014 frontend/web-admin/src/app/(admin)/albums/[code]/BulkImportDialog.t", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 frontend/web-admin/src/app/(admin)/albums/[code]/BulkImportDialog.tsx:124"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-5beeb328dfcc5204", "name": "`truncate` class without `title=` for hover reveal \u2014 frontend/web-admin/src/app/(admin)/albums/[code]/SectionTreePane.ts", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 frontend/web-admin/src/app/(admin)/albums/[code]/SectionTreePane.tsx:324"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-9775f88d93ad76a2", "name": "`truncate` class without `title=` for hover reveal \u2014 frontend/web-admin/src/components/shell/AccountMenu.tsx:26", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 frontend/web-admin/src/components/shell/AccountMenu.tsx:26"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-46d9fcfb05ee264e", "name": "`truncate` class without `title=` for hover reveal \u2014 frontend/web-admin/src/components/stamps/LegendCard.tsx:21", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 frontend/web-admin/src/components/stamps/LegendCard.tsx:21"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-7fd6c10db1032e40", "name": "Dockerfile runs as root: frontend/web-admin/Dockerfile", "shortDescription": {"text": "Dockerfile runs as root: frontend/web-admin/Dockerfile"}, "fullDescription": {"text": "No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-990da717d77e0a23", "name": "Docker base image is tag-pinned but not digest-pinned: node:${NODE_VERSION}-alpine", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: node:${NODE_VERSION}-alpine"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-983e2c830876b04c", "name": "Possible secret in backend/ms-identity/src/test/java/br/com/figurapp/identity/application/LoginConsentIT.java", "shortDescription": {"text": "Possible secret in backend/ms-identity/src/test/java/br/com/figurapp/identity/application/LoginConsentIT.java"}, "fullDescription": {"text": "Detected pattern matching password_literal. Rotate the credential and move to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-faf787a780cf7da5", "name": "Possible secret in backend/ms-identity/src/test/java/br/com/figurapp/identity/presentation/UsersBlockReportIT.java", "shortDescription": {"text": "Possible secret in backend/ms-identity/src/test/java/br/com/figurapp/identity/presentation/UsersBlockReportIT.java"}, "fullDescription": {"text": "Detected pattern matching password_literal. Rotate the credential and move to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-421f4d99879751c0", "name": "Possible secret in backend/ms-geo/src/test/java/br/com/figurapp/geo/presentation/LocationControllerIT.java", "shortDescription": {"text": "Possible secret in backend/ms-geo/src/test/java/br/com/figurapp/geo/presentation/LocationControllerIT.java"}, "fullDescription": {"text": "Detected pattern matching password_literal. Rotate the credential and move to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-1a5bb3177180bd28", "name": "Possible secret in backend/ms-geo/src/test/java/br/com/figurapp/geo/presentation/AvailabilityCapIT.java", "shortDescription": {"text": "Possible secret in backend/ms-geo/src/test/java/br/com/figurapp/geo/presentation/AvailabilityCapIT.java"}, "fullDescription": {"text": "Detected pattern matching password_literal. Rotate the credential and move to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-7251899dde466a7e", "name": "Possible secret in backend/ms-geo/src/test/java/br/com/figurapp/geo/presentation/AvailabilityControllerIT.java", "shortDescription": {"text": "Possible secret in backend/ms-geo/src/test/java/br/com/figurapp/geo/presentation/AvailabilityControllerIT.java"}, "fullDescription": {"text": "Detected pattern matching password_literal. Rotate the credential and move to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-45b0bdd8950913b9", "name": "Possible secret in backend/ms-collection/src/test/java/br/com/figurapp/collection/presentation/FollowCapIT.java", "shortDescription": {"text": "Possible secret in backend/ms-collection/src/test/java/br/com/figurapp/collection/presentation/FollowCapIT.java"}, "fullDescription": {"text": "Detected pattern matching password_literal. Rotate the credential and move to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-d13ce3040fd5d033", "name": "Possible secret in backend/ms-collection/src/test/java/br/com/figurapp/collection/presentation/CollectionSyncIT.java", "shortDescription": {"text": "Possible secret in backend/ms-collection/src/test/java/br/com/figurapp/collection/presentation/CollectionSyncIT.java"}, "fullDescription": {"text": "Detected pattern matching password_literal. Rotate the credential and move to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-0ee59679a3e635f5", "name": "Possible secret in