{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-8c1524a66883babd", "name": "Possibly dead Python function: safe_push", "shortDescription": {"text": "Possibly dead Python function: safe_push"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6510b7c462d1cbb5", "name": "Possibly dead Python function: weighted_ret", "shortDescription": {"text": "Possibly dead Python function: weighted_ret"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3b1d03207a318097", "name": "Possibly dead Python function: handle_starttag", "shortDescription": {"text": "Possibly dead Python function: handle_starttag"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-69f001e3ab202981", "name": "Possibly dead Python function: handle_endtag", "shortDescription": {"text": "Possibly dead Python function: handle_endtag"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-59164973deb52681", "name": "Possibly dead Python function: handle_data", "shortDescription": {"text": "Possibly dead Python function: handle_data"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-99684efb1d6f2f10", "name": "Possibly dead Python function: build_quote_slots", "shortDescription": {"text": "Possibly dead Python function: build_quote_slots"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0f7813f424c50331", "name": "Possibly dead Python function: b_market_1m_leader", "shortDescription": {"text": "Possibly dead Python function: b_market_1m_leader"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8e5a9649a9562191", "name": "Possibly dead Python function: b_market_breadth", "shortDescription": {"text": "Possibly dead Python function: b_market_breadth"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2bdf26f3392f19b5", "name": "Possibly dead Python function: b_memory_ddr5", "shortDescription": {"text": "Possibly dead Python function: b_memory_ddr5"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-168144397075a17c", "name": "Possibly dead Python function: b_crypto_btc", "shortDescription": {"text": "Possibly dead Python function: b_crypto_btc"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-591435fee904ef71", "name": "Possibly dead Python function: b_commodity_gold", "shortDescription": {"text": "Possibly dead Python function: b_commodity_gold"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1762fe189a5aded0", "name": "Possibly dead Python function: b_fx_usdkrw", "shortDescription": {"text": "Possibly dead Python function: b_fx_usdkrw"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-68523b1bffa62fe8", "name": "Possibly dead Python function: b_dxy", "shortDescription": {"text": "Possibly dead Python function: b_dxy"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-04febba5c2fe1c40", "name": "Possibly dead Python function: b_vix", "shortDescription": {"text": "Possibly dead Python function: b_vix"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6d2c42609fd295bf", "name": "Possibly dead Python function: b_us10y", "shortDescription": {"text": "Possibly dead Python function: b_us10y"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0bcd9b900453a255", "name": "Possibly dead Python function: b_battery_lithium", "shortDescription": {"text": "Possibly dead Python function: b_battery_lithium"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c68295be9a7e0e32", "name": "Possibly dead Python function: b_smp", "shortDescription": {"text": "Possibly dead Python function: b_smp"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ff2fa8c456713d99", "name": "Possibly dead Python function: b_scfi", "shortDescription": {"text": "Possibly dead Python function: b_scfi"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0eab0d233ce00f65", "name": "Possibly dead Python function: b_index_kospi", "shortDescription": {"text": "Possibly dead Python function: b_index_kospi"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-84fc7410d381ae63", "name": "Possibly dead Python function: b_index_nasdaq", "shortDescription": {"text": "Possibly dead Python function: b_index_nasdaq"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1ddad4f89572b524", "name": "Possibly dead Python function: b_alert_counts", "shortDescription": {"text": "Possibly dead Python function: b_alert_counts"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-54bee4f36e9ff7c2", "name": "Possibly dead Python function: b_featured_volume_top", "shortDescription": {"text": "Possibly dead Python function: b_featured_volume_top"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3fc09fffd8011505", "name": "Possibly dead Python function: b_featured_chg_top", "shortDescription": {"text": "Possibly dead Python function: b_featured_chg_top"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7c00e6aeb3c8b75d", "name": "Possibly dead Python function: b_index_kosdaq", "shortDescription": {"text": "Possibly dead Python function: b_index_kosdaq"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8b5c8e0bed427027", "name": "Possibly dead Python function: b_index_sp500", "shortDescription": {"text": "Possibly dead Python function: b_index_sp500"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5b9b376c82505dfb", "name": "Possibly dead Python function: b_index_nikkei", "shortDescription": {"text": "Possibly dead Python function: b_index_nikkei"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-de8da21b601c8e8e", "name": "Possibly dead Python function: b_index_russell", "shortDescription": {"text": "Possibly dead Python function: b_index_russell"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a0d7bcf9278923ef", "name": "Possibly dead Python function: b_index_tsec", "shortDescription": {"text": "Possibly dead Python function: b_index_tsec"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2abf45782aa9b6d8", "name": "Privileged port 23 in use", "shortDescription": {"text": "Privileged port 23 in use"}, "fullDescription": {"text": "Port 23 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-5c26bab0c8c0bae4", "name": "Privileged port 30 in use", "shortDescription": {"text": "Privileged port 30 in use"}, "fullDescription": {"text": "Port 30 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3f4cb2f52abb3302", "name": "Privileged port 16 in use", "shortDescription": {"text": "Privileged port 16 in use"}, "fullDescription": {"text": "Port 16 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-eee78839115ced1a", "name": "Privileged port 59 in use", "shortDescription": {"text": "Privileged port 59 in use"}, "fullDescription": {"text": "Port 59 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9710c8d059e53154", "name": "No frontend routes/components detected", "shortDescription": {"text": "No frontend routes/components detected"}, "fullDescription": {"text": "No React/Vue/Next routes were found. This is fine for backend-only repos."