{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-f43b7267384fb380", "name": "Stray `console.log` in TS/JS \u2014 v2/scripts/migrate.js:170", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 v2/scripts/migrate.js:170"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5c1da9a8f6e9ca68", "name": "Stray `console.log` in TS/JS \u2014 v2/scripts/patch-dates.js:41", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 v2/scripts/patch-dates.js:41"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-92c7a0a7dd869fa9", "name": "Stray `console.log` in TS/JS \u2014 v2/scripts/check-members.js:32", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 v2/scripts/check-members.js:32"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d1dac00188e975d9", "name": "Stray `console.log` in TS/JS \u2014 v2/scripts/enable-totp-mfa.js:7", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 v2/scripts/enable-totp-mfa.js:7"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ddb81ac5502e4abe", "name": "Icon-only button without accessible name \u2014 v2/src/components/SendTextModal.jsx:73", "shortDescription": {"text": "Icon-only button without accessible name \u2014 v2/src/components/SendTextModal.jsx:73"}, "fullDescription": {"text": "A `<button>` whose only child is a single glyph or symbol needs `title=` or `aria-label=` so screen readers (and tooltips on hover) work.\n\nWhy: P3 in CHECKLIST.md \u2014 icon-only buttons skipped a title.\nRule id: fq.button.no-label"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0e420fb461f0f210", "name": "`truncate` class without `title=` for hover reveal \u2014 v2/src/components/ColumnMappingScreen.jsx:125", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 v2/src/components/ColumnMappingScreen.jsx:125"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-e5457d1191814c12", "name": "`truncate` class without `title=` for hover reveal \u2014 v2/src/components/ShipmentTable.jsx:109", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 v2/src/components/ShipmentTable.jsx:109"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-2be6c75582e6a0be", "name": "`truncate` class without `title=` for hover reveal \u2014 v2/src/components/DeliveryTable.jsx:36", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 v2/src/components/DeliveryTable.jsx:36"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-76af054354508dac", "name": "`truncate` class without `title=` for hover reveal \u2014 v2/src/components/ImportPreviewModal.jsx:149", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 v2/src/components/ImportPreviewModal.jsx:149"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-0075fe1df0a31b08", "name": "Stray `console.log` in TS/JS \u2014 v2/src/contexts/AuthContext.jsx:128", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 v2/src/contexts/AuthContext.jsx:128"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d4df73ce89aabb0b", "name": "`truncate` class without `title=` for hover reveal \u2014 v2/src/pages/SettingsPage.jsx:969", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 v2/src/pages/SettingsPage.jsx:969"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-991c8cda68f4ccc1", "name": "Stray `console.log` in TS/JS \u2014 functions/usage-reconcile.js:132", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 functions/usage-reconcile.js:132"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ce2ca8af4ef095be", "name": "Stray `console.log` in TS/JS \u2014 functions/usage-counters.js:24", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 functions/usage-counters.js:24"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5ad1ffba1f9c459f", "name": "Stray `console.log` in TS/JS \u2014 functions/index.js:42", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 functions/index.js:42"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a7b432a3f11c9b18", "name": "Stray `console.log` in TS/JS \u2014 functions/ups-track-alert.js:70", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 functions/ups-track-alert.js:70"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-33b59c6d29767012", "name": "Stray `console.log` in TS/JS \u2014 functions/sms-webhook-renew.js:50", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 functions/sms-webhook-renew.js:50"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-97419a6cf3ea2ebd", "name": "Stray `console.log` in TS/JS \u2014 scripts/migrate-v1-to-v2.js:35", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 scripts/migrate-v1-to-v2.js:35"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d1778e694e9abfda", "name": "Possible secret in mobile.html", "shortDescription": {"text": "Possible secret in