backend/ms-matching/src/test/java/br/com/figurapp/matching/presentation/MatchCapIT.java", "shortDescription": {"text": "Possible secret in backend/ms-matching/src/test/java/br/com/figurapp/matching/presentation/MatchCapIT.java"}, "fullDescription": {"text": "Detected pattern matching password_literal. Rotate the credential and move to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-2aee72e3adf52c24", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "appleboy/ssh-action@v1.0.3 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2c5b65ae15f97988", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/upload-artifact@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-28c4a04bd807da0c", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "docker/build-push-action@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ad6701f0a8405e22", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9a356a187a67dd2f", "name": "Node manifest has dependencies but no lockfile: frontend/app-mobile/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: frontend/app-mobile/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5b5471722add594e", "name": "Node manifest has dependencies but no lockfile: frontend/web-admin/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: frontend/web-admin/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 5 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-72b2a6250083a784", "name": "Placeholder or mock-heavy implementation detected", "shortDescription": {"text": "Placeholder or mock-heavy implementation detected"}, "fullDescription": {"text": "Found 34 placeholder/mock markers across 26 source files. This often means the repo looks complete while core flows still use generated scaffolding or fake data."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-749d4bc1bd66df5f", "name": "Agent instructions exist but release-hardening basics are missing", "shortDescription": {"text": "Agent instructions exist but release-hardening basics are missing"}, "fullDescription": {"text": "AI-coder instruction files were found, but the repo is missing lockfile. Treat this as a contract gap: the agent is guided, but the generated output is not yet guarded by the controls that make it repeatable."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-927010054e5a4bbf", "name": "Agent authority lacks a verifier contract: .claude/commands/figurapp-start.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/commands/figurapp-start.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7aaa6cc5669b9905", "name": "Commented-code block (7 lines) in frontend/app-mobile/metro.config.js:6", "shortDescription": {"text": "Commented-code block (7 lines) in frontend/app-mobile/metro.config.js:6"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-9e679c9437950ca3", "name": "Commented-code block (14 lines) in frontend/app-mobile/scripts/build-faltantes-pdf-assets.mjs:1", "shortDescription": {"text": "Commented-code block (14 lines) in frontend/app-mobile/scripts/build-faltantes-pdf-assets.mjs:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-2a92276bb44d1802", "name": "`fetch()` without try/.catch or AbortSignal \u2014 frontend/app-mobile/src/features/matches/api/userDirectoryClient.ts:8", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 frontend/app-mobile/src/features/matches/api/userDirectoryClient.ts:8"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c8570a6882acdda4", "name": "`fetch()` without try/.catch or AbortSignal \u2014 frontend/app-mobile/src/features/matches/api/matchClient.ts:18", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 frontend/app-mobile/src/features/matches/api/matchClient.ts:18"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0e2ca81c394111a2", "name": "Commented-code block (6 lines) in frontend/app-mobile/src/features/matches/api/schemas.ts:32", "shortDescription": {"text": "Commented-code block (6 lines) in frontend/app-mobile/src/features/matches/api/schemas.ts:32"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-82a04389ac4b0837", "name": "`fetch()` without try/.catch or AbortSignal \u2014 frontend/app-mobile/src/features/profile/api/privacyClient.ts:10", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 frontend/app-mobile/src/features/profile/api/privacyClient.ts:10"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f4dc94ea1261b94a", "name": "`fetch()` without try/.catch or AbortSignal \u2014 frontend/app-mobile/src/features/chat/api/chatClient.ts:19", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 frontend/app-mobile/src/features/chat/api/chatClient.ts:19"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8412a2c1942dbe8c", "name": "`fetch()` without try/.catch or AbortSignal \u2014 frontend/app-mobile/src/features/geo/api/geoClient.ts:17", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 