{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-ce86560f354b2854", "name": "Stray `console.log` in TS/JS \u2014 src/index.ts:101", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 src/index.ts:101"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cc340fa9eb403d50", "name": "Stray `console.log` in TS/JS \u2014 src/proxy/proxy.ts:499", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 src/proxy/proxy.ts:499"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3f637d9d17d36422", "name": "Stray `console.log` in TS/JS \u2014 src/sip/rtp-relay.ts:208", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 src/sip/rtp-relay.ts:208"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-03e4c0bb0881a57e", "name": "Stray `console.log` in TS/JS \u2014 src/sip/acme.ts:45", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 src/sip/acme.ts:45"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-844ec9c58d164d81", "name": "Stray `console.log` in TS/JS \u2014 src/auth/auth.ts:319", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 src/auth/auth.ts:319"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-da59de05ee6e2ad5", "name": "Stray `console.log` in TS/JS \u2014 src/auth/oauth.ts:111", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 src/auth/oauth.ts:111"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-05695b6c3d475a9d", "name": "Stray `console.log` in TS/JS \u2014 src/auth/ldap.ts:175", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 src/auth/ldap.ts:175"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-dc32b5db85fbfbf4", "name": "Stray `console.log` in TS/JS \u2014 src/core/logger.ts:29", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 src/core/logger.ts:29"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7de6c03309f9a03e", "name": "Stray `console.log` in TS/JS \u2014 src/core/cert-store.ts:87", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 src/core/cert-store.ts:87"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-56965d8e7ce7943a", "name": "Stray `console.log` in TS/JS \u2014 src/core/cert-migration.ts:71", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 src/core/cert-migration.ts:71"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-86718a5075b823e7", "name": "Stray `console.log` in TS/JS \u2014 src/servers/sip-server.ts:299", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 src/servers/sip-server.ts:299"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-44a124aa59e9e7b7", "name": "Stray `console.log` in TS/JS \u2014 src/servers/proxy-server.ts:476", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 src/servers/proxy-server.ts:476"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d5b1a8b33415f336", "name": "Stray `console.log` in TS/JS \u2014 src/servers/webhook-server.ts:138", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 src/servers/webhook-server.ts:138"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-85a6759237714201", "name": "Stray `console.log` in TS/JS \u2014 src/telemetry/telemetry.ts:35", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 src/telemetry/telemetry.ts:35"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d5bf32bb1d2f4417", "name": "Stray `console.log` in TS/JS \u2014 src/telemetry/request-log.ts:79", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 src/telemetry/request-log.ts:79"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-17fda6087a7282e6", "name": "Stray `console.log` in TS/JS \u2014 src/telemetry/sip-log.ts:80", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 src/telemetry/sip-log.ts:80"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6940ce2c256aee76", "name": "Stray `console.log` in TS/JS \u2014 src/telemetry/tcpudp-conn-log.ts:57", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 src/telemetry/tcpudp-conn-log.ts:57"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-874f3923e723d8db", "name": "Privileged port 81 in use", "shortDescription": {"text": "Privileged port 81 in use"}, "fullDescription": {"text": "Port 81 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-93730abefd842043", "name": "Privileged port 880 in use", "shortDescription": {"text": "Privileged port 880 in use"}, "fullDescription": {"text": "Port 880 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c739a01f67140176", "name": "Privileged port 453 in use", "shortDescription": {"text": "Privileged port 453 in use"}, "fullDescription": {"text": "Port 453 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d63da3583b14afc0", "name": "Dockerfile runs as root: Dockerfile", "shortDescription": {"text": "Dockerfile runs as root: Dockerfile"}, "fullDescription": {"text": "No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9fff85edbbb8c52b", "name": "Docker base image is tag-pinned but not digest-pinned: oven/bun:1", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: oven/bun:1"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-31c647d53284d9b4", "name": "Insecure pattern 'cors_wildcard' in src/index.ts:395", "shortDescription": {"text": "Insecure pattern 'cors_wildcard' in src/index.ts:395"}, "fullDescription": {"text": "Found a known-risky pattern (cors_wildcard). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-48d32f32ab35d928", "name": "Insecure pattern 'direct_innerhtml_assignment' in src/views/invite.html:201", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in src/views/invite.html:201"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7369fab8363fdc72", "name": "Possible secret in src/views/oauth-login.html", "shortDescription": {"text": "Possible secret in src/views/oauth-login.html"}, "fullDescription": {"text": "Detected pattern matching password_literal. Rotate the credential and move to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-02b65070ce83d46e", "name": "Insecure pattern 'direct_innerhtml_assignment' in src/views/proxy-login.html:598", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in src/views/proxy-login.html:598"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b6add3304daba698", "name": "Insecure pattern 'direct_innerhtml_assignment' in src/views/password-reset.html:121", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in src/views/password-reset.html:121"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6e8a49a38406b321", "name": "Insecure pattern 'direct_innerhtml_assignment' in src/views/landing.html:644", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in src/views/landing.html:644"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-240ba32fa437dbf5", "name": "Insecure pattern 'direct_innerhtml_assignment' in src/views/admin-invite.html:186", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in src/views/admin-invite.html:186"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-33862b6143ae4f73", "name": "Insecure pattern 'direct_innerhtml_assignment' in src/views/js/dashboard-charts.js:144", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in src/views/js/dashboard-charts.js:144"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-fa93ea9ab1daaae0", "name": "Insecure pattern 'direct_innerhtml_assignment' in src/views/js/dashboard-app.js:69", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in src/views/js/dashboard-app.js:69"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d170975ed6da5c53", "name": "Insecure pattern 'direct_innerhtml_assignment' in src/views/js/dashboard-data.js:252", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in src/views/js/dashboard-data.js:252"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e09c64163e9a80c4", "name": "Insecure pattern 'insert_adjacent_html' in src/views/js/dashboard-data.js:6520", "shortDescription": {"text": "Insecure pattern 'insert_adjacent_html' in src/views/js/dashboard-data.js:6520"}, "fullDescription": {"text": "Found a known-risky pattern (insert_adjacent_html). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2ffbd7d627480b65", "name": "Insecure pattern 'private_key_in_repo' in src/views/partials/_app.html:858", "shortDescription": {"text": "Insecure pattern 'private_key_in_repo' in src/views/partials/_app.html:858"}, "fullDescription": {"text": "Found a known-risky pattern (private_key_in_repo). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-e41fd91385853f34", "name": "Insecure pattern 'private_key_in_repo' in src/core/cert-store.ts:318", "shortDescription": {"text": "Insecure pattern 'private_key_in_repo' in src/core/cert-store.ts:318"}, "fullDescription": {"text": "Found a known-risky pattern (private_key_in_repo). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-869cfaa0be0d238d", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "hmanzur/actions-set-secret@v2.0.0 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-18687054ec98207f", "name": "Very large file: src/index.ts (4311 lines)", "shortDescription": {"text": "Very large file: src/index.ts (4311 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-57ae01403ed97453", "name": "Very large file: src/proxy/proxy.ts (1279 lines)", "shortDescription": {"text": "Very large file: src/proxy/proxy.ts (1279 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-249933416620702f", "name": "Very large file: src/views/js/dashboard-data.js (8086 lines)", "shortDescription": {"text": "Very large file: src/views/js/dashboard-data.js (8086 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f1be934fbeae38f6", "name": "Very large file: src/auth/auth.ts (2881 lines)", "shortDescription": {"text": "Very large file: src/auth/auth.ts (2881 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-12b220b1be607cd4", "name": "Very large file: src/servers/oauth-handler.ts (1124 lines)", "shortDescription": {"text": "Very large file: src/servers/oauth-handler.ts (1124 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6b76755b0226057c", "name": "Very large file: src/servers/connector-server.ts (1368 lines)", "shortDescription": {"text": "Very large file: src/servers/connector-server.ts (1368 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6893a6c8b0861585", "name": "Very low test-to-source ratio", "shortDescription": {"text": "Very low test-to-source ratio"}, "fullDescription": {"text": "0 test file(s) for 49 source file(s) (ratio 0.00). Consider adding integration or unit tests for critical paths."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 101 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-11825279136b53a3", "name": "CI is configured but no tests are detected", "shortDescription": {"text": "CI is configured but no tests are detected"}, "fullDescription": {"text": "A CI pipeline exists, but the scan found no test files to gate. Opus labeled this generated-code pattern as config theater: release machinery exists, but it has little behavioral signal."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-30ee90aeb30cae58", "name": "Commented-code block (5 lines) in src/index.ts:239", "shortDescription": {"text": "Commented-code block (5 lines) in src/index.ts:239"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-a1a219d01611cca9", "name": "`fetch()` without try/.catch or AbortSignal \u2014 src/index.ts:384", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/index.ts:384"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-00ff505a1101251d", "name": "Commented-code block (5 lines) in src/proxy/proxy.ts:16", "shortDescription": {"text": "Commented-code block (5 lines) in src/proxy/proxy.ts:16"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-d987c9caab205d68", "name": "`fetch()` without try/.catch or AbortSignal \u2014 src/proxy/proxy.ts:656", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/proxy/proxy.ts:656"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-39e6e48256c951c7", "name": "`fetch()` without try/.catch or AbortSignal \u2014 src/npm/client.ts:3", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/npm/client.ts:3"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1b96a6f5774a9e3c", "name": "`fetch()` without try/.catch or AbortSignal \u2014 src/views/js/dashboard-app.js:520", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/views/js/dashboard-app.js:520"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a31f0ad0996df7d8", "name": "`fetch()` without try/.catch or AbortSignal \u2014 src/gocontact/client.ts:95", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/gocontact/client.ts:95"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ab8e686b443396c0", "name": "Commented-code block (5 lines) in src/auth/auth.ts:539", "shortDescription": {"text": "Commented-code block (5 lines) in src/auth/auth.ts:539"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-2861de9dae7b2f7f", "name": "Commented-code block (6 lines) in src/auth/oauth.ts:4", "shortDescription": {"text": "Commented-code block (6 lines) in src/auth/oauth.ts:4"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-29048ba20e47a421", "name": "Commented-code block (11 lines) in src/auth/ldap.ts:3", "shortDescription": {"text": "Commented-code block (11 lines) in src/auth/ldap.ts:3"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-c15eebb39fd2f90a", "name": "Commented-code block (8 lines) in src/core/ip-filter.ts:71", "shortDescription": {"text": "Commented-code block (8 lines) in src/core/ip-filter.ts:71"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-26a04904d1addaa9", "name": "Commented-code block (5 lines) in src/core/notifications.ts:1", "shortDescription": {"text": "Commented-code block (5 lines) in src/core/notifications.ts:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-f43c51c548abf4d1", "name": "Commented-code block (6 lines) in src/core/smtp.ts:391", "shortDescription": {"text": "Commented-code block (6 lines) in src/core/smtp.ts:391"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-51c053b348e09a9b", "name": "`fetch()` without