mobile.html"}, "fullDescription": {"text": "Detected pattern matching generic_api_key. Rotate the credential and move to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-b99c9b9b9a4160e7", "name": "Insecure pattern 'direct_innerhtml_assignment' in mobile.html:256", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in mobile.html:256"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-64b1f61eec095da8", "name": "Insecure pattern 'direct_innerhtml_assignment' in main.clean.js:21", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in main.clean.js:21"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4608b950171d4d47", "name": "Possible secret in Index.html", "shortDescription": {"text": "Possible secret in Index.html"}, "fullDescription": {"text": "Detected pattern matching generic_api_key. Rotate the credential and move to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-6d6381af2fa4368b", "name": "Insecure pattern 'direct_innerhtml_assignment' in Index.html:240", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in Index.html:240"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-cbc7070b48962913", "name": "Possible secret in main.js", "shortDescription": {"text": "Possible secret in main.js"}, "fullDescription": {"text": "Detected pattern matching generic_api_key. Rotate the credential and move to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-5c30a4aec4824e5c", "name": "Insecure pattern 'direct_innerhtml_assignment' in main.js:63", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in main.js:63"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8418afd0b9bd7ee1", "name": "Insecure pattern 'node_child_process' in v2/scripts/migrate.js:14", "shortDescription": {"text": "Insecure pattern 'node_child_process' in v2/scripts/migrate.js:14"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-92b2b35d54dfc391", "name": "Insecure pattern 'node_child_process' in v2/scripts/patch-dates.js:8", "shortDescription": {"text": "Insecure pattern 'node_child_process' in v2/scripts/patch-dates.js:8"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2b318fa6c492eeea", "name": "Insecure pattern 'node_child_process' in v2/scripts/check-members.js:1", "shortDescription": {"text": "Insecure pattern 'node_child_process' in v2/scripts/check-members.js:1"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0f4b368ae864cfc4", "name": "Insecure pattern 'node_child_process' in v2/scripts/enable-totp-mfa.js:1", "shortDescription": {"text": "Insecure pattern 'node_child_process' in v2/scripts/enable-totp-mfa.js:1"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1fab28f852b54ec4", "name": "Possible secret in v2/src/components/AccountModal.jsx", "shortDescription": {"text": "Possible secret in v2/src/components/AccountModal.jsx"}, "fullDescription": {"text": "Detected pattern matching password_literal. Rotate the credential and move to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-b024b4a00fb60f81", "name": "Possible secret in v2/src/lib/firebase.js", "shortDescription": {"text": "Possible secret in v2/src/lib/firebase.js"}, "fullDescription": {"text": "Detected pattern matching generic_api_key. Rotate the credential and move to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-941ecdbccfcde5f2", "name": "Possible secret in v2/e2e/helpers/login.js", "shortDescription": {"text": "Possible secret in v2/e2e/helpers/login.js"}, "fullDescription": {"text": "Detected pattern matching password_literal. Rotate the credential and move to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-cb639d9a10a47b23", "name": "package.json defines install-time lifecycle scripts", "shortDescription": {"text": "package.json defines install-time lifecycle scripts"}, "fullDescription": {"text": "preinstall/install/postinstall/prepare scripts execute during dependency installation. Review them carefully for network calls, obfuscation, shell execution, or credential access."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-259928d7a78a2795", "name": "Very large file: v2/src/pages/SettingsPage.jsx (1200 lines)", "shortDescription": {"text": "Very large file: v2/src/pages/SettingsPage.jsx (1200 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-141b30a41e03817b", "name": "No license file detected", "shortDescription": {"text": "No license file detected"}, "fullDescription": {"text": "No LICENSE/COPYING/NOTICE file was found. Generated repositories often omit licensing, which blocks reuse and automated intake."