frontend/app-mobile/src/features/geo/api/geoClient.ts:17"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f6ffdcf31758d0ad", "name": "Commented-code block (7 lines) in frontend/app-mobile/src/features/geo/screens/AvailabilityScreen.tsx:55", "shortDescription": {"text": "Commented-code block (7 lines) in frontend/app-mobile/src/features/geo/screens/AvailabilityScreen.tsx:55"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-961b1f79e2aea0e7", "name": "`fetch()` without try/.catch or AbortSignal \u2014 frontend/app-mobile/src/features/collection/api/collectionClient.ts:10", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 frontend/app-mobile/src/features/collection/api/collectionClient.ts:10"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-26fdf691658ca5f5", "name": "`fetch()` without try/.catch or AbortSignal \u2014 frontend/app-mobile/src/features/collection/api/catalogClient.ts:10", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 frontend/app-mobile/src/features/collection/api/catalogClient.ts:10"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7f48037230309697", "name": "`fetch()` without try/.catch or AbortSignal \u2014 frontend/app-mobile/src/features/collection/sync/useSyncTriggers.ts:38", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 frontend/app-mobile/src/features/collection/sync/useSyncTriggers.ts:38"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1bab38c9872f624e", "name": "`fetch()` without try/.catch or AbortSignal \u2014 frontend/app-mobile/src/features/auth/api/endpoints.ts:32", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 frontend/app-mobile/src/features/auth/api/endpoints.ts:32"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-28d14245a9736514", "name": "`fetch()` without try/.catch or AbortSignal \u2014 frontend/app-mobile/src/features/auth/api/client.ts:40", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 frontend/app-mobile/src/features/auth/api/client.ts:40"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-fff7355c8f82b1f7", "name": "`fetch()` without try/.catch or AbortSignal \u2014 frontend/app-mobile/src/features/auth/api/client.test.ts:53", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 frontend/app-mobile/src/features/auth/api/client.test.ts:53"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c19f566f367145ca", "name": "Commented-code block (5 lines) in frontend/app-mobile/src/features/auth/components/__tests__/profileSyncBootstrap.test.t", "shortDescription": {"text": "Commented-code block (5 lines) in frontend/app-mobile/src/features/auth/components/__tests__/profileSyncBootstrap.test.tsx:82"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-39a7a2ad7b18bf88", "name": "`fetch()` without try/.catch or AbortSignal \u2014 frontend/app-mobile/src/features/safety/api/safetyClient.ts:13", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 frontend/app-mobile/src/features/safety/api/safetyClient.ts:13"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-5e053ec2ff77b22d", "name": "`fetch()` without try/.catch or AbortSignal \u2014 frontend/app-mobile/src/features/trade/api/tradeClient.ts:20", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 frontend/app-mobile/src/features/trade/api/tradeClient.ts:20"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2578437b5c6df5ac", "name": "Commented-code block (5 lines) in frontend/app-mobile/src/features/trade/screens/TradeDetailScreen.tsx:56", "shortDescription": {"text": "Commented-code block (5 lines) in frontend/app-mobile/src/features/trade/screens/TradeDetailScreen.tsx:56"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-b1591d2a15f9e3d1", "name": "`fetch()` without try/.catch or AbortSignal \u2014 frontend/app-mobile/src/features/notifications/api/notificationsClient.ts:", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 frontend/app-mobile/src/features/notifications/api/notificationsClient.ts:21"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b3a91d81998398ee", "name": "`fetch()` without try/.catch or AbortSignal \u2014 frontend/app-mobile/src/features/stats/api/statsClient.ts:6", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 frontend/app-mobile/src/features/stats/api/statsClient.ts:6"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-5bc46bfbeff81bc6", "name": "Commented-code block (5 lines) in frontend/app-mobile/src/__tests__/appConfig.test.ts:2", "shortDescription": {"text": "Commented-code block (5 lines) in frontend/app-mobile/src/__tests__/appConfig.test.ts:2"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-2912bf625c855303", "name": "Commented-code block (5 lines) in frontend/web-admin/tests/unit/components/section-tree-search.test.tsx:34", "shortDescription": {"text": "Commented-code block (5 lines) in frontend/web-admin/tests/unit/components/section-tree-search.test.tsx:34"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-d537ce485f39a116", "name": "Commented-code