{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-56c548343cc99f57", "name": "Possibly dead Python function: setup_logging", "shortDescription": {"text": "Possibly dead Python function: setup_logging"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a8f184090e4dbfc9", "name": "Possibly dead Python function: decorator", "shortDescription": {"text": "Possibly dead Python function: decorator"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8e230a0f54b533c5", "name": "Possibly dead Python function: drain", "shortDescription": {"text": "Possibly dead Python function: drain"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-20a4a587e52b9bf5", "name": "Possibly dead Python function: start_auto_process", "shortDescription": {"text": "Possibly dead Python function: start_auto_process"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c8a5a8e69fba031f", "name": "Possibly dead Python function: cleanup", "shortDescription": {"text": "Possibly dead Python function: cleanup"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-88c61a1989a165b5", "name": "Possibly dead Python function: deep_health_check", "shortDescription": {"text": "Possibly dead Python function: deep_health_check"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0df0eff582313aa4", "name": "Possibly dead Python function: unsubscribe", "shortDescription": {"text": "Possibly dead Python function: unsubscribe"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-add93f5d57a4ad68", "name": "Possibly dead Python function: update_subscription", "shortDescription": {"text": "Possibly dead Python function: update_subscription"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4f6223fd86555c08", "name": "Possibly dead Python function: clear_history", "shortDescription": {"text": "Possibly dead Python function: clear_history"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-77898c188f4b373a", "name": "Possibly dead Python function: add_warning", "shortDescription": {"text": "Possibly dead Python function: add_warning"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d06fd6416f78c8c5", "name": "Possibly dead Python function: add_rules", "shortDescription": {"text": "Possibly dead Python function: add_rules"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4092d36d4c5246d5", "name": "Possibly dead Python function: validate_from_env", "shortDescription": {"text": "Possibly dead Python function: validate_from_env"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-39f44df931c02e77", "name": "Possibly dead Python function: remove_endpoint", "shortDescription": {"text": "Possibly dead Python function: remove_endpoint"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a66bb970d21299af", "name": "Possibly dead Python function: record_failure", "shortDescription": {"text": "Possibly dead Python function: record_failure"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-73f8787116f896ad", "name": "Possibly dead Python function: decrement_connections", "shortDescription": {"text": "Possibly dead Python function: decrement_connections"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-48d694d0772acf91", "name": "Possibly dead Python function: start_recovery_monitor", "shortDescription": {"text": "Possibly dead Python function: start_recovery_monitor"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1b9a0192172a6056", "name": "Possibly dead Python function: stop_recovery_monitor", "shortDescription": {"text": "Possibly dead Python function: stop_recovery_monitor"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2167d49769c8c220", "name": "Possibly dead Python function: replay_filtered", "shortDescription": {"text": "Possibly dead Python function: replay_filtered"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-094826b54a9a71ae", "name": "Possibly dead Python function: enable_breakpoint", "shortDescription": {"text": "Possibly dead Python function: enable_breakpoint"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ecbfc9f0c09d9600", "name": "Possibly dead Python function: disable_breakpoint", "shortDescription": {"text": "Possibly dead Python function: disable_breakpoint"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d63da3583b14afc0", "name": "Dockerfile runs as root: Dockerfile", "shortDescription": {"text": "Dockerfile runs as root: Dockerfile"}, "fullDescription": {"text": "No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-de3c1f217d72a063", "name": "Docker base image is tag-pinned but not digest-pinned: python:3.12-slim", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: python:3.12-slim"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-aa5acaa49eb8315b", "name": "Containers defined but no K8s/orchestration manifest found", "shortDescription": {"text": "Containers defined but no K8s/orchestration manifest found"}, "fullDescription": {"text": "Repo has Dockerfiles/compose but no Kubernetes/Nomad manifests. If the target deployment is K8s, the manifests may live in a separate ops repo."