}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-8dcdb26b583e58f8", "name": "Insecure pattern 'direct_innerhtml_assignment' in seibro.html:168", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in seibro.html:168"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0692afc8e96989a9", "name": "Insecure pattern 'direct_innerhtml_assignment' in market_alert.html:796", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in market_alert.html:796"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-98f08f205e3190af", "name": "Insecure pattern 'direct_innerhtml_assignment' in wrap.html:369", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in wrap.html:369"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c288c760dbaa5288", "name": "Insecure pattern 'local_storage_auth_token' in wrap.html:2853", "shortDescription": {"text": "Insecure pattern 'local_storage_auth_token' in wrap.html:2853"}, "fullDescription": {"text": "Found a known-risky pattern (local_storage_auth_token). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-15a8bbecc79a6f24", "name": "Insecure pattern 'direct_innerhtml_assignment' in architecture.html:253", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in architecture.html:253"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6d137790ee583dff", "name": "Insecure pattern 'direct_innerhtml_assignment' in index.html:171", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in index.html:171"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0a3fb2a146a779dc", "name": "Insecure pattern 'direct_innerhtml_assignment' in market.html:806", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in market.html:806"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3ca4e44d7b9ad824", "name": "Insecure pattern 'direct_innerhtml_assignment' in universe.html:205", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in universe.html:205"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-fe926578b5c2f918", "name": "Possible secret in execution/earnings_calendar_sync.py", "shortDescription": {"text": "Possible secret in execution/earnings_calendar_sync.py"}, "fullDescription": {"text": "Detected pattern matching generic_api_key. Rotate the credential and move to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-32c3c9428452735f", "name": "Possible secret in execution/sisyphe_bot.py", "shortDescription": {"text": "Possible secret in execution/sisyphe_bot.py"}, "fullDescription": {"text": "Detected pattern matching generic_api_key. Rotate the credential and move to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-22b8fce1dd769dbe", "name": "Insecure pattern 'tls_verify_false' in execution/sources/foreign_ir.py:143", "shortDescription": {"text": "Insecure pattern 'tls_verify_false' in execution/sources/foreign_ir.py:143"}, "fullDescription": {"text": "Found a known-risky pattern (tls_verify_false). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-0337648e29d3c4d8", "name": "Possible secret in execution/earnings_bot/ticker_registry.py", "shortDescription": {"text": "Possible secret in execution/earnings_bot/ticker_registry.py"}, "fullDescription": {"text": "Detected pattern matching generic_api_key. Rotate the credential and move to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-6372cebde0220094", "name": "No auth library detected", "shortDescription": {"text": "No auth library detected"}, "fullDescription": {"text": "The scanner did not find any standard auth library (JWT, OAuth, NextAuth, Auth0, etc.). The repo has auth/admin/session surface indicators, so auth may live in custom code, in a separate service, or be missing."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1e27723d94637c1a", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0a043fa411fd1ef0", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b39ec238508ecc48", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1abf27bf347efe50", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-5ddd8104969d13b1", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ab06d463f9ef9f82", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3d45332f51f0d0d3", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6fddf46249a6c6a5", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cabf294a71000843", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-211fbd26977edca2", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f82305ef3977bed6", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2c46e39102901c32", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-32868b1abb19236d", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-37716d9c0a33ad5c", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d9b97359ddf970b2", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v3 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6e6b8feb9fb1f759", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a5154024d0f3d5fe", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c2af74d3c4dc3c85", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a4d281d01d94bd1c", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-bfc1629c5fd40c89", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2116932d5bc21116", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v3 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-33c030ac2c970b64", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-44821681f40abe25", "name": "Very large file: execution/create_dashboard.py (8270 lines)", "shortDescription": {"text": "Very large file: execution/create_dashboard.py (8270 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-010ab546d473880f", "name": "Very large file: execution/sisyphe_bot.py (2574 lines)", "shortDescription": {"text": "Very large file: execution/sisyphe_bot.py (2574 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6893a6c8b0861585", "name": "Very low test-to-source ratio", "shortDescription": {"text": "Very low test-to-source ratio"}, "fullDescription": {"text": "1 test file(s) for 101 source file(s) (ratio 0.01). Consider adding integration or unit tests for critical paths."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-141b30a41e03817b", "name": "No license file detected", "shortDescription": {"text": "No license file detected"}, "fullDescription": {"text": "No LICENSE/COPYING/NOTICE file was found. Generated repositories often omit licensing, which blocks reuse and automated intake."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-faccb9061e9b52a0", "name": "No README detected", "shortDescription": {"text": "No README detected"}, "fullDescription": {"text": "No README file was found. Generated repos without README context are hard to operate, validate, or safely hand off."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 582 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-72b2a6250083a784", "name": "Placeholder or mock-heavy implementation detected", "shortDescription": {"text": "Placeholder or mock-heavy implementation detected"}, "fullDescription": {"text": "Found 20 placeholder/mock markers across 3 source files. This often means the repo looks complete while core flows still use generated scaffolding or fake data."