{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-62849e64eb96b6e2", "name": "Stray `console.log` in TS/JS \u2014 tests/test-version-detection.js:6", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 tests/test-version-detection.js:6"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6027b2134fd81a25", "name": "Stray `console.log` in TS/JS \u2014 public/js/utils/ui-logger.js:87", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 public/js/utils/ui-logger.js:87"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-104cdf51fc16af35", "name": "TODO/FIXME marker in shipping code \u2014 public/js/translations/zh.js:358", "shortDescription": {"text": "TODO/FIXME marker in shipping code \u2014 public/js/translations/zh.js:358"}, "fullDescription": {"text": "Track in /reviews or /issues, not as a code comment that rots.\n\nWhy: Drift control \u2014 shouldn't be the same as Quality TODO scanner.\nRule id: fq.todo-marker"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-ae9dc799c55d1f53", "name": "TODO/FIXME marker in shipping code \u2014 public/js/translations/tr.js:340", "shortDescription": {"text": "TODO/FIXME marker in shipping code \u2014 public/js/translations/tr.js:340"}, "fullDescription": {"text": "Track in /reviews or /issues, not as a code comment that rots.\n\nWhy: Drift control \u2014 shouldn't be the same as Quality TODO scanner.\nRule id: fq.todo-marker"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-300dae5cb385a0e9", "name": "Stray `console.log` in TS/JS \u2014 src/cli/accounts.js:106", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 src/cli/accounts.js:106"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c8d99d92c00c0c8d", "name": "Stray `console.log` in TS/JS \u2014 src/utils/logger.js:72", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 src/utils/logger.js:72"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9710c8d059e53154", "name": "No frontend routes/components detected", "shortDescription": {"text": "No frontend routes/components detected"}, "fullDescription": {"text": "No React/Vue/Next routes were found. This is fine for backend-only repos."}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-007de55a550c9d4f", "name": "Insecure pattern 'direct_innerhtml_assignment' in public/app.js:27", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in public/app.js:27"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-10fa32fa9cdac13d", "name": "Possible secret in public/js/translations/en.js", "shortDescription": {"text": "Possible secret in public/js/translations/en.js"}, "fullDescription": {"text": "Detected pattern matching password_literal. Rotate the credential and move to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-a1cc6c0939c0e5eb", "name": "Possible secret in public/js/translations/id.js", "shortDescription": {"text": "Possible secret in public/js/translations/id.js"}, "fullDescription": {"text": "Detected pattern matching password_literal. Rotate the credential and move to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-843ada2fe4091113", "name": "Possible secret in public/js/translations/zh.js", "shortDescription": {"text": "Possible secret in public/js/translations/zh.js"}, "fullDescription": {"text": "Detected pattern matching password_literal. Rotate the credential and move to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-0fd6d7cfc04f0ce7", "name": "Possible secret in public/js/translations/pt.js", "shortDescription": {"text": "Possible secret in public/js/translations/pt.js"}, "fullDescription": {"text": "Detected pattern matching password_literal. Rotate the credential and move to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-bee1c2aca368bb17", "name": "Possible secret in public/js/translations/tr.js", "shortDescription": {"text": "Possible secret in public/js/translations/tr.js"}, "fullDescription": {"text": "Detected pattern matching password_literal. Rotate the credential and move to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-949c140069784679", "name": "Possible secret in src/config.js", "shortDescription": {"text": "Possible secret in src/config.js"}, "fullDescription": {"text": "Detected pattern matching password_literal. Rotate the credential and move to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-21e506ecb2c3c3dc", "name": "Insecure pattern 'cors_wildcard' in src/server.js:80", "shortDescription": {"text": "Insecure pattern 'cors_wildcard' in src/server.js:80"}, "fullDescription": {"text": "Found a known-risky pattern (cors_wildcard). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a7fee0cc275a9dd5", "name": "Insecure pattern 'node_child_process' in src/cli/accounts.js:20", "shortDescription": {"text": "Insecure pattern 'node_child_process' in src/cli/accounts.js:20"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-14042917bfc5133b", "name": "Insecure pattern 'node_child_process' in src/utils/native-module-helper.js:7", "shortDescription": {"text": "Insecure pattern 'node_child_process' in src/utils/native-module-helper.js:7"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f75907b363f1ad71", "name": "Insecure pattern 'node_child_process' in src/utils/version-detector.js:1", "shortDescription": {"text": "Insecure pattern 'node_child_process' in src/utils/version-detector.js:1"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a53bf972e19b52fd", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cb639d9a10a47b23", "name": "package.json defines install-time lifecycle scripts", "shortDescription": {"text": "package.json defines install-time lifecycle scripts"}, "fullDescription": {"text": "preinstall/install/postinstall/prepare scripts execute during dependency installation. Review them carefully for network calls, obfuscation, shell execution, or credential access."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2698ff5dabf3a895", "name": "Very large file: public/js/components/server-config.js (1183 lines)", "shortDescription": {"text": "Very large file: public/js/components/server-config.js (1183 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4aa865056d5c5186", "name": "Very large file: src/webui/index.js (1374 lines)", "shortDescription": {"text": "Very large file: src/webui/index.js (1374 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 71 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-72b2a6250083a784", "name": "Placeholder or mock-heavy implementation detected", "shortDescription": {"text": "Placeholder or mock-heavy implementation detected"}, "fullDescription": {"text": "Found 24 placeholder/mock markers across 9 source files. This often means the repo looks complete while core flows still use generated scaffolding or fake data."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9d79c4077342a7d0", "name": "Runtime service client appears to use placeholder configuration", "shortDescription": {"text": "Runtime service client appears to use placeholder configuration"}, "fullDescription": {"text": "A runtime source file appears to wire Supabase/Firebase/AI/payment-style clients to placeholder URLs, keys, or fallback values. In the Fable corpus this often means the UI/API shape is present while the backend service is not actually configured."