block (6 lines) in frontend/web-admin/tests/unit/components/new-album-dialog.test.tsx:15", "shortDescription": {"text": "Commented-code block (6 lines) in frontend/web-admin/tests/unit/components/new-album-dialog.test.tsx:15"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-183845cbc34be5bc", "name": "Commented-code block (7 lines) in frontend/web-admin/tests/integration/admin-contract.smoke.mjs:6", "shortDescription": {"text": "Commented-code block (7 lines) in frontend/web-admin/tests/integration/admin-contract.smoke.mjs:6"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-bb4306465117cb6c", "name": "`fetch()` without try/.catch or AbortSignal \u2014 frontend/web-admin/src/app/api/admin/[...path]/route.ts:45", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 frontend/web-admin/src/app/api/admin/[...path]/route.ts:45"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-fb73cbbe343f89d5", "name": "Commented-code block (6 lines) in frontend/web-admin/src/app/api/auth/[...nextauth]/route.ts:4", "shortDescription": {"text": "Commented-code block (6 lines) in frontend/web-admin/src/app/api/auth/[...nextauth]/route.ts:4"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-7a3624e39a99f8b2", "name": "`fetch()` without try/.catch or AbortSignal \u2014 frontend/web-admin/src/auth/auth.ts:8", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 frontend/web-admin/src/auth/auth.ts:8"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2c76647ad1019d23", "name": "`fetch()` without try/.catch or AbortSignal \u2014 frontend/web-admin/src/auth/auth-testables.ts:7", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 frontend/web-admin/src/auth/auth-testables.ts:7"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9933e1428ab6fb8a", "name": "Commented-code block (5 lines) in frontend/web-admin/src/lib/base-path.ts:1", "shortDescription": {"text": "Commented-code block (5 lines) in frontend/web-admin/src/lib/base-path.ts:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-55223442b27548f6", "name": "`fetch()` without try/.catch or AbortSignal \u2014 frontend/web-admin/src/lib/base-path.ts:3", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 frontend/web-admin/src/lib/base-path.ts:3"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-369f8a478ad865e3", "name": "`fetch()` without try/.catch or AbortSignal \u2014 frontend/web-admin/src/lib/api/server-fetch.ts:17", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 frontend/web-admin/src/lib/api/server-fetch.ts:17"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3f2f3d0bcb958d41", "name": "`fetch()` without try/.catch or AbortSignal \u2014 frontend/web-admin/src/lib/api/client.ts:9", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 frontend/web-admin/src/lib/api/client.ts:9"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-af022f937dd5b7fd", "name": "9 env vars used in code but missing from .env.example", "shortDescription": {"text": "9 env vars used in code but missing from .env.example"}, "fullDescription": {"text": "Drift between code and config docs. The first few: `EXPO_PUBLIC_ALBUMS_BASE_URL`, `EXPO_PUBLIC_CHAT_BASE_URL`, `EXPO_PUBLIC_CHAT_WS_BASE_URL`, `EXPO_PUBLIC_COLLECTION_BASE_URL`, `EXPO_PUBLIC_GEO_BASE_URL`, `EXPO_PUBLIC_IDENTITY_BASE_URL`, `EXPO_PUBLIC_MAPBOX_TOKEN`, `EXPO_PUBLIC_MATCHING_BASE_URL` + 1 more. Add them (with a placeholder/comment) to .env.example so onboarding doesn't break."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/24180"}, "properties": {"repository": "andresfleao-11/figurapp", "repoUrl": "https://github.com/andresfleao-11/figurapp", "branch": "main"}, "results": [{"ruleId": "scanner-6a9728c1184ca458", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 frontend/app-mobile/scripts/preview-faltantes-pdf.ts:31"}, "properties": {"repobilityId": "3d89d303786699ef", "scanner": "scanner-primary", "fingerprint": "6a9728c1184ca458", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-a962476472fc988d", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 frontend/app-mobile/src/features/geo/hooks/useCurrentPosition.ts:48"}, "properties": {"repobilityId": "902a358051bf01ec", "scanner": "scanner-primary", "fingerprint": "a962476472fc988d", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-fe92bb525d8e08c6", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 frontend/web-admin/src/app/(admin)/albums/[code]/BulkImportDialog.tsx:124"}, "properties": {"repobilityId": "fe360084af62bf06", "scanner": "scanner-primary", "fingerprint": "fe92bb525d8e08c6", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-5beeb328dfcc5204", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 frontend/web-admin/src/app/(admin)/albums/[code]/SectionTreePane.tsx:324"}, "properties": {"repobilityId": "6133e5c9dae8b5cd", "scanner": "scanner-primary", "fingerprint": "5beeb328dfcc5204", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-9775f88d93ad76a2", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 