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9710c8d059e53154", "name": "No frontend routes/components detected", "shortDescription": {"text": "No frontend routes/components detected"}, "fullDescription": {"text": "No React/Vue/Next routes were found. This is fine for backend-only repos."}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-87173ebe96a35165", "name": "Insecure pattern 'subprocess_shell_true' in pyproject.toml:222", "shortDescription": {"text": "Insecure pattern 'subprocess_shell_true' in pyproject.toml:222"}, "fullDescription": {"text": "Found a known-risky pattern (subprocess_shell_true). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-604c7a3c7b348ad5", "name": "Insecure pattern 'weak_hash' in shared/cn_commerce_base.py:394", "shortDescription": {"text": "Insecure pattern 'weak_hash' in shared/cn_commerce_base.py:394"}, "fullDescription": {"text": "Found a known-risky pattern (weak_hash). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e81d1a7f95cfebb0", "name": "Insecure pattern 'weak_hash' in servers/taobao/server.py:34", "shortDescription": {"text": "Insecure pattern 'weak_hash' in servers/taobao/server.py:34"}, "fullDescription": {"text": "Found a known-risky pattern (weak_hash). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0f11c28b4740bf96", "name": "Insecure pattern 'weak_hash' in servers/pinduoduo/server.py:38", "shortDescription": {"text": "Insecure pattern 'weak_hash' in servers/pinduoduo/server.py:38"}, "fullDescription": {"text": "Found a known-risky pattern (weak_hash). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-261d8913747ed9d0", "name": "Insecure pattern 'weak_hash' in servers/xiaohongshu/server.py:37", "shortDescription": {"text": "Insecure pattern 'weak_hash' in servers/xiaohongshu/server.py:37"}, "fullDescription": {"text": "Found a known-risky pattern (weak_hash). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ae311722745977e8", "name": "Insecure pattern 'weak_hash' in servers/kuaishou/server.py:41", "shortDescription": {"text": "Insecure pattern 'weak_hash' in servers/kuaishou/server.py:41"}, "fullDescription": {"text": "Found a known-risky pattern (weak_hash). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e19f88e456dac100", "name": "Insecure pattern 'weak_hash' in servers/doudian/server.py:91", "shortDescription": {"text": "Insecure pattern 'weak_hash' in servers/doudian/server.py:91"}, "fullDescription": {"text": "Found a known-risky pattern (weak_hash). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7efbda965f283c17", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/setup-python@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-13997a3b10e9b8b4", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7407dcfdb2b5c014", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "dependabot/fetch-metadata@v3 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-bda6deb11902724f", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a53bf972e19b52fd", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/setup-python@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7ffa33751be3d771", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-839ef4fd12af11b2", "name": "Very large file: tests/test_integration.py (1345 lines)", "shortDescription": {"text": "Very large file: tests/test_integration.py (1345 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c034e97aeeb8eb7b", "name": "Very large file: tests/test_cn_commerce_base.py (4688 lines)", "shortDescription": {"text": "Very large file: tests/test_cn_commerce_base.py (4688 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fa3d44f394cef314", "name": "Very large file: shared/cn_commerce_base.py (7026 lines)", "shortDescription": {"text": "Very large file: shared/cn_commerce_base.py (7026 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-bab8102d714ffc6c", "name": "Very large file: servers/taobao/tests/test_taobao.py (1247 lines)", "shortDescription": {"text": "Very large file: servers/taobao/tests/test_taobao.py (1247 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2f4686ab0119c700", "name": "Very