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-d9d1ef66132d3521", "name": "`fetch()` without try/.catch or AbortSignal \u2014 public/app.js:32", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 public/app.js:32"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e6191cf0c5965b40", "name": "Commented-code block (5 lines) in public/js/data-store.js:246", "shortDescription": {"text": "Commented-code block (5 lines) in public/js/data-store.js:246"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-094b9bf98e6cfee7", "name": "`fetch()` without try/.catch or AbortSignal \u2014 public/js/utils.js:8", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 public/js/utils.js:8"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-152483b5441893c5", "name": "Commented-code block (14 lines) in public/js/translations/zh.js:379", "shortDescription": {"text": "Commented-code block (14 lines) in public/js/translations/zh.js:379"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-a2717e8d930b2eba", "name": "Commented-code block (14 lines) in public/js/translations/tr.js:361", "shortDescription": {"text": "Commented-code block (14 lines) in public/js/translations/tr.js:361"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-1afe213ca1b1accd", "name": "`fetch()` without try/.catch or AbortSignal \u2014 src/utils/helpers.js:89", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/utils/helpers.js:89"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-123ab264a0b44ba5", "name": "Commented-code block (6 lines) in src/cloudcode/model-api.js:224", "shortDescription": {"text": "Commented-code block (6 lines) in src/cloudcode/model-api.js:224"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-19721866852af0d3", "name": "Dangling fetch: GET /views/dashboard.html (tests/frontend/test-frontend-dashboard.cjs:37)", "shortDescription": {"text": "Dangling fetch: GET /views/dashboard.html (tests/frontend/test-frontend-dashboard.cjs:37)"}, "fullDescription": {"text": "`tests/frontend/test-frontend-dashboard.cjs:37` calls `GET /views/dashboard.html` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: helper:request\nNormalized path used for matching: `/views/dashboard.html`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-f72a2cc48440d769", "name": "Dangling fetch: GET /views/dashboard.html (tests/frontend/test-frontend-dashboard.cjs:70)", "shortDescription": {"text": "Dangling fetch: GET /views/dashboard.html (tests/frontend/test-frontend-dashboard.cjs:70)"}, "fullDescription": {"text": "`tests/frontend/test-frontend-dashboard.cjs:70` calls `GET /views/dashboard.html` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: helper:request\nNormalized path used for matching: `/views/dashboard.html`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-1e6072ccf3e09325", "name": "Dangling fetch: GET /views/dashboard.html (tests/frontend/test-frontend-dashboard.cjs:91)", "shortDescription": {"text": "Dangling fetch: GET /views/dashboard.html (tests/frontend/test-frontend-dashboard.cjs:91)"}, "fullDescription": {"text": "`tests/frontend/test-frontend-dashboard.cjs:91` calls `GET /views/dashboard.html` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: helper:request\nNormalized path used for matching: `/views/dashboard.html`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-324ad8b14f00d4e2", "name": "Dangling fetch: GET /views/dashboard.html (tests/frontend/test-frontend-dashboard.cjs:112)", "shortDescription": {"text": "Dangling fetch: GET /views/dashboard.html (tests/frontend/test-frontend-dashboard.cjs:112)"}, "fullDescription": {"text": "`tests/frontend/test-frontend-dashboard.cjs:112` calls `GET /views/dashboard.html` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: helper:request\nNormalized path used for matching: `/views/dashboard.html`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-4efb71aa95218b1d", "name": "Dangling fetch: GET /views/logs.html (tests/frontend/test-frontend-logs.cjs:35)", "shortDescription": {"text": "Dangling fetch: GET /views/logs.html (tests/frontend/test-frontend-logs.cjs:35)"}, "fullDescription": {"text": "`tests/frontend/test-frontend-logs.cjs:35` calls `GET /views/logs.html` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: helper:request\nNormalized path used for matching: `/views/logs.html`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-ed492cb362b359da", "name": "Dangling fetch: GET /views/logs.html (tests/frontend/test-frontend-logs.cjs:84)", "shortDescription": {"text": "Dangling fetch: GET /views/logs.html (tests/frontend/test-frontend-logs.cjs:84)"}, "fullDescription": {"text": "`tests/frontend/test-frontend-logs.cjs:84` calls `GET /views/logs.html` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: helper:request\nNormalized path used for matching: `/views/logs.html`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-dc9de79685afbbcb", "name": "Dangling fetch: GET /views/logs.html (tests/frontend/test-frontend-logs.cjs:97)", "shortDescription": {"text": "Dangling fetch: GET /views/logs.html (tests/frontend/test-frontend-logs.cjs:97)"}, "fullDescription": {"text": "`tests/frontend/test-frontend-logs.cjs:97` calls `GET /views/logs.html` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: helper:request\nNormalized path used for matching: `/views/logs.html`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-1340be4a2ffc6c4e", "name": "Dangling fetch: GET /views/logs.html (tests/frontend/test-frontend-logs.cjs:107)", "shortDescription": {"text": "Dangling fetch: GET /views/logs.html (tests/frontend/test-frontend-logs.cjs:107)"}, "fullDescription": {"text": "`tests/frontend/test-frontend-logs.cjs:107` calls `GET /views/logs.html` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: helper:request\nNormalized path used for matching: `/views/logs.html`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-06f3e3757b5db7cc", "name": "Dangling fetch: GET /views/logs.html (tests/frontend/test-frontend-logs.cjs:120)", "shortDescription": {"text": "Dangling fetch: GET /views/logs.html (tests/frontend/test-frontend-logs.cjs:120)"}, "fullDescription": {"text": "`tests/frontend/test-frontend-logs.cjs:120` calls `GET /views/logs.html` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: helper:request\nNormalized path used for matching: `/views/logs.html`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-41e65675d68105c2", "name": "Dangling fetch: GET /views/settings.html (tests/frontend/test-frontend-settings.cjs:39)", "shortDescription": {"text": "Dangling fetch: GET /views/settings.html (tests/frontend/test-frontend-settings.cjs:39)"}, "fullDescription": {"text": "`tests/frontend/test-frontend-settings.cjs:39` calls `GET /views/settings.html` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: helper:request\nNormalized path used for matching: `/views/settings.html`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-730b1b4128f0cebf", "name": "Dangling fetch: GET /views/settings.html (tests/frontend/test-frontend-settings.cjs:49)", "shortDescription": {"text": "Dangling fetch: GET /views/settings.html (tests/frontend/test-frontend-settings.cjs:49)"}, "fullDescription": {"text": "`tests/frontend/test-frontend-settings.cjs:49` calls `GET /views/settings.html` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: helper:request\nNormalized path used for matching: `/views/settings.html`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-9bfa5a9b3776c28f", "name": "Dangling fetch: GET /views/settings.html (tests/frontend/test-frontend-settings.cjs:70)", "shortDescription": {"text": "Dangling fetch: GET /views/settings.html (tests/frontend/test-frontend-settings.cjs:70)"}, "fullDescription": {"text": "`tests/frontend/test-frontend-settings.cjs:70` calls `GET /views/settings.html` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: helper:request\nNormalized path used for matching: `/views/settings.html`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-fbffda55d99637d7", "name": "Dangling fetch: GET /views/settings.html (tests/frontend/test-frontend-settings.cjs:93)", "shortDescription": {"text": "Dangling fetch: GET /views/settings.html (tests/frontend/test-frontend-settings.cjs:93)"}, "fullDescription": {"text": "`tests/frontend/test-frontend-settings.cjs:93` calls `GET /views/settings.html` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: helper:request\nNormalized path used for matching: `/views/settings.html`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-b98b57d7100a843b", "name": "Dangling fetch: GET /views/${view}.html (tests/frontend/test-frontend-settings.cjs:248)", "shortDescription": {"text": "Dangling fetch: GET /views/${view}.html (tests/frontend/test-frontend-settings.cjs:248)"}, "fullDescription": {"text": "`tests/frontend/test-frontend-settings.cjs:248` calls `GET /views/${view}.html` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: helper:request\nNormalized path used for matching: `/views/<p>.html`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-df7d09792eae5ec9", "name": "Dangling fetch: GET /${comp} (tests/frontend/test-frontend-settings.cjs:269)", "shortDescription": {"text": "Dangling fetch: GET /${comp} (tests/frontend/test-frontend-settings.cjs:269)"}, "fullDescription": {"text": "`tests/frontend/test-frontend-settings.cjs:269` calls `GET /${comp}` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: helper:request\nNormalized path used for matching: `/<p>`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-09a62aeb0711da71", "name": "Dangling fetch: GET /${store} (tests/frontend/test-frontend-settings.cjs:292)", "shortDescription": {"text": "Dangling fetch: GET /${store} (tests/frontend/test-frontend-settings.cjs:292)"}, "fullDescription": {"text": "`tests/frontend/test-frontend-settings.cjs:292` calls `GET /${store}` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: helper:request\nNormalized path used for matching: `/<p>`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-39274e124e0582bc", "name": "Dangling fetch: GET /app.js (tests/frontend/test-frontend-settings.cjs:304)", "shortDescription": {"text": "Dangling fetch: GET /app.js (tests/frontend/test-frontend-settings.cjs:304)"}, "fullDescription": {"text": "`tests/frontend/test-frontend-settings.cjs:304` calls `GET /app.js` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: helper:request\nNormalized path used for matching: `/app.js`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-af82b267819e5d42", "name": "Dangling fetch: DELETE /api/claude/presets/__test_preset__ (tests/frontend/test-frontend-settings.cjs:375)", "shortDescription": {"text": "Dangling fetch: DELETE /api/claude/presets/__test_preset__ (tests/frontend/test-frontend-settings.cjs:375)"}, "fullDescription": {"text": "`tests/frontend/test-frontend-settings.cjs:375` calls `DELETE /api/claude/presets/__test_preset__` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: helper:request\nNormalized path used for matching: `/claude/presets/__test_preset__`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-9804dbc0434ac050", "name": "Dangling fetch: GET /views/settings.html (tests/frontend/test-frontend-settings.cjs:396)", "shortDescription": {"text": "Dangling fetch: GET /views/settings.html (tests/frontend/test-frontend-settings.cjs:396)"}, "fullDescription": {"text": "`tests/frontend/test-frontend-settings.cjs:396` calls `GET /views/settings.html` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: helper:request\nNormalized path used for matching: `/views/settings.html`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-34df21d02f124265", "name": "Dangling fetch: GET /views/accounts.html (tests/frontend/test-frontend-accounts.cjs:38)", "shortDescription": {"text": "Dangling fetch: GET /views/accounts.html (tests/frontend/test-frontend-accounts.cjs:38)"}, "fullDescription": {"text": "`tests/frontend/test-frontend-accounts.cjs:38` calls `GET /views/accounts.html` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: helper:request\nNormalized path used for matching: `/views/accounts.html`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-3d7e72c4a82ecc54", "name": "Dangling fetch: GET /views/accounts.html (tests/frontend/test-frontend-accounts.cjs:68)", "shortDescription": {"text": "Dangling fetch: GET /views/accounts.html (tests/frontend/test-frontend-accounts.cjs:68)"}, "fullDescription": {"text": "`tests/frontend/test-frontend-accounts.cjs:68` calls `GET /views/accounts.html` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: helper:request\nNormalized path used for matching: `/views/accounts.html`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-c95dd45eae37d9c3", "name": "Dangling fetch: GET /views/accounts.html (tests/frontend/test-frontend-accounts.cjs:82)", "shortDescription": {"text": "Dangling fetch: GET /views/accounts.html (tests/frontend/test-frontend-accounts.cjs:82)"}, "fullDescription": {"text": "`tests/frontend/test-frontend-accounts.cjs:82` calls `GET /views/accounts.html` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: helper:request\nNormalized path used for matching: `/views/accounts.html`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-52025fe297426d86", "name": "Dangling fetch: GET /views/accounts.html (tests/frontend/test-frontend-accounts.cjs:95)", "shortDescription": {"text": "Dangling fetch: GET /views/accounts.html (tests/frontend/test-frontend-accounts.cjs:95)"}, "fullDescription": {"text": "`tests/frontend/test-frontend-accounts.cjs:95` calls `GET /views/accounts.html` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: helper:request\nNormalized path used for matching: `/views/accounts.html`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-5ae3cd257c087d79", "name": "Dangling fetch: GET /views/accounts.html (tests/frontend/test-frontend-accounts.cjs:105)", "shortDescription": {"text": "Dangling fetch: GET /views/accounts.html (tests/frontend/test-frontend-accounts.cjs:105)"}, "fullDescription": {"text": "`tests/frontend/test-frontend-accounts.cjs:105` calls `GET /views/accounts.html` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: helper:request\nNormalized path used for matching: `/views/accounts.html`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-2233371c584e937f", "name": "Dangling fetch: GET /views/accounts.html (tests/frontend/test-frontend-accounts.cjs:116)", "shortDescription": {"text": "Dangling fetch: GET /views/accounts.html (tests/frontend/test-frontend-accounts.cjs:116)"}, "fullDescription": {"text": "`tests/frontend/test-frontend-accounts.cjs:116` calls `GET /views/accounts.html` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: helper:request\nNormalized path used for matching: `/views/accounts.html`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-1200b9933a1e05c0", "name": "Dangling fetch: GET /views/accounts.html (tests/frontend/test-frontend-accounts.cjs:126)", "shortDescription": {"text": "Dangling fetch: GET /views/accounts.html (tests/frontend/test-frontend-accounts.cjs:126)"}, "fullDescription": {"text": "`tests/frontend/test-frontend-accounts.cjs:126` calls `GET /views/accounts.html` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: helper:request\nNormalized path used for matching: `/views/accounts.html`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-53a9a08b3b0fe0a3", "name": "Dangling fetch: GET /index.html (tests/frontend/test-frontend-accounts.cjs:137)", "shortDescription": {"text": "Dangling fetch: GET /index.html (tests/frontend/test-frontend-accounts.cjs:137)"}, "fullDescription": {"text": "`tests/frontend/test-frontend-accounts.cjs:137` calls `GET /index.html` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: helper:request\nNormalized path used for matching: `/index.html`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-765d9e6a0fa94f74", "name": "Dangling fetch: GET /index.html (tests/frontend/test-frontend-accounts.cjs:148)", "shortDescription": {"text": "Dangling fetch: GET /index.html (tests/frontend/test-frontend-accounts.cjs:148)"}, "fullDescription": {"text": "`tests/frontend/test-frontend-accounts.cjs:148` calls `GET /index.html` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: helper:request\nNormalized path used for matching: `/index.html`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-5fa78402ff195de3", "name": "Dangling fetch: GET http://127.0.0.1:${ANTIGRAVITY_AUTH_PORT}/ (src/auth/token-extractor.js:25)", "shortDescription": {"text": "Dangling fetch: GET http://127.0.0.1:${ANTIGRAVITY_AUTH_PORT}/ (src/auth/token-extractor.js:25)"}, "fullDescription": {"text": "`src/auth/token-extractor.js:25` calls `GET http://127.0.0.1:${ANTIGRAVITY_AUTH_PORT}/` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/http:/127.0.0.1:/<p>`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-c1766e6d593b047a", "name": "Unused endpoint: USE /v1", "shortDescription": {"text": "Unused endpoint: USE /v1"}, "fullDescription": {"text": "`src/server.js` declares `USE /v1` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7a009b1a56794f45", "name": "Unused endpoint: POST /", "shortDescription": {"text": "Unused endpoint: POST /"}, "fullDescription": {"text": "`src/server.js` declares `POST /` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fd49a91562da4bb9", "name": "Unused endpoint: POST /test/clear-signature-cache", "shortDescription": {"text": "Unused endpoint: POST /test/clear-signature-cache"}, "fullDescription": {"text": "`src/server.js` declares `POST /test/clear-signature-cache` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e18fab67ca2632c7", "name": "Unused endpoint: POST /refresh-token", "shortDescription": {"text": "Unused endpoint: POST /refresh-token"}, "fullDescription": {"text": "`src/server.js` declares `POST /refresh-token` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-251e3dbd600caba5", "name": "Unused endpoint: GET /v1/models", "shortDescription": {"text": "Unused endpoint: GET /v1/models"}, "fullDescription": {"text": "`src/server.js` declares `GET /v1/models` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e51d72bee485df7b", "name": "Unused endpoint: POST /v1/messages/count_tokens", "shortDescription": {"text": "Unused endpoint: POST /v1/messages/count_tokens"}, "fullDescription": {"text": "`src/server.js` declares `POST /v1/messages/count_tokens` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-50d20b703a1dd1f9", "name": "Unused endpoint: POST /v1/messages", "shortDescription": {"text": "Unused endpoint: POST /v1/messages"}, "fullDescription": {"text": "`src/server.js` declares `POST /v1/messages` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fd55aa0818a7c897", "name": "Unused endpoint: POST /api/auth/login", "shortDescription": {"text": "Unused endpoint: POST /api/auth/login"}, "fullDescription": {"text": "`src/webui/index.js` declares `POST /api/auth/login` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d5a39262ac205120", "name": "Unused endpoint: POST /api/auth/logout", "shortDescription": {"text": "Unused endpoint: POST /api/auth/logout"}, "fullDescription": {"text": "`src/webui/index.js` declares `POST /api/auth/logout` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-689937a7b2360faa", "name": "Unused endpoint: GET /api/claude/mode", "shortDescription": {"text": "Unused endpoint: GET /api/claude/mode"}, "fullDescription": {"text": "`src/webui/index.js` declares `GET /api/claude/mode` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-244730b98c66da2e", "name": "Unused endpoint: POST /api/claude/mode", "shortDescription": {"text": "Unused endpoint: POST /api/claude/mode"}, "fullDescription": {"text": "`src/webui/index.js` declares `POST /api/claude/mode` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cdaa65dd8f60fdb1", "name": "Unused endpoint: GET /api/logs/stream", "shortDescription": {"text": "Unused endpoint: GET /api/logs/stream"}, "fullDescription": {"text": "`src/webui/index.js` declares `GET /api/logs/stream` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1bbf662826180c05", "name": "Unused endpoint: GET /api/stats/history", "shortDescription": {"text": "Unused endpoint: GET /api/stats/history"}, "fullDescription": {"text": "`src/modules/usage-stats.js` declares `GET /api/stats/history` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/21683"}, "properties": {"repository": "TsinHzl/agy-cc-proxy", "repoUrl": "https://github.com/TsinHzl/agy-cc-proxy", "branch": "main"}, "results": [{"ruleId": "scanner-62849e64eb96b6e2", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 tests/test-version-detection.js:6"}, "properties": {"repobilityId": "d94c9963e4a482ec", "scanner": "scanner-primary", "fingerprint": "62849e64eb96b6e2", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-6027b2134fd81a25", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 public/js/utils/ui-logger.js:87"}, "properties": {"repobilityId": "b866cde0d65e1031", "scanner": "scanner-primary", "fingerprint": "6027b2134fd81a25", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-104cdf51fc16af35", "level": "none", "message": {"text": "TODO/FIXME marker in shipping code \u2014 public/js/translations/zh.js:358"}, "properties": {"repobilityId": "201c04d87309cf29", "scanner": "scanner-primary", "fingerprint": "104cdf51fc16af35", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.todo-marker"]}}, {"ruleId": "scanner-ae9dc799c55d1f53", "level": "none", "message": {"text": "TODO/FIXME marker in shipping code \u2014 public/js/translations/tr.js:340"}, "properties": {"repobilityId": "7df29ff7ea4fb3ab", "scanner": "scanner-primary", "fingerprint": "ae9dc799c55d1f53", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.todo-marker"]}}, {"ruleId": "scanner-300dae5cb385a0e9", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 src/cli/accounts.js:106"}, "properties": {"repobilityId": "0eb4a1ad77363b15", "scanner": "scanner-primary", "fingerprint": "300dae5cb385a0e9", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-c8d99d92c00c0c8d", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 src/utils/logger.js:72"}, "properties": {"repobilityId": "f9810dc1fdf3724c", "scanner": "scanner-primary", "fingerprint": "c8d99d92c00c0c8d", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-9710c8d059e53154", "level": "none", "message": {"text": "No frontend routes/components detected"}, "properties": {"repobilityId": "44ca61485762e494", "scanner": "scanner-primary", "fingerprint": "9710c8d059e53154", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-007de55a550c9d4f", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in