try/.catch or AbortSignal \u2014 src/core/ssrf-guard.ts:159", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/core/ssrf-guard.ts:159"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-36278d04f16c853d", "name": "Commented-code block (5 lines) in src/core/sms.ts:8", "shortDescription": {"text": "Commented-code block (5 lines) in src/core/sms.ts:8"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-86906e49d2dc5b38", "name": "Commented-code block (5 lines) in src/servers/port-manager.ts:46", "shortDescription": {"text": "Commented-code block (5 lines) in src/servers/port-manager.ts:46"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-1860d1427a1c4955", "name": "Commented-code block (7 lines) in src/servers/oauth-handler.ts:3", "shortDescription": {"text": "Commented-code block (7 lines) in src/servers/oauth-handler.ts:3"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-11ed859c6f7072b2", "name": "Commented-code block (5 lines) in src/servers/proxy-server.ts:193", "shortDescription": {"text": "Commented-code block (5 lines) in src/servers/proxy-server.ts:193"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-e0f28151fb4b4c2a", "name": "`fetch()` without try/.catch or AbortSignal \u2014 src/servers/proxy-server.ts:78", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/servers/proxy-server.ts:78"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e7a62e2d450247cc", "name": "Commented-code block (5 lines) in src/servers/connector-server.ts:115", "shortDescription": {"text": "Commented-code block (5 lines) in src/servers/connector-server.ts:115"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-3b57dcbcdf0fa743", "name": "Commented-code block (7 lines) in src/servers/webhook-server.ts:272", "shortDescription": {"text": "Commented-code block (7 lines) in src/servers/webhook-server.ts:272"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-f9d4151a45e12253", "name": "`fetch()` without try/.catch or AbortSignal \u2014 src/servers/webhook-server.ts:411", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/servers/webhook-server.ts:411"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-60fea22f6e67cd01", "name": "Legacy-named symbol `purgeOld` in src/telemetry/tcpudp-conn-log.ts:68", "shortDescription": {"text": "Legacy-named symbol `purgeOld` in src/telemetry/tcpudp-conn-log.ts:68"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/24604"}, "properties": {"repository": "Biscatos/Midleman", "repoUrl": "https://github.com/Biscatos/Midleman", "branch": "main"}, "results": [{"ruleId": "scanner-ce86560f354b2854", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 src/index.ts:101"}, "properties": {"repobilityId": "867f5b4f120dafeb", "scanner": "scanner-primary", "fingerprint": "ce86560f354b2854", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-cc340fa9eb403d50", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 src/proxy/proxy.ts:499"}, "properties": {"repobilityId": "1cbe1d1ad4a10370", "scanner": "scanner-primary", "fingerprint": "cc340fa9eb403d50", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-3f637d9d17d36422", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 src/sip/rtp-relay.ts:208"}, "properties": {"repobilityId": "233e4e69e4083f59", "scanner": "scanner-primary", "fingerprint": "3f637d9d17d36422", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-03e4c0bb0881a57e", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 src/sip/acme.ts:45"}, "properties": {"repobilityId": "c9560bc5f396aaf3", "scanner": "scanner-primary", "fingerprint": "03e4c0bb0881a57e", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-844ec9c58d164d81", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 src/auth/auth.ts:319"}, "properties": {"repobilityId": "07003a3ea4211d81", "scanner": "scanner-primary", "fingerprint": "844ec9c58d164d81", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-da59de05ee6e2ad5", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 src/auth/oauth.ts:111"}, "properties": {"repobilityId": "a1859802282c1ad3", "scanner": "scanner-primary", "fingerprint": "da59de05ee6e2ad5", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-05695b6c3d475a9d", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 src/auth/ldap.ts:175"}, "properties": {"repobilityId": "bc3cf9e8524e6372", "scanner": "scanner-primary", "fingerprint": "05695b6c3d475a9d", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-dc32b5db85fbfbf4", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 