large file: servers/oceanengine/tests/test_oceanengine.py (1578 lines)", "shortDescription": {"text": "Very large file: servers/oceanengine/tests/test_oceanengine.py (1578 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-abdd64ff1dcbafd3", "name": "Very large file: servers/doudian/server.py (1701 lines)", "shortDescription": {"text": "Very large file: servers/doudian/server.py (1701 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6f3cf47ecff61551", "name": "Very large file: servers/doudian/tests/test_doudian.py (2149 lines)", "shortDescription": {"text": "Very large file: servers/doudian/tests/test_doudian.py (2149 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0ae3628650178b92", "name": "Very large file: servers/jd/tests/test_jd.py (1452 lines)", "shortDescription": {"text": "Very large file: servers/jd/tests/test_jd.py (1452 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 45 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-b4b4bc68e6b0147e", "name": "Legacy-named symbol `test_get_stats_returns_copy` in tests/test_dashboard.py:119", "shortDescription": {"text": "Legacy-named symbol `test_get_stats_returns_copy` in tests/test_dashboard.py:119"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4076d38be58d6e9b", "name": "Legacy-named symbol `new_field_v2` in tests/test_api_compatibility.py:292", "shortDescription": {"text": "Legacy-named symbol `new_field_v2` in tests/test_api_compatibility.py:292"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7493c11d4edb7e37", "name": "Legacy-named symbol `test_returns_dict_copy` in tests/test_i18n.py:240", "shortDescription": {"text": "Legacy-named symbol `test_returns_dict_copy` in tests/test_i18n.py:240"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-250f57e8a1dbd3c5", "name": "4 env vars used in code but missing from .env.example", "shortDescription": {"text": "4 env vars used in code but missing from .env.example"}, "fullDescription": {"text": "Drift between code and config docs. The first few: `MCP_CN_COMMERCE_LANG`, `WX_ACCESS_TOKEN`, `WX_APP_ID`, `WX_APP_SECRET`. Add them (with a placeholder/comment) to .env.example so onboarding doesn't break."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-2c04133e54348533", "name": "Near-duplicate function bodies in 2 places", "shortDescription": {"text": "Near-duplicate function bodies in 2 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nshared/normalizer.py:normalize_order_status, shared/normalizer.py:normalize_order\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-be46ea126aa5d8dc", "name": "Near-duplicate function bodies in 3 places", "shortDescription": {"text": "Near-duplicate function bodies in 3 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nshared/dashboard.py:reset, shared/dashboard.py:reset, shared/dashboard.py:reset\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-33a6b62e30ce7ab4", "name": "Near-duplicate function bodies in 6 places", "shortDescription": {"text": "Near-duplicate function bodies in 6 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nshared/cn_commerce_base.py:reset, shared/cn_commerce_base.py:reset, shared/cn_commerce_base.py:reset, shared/cn_commerce_base.py:reset\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-122053f21232d80c", "name": "Near-duplicate function bodies in 14 places", "shortDescription": {"text": "Near-duplicate function bodies in 14 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nshared/cn_commerce_base.py:to_dict, shared/cn_commerce_base.py:to_dict, shared/cn_commerce_base.py:to_dict, shared/cn_commerce_base.py:to_dict\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-02525d39071dd2c7", "name": "Near-duplicate function bodies in 5 places", "shortDescription": {"text": "Near-duplicate function bodies in 5 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nshared/cn_commerce_base.py:from_dict, shared/cn_commerce_base.py:from_dict, shared/cn_commerce_base.py:from_dict, shared/cn_commerce_base.py:from_dict\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c54c6fb8e364daaa", "name": "Near-duplicate function bodies in 16 places", "shortDescription": {"text": "Near-duplicate function bodies in 16 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nshared/cn_commerce_base.py:get_stats_summary, shared/cn_commerce_base.py:get_stats_summary, shared/cn_commerce_base.py:get_stats, shared/cn_commerce_base.py:get_stats\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-76a2f6818267a9a8", "name": "Near-duplicate function bodies in 