public/app.js:27"}, "properties": {"repobilityId": "5192b9054ebe3f07", "scanner": "scanner-primary", "fingerprint": "007de55a550c9d4f", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "public/app.js"}, "region": {"startLine": 27}}}]}, {"ruleId": "scanner-10fa32fa9cdac13d", "level": "error", "message": {"text": "Possible secret in public/js/translations/en.js"}, "properties": {"repobilityId": "a721e77fe62544c7", "scanner": "scanner-primary", "fingerprint": "10fa32fa9cdac13d", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "public/js/translations/en.js"}, "region": {"startLine": 236}}}]}, {"ruleId": "scanner-10fa32fa9cdac13d", "level": "error", "message": {"text": "Possible secret in public/js/translations/en.js"}, "properties": {"repobilityId": "a721e77fe62544c7", "scanner": "scanner-primary", "fingerprint": "10fa32fa9cdac13d", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "public/js/translations/en.js"}, "region": {"startLine": 292}}}]}, {"ruleId": "scanner-10fa32fa9cdac13d", "level": "error", "message": {"text": "Possible secret in public/js/translations/en.js"}, "properties": {"repobilityId": "a721e77fe62544c7", "scanner": "scanner-primary", "fingerprint": "10fa32fa9cdac13d", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "public/js/translations/en.js"}, "region": {"startLine": 294}}}]}, {"ruleId": "scanner-10fa32fa9cdac13d", "level": "error", "message": {"text": "Possible secret in public/js/translations/en.js"}, "properties": {"repobilityId": "a721e77fe62544c7", "scanner": "scanner-primary", "fingerprint": "10fa32fa9cdac13d", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "public/js/translations/en.js"}, "region": {"startLine": 295}}}]}, {"ruleId": "scanner-10fa32fa9cdac13d", "level": "error", "message": {"text": "Possible secret in public/js/translations/en.js"}, "properties": {"repobilityId": "a721e77fe62544c7", "scanner": "scanner-primary", "fingerprint": "10fa32fa9cdac13d", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "public/js/translations/en.js"}, "region": {"startLine": 296}}}]}, {"ruleId": "scanner-10fa32fa9cdac13d", "level": "error", "message": {"text": "Possible secret in public/js/translations/en.js"}, "properties": {"repobilityId": "a721e77fe62544c7", "scanner": "scanner-primary", "fingerprint": "10fa32fa9cdac13d", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "public/js/translations/en.js"}, "region": {"startLine": 377}}}]}, {"ruleId": "scanner-a1cc6c0939c0e5eb", "level": "error", "message": {"text": "Possible secret in public/js/translations/id.js"}, "properties": {"repobilityId": "512a134daa30232e", "scanner": "scanner-primary", "fingerprint": "a1cc6c0939c0e5eb", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "public/js/translations/id.js"}, "region": {"startLine": 268}}}]}, {"ruleId": "scanner-a1cc6c0939c0e5eb", "level": "error", "message": {"text": "Possible secret in public/js/translations/id.js"}, "properties": {"repobilityId": "512a134daa30232e", "scanner": "scanner-primary", "fingerprint": "a1cc6c0939c0e5eb", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "public/js/translations/id.js"}, "region": {"startLine": 327}}}]}, {"ruleId": "scanner-a1cc6c0939c0e5eb", "level": "error", "message": {"text": "Possible secret in public/js/translations/id.js"}, "properties": {"repobilityId": "512a134daa30232e", "scanner": "scanner-primary", "fingerprint": "a1cc6c0939c0e5eb", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "public/js/translations/id.js"}, "region": {"startLine": 329}}}]}, {"ruleId": "scanner-a1cc6c0939c0e5eb", "level": "error", "message": {"text": "Possible secret in public/js/translations/id.js"}, "properties": {"repobilityId": "512a134daa30232e", "scanner": "scanner-primary", "fingerprint": "a1cc6c0939c0e5eb", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "public/js/translations/id.js"}, "region": {"startLine": 330}}}]}, {"ruleId": "scanner-a1cc6c0939c0e5eb", "level": "error", "message": {"text": "Possible secret in public/js/translations/id.js"}, "properties": {"repobilityId": "512a134daa30232e", "scanner": "scanner-primary", "fingerprint": "a1cc6c0939c0e5eb", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "public/js/translations/id.js"}, "region": {"startLine": 331}}}]}, {"ruleId": "scanner-a1cc6c0939c0e5eb", "level": "error", "message": {"text": "Possible secret in public/js/translations/id.js"}, "properties": {"repobilityId": "512a134daa30232e", "scanner": "scanner-primary", "fingerprint": "a1cc6c0939c0e5eb", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "public/js/translations/id.js"}, "region": {"startLine": 420}}}]}, {"ruleId": "scanner-843ada2fe4091113", "level": "error", "message": {"text": "Possible secret in public/js/translations/zh.js"}, "properties": {"repobilityId": "03c2f242175c6d75", "scanner": "scanner-primary", "fingerprint": "843ada2fe4091113", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "public/js/translations/zh.js"}, "region": {"startLine": 236}}}]}, {"ruleId": "scanner-843ada2fe4091113", "level": "error", "message": {"text": "Possible secret in public/js/translations/zh.js"}, "properties": {"repobilityId": "03c2f242175c6d75", "scanner": "scanner-primary", "fingerprint": "843ada2fe4091113", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "public/js/translations/zh.js"}, "region": {"startLine": 292}}}]}, {"ruleId": "scanner-843ada2fe4091113", "level": "error", "message": {"text": "Possible secret in public/js/translations/zh.js"}, "properties": {"repobilityId": "03c2f242175c6d75", "scanner": "scanner-primary", "fingerprint": "843ada2fe4091113", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "public/js/translations/zh.js"}, "region": {"startLine": 381}}}]}, {"ruleId": "scanner-0fd6d7cfc04f0ce7", "level": "error", "message": {"text": "Possible secret in public/js/translations/pt.js"}, "properties": {"repobilityId": "a9827c4f54a4d110", "scanner": "scanner-primary", "fingerprint": "0fd6d7cfc04f0ce7", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "public/js/translations/pt.js"}, "region": {"startLine": 215}}}]}, {"ruleId": "scanner-0fd6d7cfc04f0ce7", "level": "error", "message": {"text": "Possible secret in public/js/translations/pt.js"}, "properties": {"repobilityId": "a9827c4f54a4d110", "scanner": "scanner-primary", "fingerprint": "0fd6d7cfc04f0ce7", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "public/js/translations/pt.js"}, "region": {"startLine": 270}}}]}, {"ruleId": "scanner-0fd6d7cfc04f0ce7", "level": "error", "message": {"text": "Possible secret in public/js/translations/pt.js"}, "properties": {"repobilityId": "a9827c4f54a4d110", "scanner": "scanner-primary", "fingerprint": "0fd6d7cfc04f0ce7", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "public/js/translations/pt.js"}, "region": {"startLine": 272}}}]}, {"ruleId": "scanner-0fd6d7cfc04f0ce7", "level": "error", "message": {"text": "Possible secret in public/js/translations/pt.js"}, "properties": {"repobilityId": "a9827c4f54a4d110", "scanner": "scanner-primary", "fingerprint": "0fd6d7cfc04f0ce7", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "public/js/translations/pt.js"}, "region": {"startLine": 273}}}]}, {"ruleId": "scanner-0fd6d7cfc04f0ce7", "level": "error", "message": {"text": "Possible secret in public/js/translations/pt.js"}, "properties": {"repobilityId": "a9827c4f54a4d110", "scanner": "scanner-primary", "fingerprint": "0fd6d7cfc04f0ce7", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "public/js/translations/pt.js"}, "region": {"startLine": 