src/core/logger.ts:29"}, "properties": {"repobilityId": "2238a1a1eb6424b3", "scanner": "scanner-primary", "fingerprint": "dc32b5db85fbfbf4", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-7de6c03309f9a03e", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 src/core/cert-store.ts:87"}, "properties": {"repobilityId": "f8610ae1ca0f94ce", "scanner": "scanner-primary", "fingerprint": "7de6c03309f9a03e", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-56965d8e7ce7943a", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 src/core/cert-migration.ts:71"}, "properties": {"repobilityId": "68cd517687343ca6", "scanner": "scanner-primary", "fingerprint": "56965d8e7ce7943a", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-86718a5075b823e7", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 src/servers/sip-server.ts:299"}, "properties": {"repobilityId": "e8a5b987fdbe449f", "scanner": "scanner-primary", "fingerprint": "86718a5075b823e7", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-44a124aa59e9e7b7", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 src/servers/proxy-server.ts:476"}, "properties": {"repobilityId": "796c09804b3f14ba", "scanner": "scanner-primary", "fingerprint": "44a124aa59e9e7b7", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-d5b1a8b33415f336", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 src/servers/webhook-server.ts:138"}, "properties": {"repobilityId": "9483f99d4c42c8eb", "scanner": "scanner-primary", "fingerprint": "d5b1a8b33415f336", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-85a6759237714201", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 src/telemetry/telemetry.ts:35"}, "properties": {"repobilityId": "30503f9ba4d9e6de", "scanner": "scanner-primary", "fingerprint": "85a6759237714201", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-d5bf32bb1d2f4417", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 src/telemetry/request-log.ts:79"}, "properties": {"repobilityId": "c04abb007703f29e", "scanner": "scanner-primary", "fingerprint": "d5bf32bb1d2f4417", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-17fda6087a7282e6", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 src/telemetry/sip-log.ts:80"}, "properties": {"repobilityId": "2f93ff186480cd45", "scanner": "scanner-primary", "fingerprint": "17fda6087a7282e6", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-6940ce2c256aee76", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 src/telemetry/tcpudp-conn-log.ts:57"}, "properties": {"repobilityId": "f13cc42e33ef97df", "scanner": "scanner-primary", "fingerprint": "6940ce2c256aee76", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-874f3923e723d8db", "level": "warning", "message": {"text": "Privileged port 81 in use"}, "properties": {"repobilityId": "663b0bffb7f8fe66", "scanner": "scanner-primary", "fingerprint": "874f3923e723d8db", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docker-compose.npm.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-93730abefd842043", "level": "warning", "message": {"text": "Privileged port 880 in use"}, "properties": {"repobilityId": "41753a2d4c543676", "scanner": "scanner-primary", "fingerprint": "93730abefd842043", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docker-compose.npm.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c739a01f67140176", "level": "warning", "message": {"text": "Privileged port 453 in use"}, "properties": {"repobilityId": "307293814a76b5de", "scanner": "scanner-primary", "fingerprint": "c739a01f67140176", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docker-compose.npm.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d63da3583b14afc0", "level": "warning", "message": {"text": "Dockerfile runs as root: Dockerfile"}, "properties": {"repobilityId": "a2ed1bd120e507db", "scanner": "scanner-primary", "fingerprint": "d63da3583b14afc0", "layer": "hardware", "severity": "medium", "confidence": 1.0, "tags": ["security", "container"]}}, {"ruleId": "scanner-9fff85edbbb8c52b", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: oven/bun:1"}, "properties": {"repobilityId": "3debfd4175c0723b", "scanner": "scanner-primary", "fingerprint": "9fff85edbbb8c52b", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Dockerfile"}, "region": {"startLine": 2}}}]}, {"ruleId": "scanner-31c647d53284d9b4", "level": "warning", "message": {"text": "Insecure pattern 'cors_wildcard' in src/index.ts:395"}, "properties": {"repobilityId": "56c7c9857324258f", "scanner": "scanner-primary", "fingerprint": "31c647d53284d9b4", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "cors_wildcard"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/index.ts"}, "region": {"startLine": 