frontend/web-admin/src/components/shell/AccountMenu.tsx:26"}, "properties": {"repobilityId": "ac9e1c677314269d", "scanner": "scanner-primary", "fingerprint": "9775f88d93ad76a2", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-46d9fcfb05ee264e", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 frontend/web-admin/src/components/stamps/LegendCard.tsx:21"}, "properties": {"repobilityId": "50af62af6afbe950", "scanner": "scanner-primary", "fingerprint": "46d9fcfb05ee264e", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-7fd6c10db1032e40", "level": "warning", "message": {"text": "Dockerfile runs as root: frontend/web-admin/Dockerfile"}, "properties": {"repobilityId": "29f2b7c03b06caae", "scanner": "scanner-primary", "fingerprint": "7fd6c10db1032e40", "layer": "hardware", "severity": "medium", "confidence": 1.0, "tags": ["security", "container"]}}, {"ruleId": "scanner-990da717d77e0a23", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: node:${NODE_VERSION}-alpine"}, "properties": {"repobilityId": "0a970fa1018274be", "scanner": "scanner-primary", "fingerprint": "990da717d77e0a23", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/web-admin/Dockerfile"}, "region": {"startLine": 5}}}]}, {"ruleId": "scanner-990da717d77e0a23", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: node:${NODE_VERSION}-alpine"}, "properties": {"repobilityId": "2288ab434d52216e", "scanner": "scanner-primary", "fingerprint": "990da717d77e0a23", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/web-admin/Dockerfile"}, "region": {"startLine": 18}}}]}, {"ruleId": "scanner-983e2c830876b04c", "level": "error", "message": {"text": "Possible secret in backend/ms-identity/src/test/java/br/com/figurapp/identity/application/LoginConsentIT.java"}, "properties": {"repobilityId": "2e9d434be0805330", "scanner": "scanner-primary", "fingerprint": "983e2c830876b04c", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/ms-identity/src/test/java/br/com/figurapp/identity/application/LoginConsentIT.java"}, "region": {"startLine": 55}}}]}, {"ruleId": "scanner-faf787a780cf7da5", "level": "error", "message": {"text": "Possible secret in backend/ms-identity/src/test/java/br/com/figurapp/identity/presentation/UsersBlockReportIT.java"}, "properties": {"repobilityId": "01436c713761dea7", "scanner": "scanner-primary", "fingerprint": "faf787a780cf7da5", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/ms-identity/src/test/java/br/com/figurapp/identity/presentation/UsersBlockReportIT.java"}, "region": {"startLine": 278}}}]}, {"ruleId": "scanner-421f4d99879751c0", "level": "error", "message": {"text": "Possible secret in backend/ms-geo/src/test/java/br/com/figurapp/geo/presentation/LocationControllerIT.java"}, "properties": {"repobilityId": "31ab7d984a7ee749", "scanner": "scanner-primary", "fingerprint": "421f4d99879751c0", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/ms-geo/src/test/java/br/com/figurapp/geo/presentation/LocationControllerIT.java"}, "region": {"startLine": 54}}}]}, {"ruleId": "scanner-1a5bb3177180bd28", "level": "error", "message": {"text": "Possible secret in backend/ms-geo/src/test/java/br/com/figurapp/geo/presentation/AvailabilityCapIT.java"}, "properties": {"repobilityId": "83089b4f3729f31e", "scanner": "scanner-primary", "fingerprint": "1a5bb3177180bd28", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/ms-geo/src/test/java/br/com/figurapp/geo/presentation/AvailabilityCapIT.java"}, "region": {"startLine": 57}}}]}, {"ruleId": "scanner-7251899dde466a7e", "level": "error", "message": {"text": "Possible secret in backend/ms-geo/src/test/java/br/com/figurapp/geo/presentation/AvailabilityControllerIT.java"}, "properties": {"repobilityId": "82cd5c1e4b4fab96", "scanner": "scanner-primary", "fingerprint": "7251899dde466a7e", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/ms-geo/src/test/java/br/com/figurapp/geo/presentation/AvailabilityControllerIT.java"}, "region": {"startLine": 46}}}]}, {"ruleId": "scanner-45b0bdd8950913b9", "level": "error", "message": {"text": "Possible secret in backend/ms-collection/src/test/java/br/com/figurapp/collection/presentation/FollowCapIT.java"}, "properties": {"repobilityId": "ece4d8c5dfcd9f75", "scanner": "scanner-primary", "fingerprint": "45b0bdd8950913b9", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/ms-collection/src/test/java/br/com/figurapp/collection/presentation/FollowCapIT.java"}, "region": {"startLine": 66}}}]}, {"ruleId": "scanner-d13ce3040fd5d033", "level": "error", "message": {"text": "Possible secret in backend/ms-collection/src/test/java/br/com/figurapp/collection/presentation/CollectionSyncIT.java"}, "properties": {"repobilityId": "5cfedeb3845bc25f", "scanner": "scanner-primary", "fingerprint": "d13ce3040fd5d033", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/ms-collection/src/test/java/br/com/figurapp/collection/presentation/CollectionSyncIT.java"}, "region": {"startLine": 