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b9088664ace7f748", "name": "Composite production-readiness gap", "shortDescription": {"text": "Composite production-readiness gap"}, "fullDescription": {"text": "Multiple low-cost hardening controls are missing together: license, operator-readme. Opus verification showed these co-occurring gaps are a better readiness signal than reading each flag in isolation."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-749d4bc1bd66df5f", "name": "Agent instructions exist but release-hardening basics are missing", "shortDescription": {"text": "Agent instructions exist but release-hardening basics are missing"}, "fullDescription": {"text": "AI-coder instruction files were found, but the repo is missing license, operator-readme. Treat this as a contract gap: the agent is guided, but the generated output is not yet guarded by the controls that make it repeatable."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-abb265ed0f23596b", "name": "Agent authority lacks a verifier contract: .claude/rules/target-transform.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/rules/target-transform.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-506c72843d5c71e3", "name": "Agent authority lacks a verifier contract: .claude/rules/vm-deploy.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/rules/vm-deploy.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ffab02ed5aa606c1", "name": "Legacy-named symbol `df_old` in calculate_wrap_nav.py:70", "shortDescription": {"text": "Legacy-named symbol `df_old` in calculate_wrap_nav.py:70"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f6c5ae744774edc2", "name": "Commented-code block (7 lines) in calculate_wrap_nav.py:41", "shortDescription": {"text": "Commented-code block (7 lines) in calculate_wrap_nav.py:41"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-188bd208dd1fe8ad", "name": "Commented-code block (7 lines) in calculate_returns.py:17", "shortDescription": {"text": "Commented-code block (7 lines) in calculate_returns.py:17"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-13d1ba30b6ac48cb", "name": "Network/subprocess call without timeout or try/except \u2014 add_universe_ticker.py:149", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 add_universe_ticker.py:149"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-faaefd6868dc07f9", "name": "Commented-code block (6 lines) in execution/daily_alert.py:16", "shortDescription": {"text": "Commented-code block (6 lines) in execution/daily_alert.py:16"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-87b7ddd50bf484e7", "name": "Commented-code block (6 lines) in execution/create_portfolio_tables.py:26", "shortDescription": {"text": "Commented-code block (6 lines) in execution/create_portfolio_tables.py:26"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-b8f576472b92d16f", "name": "Commented-code block (5 lines) in execution/daily_portfolio_report.py:115", "shortDescription": {"text": "Commented-code block (5 lines) in execution/daily_portfolio_report.py:115"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-d819e2797263e64d", "name": "Commented-code block (6 lines) in execution/draw_wrap_charts.py:45", "shortDescription": {"text": "Commented-code block (6 lines) in execution/draw_wrap_charts.py:45"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-19779b66da0b3898", "name": "Network/subprocess call without timeout or try/except \u2014 execution/sisyphe_bot.py:1566", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 execution/sisyphe_bot.py:1566"}, "fullDescription": {"text": "`requests.put(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6ee49fc828f5041a", "name": "Blocking `requests.get(...)` inside `async def idea_command` \u2014 execution/sisyphe_bot.py:2225", "shortDescription": {"text": "Blocking `requests.get(...)` inside `async def idea_command` \u2014 execution/sisyphe_bot.py:2225"}, "fullDescription": {"text": "Sync I/O inside an async function blocks the event loop. While `requests.get(...)` is running, *all* other coroutines on this loop are paused \u2014 silent throughput collapse under concurrency. Use the async equivalent (`httpx.AsyncClient`, `asyncio.sleep`, `aiofiles`) or wrap with `await asyncio.to_thread(...)`."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "high", "confidence": 1.0}}, {"id": "scanner-8f48eb5a3ccb621b", "name": "Commented-code block (6 lines) in execution/sources/base.py:109", "shortDescription": {"text": "Commented-code block (6 lines) in execution/sources/base.py:109"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-40273265e5aac025", "name": "Legacy-named symbol `earnings_bot_v1` in execution/earnings_bot/prompt_builder.py:24", "shortDescription": {"text": "Legacy-named symbol `earnings_bot_v1` in execution/earnings_bot/prompt_builder.py:24"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5fa5af25316da646", "name": "16 env vars used in code but missing from .env.example", "shortDescription": {"text": "16 env vars used in code but missing from .env.example"}, "fullDescription": {"text": "Drift between code and config docs. The first few: `DATA_GO_KR_API_KEY`, `EARNINGS_BOT_DRY_RUN`, `EARNINGS_BOT_LOG_LEVEL`, `ECOS_API_KEY`, `FRED_API_KEY`, `KIS_APP_KEY`, `KIS_APP_SECRET`, `KIS_BASE_URL` + 8 more. Add them (with a placeholder/comment) to .env.example so onboarding doesn't break."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2c04133e54348533", "name": "Near-duplicate function bodies in 2 places", "shortDescription": {"text": "Near-duplicate function bodies in 2 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nadd_aum.py:read_input, add_universe_ticker.py:read_input\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-49c98f7cedd9c977", "name": "Near-duplicate function bodies in 4 places", "shortDescription": {"text": "Near-duplicate function bodies in 4 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nexecution/earnings_bot/transcript_sources/insider_monkey.py:parse, execution/earnings_bot/transcript_sources/motley_fool.py:parse, execution/earnings_bot/transcript_sources/marketbeat.py:parse, execution/earnings_bot/transcript_sources/globe_and_mail.py:parse\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/19743"}, "properties": {"repository": "sisyphe10/Antigravity_Market_Dashboard", "repoUrl": "https://github.com/sisyphe10/Antigravity_Market_Dashboard", "branch": "main"}, "results": [{"ruleId": "scanner-8c1524a66883babd", "level": "note", "message": {"text": "Possibly dead Python function: safe_push"}, "properties": {"repobilityId": "b29e2e898ed1e7e8", "scanner": "scanner-primary", "fingerprint": "8c1524a66883babd", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/local_safe_push.py:152"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6510b7c462d1cbb5", "level": "note", "message": {"text": "Possibly dead Python function: weighted_ret"}, "properties": {"repobilityId": "d79d2242b5798cdf", "scanner": "scanner-primary", "fingerprint": "6510b7c462d1cbb5", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "execution/fetch_kodex_sectors.py:169"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3b1d03207a318097", "level": "note", "message": {"text": "Possibly dead Python function: handle_starttag"}, "properties": {"repobilityId": "3bf216d149959ebf", "scanner": "scanner-primary", "fingerprint": "3b1d03207a318097", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "execution/fetch_kna_news.py:80"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-69f001e3ab202981", "level": "note", "message": {"text": "Possibly dead Python function: handle_endtag"}, "properties": {"repobilityId": "7eb6f3decafc1766", "scanner": "scanner-primary", "fingerprint": "69f001e3ab202981", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "execution/fetch_kna_news.py:92"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-59164973deb52681", "level": "note", "message": {"text": "Possibly dead Python function: handle_data"}, "properties": {"repobilityId": "3a673a278f4fc1e6", "scanner": "scanner-primary", "fingerprint": "59164973deb52681", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "execution/fetch_kna_news.py:101"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-99684efb1d6f2f10", "level": "note", "message": {"text": "Possibly dead Python function: build_quote_slots"}, "properties": {"repobilityId": "f3b648d0cf0ce20d", "scanner": "scanner-primary", "fingerprint": "99684efb1d6f2f10", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "execution/create_landing_highlights.py:44"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-0f7813f424c50331", "level": "note", "message": {"text": "Possibly dead Python function: b_market_1m_leader"}, "properties": {"repobilityId": "79d0fc2c650aecd7", "scanner": "scanner-primary", "fingerprint": "0f7813f424c50331", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "execution/create_landing_highlights.py:234"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-8e5a9649a9562191", "level": "note", "message": {"text": "Possibly dead Python function: b_market_breadth"}, "properties": {"repobilityId": "9e249481096ad092", "scanner": "scanner-primary", "fingerprint": "8e5a9649a9562191", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "execution/create_landing_highlights.py:254"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-2bdf26f3392f19b5", "level": "note", "message": {"text": "Possibly dead Python function: b_memory_ddr5"}, "properties": {"repobilityId": "e862275bd4bf8643", "scanner": "scanner-primary", "fingerprint": "2bdf26f3392f19b5", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "execution/create_landing_highlights.py:276"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-168144397075a17c", "level": "note", "message": {"text": "Possibly dead Python function: b_crypto_btc"}, "properties": {"repobilityId": "e0e32b08b35090e0", "scanner": "scanner-primary", "fingerprint": "168144397075a17c", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "execution/create_landing_highlights.py:299"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-591435fee904ef71", "level": "note", "message": {"text": "Possibly dead Python function: b_commodity_gold"}, "properties": {"repobilityId": "63ffe92c55aff030", "scanner": "scanner-primary", "fingerprint": "591435fee904ef71", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "execution/create_landing_highlights.py:312"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-1762fe189a5aded0", "level": "note", "message": {"text": "Possibly dead Python function: b_fx_usdkrw"}, "properties": {"repobilityId": "3ca7e74a3e36a84f", "scanner": "scanner-primary", "fingerprint": "1762fe189a5aded0", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "execution/create_landing_highlights.py:322"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-68523b1bffa62fe8", "level": "note", "message": {"text": "Possibly dead Python function: b_dxy"}, "properties": {"repobilityId": "f89c774c9e4df467", "scanner": "scanner-primary", "fingerprint": "68523b1bffa62fe8", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "execution/create_landing_highlights.py:332"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-04febba5c2fe1c40", "level": "note", "message": {"text": "Possibly dead Python function: b_vix"}, "properties": {"repobilityId": "a0aa29ccc8535d6d", "scanner": "scanner-primary", "fingerprint": "04febba5c2fe1c40", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "execution/create_landing_highlights.py:348"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6d2c42609fd295bf", "level": "note", "message": {"text": "Possibly dead Python function: b_us10y"}, "properties": {"repobilityId": "e4f532a777f97b1e", "scanner": "scanner-primary", "fingerprint": "6d2c42609fd295bf", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "execution/create_landing_highlights.py:364"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-0bcd9b900453a255", "level": "note", "message": {"text": "Possibly dead Python function: b_battery_lithium"}, "properties": {"repobilityId": "d47f468a6bfc77fd", "scanner": "scanner-primary", "fingerprint": "0bcd9b900453a255", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "execution/create_landing_highlights.py:374"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c68295be9a7e0e32", "level": "note", "message": {"text": "Possibly dead Python function: b_smp"}, "properties": {"repobilityId": "680689ff5b55e189", "scanner": "scanner-primary", "fingerprint": "c68295be9a7e0e32", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "execution/create_landing_highlights.py:396"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ff2fa8c456713d99", "level": "note", "message": {"text": "Possibly dead Python function: b_scfi"}, "properties": {"repobilityId": "9bb78962e4278993", "scanner": "scanner-primary", "fingerprint": "ff2fa8c456713d99", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "execution/create_landing_highlights.py:406"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-0eab0d233ce00f65", "level": "note", "message": {"text": "Possibly dead Python function: b_index_kospi"}, "properties": {"repobilityId": "c09118b85e07bb05", "scanner": "scanner-primary", "fingerprint": "0eab0d233ce00f65", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "execution/create_landing_highlights.py:419"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-84fc7410d381ae63", "level": "note", "message": {"text": "Possibly dead Python function: b_index_nasdaq"}, "properties": {"repobilityId": "44dbb27caaf80992", "scanner": "scanner-primary", "fingerprint": "84fc7410d381ae63", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "execution/create_landing_highlights.py:432"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-1ddad4f89572b524", "level": "note", "message": {"text": "Possibly dead Python function: b_alert_counts"}, "properties": {"repobilityId": "dde99263280cbd5f", "scanner": "scanner-primary", "fingerprint": "1ddad4f89572b524", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "execution/create_landing_highlights.py:445"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-54bee4f36e9ff7c2", "level": "note", "message": {"text": "Possibly dead Python function: b_featured_volume_top"}, "properties": {"repobilityId": "781409b20e5e235f", "scanner": "scanner-primary", "fingerprint": "54bee4f36e9ff7c2", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "execution/create_landing_highlights.py:471"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3fc09fffd8011505", "level": "note", "message": {"text": "Possibly dead Python function: b_featured_chg_top"}, "properties": {"repobilityId": "b6b266b78d659e71", "scanner": "scanner-primary", "fingerprint": "3fc09fffd8011505", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "execution/create_landing_highlights.py:495"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-7c00e6aeb3c8b75d", "level": "note", "message": {"text": "Possibly dead Python function: b_index_kosdaq"}, "properties": {"repobilityId": "0f0154bf051336a0", "scanner": "scanner-primary", "fingerprint": "7c00e6aeb3c8b75d", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "execution/create_landing_highlights.py:557"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-8b5c8e0bed427027", "level": "note", "message": {"text": "Possibly dead Python function: b_index_sp500"}, "properties": {"repobilityId": "928b8e4b7f535f27", "scanner": "scanner-primary", "fingerprint": "8b5c8e0bed427027", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "execution/create_landing_highlights.py:561"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-5b9b376c82505dfb", "level": "note", "message": {"text": "Possibly dead Python function: b_index_nikkei"}, "properties": {"repobilityId": "2eaf749990e35bbd", "scanner": "scanner-primary", "fingerprint": "5b9b376c82505dfb", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "execution/create_landing_highlights.py:565"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-de8da21b601c8e8e", "level": "note", "message": {"text": "Possibly dead Python function: b_index_russell"}, "properties": {"repobilityId": "e07aa009e5cda872", "scanner": "scanner-primary", "fingerprint": "de8da21b601c8e8e", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "execution/create_landing_highlights.py:569"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a0d7bcf9278923ef", "level": "note", "message": {"text": "Possibly dead Python function: b_index_tsec"}, "properties": {"repobilityId": "8d5201cb8c93baf5", "scanner": "scanner-primary", "fingerprint": "a0d7bcf9278923ef", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "execution/create_landing_highlights.py:573"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-2abf45782aa9b6d8", "level": "warning", "message": {"text": "Privileged port 23 in use"}, "properties": {"repobilityId": "a1230e3dfc4becfa", "scanner": "scanner-primary", "fingerprint": "2abf45782aa9b6d8", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/deploy.sh"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-5c26bab0c8c0bae4", "level": "warning", "message": {"text": "Privileged port 30 in use"}, "properties": {"repobilityId": "54f172e7d16fc662", "scanner": "scanner-primary", "fingerprint": "5c26bab0c8c0bae4", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/deploy.sh"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3f4cb2f52abb3302", "level": "warning", "message": {"text": "Privileged port 16 in use"}, "properties": {"repobilityId": "d31009168c502ace", "scanner": "scanner-primary", "fingerprint": "3f4cb2f52abb3302", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/deploy.sh"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-eee78839115ced1a", "level": "warning", "message": {"text": "Privileged port 59 in use"}, "properties": {"repobilityId": "6c14a9dab4958e92", "scanner": "scanner-primary", "fingerprint": "eee78839115ced1a", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/deploy.sh"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-9710c8d059e53154", "level": "none", "message": {"text": "No frontend routes/components detected"}, "properties": {"repobilityId": "44ca61485762e494", "scanner": "scanner-primary", "fingerprint": "9710c8d059e53154", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-8dcdb26b583e58f8", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in seibro.html:168"}, "properties": {"repobilityId": "8bd78db22608c9b9", "scanner": "scanner-primary", "fingerprint": "8dcdb26b583e58f8", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "seibro.html"}, "region": {"startLine": 168}}}]}, {"ruleId": "scanner-0692afc8e96989a9", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in market_alert.html:796"}, "properties": {"repobilityId": "58e42ebd88354d65", "scanner": "scanner-primary", "fingerprint": "0692afc8e96989a9", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "market_alert.html"}, "region": {"startLine": 796}}}]}, {"ruleId": "scanner-98f08f205e3190af", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in wrap.html:369"}, "properties": {"repobilityId": "be0d1612ed7c2d23", "scanner": "scanner-primary", "fingerprint": "98f08f205e3190af", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "wrap.html"}, "region": {"startLine": 369}}}]}, {"ruleId": "scanner-c288c760dbaa5288", "level": "warning", "message": {"text": "Insecure pattern 'local_storage_auth_token' in wrap.html:2853"}, "properties": {"repobilityId": "052bcbd128eba3d5", "scanner": "scanner-primary", "fingerprint": "c288c760dbaa5288", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "local_storage_auth_token"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "wrap.html"}, "region": {"startLine": 2853}}}]}, {"ruleId": "scanner-15a8bbecc79a6f24", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in architecture.html:253"}, "properties": {"repobilityId": "4e6c87d444e47c62", "scanner": "scanner-primary", "fingerprint": "15a8bbecc79a6f24", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "architecture.html"}, "region": {"startLine": 253}}}]}, {"ruleId": "scanner-6d137790ee583dff", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in index.html:171"}, "properties": {"repobilityId": "f91708437a3a5445", "scanner": "scanner-primary", "fingerprint": "6d137790ee583dff", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "index.html"}, "region": {"startLine": 171}}}]}, {"ruleId": "scanner-0a3fb2a146a779dc", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in market.html:806"}, "properties": {"repobilityId": "1965453a0faf8293", "scanner": "scanner-primary", "fingerprint": "0a3fb2a146a779dc", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "market.html"}, "region": {"startLine": 806}}}]}, {"ruleId": "scanner-3ca4e44d7b9ad824", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in universe.html:205"}, "properties": {"repobilityId": "1bdd7a2c56692f5a", "scanner": "scanner-primary", "fingerprint": "3ca4e44d7b9ad824", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "universe.html"}, "region": {"startLine": 