8 places", "shortDescription": {"text": "Near-duplicate function bodies in 8 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nshared/cn_commerce_base.py:reset_stats, shared/cn_commerce_base.py:reset_stats, shared/cn_commerce_base.py:reset_stats, shared/cn_commerce_base.py:reset_stats\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/21524"}, "properties": {"repository": "TonyWang-hub/mcp-cn-commerce", "repoUrl": "https://github.com/TonyWang-hub/mcp-cn-commerce", "branch": "main"}, "results": [{"ruleId": "scanner-56c548343cc99f57", "level": "note", "message": {"text": "Possibly dead Python function: setup_logging"}, "properties": {"repobilityId": "e79074b18f293f2b", "scanner": "scanner-primary", "fingerprint": "56c548343cc99f57", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "shared/cn_commerce_base.py:314"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a8f184090e4dbfc9", "level": "note", "message": {"text": "Possibly dead Python function: decorator"}, "properties": {"repobilityId": "ffbcbc9bc189af1c", "scanner": "scanner-primary", "fingerprint": "a8f184090e4dbfc9", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "shared/cn_commerce_base.py:1322"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-8e230a0f54b533c5", "level": "note", "message": {"text": "Possibly dead Python function: drain"}, "properties": {"repobilityId": "eaf5b0aa0fd72e74", "scanner": "scanner-primary", "fingerprint": "8e230a0f54b533c5", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "shared/cn_commerce_base.py:1666"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-20a4a587e52b9bf5", "level": "note", "message": {"text": "Possibly dead Python function: start_auto_process"}, "properties": {"repobilityId": "1839b5ec392711df", "scanner": "scanner-primary", "fingerprint": "20a4a587e52b9bf5", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "shared/cn_commerce_base.py:1749"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c8a5a8e69fba031f", "level": "note", "message": {"text": "Possibly dead Python function: cleanup"}, "properties": {"repobilityId": "c1cf2fbdf1e262a0", "scanner": "scanner-primary", "fingerprint": "c8a5a8e69fba031f", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "shared/cn_commerce_base.py:1941"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-88c61a1989a165b5", "level": "note", "message": {"text": "Possibly dead Python function: deep_health_check"}, "properties": {"repobilityId": "bdff4bc2d522e804", "scanner": "scanner-primary", "fingerprint": "88c61a1989a165b5", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "shared/cn_commerce_base.py:3114"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-0df0eff582313aa4", "level": "note", "message": {"text": "Possibly dead Python function: unsubscribe"}, "properties": {"repobilityId": "c67fee6b30e76d20", "scanner": "scanner-primary", "fingerprint": "0df0eff582313aa4", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "shared/cn_commerce_base.py:3930"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-add93f5d57a4ad68", "level": "note", "message": {"text": "Possibly dead Python function: update_subscription"}, "properties": {"repobilityId": "3b35e3c6975ad2c7", "scanner": "scanner-primary", "fingerprint": "add93f5d57a4ad68", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "shared/cn_commerce_base.py:3984"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-4f6223fd86555c08", "level": "note", "message": {"text": "Possibly dead Python function: clear_history"}, "properties": {"repobilityId": "ce5a2cd1428c9a38", "scanner": "scanner-primary", "fingerprint": "4f6223fd86555c08", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "shared/cn_commerce_base.py:4197"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-77898c188f4b373a", "level": "note", "message": {"text": "Possibly dead Python function: add_warning"}, "properties": {"repobilityId": "96622bf97bb5e137", "scanner": "scanner-primary", "fingerprint": "77898c188f4b373a", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "shared/cn_commerce_base.py:4278"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d06fd6416f78c8c5", "level": "note", "message": {"text": "Possibly dead Python function: add_rules"}, "properties": {"repobilityId": "61deacb8226f1b08", "scanner": "scanner-primary", "fingerprint": "d06fd6416f78c8c5", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "shared/cn_commerce_base.py:4339"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-4092d36d4c5246d5", "level": "note", "message": {"text": "Possibly dead