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 150 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-72b2a6250083a784", "name": "Placeholder or mock-heavy implementation detected", "shortDescription": {"text": "Placeholder or mock-heavy implementation detected"}, "fullDescription": {"text": "Found 52 placeholder/mock markers across 19 source files. This often means the repo looks complete while core flows still use generated scaffolding or fake data."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-749d4bc1bd66df5f", "name": "Agent instructions exist but release-hardening basics are missing", "shortDescription": {"text": "Agent instructions exist but release-hardening basics are missing"}, "fullDescription": {"text": "AI-coder instruction files were found, but the repo is missing license. Treat this as a contract gap: the agent is guided, but the generated output is not yet guarded by the controls that make it repeatable."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-7c11e8425c41d5ac", "name": "`fetch()` without try/.catch or AbortSignal \u2014 v2/scripts/migrate.js:36", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 v2/scripts/migrate.js:36"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-861f1c6c72a77950", "name": "`fetch()` without try/.catch or AbortSignal \u2014 v2/scripts/patch-dates.js:25", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 v2/scripts/patch-dates.js:25"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-109cedd23a315977", "name": "`fetch()` without try/.catch or AbortSignal \u2014 v2/scripts/check-members.js:11", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 v2/scripts/check-members.js:11"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8aeb8ea6761514c7", "name": "`fetch()` without try/.catch or AbortSignal \u2014 v2/scripts/enable-totp-mfa.js:59", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 v2/scripts/enable-totp-mfa.js:59"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-bc5455b8f3ea90bb", "name": "Commented-code block (5 lines) in v2/src/components/AdminSettingsPanel.jsx:1", "shortDescription": {"text": "Commented-code block (5 lines) in v2/src/components/AdminSettingsPanel.jsx:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-7405bc220b6ddcb2", "name": "Commented-code block (5 lines) in functions/usage-reconcile.js:1", "shortDescription": {"text": "Commented-code block (5 lines) in functions/usage-reconcile.js:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-17879bc17948ab79", "name": "`fetch()` without try/.catch or AbortSignal \u2014 functions/ringcentral-auth.js:18", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 functions/ringcentral-auth.js:18"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2e4dba99c6bbc8fb", "name": "`fetch()` without try/.catch or AbortSignal \u2014 functions/sms-webhook-register.js:50", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 functions/sms-webhook-register.js:50"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c7270d037e150350", "name": "Commented-code block (6 lines) in functions/admin-settings.js:1", "shortDescription": {"text": "Commented-code block (6 lines) in functions/admin-settings.js:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-0a071df3e87dec66", "name": "Commented-code block (6 lines) in functions/index.js:388", "shortDescription": {"text": "Commented-code block (6 lines) in functions/index.js:388"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-9b1a1137e8ac404d", "name": "`fetch()` without try/.catch or AbortSignal \u2014 functions/index.js:43", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 functions/index.js:43"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-728b68965700b25a", "name": "Commented-code block (5 lines) in functions/sms-webhook-renew.js:9", "shortDescription": {"text": "Commented-code block (5 lines) in functions/sms-webhook-renew.js:9"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-da4d288a7cbe3ce2", "name": "`fetch()` without try/.catch or AbortSignal \u2014 functions/ringcentral-sms.js:6", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 functions/ringcentral-sms.js:6"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f836115998c4e0ca", "name": "Commented-code block (8 lines) in functions/lib/settings-mask.js:1", "shortDescription": {"text": "Commented-code block (8 lines) in functions/lib/settings-mask.js:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-ed41589a28ca8282", "name": "Frontend route `/app` has no Link/navigate to it \u2014 v2/src/App.jsx", "shortDescription": {"text": "Frontend route `/app` has no Link/navigate to it \u2014 v2/src/App.jsx"}, "fullDescription": {"text": "The route is registered but no `<Link to=\u2026>` or `navigate(\u2026)` in the codebase navigates here. Either it's reachable only via direct URL (intentional), it's dead, or the link broke during a refactor."