205}}}]}, {"ruleId": "scanner-fe926578b5c2f918", "level": "error", "message": {"text": "Possible secret in execution/earnings_calendar_sync.py"}, "properties": {"repobilityId": "8eae9f116f6f62cf", "scanner": "scanner-primary", "fingerprint": "fe926578b5c2f918", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "execution/earnings_calendar_sync.py"}, "region": {"startLine": 33}}}]}, {"ruleId": "scanner-32c3c9428452735f", "level": "error", "message": {"text": "Possible secret in execution/sisyphe_bot.py"}, "properties": {"repobilityId": "661552ffdbd96a25", "scanner": "scanner-primary", "fingerprint": "32c3c9428452735f", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "execution/sisyphe_bot.py"}, "region": {"startLine": 2284}}}]}, {"ruleId": "scanner-22b8fce1dd769dbe", "level": "error", "message": {"text": "Insecure pattern 'tls_verify_false' in execution/sources/foreign_ir.py:143"}, "properties": {"repobilityId": "966162a72b3b0626", "scanner": "scanner-primary", "fingerprint": "22b8fce1dd769dbe", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "tls_verify_false"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "execution/sources/foreign_ir.py"}, "region": {"startLine": 143}}}]}, {"ruleId": "scanner-0337648e29d3c4d8", "level": "error", "message": {"text": "Possible secret in execution/earnings_bot/ticker_registry.py"}, "properties": {"repobilityId": "9b564e3495de573e", "scanner": "scanner-primary", "fingerprint": "0337648e29d3c4d8", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "execution/earnings_bot/ticker_registry.py"}, "region": {"startLine": 25}}}]}, {"ruleId": "scanner-6372cebde0220094", "level": "warning", "message": {"text": "No auth library detected"}, "properties": {"repobilityId": "a5b6035a5bbf8054", "scanner": "scanner-primary", "fingerprint": "6372cebde0220094", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["coverage", "auth"]}}, {"ruleId": "scanner-1e27723d94637c1a", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "98ba05956bac33ed", "scanner": "scanner-primary", "fingerprint": "1e27723d94637c1a", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/daily_fred.yml"}, "region": {"startLine": 25}}}]}, {"ruleId": "scanner-1e27723d94637c1a", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "c105e9d0d7b443b0", "scanner": "scanner-primary", "fingerprint": "1e27723d94637c1a", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/daily_fred.yml"}, "region": {"startLine": 30}}}]}, {"ruleId": "scanner-0a043fa411fd1ef0", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "a5f3e2efc4055e32", "scanner": "scanner-primary", "fingerprint": "0a043fa411fd1ef0", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/daily_fred.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b39ec238508ecc48", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "67d4620988c50280", "scanner": "scanner-primary", "fingerprint": "b39ec238508ecc48", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/daily_disclosures.yml"}, "region": {"startLine": 16}}}]}, {"ruleId": "scanner-b39ec238508ecc48", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "8d124a99875ae4cb", "scanner": "scanner-primary", "fingerprint": "b39ec238508ecc48", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/daily_disclosures.yml"}, "region": {"startLine": 19}}}]}, {"ruleId": "scanner-b39ec238508ecc48", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "6058e96d42678878", "scanner": "scanner-primary", "fingerprint": "b39ec238508ecc48", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/daily_disclosures.yml"}, "region": {"startLine": 40}}}]}, {"ruleId": "scanner-1abf27bf347efe50", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "474049800900a6a0", "scanner": "scanner-primary", "fingerprint": "1abf27bf347efe50", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/daily_disclosures.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-5ddd8104969d13b1", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "265e3254ff401ebe", "scanner": "scanner-primary", "fingerprint": "5ddd8104969d13b1", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/earnings_calendar_sync.yml"}, "region": {"startLine": 14}}}]}, {"ruleId": "scanner-5ddd8104969d13b1", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "1fd621e3130b915b", "scanner": "scanner-primary", "fingerprint": "5ddd8104969d13b1", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/earnings_calendar_sync.yml"}, "region": {"startLine": 17}}}]}, {"ruleId": "scanner-ab06d463f9ef9f82", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "70a09b8b44a32169", "scanner": "scanner-primary", "fingerprint": "ab06d463f9ef9f82", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/daily_kofia.yml"}, "region": {"startLine": 24}}}]}, {"ruleId": "scanner-ab06d463f9ef9f82", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "2a0d698912a80d3b", "scanner": "scanner-primary", "fingerprint": "ab06d463f9ef9f82", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/daily_kofia.yml"}, "region": {"startLine": 29}}}]}, {"ruleId": "scanner-3d45332f51f0d0d3", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "a6b902758416e68a", "scanner": "scanner-primary", "fingerprint": "3d45332f51f0d0d3", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/daily_kofia.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6fddf46249a6c6a5", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "ce353118f62a1af7", "scanner": "scanner-primary", "fingerprint": "6fddf46249a6c6a5", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/finalize_orders.yml"}, "region": {"startLine": 20}}}]}, {"ruleId": "scanner-6fddf46249a6c6a5", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "4cc394fc3aab1818", "scanner": "scanner-primary", "fingerprint": "6fddf46249a6c6a5", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/finalize_orders.yml"}, "region": {"startLine": 25}}}]}, {"ruleId": "scanner-cabf294a71000843", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "009b46fabbdac2c0", "scanner": "scanner-primary", "fingerprint": "cabf294a71000843", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/finalize_orders.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-211fbd26977edca2", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "06f149dce1170fc8", "scanner": "scanner-primary", "fingerprint": "211fbd26977edca2", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/daily_universe.yml"}, "region": {"startLine": 19}}}]}, {"ruleId": "scanner-211fbd26977edca2", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "1e8420a0577f80f7", "scanner": "scanner-primary", "fingerprint": "211fbd26977edca2", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/daily_universe.yml"}, "region": {"startLine": 22}}}]}, {"ruleId": "scanner-211fbd26977edca2", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "b07331fc0a937e06", "scanner": "scanner-primary", "fingerprint": "211fbd26977edca2", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/daily_universe.yml"}, "region": {"startLine": 37}}}]}, {"ruleId": "scanner-f82305ef3977bed6", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "8fbad1018dd9059f", "scanner": "scanner-primary", "fingerprint": "f82305ef3977bed6", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/daily_universe.