395}}}]}, {"ruleId": "scanner-48d32f32ab35d928", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in src/views/invite.html:201"}, "properties": {"repobilityId": "22f7bef0b939acb2", "scanner": "scanner-primary", "fingerprint": "48d32f32ab35d928", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/views/invite.html"}, "region": {"startLine": 201}}}]}, {"ruleId": "scanner-7369fab8363fdc72", "level": "error", "message": {"text": "Possible secret in src/views/oauth-login.html"}, "properties": {"repobilityId": "947bb7525b03d820", "scanner": "scanner-primary", "fingerprint": "7369fab8363fdc72", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/views/oauth-login.html"}, "region": {"startLine": 217}}}]}, {"ruleId": "scanner-02b65070ce83d46e", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in src/views/proxy-login.html:598"}, "properties": {"repobilityId": "8036c0f2d7b1cb82", "scanner": "scanner-primary", "fingerprint": "02b65070ce83d46e", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/views/proxy-login.html"}, "region": {"startLine": 598}}}]}, {"ruleId": "scanner-b6add3304daba698", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in src/views/password-reset.html:121"}, "properties": {"repobilityId": "336c9f36a321b2b5", "scanner": "scanner-primary", "fingerprint": "b6add3304daba698", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/views/password-reset.html"}, "region": {"startLine": 121}}}]}, {"ruleId": "scanner-6e8a49a38406b321", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in src/views/landing.html:644"}, "properties": {"repobilityId": "06399b792dcc8a40", "scanner": "scanner-primary", "fingerprint": "6e8a49a38406b321", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/views/landing.html"}, "region": {"startLine": 644}}}]}, {"ruleId": "scanner-240ba32fa437dbf5", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in src/views/admin-invite.html:186"}, "properties": {"repobilityId": "67d80a3003876d11", "scanner": "scanner-primary", "fingerprint": "240ba32fa437dbf5", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/views/admin-invite.html"}, "region": {"startLine": 186}}}]}, {"ruleId": "scanner-33862b6143ae4f73", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in src/views/js/dashboard-charts.js:144"}, "properties": {"repobilityId": "072bb59f0033ce16", "scanner": "scanner-primary", "fingerprint": "33862b6143ae4f73", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/views/js/dashboard-charts.js"}, "region": {"startLine": 144}}}]}, {"ruleId": "scanner-fa93ea9ab1daaae0", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in src/views/js/dashboard-app.js:69"}, "properties": {"repobilityId": "3071b4e07e1c6dfa", "scanner": "scanner-primary", "fingerprint": "fa93ea9ab1daaae0", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/views/js/dashboard-app.js"}, "region": {"startLine": 69}}}]}, {"ruleId": "scanner-d170975ed6da5c53", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in src/views/js/dashboard-data.js:252"}, "properties": {"repobilityId": "60d252c5de72c2d3", "scanner": "scanner-primary", "fingerprint": "d170975ed6da5c53", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/views/js/dashboard-data.js"}, "region": {"startLine": 252}}}]}, {"ruleId": "scanner-e09c64163e9a80c4", "level": "warning", "message": {"text": "Insecure pattern 'insert_adjacent_html' in src/views/js/dashboard-data.js:6520"}, "properties": {"repobilityId": "dc4bbe45ef7bcb6e", "scanner": "scanner-primary", "fingerprint": "e09c64163e9a80c4", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "insert_adjacent_html"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/views/js/dashboard-data.js"}, "region": {"startLine": 6520}}}]}, {"ruleId": "scanner-2ffbd7d627480b65", "level": "error", "message": {"text": "Insecure pattern 'private_key_in_repo' in src/views/partials/_app.html:858"}, "properties": {"repobilityId": "70eab49a924a8a66", "scanner": "scanner-primary", "fingerprint": "2ffbd7d627480b65", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["owasp", "private_key_in_repo"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/views/partials/_app.html"}, "region": {"startLine": 858}}}]}, {"ruleId": "scanner-e41fd91385853f34", "level": "error", "message": {"text": "Insecure pattern 'private_key_in_repo' in src/core/cert-store.ts:318"}, "properties": {"repobilityId": "b8fe69053e92dde2", "scanner": "scanner-primary", "fingerprint": "e41fd91385853f34", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["owasp", "private_key_in_repo"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/core/cert-store.ts"}, "region": {"startLine": 