Python function: validate_from_env"}, "properties": {"repobilityId": "ab0603847b49b19c", "scanner": "scanner-primary", "fingerprint": "4092d36d4c5246d5", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "shared/cn_commerce_base.py:4482"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-39f44df931c02e77", "level": "note", "message": {"text": "Possibly dead Python function: remove_endpoint"}, "properties": {"repobilityId": "a7ef88893366b78d", "scanner": "scanner-primary", "fingerprint": "39f44df931c02e77", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "shared/cn_commerce_base.py:4597"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a66bb970d21299af", "level": "note", "message": {"text": "Possibly dead Python function: record_failure"}, "properties": {"repobilityId": "e3f52d24c55c1b41", "scanner": "scanner-primary", "fingerprint": "a66bb970d21299af", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "shared/cn_commerce_base.py:4660"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-73f8787116f896ad", "level": "note", "message": {"text": "Possibly dead Python function: decrement_connections"}, "properties": {"repobilityId": "8e4e7091190f5426", "scanner": "scanner-primary", "fingerprint": "73f8787116f896ad", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "shared/cn_commerce_base.py:4749"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-48d694d0772acf91", "level": "note", "message": {"text": "Possibly dead Python function: start_recovery_monitor"}, "properties": {"repobilityId": "9edf1e83b0d1b383", "scanner": "scanner-primary", "fingerprint": "48d694d0772acf91", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "shared/cn_commerce_base.py:5047"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-1b9a0192172a6056", "level": "note", "message": {"text": "Possibly dead Python function: stop_recovery_monitor"}, "properties": {"repobilityId": "52e3de18951384a9", "scanner": "scanner-primary", "fingerprint": "1b9a0192172a6056", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "shared/cn_commerce_base.py:5070"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-2167d49769c8c220", "level": "note", "message": {"text": "Possibly dead Python function: replay_filtered"}, "properties": {"repobilityId": "b8180841b99a0e2d", "scanner": "scanner-primary", "fingerprint": "2167d49769c8c220", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "shared/cn_commerce_base.py:5719"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-094826b54a9a71ae", "level": "note", "message": {"text": "Possibly dead Python function: enable_breakpoint"}, "properties": {"repobilityId": "0234c6a2431ac0e0", "scanner": "scanner-primary", "fingerprint": "094826b54a9a71ae", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "shared/cn_commerce_base.py:6226"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ecbfc9f0c09d9600", "level": "note", "message": {"text": "Possibly dead Python function: disable_breakpoint"}, "properties": {"repobilityId": "e573a31be1229ee5", "scanner": "scanner-primary", "fingerprint": "ecbfc9f0c09d9600", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "shared/cn_commerce_base.py:6235"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d63da3583b14afc0", "level": "warning", "message": {"text": "Dockerfile runs as root: Dockerfile"}, "properties": {"repobilityId": "a2ed1bd120e507db", "scanner": "scanner-primary", "fingerprint": "d63da3583b14afc0", "layer": "hardware", "severity": "medium", "confidence": 1.0, "tags": ["security", "container"]}}, {"ruleId": "scanner-de3c1f217d72a063", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: python:3.12-slim"}, "properties": {"repobilityId": "c56aa3f31a12f1ff", "scanner": "scanner-primary", "fingerprint": "de3c1f217d72a063", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Dockerfile"}, "region": {"startLine": 13}}}]}, {"ruleId": "scanner-aa5acaa49eb8315b", "level": "note", "message": {"text": "Containers defined but no K8s/orchestration manifest found"}, "properties": {"repobilityId": "b230ea9b68736081", "scanner": "scanner-primary", "fingerprint": "aa5acaa49eb8315b", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["coverage", "deployment"]}}, {"ruleId": "scanner-9710c8d059e53154", "level": "none", "message": {"text": "No frontend routes/components detected"}, "properties": {"repobilityId": "44ca61485762e494", "scanner": "scanner-primary", "fingerprint": "9710c8d059e53154", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-87173ebe96a35165", "level": "warning", "message": {"text": "Insecure