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-79cbe7a3ca7329be", "name": "Frontend route `/admin/dashboard` has no Link/navigate to it \u2014 v2/src/App.jsx", "shortDescription": {"text": "Frontend route `/admin/dashboard` has no Link/navigate to it \u2014 v2/src/App.jsx"}, "fullDescription": {"text": "The route is registered but no `<Link to=\u2026>` or `navigate(\u2026)` in the codebase navigates here. Either it's reachable only via direct URL (intentional), it's dead, or the link broke during a refactor."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e7753f693e906d8a", "name": "Frontend route `/:slug/join` has no Link/navigate to it \u2014 v2/src/App.jsx", "shortDescription": {"text": "Frontend route `/:slug/join` has no Link/navigate to it \u2014 v2/src/App.jsx"}, "fullDescription": {"text": "The route is registered but no `<Link to=\u2026>` or `navigate(\u2026)` in the codebase navigates here. Either it's reachable only via direct URL (intentional), it's dead, or the link broke during a refactor."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-57acb1ff6dae8a62", "name": "Frontend route `/:slug/welcome` has no Link/navigate to it \u2014 v2/src/App.jsx", "shortDescription": {"text": "Frontend route `/:slug/welcome` has no Link/navigate to it \u2014 v2/src/App.jsx"}, "fullDescription": {"text": "The route is registered but no `<Link to=\u2026>` or `navigate(\u2026)` in the codebase navigates here. Either it's reachable only via direct URL (intentional), it's dead, or the link broke during a refactor."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8344cd72e839760a", "name": "Frontend route `/:slug` has no Link/navigate to it \u2014 v2/src/App.jsx", "shortDescription": {"text": "Frontend route `/:slug` has no Link/navigate to it \u2014 v2/src/App.jsx"}, "fullDescription": {"text": "The route is registered but no `<Link to=\u2026>` or `navigate(\u2026)` in the codebase navigates here. Either it's reachable only via direct URL (intentional), it's dead, or the link broke during a refactor."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-cc47f7d1c7b7b85c", "name": "Frontend route `import` has no Link/navigate to it \u2014 v2/src/App.jsx", "shortDescription": {"text": "Frontend route `import` has no Link/navigate to it \u2014 v2/src/App.jsx"}, "fullDescription": {"text": "The route is registered but no `<Link to=\u2026>` or `navigate(\u2026)` in the codebase navigates here. Either it's reachable only via direct URL (intentional), it's dead, or the link broke during a refactor."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-eecb1c57c5e112d7", "name": "Frontend route `settings` has no Link/navigate to it \u2014 v2/src/App.jsx", "shortDescription": {"text": "Frontend route `settings` has no Link/navigate to it \u2014 v2/src/App.jsx"}, "fullDescription": {"text": "The route is registered but no `<Link to=\u2026>` or `navigate(\u2026)` in the codebase navigates here. Either it's reachable only via direct URL (intentional), it's dead, or the link broke during a refactor."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-84a95371d4cd22da", "name": "Frontend route `/admin` has no Link/navigate to it \u2014 v2/src/__tests__/AdminProtectedRoute.test.jsx", "shortDescription": {"text": "Frontend route `/admin` has no Link/navigate to it \u2014 v2/src/__tests__/AdminProtectedRoute.test.jsx"}, "fullDescription": {"text": "The route is registered but no `<Link to=\u2026>` or `navigate(\u2026)` in the codebase navigates here. Either it's reachable only via direct URL (intentional), it's dead, or the link broke during a refactor."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-24cea7a794a2c759", "name": "Frontend route `/:slug/dashboard` has no Link/navigate to it \u2014 v2/src/__tests__/trackingGrouping.test.jsx", "shortDescription": {"text": "Frontend route `/:slug/dashboard` has no Link/navigate to it \u2014 v2/src/__tests__/trackingGrouping.test.jsx"}, "fullDescription": {"text": "The route is registered but no `<Link to=\u2026>` or `navigate(\u2026)` in the codebase navigates here. Either it's reachable only via direct URL (intentional), it's dead, or the link broke during a refactor."