{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-d347f255add996e7", "name": "Possibly dead Python function: log_message", "shortDescription": {"text": "Possibly dead Python function: log_message"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f9f77db3086e1e29", "name": "Possibly dead Python function: do_GET", "shortDescription": {"text": "Possibly dead Python function: do_GET"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1418cc21fe36fba9", "name": "Stray `console.log` in TS/JS \u2014 frontend/src/lib/nostr/stage.svelte.ts:69", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 frontend/src/lib/nostr/stage.svelte.ts:69"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-46f012d181cd0c12", "name": "Stray `console.log` in TS/JS \u2014 frontend/src/lib/nostr/nostrLogin.ts:308", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 frontend/src/lib/nostr/nostrLogin.ts:308"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-686e486d1186f459", "name": "Stray `console.log` in TS/JS \u2014 frontend/src/lib/nostr/sync.svelte.ts:42", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 frontend/src/lib/nostr/sync.svelte.ts:42"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-129b16d505d7a243", "name": "Stray `console.log` in TS/JS \u2014 frontend/src/lib/nostr/queue.svelte.ts:69", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 frontend/src/lib/nostr/queue.svelte.ts:69"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2b8a03f59fe2c696", "name": "Stray `console.log` in TS/JS \u2014 frontend/src/lib/nostr/auth.svelte.ts:46", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 frontend/src/lib/nostr/auth.svelte.ts:46"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-11e5ea43a37f4186", "name": "Icon-only button without accessible name \u2014 frontend/src/lib/components/PremiumModal.svelte:124", "shortDescription": {"text": "Icon-only button without accessible name \u2014 frontend/src/lib/components/PremiumModal.svelte:124"}, "fullDescription": {"text": "A `<button>` whose only child is a single glyph or symbol needs `title=` or `aria-label=` so screen readers (and tooltips on hover) work.\n\nWhy: P3 in CHECKLIST.md \u2014 icon-only buttons skipped a title.\nRule id: fq.button.no-label"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a13a538bd8d385cd", "name": "Icon-only button without accessible name \u2014 frontend/src/lib/components/club/GoLiveButton.svelte:70", "shortDescription": {"text": "Icon-only button without accessible name \u2014 frontend/src/lib/components/club/GoLiveButton.svelte:70"}, "fullDescription": {"text": "A `<button>` whose only child is a single glyph or symbol needs `title=` or `aria-label=` so screen readers (and tooltips on hover) work.\n\nWhy: P3 in CHECKLIST.md \u2014 icon-only buttons skipped a title.\nRule id: fq.button.no-label"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9710c8d059e53154", "name": "No frontend routes/components detected", "shortDescription": {"text": "No frontend routes/components detected"}, "fullDescription": {"text": "No React/Vue/Next routes were found. This is fine for backend-only repos."}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-1224086bc3996c3b", "name": "Insecure pattern 'cors_wildcard' in relay/radiostream.go:983", "shortDescription": {"text": "Insecure pattern 'cors_wildcard' in relay/radiostream.go:983"}, "fullDescription": {"text": "Found a known-risky pattern (cors_wildcard). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-89dfe1e09869399d", "name": "Insecure pattern 'cors_wildcard' in relay/livekit.go:106", "shortDescription": {"text": "Insecure pattern 'cors_wildcard' in relay/livekit.go:106"}, "fullDescription": {"text": "Found a known-risky pattern (cors_wildcard). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ca1e38470cbd4a39", "name": "Insecure pattern 'cors_wildcard' in relay/leaderboard.go:160", "shortDescription": {"text": "Insecure pattern 'cors_wildcard' in relay/leaderboard.go:160"}, "fullDescription": {"text": "Found a known-risky pattern (cors_wildcard). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-69087382e9320465", "name": "Insecure pattern 'cors_wildcard' in relay/lnbits.go:161", "shortDescription": {"text": "Insecure pattern 'cors_wildcard' in relay/lnbits.go:161"}, "fullDescription": {"text": "Found a known-risky pattern (cors_wildcard). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-efa918707eac80ff", "name": "Insecure pattern 'cors_wildcard' in deploy/lnurlp_proxy.py:39", "shortDescription": {"text": "Insecure pattern 'cors_wildcard' in deploy/lnurlp_proxy.py:39"}, "fullDescription": {"text": "Found a known-risky pattern (cors_wildcard). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f6bfdaa7bf9a2148", "name": "Very large file: relay/conductor.go (1952 lines)", "shortDescription": {"text": "Very large file: relay/conductor.go (1952 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ea3b5e389d8c9c0f", "name": "Low test-to-source ratio", "shortDescription": {"text": "Low test-to-source ratio"}, "fullDescription": {"text": "13 tests / 73 src (ratio 0.18)."