83}}}]}, {"ruleId": "scanner-0ee59679a3e635f5", "level": "error", "message": {"text": "Possible secret in backend/ms-matching/src/test/java/br/com/figurapp/matching/presentation/MatchCapIT.java"}, "properties": {"repobilityId": "02ca43255627d913", "scanner": "scanner-primary", "fingerprint": "0ee59679a3e635f5", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/ms-matching/src/test/java/br/com/figurapp/matching/presentation/MatchCapIT.java"}, "region": {"startLine": 76}}}]}, {"ruleId": "scanner-2aee72e3adf52c24", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "ce71c6c9acd63b33", "scanner": "scanner-primary", "fingerprint": "2aee72e3adf52c24", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/seed-prod-album.yml"}, "region": {"startLine": 48}}}]}, {"ruleId": "scanner-2c5b65ae15f97988", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "492f59e2c22d47c3", "scanner": "scanner-primary", "fingerprint": "2c5b65ae15f97988", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/web-admin.yml"}, "region": {"startLine": 133}}}]}, {"ruleId": "scanner-2c5b65ae15f97988", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "492f59e2c22d47c3", "scanner": "scanner-primary", "fingerprint": "2c5b65ae15f97988", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/web-admin.yml"}, "region": {"startLine": 138}}}]}, {"ruleId": "scanner-28c4a04bd807da0c", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "b5ff68ae3a5989fc", "scanner": "scanner-primary", "fingerprint": "28c4a04bd807da0c", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/deploy.yml"}, "region": {"startLine": 76}}}]}, {"ruleId": "scanner-28c4a04bd807da0c", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "0bc463708914950e", "scanner": "scanner-primary", "fingerprint": "28c4a04bd807da0c", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/deploy.yml"}, "region": {"startLine": 96}}}]}, {"ruleId": "scanner-ad6701f0a8405e22", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "8384c23520d55657", "scanner": "scanner-primary", "fingerprint": "ad6701f0a8405e22", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/deploy.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-9a356a187a67dd2f", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: frontend/app-mobile/package.json"}, "properties": {"repobilityId": "71b63c1899f951d7", "scanner": "scanner-primary", "fingerprint": "9a356a187a67dd2f", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/app-mobile/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-5b5471722add594e", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: frontend/web-admin/package.json"}, "properties": {"repobilityId": "f8fe6a495425c650", "scanner": "scanner-primary", "fingerprint": "5b5471722add594e", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/web-admin/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "53deedb1a4e546da", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-72b2a6250083a784", "level": "warning", "message": {"text": "Placeholder or mock-heavy implementation detected"}, "properties": {"repobilityId": "2f94045bfb539613", "scanner": "scanner-primary", "fingerprint": "72b2a6250083a784", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "incomplete", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "64a8310036a72252", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-749d4bc1bd66df5f", "level": "warning", "message": {"text": "Agent instructions exist but release-hardening basics are missing"}, "properties": {"repobilityId": "7ee96d9c6efb7754", "scanner": "scanner-primary", "fingerprint": "749d4bc1bd66df5f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-927010054e5a4bbf", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/commands/figurapp-start.md"}, "properties": {"repobilityId": "9d718aff7d23c8d9", "scanner": "scanner-primary", "fingerprint": "927010054e5a4bbf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/commands/figurapp-start.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-7aaa6cc5669b9905", "level": "none", "message": {"text": "Commented-code block (7 lines) in frontend/app-mobile/metro.config.js:6"}, "properties": {"repobilityId": "644552af9653aa5a", "scanner": "scanner-primary", "fingerprint": "7aaa6cc5669b9905", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-9e679c9437950ca3", "level": "none", "message": {"text": "Commented-code block (14 lines) in frontend/app-mobile/scripts/build-faltantes-pdf-assets.mjs:1"}, "properties": {"repobilityId": "223464388bd9ab1b", "scanner": "scanner-primary", "fingerprint": "9e679c9437950ca3", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-2a92276bb44d1802", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 