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/19876"}, "properties": {"repository": "SMC1177/delivery-manifest", "repoUrl": "https://github.com/SMC1177/delivery-manifest", "branch": "main"}, "results": [{"ruleId": "scanner-f43b7267384fb380", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 v2/scripts/migrate.js:170"}, "properties": {"repobilityId": "128434f42255cbe5", "scanner": "scanner-primary", "fingerprint": "f43b7267384fb380", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-5c1da9a8f6e9ca68", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 v2/scripts/patch-dates.js:41"}, "properties": {"repobilityId": "70ea955e47f3836e", "scanner": "scanner-primary", "fingerprint": "5c1da9a8f6e9ca68", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-92c7a0a7dd869fa9", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 v2/scripts/check-members.js:32"}, "properties": {"repobilityId": "ab0845cdd820b854", "scanner": "scanner-primary", "fingerprint": "92c7a0a7dd869fa9", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-d1dac00188e975d9", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 v2/scripts/enable-totp-mfa.js:7"}, "properties": {"repobilityId": "0257eda932fc4eef", "scanner": "scanner-primary", "fingerprint": "d1dac00188e975d9", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-ddb81ac5502e4abe", "level": "note", "message": {"text": "Icon-only button without accessible name \u2014 v2/src/components/SendTextModal.jsx:73"}, "properties": {"repobilityId": "edac16e2569cbe7a", "scanner": "scanner-primary", "fingerprint": "ddb81ac5502e4abe", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.button.no-label"]}}, {"ruleId": "scanner-0e420fb461f0f210", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 v2/src/components/ColumnMappingScreen.jsx:125"}, "properties": {"repobilityId": "80efc6aac5074590", "scanner": "scanner-primary", "fingerprint": "0e420fb461f0f210", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-e5457d1191814c12", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 v2/src/components/ShipmentTable.jsx:109"}, "properties": {"repobilityId": "e1654d5ab7fc6936", "scanner": "scanner-primary", "fingerprint": "e5457d1191814c12", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-2be6c75582e6a0be", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 v2/src/components/DeliveryTable.jsx:36"}, "properties": {"repobilityId": "07cc810b1c1512fa", "scanner": "scanner-primary", "fingerprint": "2be6c75582e6a0be", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-76af054354508dac", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 v2/src/components/ImportPreviewModal.jsx:149"}, "properties": {"repobilityId": "ea7f52af5b6dfaf3", "scanner": "scanner-primary", "fingerprint": "76af054354508dac", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-0075fe1df0a31b08", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 v2/src/contexts/AuthContext.jsx:128"}, "properties": {"repobilityId": "044b4af4f3affeb2", "scanner": "scanner-primary", "fingerprint": "0075fe1df0a31b08", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-d4df73ce89aabb0b", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 v2/src/pages/SettingsPage.jsx:969"}, "properties": {"repobilityId": "ec3cd34ba3ac9263", "scanner": "scanner-primary", "fingerprint": "d4df73ce89aabb0b", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-991c8cda68f4ccc1", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 functions/usage-reconcile.js:132"}, "properties": {"repobilityId": "6850c0c3ea71a7a6", "scanner": "scanner-primary", "fingerprint": "991c8cda68f4ccc1", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-ce2ca8af4ef095be", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 functions/usage-counters.js:24"}, "properties": {"repobilityId": "57fbe2a33be2a33c", "scanner": "scanner-primary", "fingerprint": "ce2ca8af4ef095be", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-5ad1ffba1f9c459f", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 functions/index.js:42"}, "properties": {"repobilityId": "fc340c3549298d81", "scanner": "scanner-primary", "fingerprint": "5ad1ffba1f9c459f", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-a7b432a3f11c9b18", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 functions/ups-track-alert.js:70"}, "properties": {"repobilityId": "6286e8a89e3038b5", "scanner": "scanner-primary", "fingerprint": "a7b432a3f11c9b18", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-33b59c6d29767012", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 functions/sms-webhook-renew.js:50"}, "properties": {"repobilityId": "fd77904e3eb45b38", "scanner": "scanner-primary", "fingerprint": "33b59c6d29767012", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-97419a6cf3ea2ebd", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 scripts/migrate-v1-to-v2.js:35"}, "properties": {"repobilityId": "ccd763f4ce6919a9", "scanner": "scanner-primary", "fingerprint": "97419a6cf3ea2ebd", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-d1778e694e9abfda", "level": "error", "message": {"text": "Possible secret in