274}}}]}, {"ruleId": "scanner-bee1c2aca368bb17", "level": "error", "message": {"text": "Possible secret in public/js/translations/tr.js"}, "properties": {"repobilityId": "38813b880930a5a6", "scanner": "scanner-primary", "fingerprint": "bee1c2aca368bb17", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "public/js/translations/tr.js"}, "region": {"startLine": 218}}}]}, {"ruleId": "scanner-bee1c2aca368bb17", "level": "error", "message": {"text": "Possible secret in public/js/translations/tr.js"}, "properties": {"repobilityId": "38813b880930a5a6", "scanner": "scanner-primary", "fingerprint": "bee1c2aca368bb17", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "public/js/translations/tr.js"}, "region": {"startLine": 274}}}]}, {"ruleId": "scanner-bee1c2aca368bb17", "level": "error", "message": {"text": "Possible secret in public/js/translations/tr.js"}, "properties": {"repobilityId": "38813b880930a5a6", "scanner": "scanner-primary", "fingerprint": "bee1c2aca368bb17", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "public/js/translations/tr.js"}, "region": {"startLine": 276}}}]}, {"ruleId": "scanner-bee1c2aca368bb17", "level": "error", "message": {"text": "Possible secret in public/js/translations/tr.js"}, "properties": {"repobilityId": "38813b880930a5a6", "scanner": "scanner-primary", "fingerprint": "bee1c2aca368bb17", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "public/js/translations/tr.js"}, "region": {"startLine": 277}}}]}, {"ruleId": "scanner-bee1c2aca368bb17", "level": "error", "message": {"text": "Possible secret in public/js/translations/tr.js"}, "properties": {"repobilityId": "38813b880930a5a6", "scanner": "scanner-primary", "fingerprint": "bee1c2aca368bb17", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "public/js/translations/tr.js"}, "region": {"startLine": 278}}}]}, {"ruleId": "scanner-bee1c2aca368bb17", "level": "error", "message": {"text": "Possible secret in public/js/translations/tr.js"}, "properties": {"repobilityId": "38813b880930a5a6", "scanner": "scanner-primary", "fingerprint": "bee1c2aca368bb17", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "public/js/translations/tr.js"}, "region": {"startLine": 363}}}]}, {"ruleId": "scanner-949c140069784679", "level": "error", "message": {"text": "Possible secret in src/config.js"}, "properties": {"repobilityId": "b9ad66c01e6fc9c7", "scanner": "scanner-primary", "fingerprint": "949c140069784679", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/config.js"}, "region": {"startLine": 189}}}]}, {"ruleId": "scanner-21e506ecb2c3c3dc", "level": "warning", "message": {"text": "Insecure pattern 'cors_wildcard' in src/server.js:80"}, "properties": {"repobilityId": "d45a416ef266a21a", "scanner": "scanner-primary", "fingerprint": "21e506ecb2c3c3dc", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "cors_wildcard"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/server.js"}, "region": {"startLine": 80}}}]}, {"ruleId": "scanner-a7fee0cc275a9dd5", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in src/cli/accounts.js:20"}, "properties": {"repobilityId": "33ce2160dbd044d9", "scanner": "scanner-primary", "fingerprint": "a7fee0cc275a9dd5", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/cli/accounts.js"}, "region": {"startLine": 20}}}]}, {"ruleId": "scanner-14042917bfc5133b", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in src/utils/native-module-helper.js:7"}, "properties": {"repobilityId": "5eb9137f0a07736a", "scanner": "scanner-primary", "fingerprint": "14042917bfc5133b", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/utils/native-module-helper.js"}, "region": {"startLine": 7}}}]}, {"ruleId": "scanner-f75907b363f1ad71", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in src/utils/version-detector.js:1"}, "properties": {"repobilityId": "46ff92d947f0af07", "scanner": "scanner-primary", "fingerprint": "f75907b363f1ad71", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/utils/version-detector.js"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a53bf972e19b52fd", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "3ff29596dff0eef0", "scanner": "scanner-primary", "fingerprint": "a53bf972e19b52fd", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/publish.yml"}, "region": {"startLine": 12}}}]}, {"ruleId": "scanner-a53bf972e19b52fd", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "b2a2052e1c570c41", "scanner": "scanner-primary", "fingerprint": "a53bf972e19b52fd", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/publish.yml"}, "region": {"startLine": 15}}}]}, {"ruleId": "scanner-cb639d9a10a47b23", "level": "note", "message": {"text": "package.json defines install-time lifecycle scripts"}, "properties": {"repobilityId": "b86179956da3a4a8", "scanner": "scanner-primary", "fingerprint": "cb639d9a10a47b23", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "npm", "install-scripts"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-2698ff5dabf3a895", "level": "note", "message": {"text": "Very large file: public/js/components/server-config.js (1183 lines)"}, "properties": {"repobilityId": "3f2432b81d49acff", "scanner": "scanner-primary", "fingerprint": "2698ff5dabf3a895", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-4aa865056d5c5186", "level": "note", "message": {"text": "Very large file: src/webui/index.js (1374 lines)"}, "properties": {"repobilityId": "648fc5571e5b7083", "scanner": "scanner-primary", "fingerprint": "4aa865056d5c5186", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "dc5746ff2677c317", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-72b2a6250083a784", "level": "warning", "message": {"text": "Placeholder or mock-heavy implementation detected"}, "properties": {"repobilityId": "bb39e9de62eb6863", "scanner": "scanner-primary", "fingerprint": "72b2a6250083a784", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "incomplete", "generated-repo-pattern"]}}, {"ruleId": "scanner-9d79c4077342a7d0", "level": "warning", "message": {"text": "Runtime service client appears to use placeholder configuration"}, "properties": {"repobilityId": "e909dbd52a94e65a", "scanner": "scanner-primary", "fingerprint": "9d79c4077342a7d0", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "runtime-config", "service-client", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "7c26709d1b16f79b", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "1936c82d98bad332", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "450a111c4699f30e", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-d9d1ef66132d3521", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 public/app.js:32"}, "properties": {"repobilityId": "09b5004a095c9390", "scanner": "scanner-primary", "fingerprint": "d9d1ef66132d3521", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-e6191cf0c5965b40", "level": "none", "message": {"text": "Commented-code block (5 lines) in public/js/data-store.js:246"}, "properties": {"repobilityId": "ef71d8d16ed33d88", "scanner": "scanner-primary", "fingerprint": "e6191cf0c5965b40", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-094b9bf98e6cfee7", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 public/js/utils.js:8"}, "properties": {"repobilityId": "b5db1a67fafd8716", "scanner": "scanner-primary", "fingerprint": "094b9bf98e6cfee7", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-152483b5441893c5", "level": "none", "message": {"text": "Commented-code