pattern 'subprocess_shell_true' in pyproject.toml:222"}, "properties": {"repobilityId": "aef729276289d742", "scanner": "scanner-primary", "fingerprint": "87173ebe96a35165", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "subprocess_shell_true"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pyproject.toml"}, "region": {"startLine": 222}}}]}, {"ruleId": "scanner-604c7a3c7b348ad5", "level": "warning", "message": {"text": "Insecure pattern 'weak_hash' in shared/cn_commerce_base.py:394"}, "properties": {"repobilityId": "dd1c15ce245625b4", "scanner": "scanner-primary", "fingerprint": "604c7a3c7b348ad5", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "weak_hash"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "shared/cn_commerce_base.py"}, "region": {"startLine": 394}}}]}, {"ruleId": "scanner-e81d1a7f95cfebb0", "level": "warning", "message": {"text": "Insecure pattern 'weak_hash' in servers/taobao/server.py:34"}, "properties": {"repobilityId": "2be6dad70eedb5d1", "scanner": "scanner-primary", "fingerprint": "e81d1a7f95cfebb0", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "weak_hash"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "servers/taobao/server.py"}, "region": {"startLine": 34}}}]}, {"ruleId": "scanner-0f11c28b4740bf96", "level": "warning", "message": {"text": "Insecure pattern 'weak_hash' in servers/pinduoduo/server.py:38"}, "properties": {"repobilityId": "53a80e8dada6b75d", "scanner": "scanner-primary", "fingerprint": "0f11c28b4740bf96", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "weak_hash"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "servers/pinduoduo/server.py"}, "region": {"startLine": 38}}}]}, {"ruleId": "scanner-261d8913747ed9d0", "level": "warning", "message": {"text": "Insecure pattern 'weak_hash' in servers/xiaohongshu/server.py:37"}, "properties": {"repobilityId": "66b739f06cc8f662", "scanner": "scanner-primary", "fingerprint": "261d8913747ed9d0", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "weak_hash"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "servers/xiaohongshu/server.py"}, "region": {"startLine": 37}}}]}, {"ruleId": "scanner-ae311722745977e8", "level": "warning", "message": {"text": "Insecure pattern 'weak_hash' in servers/kuaishou/server.py:41"}, "properties": {"repobilityId": "c47636f80f95a3e3", "scanner": "scanner-primary", "fingerprint": "ae311722745977e8", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "weak_hash"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "servers/kuaishou/server.py"}, "region": {"startLine": 41}}}]}, {"ruleId": "scanner-e19f88e456dac100", "level": "warning", "message": {"text": "Insecure pattern 'weak_hash' in servers/doudian/server.py:91"}, "properties": {"repobilityId": "89d4b918cb9cd8f3", "scanner": "scanner-primary", "fingerprint": "e19f88e456dac100", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "weak_hash"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "servers/doudian/server.py"}, "region": {"startLine": 91}}}]}, {"ruleId": "scanner-7efbda965f283c17", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "925b528a63157ee6", "scanner": "scanner-primary", "fingerprint": "7efbda965f283c17", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/test.yml"}, "region": {"startLine": 24}}}]}, {"ruleId": "scanner-7efbda965f283c17", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "936d59e0fe228df4", "scanner": "scanner-primary", "fingerprint": "7efbda965f283c17", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/test.yml"}, "region": {"startLine": 48}}}]}, {"ruleId": "scanner-7efbda965f283c17", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "925b528a63157ee6", "scanner": "scanner-primary", "fingerprint": "7efbda965f283c17", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/test.yml"}, "region": {"startLine": 62}}}]}, {"ruleId": "scanner-7efbda965f283c17", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "925b528a63157ee6", "scanner": "scanner-primary", "fingerprint": "7efbda965f283c17", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/test.yml"}, "region": {"startLine": 85}}}]}, {"ruleId": "scanner-7efbda965f283c17", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "925b528a63157ee6", "scanner": "scanner-primary", "fingerprint": "7efbda965f283c17", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/test.yml"}, "region": {"startLine": 108}}}]}, {"ruleId": "scanner-7efbda965f283c17", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "925b528a63157ee6", "scanner": "scanner-primary", "fingerprint": "7efbda965f283c17", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/test.yml"}, "region": {"startLine": 127}}}]}, {"ruleId": "scanner-13997a3b10e9b8b4", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "177dca8b20833972", "scanner": "scanner-primary", "fingerprint": "13997a3b10e9b8b4", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/mcp-registry.