mobile.html"}, "properties": {"repobilityId": "2db191337449e8d7", "scanner": "scanner-primary", "fingerprint": "d1778e694e9abfda", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "mobile.html"}, "region": {"startLine": 288}}}]}, {"ruleId": "scanner-b99c9b9b9a4160e7", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in mobile.html:256"}, "properties": {"repobilityId": "39c1e01516c2959e", "scanner": "scanner-primary", "fingerprint": "b99c9b9b9a4160e7", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "mobile.html"}, "region": {"startLine": 256}}}]}, {"ruleId": "scanner-64b1f61eec095da8", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in main.clean.js:21"}, "properties": {"repobilityId": "42ab3edee89761cb", "scanner": "scanner-primary", "fingerprint": "64b1f61eec095da8", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "main.clean.js"}, "region": {"startLine": 21}}}]}, {"ruleId": "scanner-4608b950171d4d47", "level": "error", "message": {"text": "Possible secret in Index.html"}, "properties": {"repobilityId": "e3ddd82373b2fa8f", "scanner": "scanner-primary", "fingerprint": "4608b950171d4d47", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Index.html"}, "region": {"startLine": 251}}}]}, {"ruleId": "scanner-6d6381af2fa4368b", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in Index.html:240"}, "properties": {"repobilityId": "eda33fcc9beb5a1c", "scanner": "scanner-primary", "fingerprint": "6d6381af2fa4368b", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Index.html"}, "region": {"startLine": 240}}}]}, {"ruleId": "scanner-cbc7070b48962913", "level": "error", "message": {"text": "Possible secret in main.js"}, "properties": {"repobilityId": "953f89686943de64", "scanner": "scanner-primary", "fingerprint": "cbc7070b48962913", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "main.js"}, "region": {"startLine": 10}}}]}, {"ruleId": "scanner-5c30a4aec4824e5c", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in main.js:63"}, "properties": {"repobilityId": "1b4d35edc097833f", "scanner": "scanner-primary", "fingerprint": "5c30a4aec4824e5c", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "main.js"}, "region": {"startLine": 63}}}]}, {"ruleId": "scanner-8418afd0b9bd7ee1", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in v2/scripts/migrate.js:14"}, "properties": {"repobilityId": "daf12dac05073bf6", "scanner": "scanner-primary", "fingerprint": "8418afd0b9bd7ee1", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "v2/scripts/migrate.js"}, "region": {"startLine": 14}}}]}, {"ruleId": "scanner-92b2b35d54dfc391", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in v2/scripts/patch-dates.js:8"}, "properties": {"repobilityId": "a975d0efd212c4a5", "scanner": "scanner-primary", "fingerprint": "92b2b35d54dfc391", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "v2/scripts/patch-dates.js"}, "region": {"startLine": 8}}}]}, {"ruleId": "scanner-2b318fa6c492eeea", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in v2/scripts/check-members.js:1"}, "properties": {"repobilityId": "d88673f4e2b59a8b", "scanner": "scanner-primary", "fingerprint": "2b318fa6c492eeea", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "v2/scripts/check-members.js"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-0f4b368ae864cfc4", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in v2/scripts/enable-totp-mfa.js:1"}, "properties": {"repobilityId": "43b8f2578b842290", "scanner": "scanner-primary", "fingerprint": "0f4b368ae864cfc4", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "v2/scripts/enable-totp-mfa.js"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-1fab28f852b54ec4", "level": "error", "message": {"text": "Possible secret in v2/src/components/AccountModal.jsx"}, "properties": {"repobilityId": "39d8884bbefd7312", "scanner": "scanner-primary", "fingerprint": "1fab28f852b54ec4", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "v2/src/components/AccountModal.jsx"}, "region": {"startLine": 41}}}]}, {"ruleId": "scanner-b024b4a00fb60f81", "level": "error", "message": {"text": "Possible secret in v2/src/lib/firebase.js"}, "properties": {"repobilityId": "5ace98a86591e128", "scanner": "scanner-primary", "fingerprint": "b024b4a00fb60f81", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "v2/src/lib/firebase.js"}, "region": {"startLine": 8}}}]}, {"ruleId": "scanner-941ecdbccfcde5f2", "level": "error", "message": {"text": "Possible secret in v2/e2e/helpers/login.js"}, "properties": {"repobilityId": "115fd4ab578bba90", "scanner": "scanner-primary", "fingerprint": "941ecdbccfcde5f2", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "v2/e2e/helpers/login.js"}, "region": {"startLine": 52}}}]}, {"ruleId": "scanner-941ecdbccfcde5f2", "level": "error", "message": {"text": "Possible