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-2c46e39102901c32", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "261d09af25f094e9", "scanner": "scanner-primary", "fingerprint": "2c46e39102901c32", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/daily_crawl.yml"}, "region": {"startLine": 29}}}]}, {"ruleId": "scanner-2c46e39102901c32", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "36dc3d75d743a068", "scanner": "scanner-primary", "fingerprint": "2c46e39102901c32", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/daily_crawl.yml"}, "region": {"startLine": 34}}}]}, {"ruleId": "scanner-2c46e39102901c32", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "8557826fd88fed7f", "scanner": "scanner-primary", "fingerprint": "2c46e39102901c32", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/daily_crawl.yml"}, "region": {"startLine": 131}}}]}, {"ruleId": "scanner-32868b1abb19236d", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "a3702f66100cb733", "scanner": "scanner-primary", "fingerprint": "32868b1abb19236d", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/daily_crawl.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-37716d9c0a33ad5c", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "abfb5752158cf655", "scanner": "scanner-primary", "fingerprint": "37716d9c0a33ad5c", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/claude.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d9b97359ddf970b2", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "c76392583bd4d35a", "scanner": "scanner-primary", "fingerprint": "d9b97359ddf970b2", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/run_merge_ddr5.yml"}, "region": {"startLine": 16}}}]}, {"ruleId": "scanner-d9b97359ddf970b2", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "96427f938c9b18bd", "scanner": "scanner-primary", "fingerprint": "d9b97359ddf970b2", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/run_merge_ddr5.yml"}, "region": {"startLine": 19}}}]}, {"ruleId": "scanner-6e6b8feb9fb1f759", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "4cb97ad7cbd109d2", "scanner": "scanner-primary", "fingerprint": "6e6b8feb9fb1f759", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/run_merge_ddr5.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a5154024d0f3d5fe", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "c6e22b4c3d47728c", "scanner": "scanner-primary", "fingerprint": "a5154024d0f3d5fe", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/daily_ecos.yml"}, "region": {"startLine": 25}}}]}, {"ruleId": "scanner-a5154024d0f3d5fe", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "06aca04680d1a10b", "scanner": "scanner-primary", "fingerprint": "a5154024d0f3d5fe", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/daily_ecos.yml"}, "region": {"startLine": 30}}}]}, {"ruleId": "scanner-c2af74d3c4dc3c85", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "b7d7916c17cc6a30", "scanner": "scanner-primary", "fingerprint": "c2af74d3c4dc3c85", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/daily_ecos.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a4d281d01d94bd1c", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "36b76c12c68c2d22", "scanner": "scanner-primary", "fingerprint": "a4d281d01d94bd1c", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/recalc_wrap_nav.yml"}, "region": {"startLine": 26}}}]}, {"ruleId": "scanner-a4d281d01d94bd1c", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "762ccd29936cb58a", "scanner": "scanner-primary", "fingerprint": "a4d281d01d94bd1c", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/recalc_wrap_nav.yml"}, "region": {"startLine": 31}}}]}, {"ruleId": "scanner-bfc1629c5fd40c89", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "1043ee5d48d97515", "scanner": "scanner-primary", "fingerprint": "bfc1629c5fd40c89", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/recalc_wrap_nav.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-2116932d5bc21116", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "0a9719e903b1c402", "scanner": "scanner-primary", "fingerprint": "2116932d5bc21116", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/run_backfill.yml"}, "region": {"startLine": 18}}}]}, {"ruleId": "scanner-2116932d5bc21116", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "1529fd50329129cf", "scanner": "scanner-primary", "fingerprint": "2116932d5bc21116", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/run_backfill.yml"}, "region": {"startLine": 21}}}]}, {"ruleId": "scanner-33c030ac2c970b64", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "599a7d448a62f4cd", "scanner": "scanner-primary", "fingerprint": "33c030ac2c970b64", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/run_backfill.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-44821681f40abe25", "level": "note", "message": {"text": "Very large file: execution/create_dashboard.py (8270 lines)"}, "properties": {"repobilityId": "2e3ed6fc3c5ef265", "scanner": "scanner-primary", "fingerprint": "44821681f40abe25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-010ab546d473880f", "level": "note", "message": {"text": "Very large file: execution/sisyphe_bot.py (2574 lines)"}, "properties": {"repobilityId": "e20012f34c82bb02", "scanner": "scanner-primary", "fingerprint": "010ab546d473880f", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-6893a6c8b0861585", "level": "warning", "message": {"text": "Very low test-to-source ratio"}, "properties": {"repobilityId": "54a7de3f06314bf0", "scanner": "scanner-primary", "fingerprint": "6893a6c8b0861585", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["tests", "coverage"]}}, {"ruleId": "scanner-141b30a41e03817b", "level": "note", "message": {"text": "No license file detected"}, "properties": {"repobilityId": "8e4d52abfa86696d", "scanner": "scanner-primary", "fingerprint": "141b30a41e03817b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["license", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-faccb9061e9b52a0", "level": "note", "message": {"text": "No README detected"}, "properties": {"repobilityId": "9cb414f4f391278e", "scanner": "scanner-primary", "fingerprint": "faccb9061e9b52a0", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["docs", "readme", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "9b5ad11a3112ed2e", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-72b2a6250083a784", "level": "warning", "message": {"text": "Placeholder or mock-heavy implementation detected"}, "properties": {"repobilityId": "ddfb9e5dae7db111", "scanner": "scanner-primary", "fingerprint": "72b2a6250083a784", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "incomplete", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "229adae0af1b6c29", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-b9088664ace7f748", "level": "note", "message": {"text": "Composite