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-7407dcfdb2b5c014", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "938d1a5227326eca", "scanner": "scanner-primary", "fingerprint": "7407dcfdb2b5c014", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/auto-merge.yml"}, "region": {"startLine": 17}}}]}, {"ruleId": "scanner-bda6deb11902724f", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "52fa6a3933670e49", "scanner": "scanner-primary", "fingerprint": "bda6deb11902724f", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/auto-merge.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a53bf972e19b52fd", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "e41d383711839b43", "scanner": "scanner-primary", "fingerprint": "a53bf972e19b52fd", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/publish.yml"}, "region": {"startLine": 23}}}]}, {"ruleId": "scanner-a53bf972e19b52fd", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "92994a16dfe89492", "scanner": "scanner-primary", "fingerprint": "a53bf972e19b52fd", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/publish.yml"}, "region": {"startLine": 33}}}]}, {"ruleId": "scanner-7ffa33751be3d771", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "491a3ad29cbaf189", "scanner": "scanner-primary", "fingerprint": "7ffa33751be3d771", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/publish.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-839ef4fd12af11b2", "level": "note", "message": {"text": "Very large file: tests/test_integration.py (1345 lines)"}, "properties": {"repobilityId": "d1be68b27bf61c72", "scanner": "scanner-primary", "fingerprint": "839ef4fd12af11b2", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-c034e97aeeb8eb7b", "level": "note", "message": {"text": "Very large file: tests/test_cn_commerce_base.py (4688 lines)"}, "properties": {"repobilityId": "caa378d2f6a1271b", "scanner": "scanner-primary", "fingerprint": "c034e97aeeb8eb7b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-fa3d44f394cef314", "level": "note", "message": {"text": "Very large file: shared/cn_commerce_base.py (7026 lines)"}, "properties": {"repobilityId": "67dc0c1ea1ad92db", "scanner": "scanner-primary", "fingerprint": "fa3d44f394cef314", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-bab8102d714ffc6c", "level": "note", "message": {"text": "Very large file: servers/taobao/tests/test_taobao.py (1247 lines)"}, "properties": {"repobilityId": "4887c3319f743a4d", "scanner": "scanner-primary", "fingerprint": "bab8102d714ffc6c", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-2f4686ab0119c700", "level": "note", "message": {"text": "Very large file: servers/oceanengine/tests/test_oceanengine.py (1578 lines)"}, "properties": {"repobilityId": "0627c4eda45d8617", "scanner": "scanner-primary", "fingerprint": "2f4686ab0119c700", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-abdd64ff1dcbafd3", "level": "note", "message": {"text": "Very large file: servers/doudian/server.py (1701 lines)"}, "properties": {"repobilityId": "ed3c4f3a957a9212", "scanner": "scanner-primary", "fingerprint": "abdd64ff1dcbafd3", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-6f3cf47ecff61551", "level": "note", "message": {"text": "Very large file: servers/doudian/tests/test_doudian.py (2149 lines)"}, "properties": {"repobilityId": "8b78b97918760c7d", "scanner": "scanner-primary", "fingerprint": "6f3cf47ecff61551", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-0ae3628650178b92", "level": "note", "message": {"text": "Very large file: servers/jd/tests/test_jd.py (1452 lines)"}, "properties": {"repobilityId": "a82a9528eaa3e771", "scanner": "scanner-primary", "fingerprint": "0ae3628650178b92", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "076523d755054da4", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "bd56912f029008d3", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "c1068a2afc35160b", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "3b30024488a9f9a0", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-b4b4bc68e6b0147e", "level": "note", "message": {"text": "Legacy-named symbol `test_get_stats_returns_copy` in