block (14 lines) in public/js/translations/zh.js:379"}, "properties": {"repobilityId": "0ad0e3ee3ebaadac", "scanner": "scanner-primary", "fingerprint": "152483b5441893c5", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-a2717e8d930b2eba", "level": "none", "message": {"text": "Commented-code block (14 lines) in public/js/translations/tr.js:361"}, "properties": {"repobilityId": "41e1ea8bdd2475ed", "scanner": "scanner-primary", "fingerprint": "a2717e8d930b2eba", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-1afe213ca1b1accd", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/utils/helpers.js:89"}, "properties": {"repobilityId": "baf9bf08c212bb04", "scanner": "scanner-primary", "fingerprint": "1afe213ca1b1accd", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-123ab264a0b44ba5", "level": "none", "message": {"text": "Commented-code block (6 lines) in src/cloudcode/model-api.js:224"}, "properties": {"repobilityId": "175aac2063439142", "scanner": "scanner-primary", "fingerprint": "123ab264a0b44ba5", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-19721866852af0d3", "level": "error", "message": {"text": "Dangling fetch: GET /views/dashboard.html (tests/frontend/test-frontend-dashboard.cjs:37)"}, "properties": {"repobilityId": "99a7f3c111eac93e", "scanner": "scanner-primary", "fingerprint": "19721866852af0d3", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "helper:request"]}}, {"ruleId": "scanner-f72a2cc48440d769", "level": "error", "message": {"text": "Dangling fetch: GET /views/dashboard.html (tests/frontend/test-frontend-dashboard.cjs:70)"}, "properties": {"repobilityId": "523dd42f5e6664f2", "scanner": "scanner-primary", "fingerprint": "f72a2cc48440d769", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "helper:request"]}}, {"ruleId": "scanner-1e6072ccf3e09325", "level": "error", "message": {"text": "Dangling fetch: GET /views/dashboard.html (tests/frontend/test-frontend-dashboard.cjs:91)"}, "properties": {"repobilityId": "c6a51b40af0ebd03", "scanner": "scanner-primary", "fingerprint": "1e6072ccf3e09325", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "helper:request"]}}, {"ruleId": "scanner-324ad8b14f00d4e2", "level": "error", "message": {"text": "Dangling fetch: GET /views/dashboard.html (tests/frontend/test-frontend-dashboard.cjs:112)"}, "properties": {"repobilityId": "fbf77bb2c6def7f1", "scanner": "scanner-primary", "fingerprint": "324ad8b14f00d4e2", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "helper:request"]}}, {"ruleId": "scanner-4efb71aa95218b1d", "level": "error", "message": {"text": "Dangling fetch: GET /views/logs.html (tests/frontend/test-frontend-logs.cjs:35)"}, "properties": {"repobilityId": "aec2ca60bee1bcd6", "scanner": "scanner-primary", "fingerprint": "4efb71aa95218b1d", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "helper:request"]}}, {"ruleId": "scanner-ed492cb362b359da", "level": "error", "message": {"text": "Dangling fetch: GET /views/logs.html (tests/frontend/test-frontend-logs.cjs:84)"}, "properties": {"repobilityId": "05ed5a643942bc75", "scanner": "scanner-primary", "fingerprint": "ed492cb362b359da", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "helper:request"]}}, {"ruleId": "scanner-dc9de79685afbbcb", "level": "error", "message": {"text": "Dangling fetch: GET /views/logs.html (tests/frontend/test-frontend-logs.cjs:97)"}, "properties": {"repobilityId": "e9c0d937b15a25e4", "scanner": "scanner-primary", "fingerprint": "dc9de79685afbbcb", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "helper:request"]}}, {"ruleId": "scanner-1340be4a2ffc6c4e", "level": "error", "message": {"text": "Dangling fetch: GET /views/logs.html (tests/frontend/test-frontend-logs.cjs:107)"}, "properties": {"repobilityId": "0894a24d266413f8", "scanner": "scanner-primary", "fingerprint": "1340be4a2ffc6c4e", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "helper:request"]}}, {"ruleId": "scanner-06f3e3757b5db7cc", "level": "error", "message": {"text": "Dangling fetch: GET /views/logs.html (tests/frontend/test-frontend-logs.cjs:120)"}, "properties": {"repobilityId": "cdbe2d9a78d378de", "scanner": "scanner-primary", "fingerprint": "06f3e3757b5db7cc", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "helper:request"]}}, {"ruleId": "scanner-41e65675d68105c2", "level": "error", "message": {"text": "Dangling fetch: GET /views/settings.html (tests/frontend/test-frontend-settings.cjs:39)"}, "properties": {"repobilityId": "3ebb597730503065", "scanner": "scanner-primary", "fingerprint": "41e65675d68105c2", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "helper:request"]}}, {"ruleId": "scanner-730b1b4128f0cebf", "level": "error", "message": {"text": "Dangling fetch: GET /views/settings.html (tests/frontend/test-frontend-settings.cjs:49)"}, "properties": {"repobilityId": "97c386952fe3a25f", "scanner": "scanner-primary", "fingerprint": "730b1b4128f0cebf", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "helper:request"]}}, {"ruleId": "scanner-9bfa5a9b3776c28f", "level": "error", "message": {"text": "Dangling fetch: GET /views/settings.html (tests/frontend/test-frontend-settings.cjs:70)"}, "properties": {"repobilityId": "85284db8aa731ba9", "scanner": "scanner-primary", "fingerprint": "9bfa5a9b3776c28f", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "helper:request"]}}, {"ruleId": "scanner-fbffda55d99637d7", "level": "error", "message": {"text": "Dangling fetch: GET /views/settings.html (tests/frontend/test-frontend-settings.cjs:93)"}, "properties": {"repobilityId": "18d270ff45969160", "scanner": "scanner-primary", "fingerprint": "fbffda55d99637d7", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "helper:request"]}}, {"ruleId": "scanner-b98b57d7100a843b", "level": "error", "message": {"text": "Dangling fetch: GET /views/${view}.html (tests/frontend/test-frontend-settings.cjs:248)"}, "properties": {"repobilityId": "5833539f4c899a77", "scanner": "scanner-primary", "fingerprint": "b98b57d7100a843b", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "helper:request"]}}, {"ruleId": "scanner-df7d09792eae5ec9", "level": "error", "message": {"text": "Dangling fetch: GET /${comp} (tests/frontend/test-frontend-settings.cjs:269)"}, "properties": {"repobilityId": "c9aeaf5390706597", "scanner": "scanner-primary", "fingerprint": "df7d09792eae5ec9", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "helper:request"]}}, {"ruleId": "scanner-09a62aeb0711da71", "level": "error", "message": {"text": "Dangling fetch: GET /${store} (tests/frontend/test-frontend-settings.cjs:292)"}, "properties": {"repobilityId": "9c5d4327cc685dcf", "scanner": "scanner-primary", "fingerprint": "09a62aeb0711da71", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "helper:request"]}}, {"ruleId": "scanner-39274e124e0582bc", "level": "error", "message": {"text": "Dangling fetch: GET /app.js (tests/frontend/test-frontend-settings.cjs:304)"}, "properties": {"repobilityId": "82b5a02e0fc867f0", "scanner": "scanner-primary", "fingerprint": "39274e124e0582bc", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "helper:request"]}}, {"ruleId": "scanner-af82b267819e5d42", "level": "error", "message": {"text": "Dangling fetch: DELETE /api/claude/presets/__test_preset__ (tests/frontend/test-frontend-settings.cjs:375)"}, "properties": {"repobilityId": "d188867ec3423ca0", "scanner": "scanner-primary", "fingerprint": "af82b267819e5d42", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "helper:request"]}}, {"ruleId": "scanner-9804dbc0434ac050", "level": "error", "message": {"text": "Dangling