318}}}]}, {"ruleId": "scanner-869cfaa0be0d238d", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "a04b9373f1951d76", "scanner": "scanner-primary", "fingerprint": "869cfaa0be0d238d", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/docker-build-push.yml"}, "region": {"startLine": 24}}}]}, {"ruleId": "scanner-18687054ec98207f", "level": "note", "message": {"text": "Very large file: src/index.ts (4311 lines)"}, "properties": {"repobilityId": "25727599e08a7f66", "scanner": "scanner-primary", "fingerprint": "18687054ec98207f", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-57ae01403ed97453", "level": "note", "message": {"text": "Very large file: src/proxy/proxy.ts (1279 lines)"}, "properties": {"repobilityId": "55850ba4f2de12f0", "scanner": "scanner-primary", "fingerprint": "57ae01403ed97453", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-249933416620702f", "level": "note", "message": {"text": "Very large file: src/views/js/dashboard-data.js (8086 lines)"}, "properties": {"repobilityId": "bb312e0e06ad8432", "scanner": "scanner-primary", "fingerprint": "249933416620702f", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-f1be934fbeae38f6", "level": "note", "message": {"text": "Very large file: src/auth/auth.ts (2881 lines)"}, "properties": {"repobilityId": "1485d52dd674a85a", "scanner": "scanner-primary", "fingerprint": "f1be934fbeae38f6", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-12b220b1be607cd4", "level": "note", "message": {"text": "Very large file: src/servers/oauth-handler.ts (1124 lines)"}, "properties": {"repobilityId": "3890eab2ad51d26d", "scanner": "scanner-primary", "fingerprint": "12b220b1be607cd4", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-6b76755b0226057c", "level": "note", "message": {"text": "Very large file: src/servers/connector-server.ts (1368 lines)"}, "properties": {"repobilityId": "88f9a8b62677f16e", "scanner": "scanner-primary", "fingerprint": "6b76755b0226057c", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-6893a6c8b0861585", "level": "warning", "message": {"text": "Very low test-to-source ratio"}, "properties": {"repobilityId": "54a7de3f06314bf0", "scanner": "scanner-primary", "fingerprint": "6893a6c8b0861585", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["tests", "coverage"]}}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "c3b3f2c4c4e544f9", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "52dd848b03b7278e", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-11825279136b53a3", "level": "warning", "message": {"text": "CI is configured but no tests are detected"}, "properties": {"repobilityId": "6ed1b67778b4b2ae", "scanner": "scanner-primary", "fingerprint": "11825279136b53a3", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["tests", "ci", "config-theater", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-30ee90aeb30cae58", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/index.ts:239"}, "properties": {"repobilityId": "c506ce56204f94de", "scanner": "scanner-primary", "fingerprint": "30ee90aeb30cae58", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-a1a219d01611cca9", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/index.ts:384"}, "properties": {"repobilityId": "758bc3d6b344c5bd", "scanner": "scanner-primary", "fingerprint": "a1a219d01611cca9", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-00ff505a1101251d", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/proxy/proxy.ts:16"}, "properties": {"repobilityId": "e0c5f8f949e05fb0", "scanner": "scanner-primary", "fingerprint": "00ff505a1101251d", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-d987c9caab205d68", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/proxy/proxy.ts:656"}, "properties": {"repobilityId": "c0fd4d187e851d98", "scanner": "scanner-primary", "fingerprint": "d987c9caab205d68", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-39e6e48256c951c7", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/npm/client.ts:3"}, "properties": {"repobilityId": "cbfba52658022d07", "scanner": "scanner-primary", "fingerprint": "39e6e48256c951c7", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-1b96a6f5774a9e3c", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/views/js/dashboard-app.js:520"}, "properties": {"repobilityId": "36befbed35e3e4ca", "scanner": "scanner-primary", "fingerprint": "1b96a6f5774a9e3c", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-a31f0ad0996df7d8", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/gocontact/client.ts:95"}, "properties": {"repobilityId": "f1a9e8052b4d0a69", "scanner": "scanner-primary", "fingerprint": "a31f0ad0996df7d8", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-ab8e686b443396c0", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/auth/auth.ts:539"}, "properties": {"repobilityId": "60fceb0507745c2c", "scanner": "scanner-primary", "fingerprint": "ab8e686b443396c0", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-2861de9dae7b2f7f", "level": "none", "message": {"text": "Commented-code