production-readiness gap"}, "properties": {"repobilityId": "9c76c308bda4baea", "scanner": "scanner-primary", "fingerprint": "b9088664ace7f748", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["production-readiness", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-749d4bc1bd66df5f", "level": "warning", "message": {"text": "Agent instructions exist but release-hardening basics are missing"}, "properties": {"repobilityId": "9260e12b5b81d438", "scanner": "scanner-primary", "fingerprint": "749d4bc1bd66df5f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "9188d5893bf35932", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "4adca02530aecc32", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-abb265ed0f23596b", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/rules/target-transform.md"}, "properties": {"repobilityId": "00166c1c8a27b3ed", "scanner": "scanner-primary", "fingerprint": "abb265ed0f23596b", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/rules/target-transform.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-506c72843d5c71e3", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/rules/vm-deploy.md"}, "properties": {"repobilityId": "220ded1a32a7b15b", "scanner": "scanner-primary", "fingerprint": "506c72843d5c71e3", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/rules/vm-deploy.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ffab02ed5aa606c1", "level": "note", "message": {"text": "Legacy-named symbol `df_old` in calculate_wrap_nav.py:70"}, "properties": {"repobilityId": "ac1dfb6a15d88ba0", "scanner": "scanner-primary", "fingerprint": "ffab02ed5aa606c1", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-f6c5ae744774edc2", "level": "none", "message": {"text": "Commented-code block (7 lines) in calculate_wrap_nav.py:41"}, "properties": {"repobilityId": "b3027d4da37dba45", "scanner": "scanner-primary", "fingerprint": "f6c5ae744774edc2", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-188bd208dd1fe8ad", "level": "none", "message": {"text": "Commented-code block (7 lines) in calculate_returns.py:17"}, "properties": {"repobilityId": "b6c6edd7e1a1a685", "scanner": "scanner-primary", "fingerprint": "188bd208dd1fe8ad", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-13d1ba30b6ac48cb", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 add_universe_ticker.py:149"}, "properties": {"repobilityId": "90c35ab555b47800", "scanner": "scanner-primary", "fingerprint": "13d1ba30b6ac48cb", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-faaefd6868dc07f9", "level": "none", "message": {"text": "Commented-code block (6 lines) in execution/daily_alert.py:16"}, "properties": {"repobilityId": "e10f0ea61844d612", "scanner": "scanner-primary", "fingerprint": "faaefd6868dc07f9", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-87b7ddd50bf484e7", "level": "none", "message": {"text": "Commented-code block (6 lines) in execution/create_portfolio_tables.py:26"}, "properties": {"repobilityId": "f31e65c1caadff32", "scanner": "scanner-primary", "fingerprint": "87b7ddd50bf484e7", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-b8f576472b92d16f", "level": "none", "message": {"text": "Commented-code block (5 lines) in execution/daily_portfolio_report.py:115"}, "properties": {"repobilityId": "3c2d806536810171", "scanner": "scanner-primary", "fingerprint": "b8f576472b92d16f", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-d819e2797263e64d", "level": "none", "message": {"text": "Commented-code block (6 lines) in execution/draw_wrap_charts.py:45"}, "properties": {"repobilityId": "db2e15b801699be5", "scanner": "scanner-primary", "fingerprint": "d819e2797263e64d", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-19779b66da0b3898", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 execution/sisyphe_bot.py:1566"}, "properties": {"repobilityId": "81a222efd75e9a7f", "scanner": "scanner-primary", "fingerprint": "19779b66da0b3898", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-6ee49fc828f5041a", "level": "error", "message": {"text": "Blocking `requests.get(...)` inside `async def idea_command` \u2014 execution/sisyphe_bot.py:2225"}, "properties": {"repobilityId": "4ed35412ce8328a9", "scanner": "scanner-primary", "fingerprint": "6ee49fc828f5041a", "layer": "quality", "severity": "high", "confidence": 1.0, "tags": ["integrity", "sync-io-in-async", "performance"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "execution/sisyphe_bot.py"}, "region": {"startLine": 2225}}}]}, {"ruleId": "scanner-8f48eb5a3ccb621b", "level": "none", "message": {"text": "Commented-code block (6 lines) in execution/sources/base.py:109"}, "properties": {"repobilityId": "2c14244070b1c7bd", "scanner": "scanner-primary", "fingerprint": "8f48eb5a3ccb621b", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-40273265e5aac025", "level": "note", "message": {"text": "Legacy-named symbol `earnings_bot_v1` in execution/earnings_bot/prompt_builder.py:24"}, "properties": {"repobilityId": "6c661c3fa8bb2504", "scanner": "scanner-primary", "fingerprint": "40273265e5aac025", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-5fa5af25316da646", "level": "note", "message": {"text": "16 env vars used in code but missing from .env.example"}, "properties": {"repobilityId": "e0919a3f6a45e8c2", "scanner": "scanner-primary", "fingerprint": "5fa5af25316da646", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "config-drift"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "c4be8f6c4fd4d025", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "c61f93da87368b82", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "f39939b622942b4b", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "db3114ab582d8b4b", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "ed4e504ac374daef", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "96281f397073ac88", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "a9353c5cfa032bc7", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "9e785bc66d858c92", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "f09f5b400763a374", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "57ecc8c62d3357cd", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "51f402647abe4937", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "64bcbae1f6e5cdd9", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "ffbc25bc8a873b25", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-49c98f7cedd9c977", "level": "note", "message": {"text": "Near-duplicate function bodies in 4 places"}, "properties": {"repobilityId": "6134358591ce50b9", "scanner": "scanner-primary", "fingerprint": "49c98f7cedd9c977", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "4ddd7fcfc8f2a5bd", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "b7959c1de1d0a811", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}]}]}