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-141b30a41e03817b", "name": "No license file detected", "shortDescription": {"text": "No license file detected"}, "fullDescription": {"text": "No LICENSE/COPYING/NOTICE file was found. Generated repositories often omit licensing, which blocks reuse and automated intake."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 44 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-749d4bc1bd66df5f", "name": "Agent instructions exist but release-hardening basics are missing", "shortDescription": {"text": "Agent instructions exist but release-hardening basics are missing"}, "fullDescription": {"text": "AI-coder instruction files were found, but the repo is missing license. Treat this as a contract gap: the agent is guided, but the generated output is not yet guarded by the controls that make it repeatable."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-e9fc285eb72c8bc6", "name": "Commented-code block (6 lines) in relay/grouptest.mjs:1", "shortDescription": {"text": "Commented-code block (6 lines) in relay/grouptest.mjs:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-bf6663a7f94e34d0", "name": "`fetch()` without try/.catch or AbortSignal \u2014 relay/grouptest.mjs:257", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 relay/grouptest.mjs:257"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ca740f0d43922cfa", "name": "Commented-code block (8 lines) in frontend/scripts/gen-assets.mjs:1", "shortDescription": {"text": "Commented-code block (8 lines) in frontend/scripts/gen-assets.mjs:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-faeafeb0ec18f63e", "name": "`fetch()` without try/.catch or AbortSignal \u2014 frontend/src/lib/player/livekit.ts:59", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 frontend/src/lib/player/livekit.ts:59"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-fc5cfe26a85c751e", "name": "Commented-code block (5 lines) in frontend/src/lib/nostr/nostrLogin.ts:319", "shortDescription": {"text": "Commented-code block (5 lines) in frontend/src/lib/nostr/nostrLogin.ts:319"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-709d686804761c67", "name": "`fetch()` without try/.catch or AbortSignal \u2014 frontend/src/lib/nostr/premium.svelte.ts:133", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 frontend/src/lib/nostr/premium.svelte.ts:133"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f226fa986a7ee83f", "name": "Commented-code block (5 lines) in frontend/src/lib/nostr/autodj.svelte.ts:7", "shortDescription": {"text": "Commented-code block (5 lines) in frontend/src/lib/nostr/autodj.svelte.ts:7"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-1e6b24f49ae2aa39", "name": "Commented-code block (5 lines) in frontend/src/lib/nostr/pool.ts:37", "shortDescription": {"text": "Commented-code block (5 lines) in frontend/src/lib/nostr/pool.ts:37"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-a68a1d3c76c88d17", "name": "Commented-code block (8 lines) in frontend/src/lib/nostr/queue.svelte.ts:72", "shortDescription": {"text": "Commented-code block (8 lines) in frontend/src/lib/nostr/queue.svelte.ts:72"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-d8155541da9a8c82", "name": "Commented-code block (5 lines) in frontend/src/lib/nostr/roundrobin.ts:4", "shortDescription": {"text": "Commented-code block (5 lines) in frontend/src/lib/nostr/roundrobin.ts:4"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-f2afe24e8b9bc537", "name": "`fetch()` without try/.catch or AbortSignal \u2014 frontend/src/lib/nostr/radiostream.ts:27", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 frontend/src/lib/nostr/radiostream.ts:27"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-02dbccd0bf92e164", "name": "Commented-code block (6 lines) in frontend/src/lib/nostr/playlog.ts:3", "shortDescription": {"text": "Commented-code block (6 lines) in frontend/src/lib/nostr/playlog.ts:3"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-a8c8341cc20ea4dd", "name": "`fetch()` without try/.catch or AbortSignal \u2014 frontend/src/lib/nostr/blossom.ts:43", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 frontend/src/lib/nostr/blossom.ts:43"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4814ee6f7eceda95", "name": "Commented-code block (5 lines) in frontend/src/lib/nostr/profiles.svelte.ts:7", "shortDescription": {"text": "Commented-code block (5 lines) in frontend/src/lib/nostr/profiles.svelte.ts:7"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-8614917c8ea3dc63", "name": "Commented-code block (5 lines) in frontend/src/lib/nostr/playlog.svelte.ts:6", "shortDescription": {"text": "Commented-code block (5 lines) in frontend/src/lib/nostr/playlog.svelte.ts:6"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-892f08f3b0e599b4", "name": "`fetch()` without