tests/test_dashboard.py:119"}, "properties": {"repobilityId": "8a0f10cf7cb55abd", "scanner": "scanner-primary", "fingerprint": "b4b4bc68e6b0147e", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-4076d38be58d6e9b", "level": "note", "message": {"text": "Legacy-named symbol `new_field_v2` in tests/test_api_compatibility.py:292"}, "properties": {"repobilityId": "ee6fb20d7ff0b83e", "scanner": "scanner-primary", "fingerprint": "4076d38be58d6e9b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-7493c11d4edb7e37", "level": "note", "message": {"text": "Legacy-named symbol `test_returns_dict_copy` in tests/test_i18n.py:240"}, "properties": {"repobilityId": "9137408b61abc08f", "scanner": "scanner-primary", "fingerprint": "7493c11d4edb7e37", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-250f57e8a1dbd3c5", "level": "none", "message": {"text": "4 env vars used in code but missing from .env.example"}, "properties": {"repobilityId": "57584f22b735b5ee", "scanner": "scanner-primary", "fingerprint": "250f57e8a1dbd3c5", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "config-drift"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "dbf209c8a7d9ce3d", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "35e21d3c62c8b301", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "6df549beb4b856eb", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-be46ea126aa5d8dc", "level": "note", "message": {"text": "Near-duplicate function bodies in 3 places"}, "properties": {"repobilityId": "1e37586d12a46906", "scanner": "scanner-primary", "fingerprint": "be46ea126aa5d8dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "c6dc66a1d7cd8bfd", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "e817e454624314f6", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "4e734ef913af2322", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "55e208df4e1451a2", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-be46ea126aa5d8dc", "level": "note", "message": {"text": "Near-duplicate function bodies in 3 places"}, "properties": {"repobilityId": "d0edffaf481547aa", "scanner": "scanner-primary", "fingerprint": "be46ea126aa5d8dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-be46ea126aa5d8dc", "level": "note", "message": {"text": "Near-duplicate function bodies in 3 places"}, "properties": {"repobilityId": "1eeeea5cb5b85487", "scanner": "scanner-primary", "fingerprint": "be46ea126aa5d8dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "a3b14c23d7712bbe", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-be46ea126aa5d8dc", "level": "note", "message": {"text": "Near-duplicate function bodies in 3 places"}, "properties": {"repobilityId": "b9f4887e188f1ba3", "scanner": "scanner-primary", "fingerprint": "be46ea126aa5d8dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-33a6b62e30ce7ab4", "level": "note", "message": {"text": "Near-duplicate function bodies in 6 places"}, "properties": {"repobilityId": "37b8c7d6ca2d5966", "scanner": "scanner-primary", "fingerprint": "33a6b62e30ce7ab4", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-122053f21232d80c", "level": "note", "message": {"text": "Near-duplicate function bodies in 14 places"}, "properties": {"repobilityId": "c0ec1314e28b2234", "scanner": "scanner-primary", "fingerprint": "122053f21232d80c", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-02525d39071dd2c7", "level": "note", "message": {"text": "Near-duplicate function bodies in 5 places"}, "properties": {"repobilityId": "8eb5585c602e5f61", "scanner": "scanner-primary", "fingerprint": "02525d39071dd2c7", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-c54c6fb8e364daaa", "level": "note", "message": {"text": "Near-duplicate function bodies in 16 places"}, "properties": {"repobilityId": "50111e2196a0d226", "scanner": "scanner-primary", "fingerprint": "c54c6fb8e364daaa", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-76a2f6818267a9a8", "level": "note", "message": {"text": "Near-duplicate function bodies in 8 places"}, "properties": {"repobilityId": "01c3128bb093b776", "scanner": "scanner-primary", "fingerprint": "76a2f6818267a9a8", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-be46ea126aa5d8dc", "level": "note", "message": {"text": "Near-duplicate function bodies in 3 places"}, "properties": {"repobilityId": "37249b9ccd849f7c", "scanner": "scanner-primary", "fingerprint": "be46ea126aa5d8dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "354ffa29ebe8501b", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "7af0c4e9d9056e56", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}]}]}