fetch: GET /views/settings.html (tests/frontend/test-frontend-settings.cjs:396)"}, "properties": {"repobilityId": "640a2363197292ac", "scanner": "scanner-primary", "fingerprint": "9804dbc0434ac050", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "helper:request"]}}, {"ruleId": "scanner-34df21d02f124265", "level": "error", "message": {"text": "Dangling fetch: GET /views/accounts.html (tests/frontend/test-frontend-accounts.cjs:38)"}, "properties": {"repobilityId": "f2ab43afece0248b", "scanner": "scanner-primary", "fingerprint": "34df21d02f124265", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "helper:request"]}}, {"ruleId": "scanner-3d7e72c4a82ecc54", "level": "error", "message": {"text": "Dangling fetch: GET /views/accounts.html (tests/frontend/test-frontend-accounts.cjs:68)"}, "properties": {"repobilityId": "7d36c202eb8c73cb", "scanner": "scanner-primary", "fingerprint": "3d7e72c4a82ecc54", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "helper:request"]}}, {"ruleId": "scanner-c95dd45eae37d9c3", "level": "error", "message": {"text": "Dangling fetch: GET /views/accounts.html (tests/frontend/test-frontend-accounts.cjs:82)"}, "properties": {"repobilityId": "8e91a129a1e9b970", "scanner": "scanner-primary", "fingerprint": "c95dd45eae37d9c3", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "helper:request"]}}, {"ruleId": "scanner-52025fe297426d86", "level": "error", "message": {"text": "Dangling fetch: GET /views/accounts.html (tests/frontend/test-frontend-accounts.cjs:95)"}, "properties": {"repobilityId": "a7414f01f031b9ef", "scanner": "scanner-primary", "fingerprint": "52025fe297426d86", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "helper:request"]}}, {"ruleId": "scanner-5ae3cd257c087d79", "level": "error", "message": {"text": "Dangling fetch: GET /views/accounts.html (tests/frontend/test-frontend-accounts.cjs:105)"}, "properties": {"repobilityId": "529e11bccc48b9de", "scanner": "scanner-primary", "fingerprint": "5ae3cd257c087d79", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "helper:request"]}}, {"ruleId": "scanner-2233371c584e937f", "level": "error", "message": {"text": "Dangling fetch: GET /views/accounts.html (tests/frontend/test-frontend-accounts.cjs:116)"}, "properties": {"repobilityId": "7578d348551700bb", "scanner": "scanner-primary", "fingerprint": "2233371c584e937f", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "helper:request"]}}, {"ruleId": "scanner-1200b9933a1e05c0", "level": "error", "message": {"text": "Dangling fetch: GET /views/accounts.html (tests/frontend/test-frontend-accounts.cjs:126)"}, "properties": {"repobilityId": "30fc8fe76426bf0e", "scanner": "scanner-primary", "fingerprint": "1200b9933a1e05c0", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "helper:request"]}}, {"ruleId": "scanner-53a9a08b3b0fe0a3", "level": "error", "message": {"text": "Dangling fetch: GET /index.html (tests/frontend/test-frontend-accounts.cjs:137)"}, "properties": {"repobilityId": "cdcc2f4d2929a52a", "scanner": "scanner-primary", "fingerprint": "53a9a08b3b0fe0a3", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "helper:request"]}}, {"ruleId": "scanner-765d9e6a0fa94f74", "level": "error", "message": {"text": "Dangling fetch: GET /index.html (tests/frontend/test-frontend-accounts.cjs:148)"}, "properties": {"repobilityId": "45de121a69fa4876", "scanner": "scanner-primary", "fingerprint": "765d9e6a0fa94f74", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "helper:request"]}}, {"ruleId": "scanner-5fa78402ff195de3", "level": "error", "message": {"text": "Dangling fetch: GET http://127.0.0.1:${ANTIGRAVITY_AUTH_PORT}/ (src/auth/token-extractor.js:25)"}, "properties": {"repobilityId": "918b5a2a7dff2616", "scanner": "scanner-primary", "fingerprint": "5fa78402ff195de3", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-c1766e6d593b047a", "level": "note", "message": {"text": "Unused endpoint: USE /v1"}, "properties": {"repobilityId": "fc184544c3ac83cd", "scanner": "scanner-primary", "fingerprint": "c1766e6d593b047a", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-7a009b1a56794f45", "level": "note", "message": {"text": "Unused endpoint: POST /"}, "properties": {"repobilityId": "d523bdc5b9e51049", "scanner": "scanner-primary", "fingerprint": "7a009b1a56794f45", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-fd49a91562da4bb9", "level": "note", "message": {"text": "Unused endpoint: POST /test/clear-signature-cache"}, "properties": {"repobilityId": "5d0e0745d7f23d1f", "scanner": "scanner-primary", "fingerprint": "fd49a91562da4bb9", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-e18fab67ca2632c7", "level": "note", "message": {"text": "Unused endpoint: POST /refresh-token"}, "properties": {"repobilityId": "ee7a34b797ed5850", "scanner": "scanner-primary", "fingerprint": "e18fab67ca2632c7", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-251e3dbd600caba5", "level": "note", "message": {"text": "Unused endpoint: GET /v1/models"}, "properties": {"repobilityId": "a4ce81f20d33a33b", "scanner": "scanner-primary", "fingerprint": "251e3dbd600caba5", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-e51d72bee485df7b", "level": "note", "message": {"text": "Unused endpoint: POST /v1/messages/count_tokens"}, "properties": {"repobilityId": "5ce4fcc8e01bbadc", "scanner": "scanner-primary", "fingerprint": "e51d72bee485df7b", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-50d20b703a1dd1f9", "level": "note", "message": {"text": "Unused endpoint: POST /v1/messages"}, "properties": {"repobilityId": "43444cb937d1ec35", "scanner": "scanner-primary", "fingerprint": "50d20b703a1dd1f9", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-fd55aa0818a7c897", "level": "note", "message": {"text": "Unused endpoint: POST /api/auth/login"}, "properties": {"repobilityId": "2868194544522b3d", "scanner": "scanner-primary", "fingerprint": "fd55aa0818a7c897", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-d5a39262ac205120", "level": "note", "message": {"text": "Unused endpoint: POST /api/auth/logout"}, "properties": {"repobilityId": "e5a9a3d2205cabe2", "scanner": "scanner-primary", "fingerprint": "d5a39262ac205120", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-689937a7b2360faa", "level": "note", "message": {"text": "Unused endpoint: GET /api/claude/mode"}, "properties": {"repobilityId": "f8576e0d9351e3f5", "scanner": "scanner-primary", "fingerprint": "689937a7b2360faa", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-244730b98c66da2e", "level": "note", "message": {"text": "Unused endpoint: POST /api/claude/mode"}, "properties": {"repobilityId": "0a0c30963b8c163b", "scanner": "scanner-primary", "fingerprint": "244730b98c66da2e", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-cdaa65dd8f60fdb1", "level": "note", "message": {"text": "Unused endpoint: GET /api/logs/stream"}, "properties": {"repobilityId": "b56171e2df17ec15", "scanner": "scanner-primary", "fingerprint": "cdaa65dd8f60fdb1", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-1bbf662826180c05", "level": "note", "message": {"text": "Unused endpoint: GET /api/stats/history"}, "properties": {"repobilityId": "4a418c23e92f4736", "scanner": "scanner-primary", "fingerprint": "1bbf662826180c05", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}]}]}