try/.catch or AbortSignal \u2014 frontend/src/lib/nostr/admin.ts:36", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 frontend/src/lib/nostr/admin.ts:36"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-fbd80598cbd0cf41", "name": "Commented-code block (5 lines) in frontend/src/lib/nostr/leaderboard.ts:4", "shortDescription": {"text": "Commented-code block (5 lines) in frontend/src/lib/nostr/leaderboard.ts:4"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-af022f937dd5b7fd", "name": "9 env vars used in code but missing from .env.example", "shortDescription": {"text": "9 env vars used in code but missing from .env.example"}, "fullDescription": {"text": "Drift between code and config docs. The first few: `ADMIN_SK`, `ADMIN_URL`, `CLUB`, `LNURL_DOMAIN`, `LNURL_FALLBACK_DOMAIN`, `PORT`, `RELAY_PK`, `RELAY_PUBLIC_URL` + 1 more. Add them (with a placeholder/comment) to .env.example so onboarding doesn't break."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/18988"}, "properties": {"repository": "satoshidude/zapclub.io", "repoUrl": "https://github.com/satoshidude/zapclub.io", "branch": "main"}, "results": [{"ruleId": "scanner-d347f255add996e7", "level": "note", "message": {"text": "Possibly dead Python function: log_message"}, "properties": {"repobilityId": "965f3150b4af5b2e", "scanner": "scanner-primary", "fingerprint": "d347f255add996e7", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "deploy/lnurlp_proxy.py:31"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f9f77db3086e1e29", "level": "note", "message": {"text": "Possibly dead Python function: do_GET"}, "properties": {"repobilityId": "2d943bb45e4f13bd", "scanner": "scanner-primary", "fingerprint": "f9f77db3086e1e29", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "deploy/lnurlp_proxy.py:43"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-1418cc21fe36fba9", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 frontend/src/lib/nostr/stage.svelte.ts:69"}, "properties": {"repobilityId": "10aaf1dadfe5c3a7", "scanner": "scanner-primary", "fingerprint": "1418cc21fe36fba9", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-46f012d181cd0c12", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 frontend/src/lib/nostr/nostrLogin.ts:308"}, "properties": {"repobilityId": "8d38a035125bbcd0", "scanner": "scanner-primary", "fingerprint": "46f012d181cd0c12", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-686e486d1186f459", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 frontend/src/lib/nostr/sync.svelte.ts:42"}, "properties": {"repobilityId": "4d1ef79803aafb4b", "scanner": "scanner-primary", "fingerprint": "686e486d1186f459", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-129b16d505d7a243", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 frontend/src/lib/nostr/queue.svelte.ts:69"}, "properties": {"repobilityId": "432d5d709e1d766a", "scanner": "scanner-primary", "fingerprint": "129b16d505d7a243", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-2b8a03f59fe2c696", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 frontend/src/lib/nostr/auth.svelte.ts:46"}, "properties": {"repobilityId": "4f10111e7dbc5b9b", "scanner": "scanner-primary", "fingerprint": "2b8a03f59fe2c696", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-11e5ea43a37f4186", "level": "note", "message": {"text": "Icon-only button without accessible name \u2014 frontend/src/lib/components/PremiumModal.svelte:124"}, "properties": {"repobilityId": "9bf390903c2afb05", "scanner": "scanner-primary", "fingerprint": "11e5ea43a37f4186", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.button.no-label"]}}, {"ruleId": "scanner-a13a538bd8d385cd", "level": "note", "message": {"text": "Icon-only button without accessible name \u2014 frontend/src/lib/components/club/GoLiveButton.svelte:70"}, "properties": {"repobilityId": "ff4b45d998513a3c", "scanner": "scanner-primary", "fingerprint": "a13a538bd8d385cd", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.button.no-label"]}}, {"ruleId": "scanner-9710c8d059e53154", "level": "none", "message": {"text": "No frontend routes/components detected"}, "properties": {"repobilityId": "44ca61485762e494", "scanner": "scanner-primary", "fingerprint": "9710c8d059e53154", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-1224086bc3996c3b", "level": "warning", "message": {"text": "Insecure pattern 'cors_wildcard' in relay/radiostream.go:983"}, "properties": {"repobilityId": "cdf3c1786dc4d1f1", "scanner": "scanner-primary", "fingerprint": "1224086bc3996c3b", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "cors_wildcard"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "relay/radiostream.go"}, "region": {"startLine": 983}}}]}, {"ruleId": "scanner-89dfe1e09869399d", "level": "warning", "message": {"text": "Insecure pattern 'cors_wildcard' in