secret in v2/e2e/helpers/login.js"}, "properties": {"repobilityId": "115fd4ab578bba90", "scanner": "scanner-primary", "fingerprint": "941ecdbccfcde5f2", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "v2/e2e/helpers/login.js"}, "region": {"startLine": 55}}}]}, {"ruleId": "scanner-cb639d9a10a47b23", "level": "note", "message": {"text": "package.json defines install-time lifecycle scripts"}, "properties": {"repobilityId": "b86179956da3a4a8", "scanner": "scanner-primary", "fingerprint": "cb639d9a10a47b23", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "npm", "install-scripts"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-259928d7a78a2795", "level": "note", "message": {"text": "Very large file: v2/src/pages/SettingsPage.jsx (1200 lines)"}, "properties": {"repobilityId": "a7f805b14cc3a0ec", "scanner": "scanner-primary", "fingerprint": "259928d7a78a2795", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-141b30a41e03817b", "level": "note", "message": {"text": "No license file detected"}, "properties": {"repobilityId": "10686315da4abf9c", "scanner": "scanner-primary", "fingerprint": "141b30a41e03817b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["license", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "66fbf4460cf722e4", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-72b2a6250083a784", "level": "warning", "message": {"text": "Placeholder or mock-heavy implementation detected"}, "properties": {"repobilityId": "616f19608231316a", "scanner": "scanner-primary", "fingerprint": "72b2a6250083a784", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "incomplete", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "e3f21a0cf79640d7", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-749d4bc1bd66df5f", "level": "warning", "message": {"text": "Agent instructions exist but release-hardening basics are missing"}, "properties": {"repobilityId": "e98357d92b2870db", "scanner": "scanner-primary", "fingerprint": "749d4bc1bd66df5f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "77efc30dcd08b14e", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "570cb1b69ad55a43", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-7c11e8425c41d5ac", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 v2/scripts/migrate.js:36"}, "properties": {"repobilityId": "5b652bf1fd8c000d", "scanner": "scanner-primary", "fingerprint": "7c11e8425c41d5ac", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-861f1c6c72a77950", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 v2/scripts/patch-dates.js:25"}, "properties": {"repobilityId": "8fa30f0c628d437b", "scanner": "scanner-primary", "fingerprint": "861f1c6c72a77950", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-109cedd23a315977", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 v2/scripts/check-members.js:11"}, "properties": {"repobilityId": "ec5a0004922bf554", "scanner": "scanner-primary", "fingerprint": "109cedd23a315977", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-8aeb8ea6761514c7", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 v2/scripts/enable-totp-mfa.js:59"}, "properties": {"repobilityId": "c3d82ead1c63d82e", "scanner": "scanner-primary", "fingerprint": "8aeb8ea6761514c7", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-bc5455b8f3ea90bb", "level": "none", "message": {"text": "Commented-code block (5 lines) in v2/src/components/AdminSettingsPanel.jsx:1"}, "properties": {"repobilityId": "5e72599ac4884674", "scanner": "scanner-primary", "fingerprint": "bc5455b8f3ea90bb", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-7405bc220b6ddcb2", "level": "none", "message": {"text": "Commented-code block (5 lines) in functions/usage-reconcile.js:1"}, "properties": {"repobilityId": "8e0c7d07c3559ba3", "scanner": "scanner-primary", "fingerprint": "7405bc220b6ddcb2", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-17879bc17948ab79", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 functions/ringcentral-auth.js:18"}, "properties": {"repobilityId": "cebcb5328361fe09", "scanner": "scanner-primary", "fingerprint": "17879bc17948ab79", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-2e4dba99c6bbc8fb", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 functions/sms-webhook-register.js:50"}, "properties": {"repobilityId": "bf6e2d76e7cd35dd", "scanner": "scanner-primary", "fingerprint": "2e4dba99c6bbc8fb", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-c7270d037e150350", "level": "none", "message": {"text": "Commented-code block (6 lines) in functions/admin-settings.js:1"}, "properties": {"repobilityId": "8709c2fda29fb859", "scanner": "scanner-primary", "fingerprint": "c7270d037e150350", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-0a071df3e87dec66", "level": "none", "message": {"text": "Commented-code