block (6 lines) in src/auth/oauth.ts:4"}, "properties": {"repobilityId": "d4d15685c5e055d6", "scanner": "scanner-primary", "fingerprint": "2861de9dae7b2f7f", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-29048ba20e47a421", "level": "none", "message": {"text": "Commented-code block (11 lines) in src/auth/ldap.ts:3"}, "properties": {"repobilityId": "1318a5f976881b80", "scanner": "scanner-primary", "fingerprint": "29048ba20e47a421", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-c15eebb39fd2f90a", "level": "none", "message": {"text": "Commented-code block (8 lines) in src/core/ip-filter.ts:71"}, "properties": {"repobilityId": "ab162bff7fd4212c", "scanner": "scanner-primary", "fingerprint": "c15eebb39fd2f90a", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-26a04904d1addaa9", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/core/notifications.ts:1"}, "properties": {"repobilityId": "57c5c9e67643318b", "scanner": "scanner-primary", "fingerprint": "26a04904d1addaa9", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-f43c51c548abf4d1", "level": "none", "message": {"text": "Commented-code block (6 lines) in src/core/smtp.ts:391"}, "properties": {"repobilityId": "bd80d253bc6012de", "scanner": "scanner-primary", "fingerprint": "f43c51c548abf4d1", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-51c053b348e09a9b", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/core/ssrf-guard.ts:159"}, "properties": {"repobilityId": "592506d868b5fa07", "scanner": "scanner-primary", "fingerprint": "51c053b348e09a9b", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-36278d04f16c853d", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/core/sms.ts:8"}, "properties": {"repobilityId": "36f72b02e15811e8", "scanner": "scanner-primary", "fingerprint": "36278d04f16c853d", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-86906e49d2dc5b38", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/servers/port-manager.ts:46"}, "properties": {"repobilityId": "341d35dab75411ff", "scanner": "scanner-primary", "fingerprint": "86906e49d2dc5b38", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-1860d1427a1c4955", "level": "none", "message": {"text": "Commented-code block (7 lines) in src/servers/oauth-handler.ts:3"}, "properties": {"repobilityId": "4ba4cff7fb1faf08", "scanner": "scanner-primary", "fingerprint": "1860d1427a1c4955", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-11ed859c6f7072b2", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/servers/proxy-server.ts:193"}, "properties": {"repobilityId": "e97b29bbfca1eca0", "scanner": "scanner-primary", "fingerprint": "11ed859c6f7072b2", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-e0f28151fb4b4c2a", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/servers/proxy-server.ts:78"}, "properties": {"repobilityId": "e4d975d37e559764", "scanner": "scanner-primary", "fingerprint": "e0f28151fb4b4c2a", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-e7a62e2d450247cc", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/servers/connector-server.ts:115"}, "properties": {"repobilityId": "8311e9307ffdf29e", "scanner": "scanner-primary", "fingerprint": "e7a62e2d450247cc", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-3b57dcbcdf0fa743", "level": "none", "message": {"text": "Commented-code block (7 lines) in src/servers/webhook-server.ts:272"}, "properties": {"repobilityId": "5004c8bbb75acb41", "scanner": "scanner-primary", "fingerprint": "3b57dcbcdf0fa743", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-f9d4151a45e12253", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/servers/webhook-server.ts:411"}, "properties": {"repobilityId": "a176d74ecb8da12f", "scanner": "scanner-primary", "fingerprint": "f9d4151a45e12253", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-60fea22f6e67cd01", "level": "note", "message": {"text": "Legacy-named symbol `purgeOld` in src/telemetry/tcpudp-conn-log.ts:68"}, "properties": {"repobilityId": "cdc4afef04d0156c", "scanner": "scanner-primary", "fingerprint": "60fea22f6e67cd01", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}]}]}