frontend/app-mobile/src/features/matches/api/userDirectoryClient.ts:8"}, "properties": {"repobilityId": "53ed00d0ce68938d", "scanner": "scanner-primary", "fingerprint": "2a92276bb44d1802", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-c8570a6882acdda4", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 frontend/app-mobile/src/features/matches/api/matchClient.ts:18"}, "properties": {"repobilityId": "a909084af601c545", "scanner": "scanner-primary", "fingerprint": "c8570a6882acdda4", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-0e2ca81c394111a2", "level": "none", "message": {"text": "Commented-code block (6 lines) in frontend/app-mobile/src/features/matches/api/schemas.ts:32"}, "properties": {"repobilityId": "22c1dc36492910c3", "scanner": "scanner-primary", "fingerprint": "0e2ca81c394111a2", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-82a04389ac4b0837", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 frontend/app-mobile/src/features/profile/api/privacyClient.ts:10"}, "properties": {"repobilityId": "9cde235019f2217f", "scanner": "scanner-primary", "fingerprint": "82a04389ac4b0837", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-f4dc94ea1261b94a", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 frontend/app-mobile/src/features/chat/api/chatClient.ts:19"}, "properties": {"repobilityId": "bc2ae0c6ebed88ca", "scanner": "scanner-primary", "fingerprint": "f4dc94ea1261b94a", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-8412a2c1942dbe8c", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 frontend/app-mobile/src/features/geo/api/geoClient.ts:17"}, "properties": {"repobilityId": "5d3967502752d3cc", "scanner": "scanner-primary", "fingerprint": "8412a2c1942dbe8c", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-f6ffdcf31758d0ad", "level": "none", "message": {"text": "Commented-code block (7 lines) in frontend/app-mobile/src/features/geo/screens/AvailabilityScreen.tsx:55"}, "properties": {"repobilityId": "0de1cae94e4a06a0", "scanner": "scanner-primary", "fingerprint": "f6ffdcf31758d0ad", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-961b1f79e2aea0e7", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 frontend/app-mobile/src/features/collection/api/collectionClient.ts:10"}, "properties": {"repobilityId": "b521a1be39e690fa", "scanner": "scanner-primary", "fingerprint": "961b1f79e2aea0e7", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-26fdf691658ca5f5", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 frontend/app-mobile/src/features/collection/api/catalogClient.ts:10"}, "properties": {"repobilityId": "7e4482f1ef1a70cf", "scanner": "scanner-primary", "fingerprint": "26fdf691658ca5f5", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-7f48037230309697", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 frontend/app-mobile/src/features/collection/sync/useSyncTriggers.ts:38"}, "properties": {"repobilityId": "8659b523d5e1dd26", "scanner": "scanner-primary", "fingerprint": "7f48037230309697", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-1bab38c9872f624e", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 frontend/app-mobile/src/features/auth/api/endpoints.ts:32"}, "properties": {"repobilityId": "126eb1c349ccf087", "scanner": "scanner-primary", "fingerprint": "1bab38c9872f624e", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-28d14245a9736514", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 frontend/app-mobile/src/features/auth/api/client.ts:40"}, "properties": {"repobilityId": "aff1281d5d8a4256", "scanner": "scanner-primary", "fingerprint": "28d14245a9736514", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-fff7355c8f82b1f7", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 frontend/app-mobile/src/features/auth/api/client.test.ts:53"}, "properties": {"repobilityId": "aa47976157dfb864", "scanner": "scanner-primary", "fingerprint": "fff7355c8f82b1f7", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-c19f566f367145ca", "level": "none", "message": {"text": "Commented-code block (5 lines) in frontend/app-mobile/src/features/auth/components/__tests__/profileSyncBootstrap.test.tsx:82"}, "properties": {"repobilityId": "f20d0f20e5c02340", "scanner": "scanner-primary", "fingerprint": "c19f566f367145ca", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-39a7a2ad7b18bf88", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 frontend/app-mobile/src/features/safety/api/safetyClient.ts:13"}, "properties": {"repobilityId": "44951794e0d1adb4", "scanner": "scanner-primary", "fingerprint": "39a7a2ad7b18bf88", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-5e053ec2ff77b22d", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 frontend/app-mobile/src/features/trade/api/tradeClient.ts:20"}, "properties": {"repobilityId": "8c047fc526da9e71", "scanner": "scanner-primary", "fingerprint": "5e053ec2ff77b22d", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-2578437b5c6df5ac", "level": "none", "message": {"text": "Commented-code