block (6 lines) in functions/index.js:388"}, "properties": {"repobilityId": "cf235041614f7a61", "scanner": "scanner-primary", "fingerprint": "0a071df3e87dec66", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-9b1a1137e8ac404d", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 functions/index.js:43"}, "properties": {"repobilityId": "c9af177cdf98629a", "scanner": "scanner-primary", "fingerprint": "9b1a1137e8ac404d", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-728b68965700b25a", "level": "none", "message": {"text": "Commented-code block (5 lines) in functions/sms-webhook-renew.js:9"}, "properties": {"repobilityId": "268816f1bd33d21a", "scanner": "scanner-primary", "fingerprint": "728b68965700b25a", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-da4d288a7cbe3ce2", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 functions/ringcentral-sms.js:6"}, "properties": {"repobilityId": "8330f4bebc344f69", "scanner": "scanner-primary", "fingerprint": "da4d288a7cbe3ce2", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-f836115998c4e0ca", "level": "none", "message": {"text": "Commented-code block (8 lines) in functions/lib/settings-mask.js:1"}, "properties": {"repobilityId": "30465a3c00f31086", "scanner": "scanner-primary", "fingerprint": "f836115998c4e0ca", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-ed41589a28ca8282", "level": "warning", "message": {"text": "Frontend route `/app` has no Link/navigate to it \u2014 v2/src/App.jsx"}, "properties": {"repobilityId": "2b1a5ef7dc89a266", "scanner": "scanner-primary", "fingerprint": "ed41589a28ca8282", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "orphan-page", "wiring"]}}, {"ruleId": "scanner-79cbe7a3ca7329be", "level": "warning", "message": {"text": "Frontend route `/admin/dashboard` has no Link/navigate to it \u2014 v2/src/App.jsx"}, "properties": {"repobilityId": "548c56136d2c92da", "scanner": "scanner-primary", "fingerprint": "79cbe7a3ca7329be", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "orphan-page", "wiring"]}}, {"ruleId": "scanner-e7753f693e906d8a", "level": "warning", "message": {"text": "Frontend route `/:slug/join` has no Link/navigate to it \u2014 v2/src/App.jsx"}, "properties": {"repobilityId": "288bf63b070e792c", "scanner": "scanner-primary", "fingerprint": "e7753f693e906d8a", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "orphan-page", "wiring"]}}, {"ruleId": "scanner-57acb1ff6dae8a62", "level": "warning", "message": {"text": "Frontend route `/:slug/welcome` has no Link/navigate to it \u2014 v2/src/App.jsx"}, "properties": {"repobilityId": "49df230f109c490b", "scanner": "scanner-primary", "fingerprint": "57acb1ff6dae8a62", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "orphan-page", "wiring"]}}, {"ruleId": "scanner-8344cd72e839760a", "level": "warning", "message": {"text": "Frontend route `/:slug` has no Link/navigate to it \u2014 v2/src/App.jsx"}, "properties": {"repobilityId": "9d26285fdf5e3b28", "scanner": "scanner-primary", "fingerprint": "8344cd72e839760a", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "orphan-page", "wiring"]}}, {"ruleId": "scanner-cc47f7d1c7b7b85c", "level": "warning", "message": {"text": "Frontend route `import` has no Link/navigate to it \u2014 v2/src/App.jsx"}, "properties": {"repobilityId": "059b5f35648025b6", "scanner": "scanner-primary", "fingerprint": "cc47f7d1c7b7b85c", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "orphan-page", "wiring"]}}, {"ruleId": "scanner-eecb1c57c5e112d7", "level": "warning", "message": {"text": "Frontend route `settings` has no Link/navigate to it \u2014 v2/src/App.jsx"}, "properties": {"repobilityId": "078807976d04ea60", "scanner": "scanner-primary", "fingerprint": "eecb1c57c5e112d7", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "orphan-page", "wiring"]}}, {"ruleId": "scanner-84a95371d4cd22da", "level": "warning", "message": {"text": "Frontend route `/admin` has no Link/navigate to it \u2014 v2/src/__tests__/AdminProtectedRoute.test.jsx"}, "properties": {"repobilityId": "47c11e00ecd7a4ea", "scanner": "scanner-primary", "fingerprint": "84a95371d4cd22da", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "orphan-page", "wiring"]}}, {"ruleId": "scanner-24cea7a794a2c759", "level": "warning", "message": {"text": "Frontend route `/:slug/dashboard` has no Link/navigate to it \u2014 v2/src/__tests__/trackingGrouping.test.jsx"}, "properties": {"repobilityId": "8f564aa67f790a30", "scanner": "scanner-primary", "fingerprint": "24cea7a794a2c759", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "orphan-page", "wiring"]}}]}]}