block (5 lines) in frontend/app-mobile/src/features/trade/screens/TradeDetailScreen.tsx:56"}, "properties": {"repobilityId": "91936afc55b71ce1", "scanner": "scanner-primary", "fingerprint": "2578437b5c6df5ac", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-b1591d2a15f9e3d1", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 frontend/app-mobile/src/features/notifications/api/notificationsClient.ts:21"}, "properties": {"repobilityId": "fbff57a5d5e11443", "scanner": "scanner-primary", "fingerprint": "b1591d2a15f9e3d1", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-b3a91d81998398ee", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 frontend/app-mobile/src/features/stats/api/statsClient.ts:6"}, "properties": {"repobilityId": "bc372671f9169d7a", "scanner": "scanner-primary", "fingerprint": "b3a91d81998398ee", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-5bc46bfbeff81bc6", "level": "none", "message": {"text": "Commented-code block (5 lines) in frontend/app-mobile/src/__tests__/appConfig.test.ts:2"}, "properties": {"repobilityId": "8a11244892266b4e", "scanner": "scanner-primary", "fingerprint": "5bc46bfbeff81bc6", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-2912bf625c855303", "level": "none", "message": {"text": "Commented-code block (5 lines) in frontend/web-admin/tests/unit/components/section-tree-search.test.tsx:34"}, "properties": {"repobilityId": "2d169bd078c3735d", "scanner": "scanner-primary", "fingerprint": "2912bf625c855303", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-d537ce485f39a116", "level": "none", "message": {"text": "Commented-code block (6 lines) in frontend/web-admin/tests/unit/components/new-album-dialog.test.tsx:15"}, "properties": {"repobilityId": "d9542248e94fdda5", "scanner": "scanner-primary", "fingerprint": "d537ce485f39a116", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-183845cbc34be5bc", "level": "none", "message": {"text": "Commented-code block (7 lines) in frontend/web-admin/tests/integration/admin-contract.smoke.mjs:6"}, "properties": {"repobilityId": "663bb0e262fc0a55", "scanner": "scanner-primary", "fingerprint": "183845cbc34be5bc", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-bb4306465117cb6c", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 frontend/web-admin/src/app/api/admin/[...path]/route.ts:45"}, "properties": {"repobilityId": "19c1c49e281e7a27", "scanner": "scanner-primary", "fingerprint": "bb4306465117cb6c", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-fb73cbbe343f89d5", "level": "none", "message": {"text": "Commented-code block (6 lines) in frontend/web-admin/src/app/api/auth/[...nextauth]/route.ts:4"}, "properties": {"repobilityId": "e4e7a628770e641f", "scanner": "scanner-primary", "fingerprint": "fb73cbbe343f89d5", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-7a3624e39a99f8b2", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 frontend/web-admin/src/auth/auth.ts:8"}, "properties": {"repobilityId": "a345cdeb2049823a", "scanner": "scanner-primary", "fingerprint": "7a3624e39a99f8b2", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-2c76647ad1019d23", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 frontend/web-admin/src/auth/auth-testables.ts:7"}, "properties": {"repobilityId": "ace157fe8dd32bf3", "scanner": "scanner-primary", "fingerprint": "2c76647ad1019d23", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-9933e1428ab6fb8a", "level": "none", "message": {"text": "Commented-code block (5 lines) in frontend/web-admin/src/lib/base-path.ts:1"}, "properties": {"repobilityId": "1139ecd0a6d56d55", "scanner": "scanner-primary", "fingerprint": "9933e1428ab6fb8a", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-55223442b27548f6", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 frontend/web-admin/src/lib/base-path.ts:3"}, "properties": {"repobilityId": "a83a5d986129f5be", "scanner": "scanner-primary", "fingerprint": "55223442b27548f6", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-369f8a478ad865e3", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 frontend/web-admin/src/lib/api/server-fetch.ts:17"}, "properties": {"repobilityId": "f849320d67785507", "scanner": "scanner-primary", "fingerprint": "369f8a478ad865e3", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-3f2f3d0bcb958d41", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 frontend/web-admin/src/lib/api/client.ts:9"}, "properties": {"repobilityId": "7306276432158181", "scanner": "scanner-primary", "fingerprint": "3f2f3d0bcb958d41", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-af022f937dd5b7fd", "level": "note", "message": {"text": "9 env vars used in code but missing from .env.example"}, "properties": {"repobilityId": "5597384795dea7a4", "scanner": "scanner-primary", "fingerprint": "af022f937dd5b7fd", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "config-drift"]}}]}]}