relay/livekit.go:106"}, "properties": {"repobilityId": "ac00f8b87961c7a1", "scanner": "scanner-primary", "fingerprint": "89dfe1e09869399d", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "cors_wildcard"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "relay/livekit.go"}, "region": {"startLine": 106}}}]}, {"ruleId": "scanner-ca1e38470cbd4a39", "level": "warning", "message": {"text": "Insecure pattern 'cors_wildcard' in relay/leaderboard.go:160"}, "properties": {"repobilityId": "8d346c1f29d2ae84", "scanner": "scanner-primary", "fingerprint": "ca1e38470cbd4a39", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "cors_wildcard"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "relay/leaderboard.go"}, "region": {"startLine": 160}}}]}, {"ruleId": "scanner-69087382e9320465", "level": "warning", "message": {"text": "Insecure pattern 'cors_wildcard' in relay/lnbits.go:161"}, "properties": {"repobilityId": "f40511cff998b308", "scanner": "scanner-primary", "fingerprint": "69087382e9320465", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "cors_wildcard"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "relay/lnbits.go"}, "region": {"startLine": 161}}}]}, {"ruleId": "scanner-efa918707eac80ff", "level": "warning", "message": {"text": "Insecure pattern 'cors_wildcard' in deploy/lnurlp_proxy.py:39"}, "properties": {"repobilityId": "6c2571b95bae284c", "scanner": "scanner-primary", "fingerprint": "efa918707eac80ff", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "cors_wildcard"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "deploy/lnurlp_proxy.py"}, "region": {"startLine": 39}}}]}, {"ruleId": "scanner-f6bfdaa7bf9a2148", "level": "note", "message": {"text": "Very large file: relay/conductor.go (1952 lines)"}, "properties": {"repobilityId": "51a173d2e923fd10", "scanner": "scanner-primary", "fingerprint": "f6bfdaa7bf9a2148", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-ea3b5e389d8c9c0f", "level": "note", "message": {"text": "Low test-to-source ratio"}, "properties": {"repobilityId": "ef7b2552cc00a375", "scanner": "scanner-primary", "fingerprint": "ea3b5e389d8c9c0f", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["tests"]}}, {"ruleId": "scanner-141b30a41e03817b", "level": "note", "message": {"text": "No license file detected"}, "properties": {"repobilityId": "d6b71d91f02ebc4c", "scanner": "scanner-primary", "fingerprint": "141b30a41e03817b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["license", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "24c94717e63dcaf4", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "394685330eff48eb", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-749d4bc1bd66df5f", "level": "warning", "message": {"text": "Agent instructions exist but release-hardening basics are missing"}, "properties": {"repobilityId": "2564ea7712c6d93d", "scanner": "scanner-primary", "fingerprint": "749d4bc1bd66df5f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "9d81e5f1cb4248ba", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "a2fd198363b36317", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-e9fc285eb72c8bc6", "level": "none", "message": {"text": "Commented-code block (6 lines) in relay/grouptest.mjs:1"}, "properties": {"repobilityId": "2ce73b8c0bc26e50", "scanner": "scanner-primary", "fingerprint": "e9fc285eb72c8bc6", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-bf6663a7f94e34d0", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 relay/grouptest.mjs:257"}, "properties": {"repobilityId": "cb4e18c04e459090", "scanner": "scanner-primary", "fingerprint": "bf6663a7f94e34d0", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-ca740f0d43922cfa", "level": "none", "message": {"text": "Commented-code block (8 lines) in frontend/scripts/gen-assets.mjs:1"}, "properties": {"repobilityId": "2f9ba91fa50a4ea9", "scanner": "scanner-primary", "fingerprint": "ca740f0d43922cfa", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-faeafeb0ec18f63e", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 frontend/src/lib/player/livekit.ts:59"}, "properties": {"repobilityId": "0ceccb099397d9d4", "scanner": "scanner-primary", "fingerprint": "faeafeb0ec18f63e", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-fc5cfe26a85c751e", "level": "none", "message": {"text": "Commented-code block (5 lines) in frontend/src/lib/nostr/nostrLogin.ts:319"}, "properties": {"repobilityId": "db8d7d5d8e42c8d2", "scanner": "scanner-primary", "fingerprint": "fc5cfe26a85c751e", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-709d686804761c67", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 frontend/src/lib/nostr/premium.svelte.ts:133"}, "properties": {"repobilityId": "737263b9a227590b", "scanner": "scanner-primary", "fingerprint": "709d686804761c67", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-f226fa986a7ee83f", "level": "none", "message": {"text": "Commented-code block (5 lines) in frontend/src/lib/nostr/autodj.svelte.ts:7"}, "properties": {"repobilityId": "f724c6dfdea10244", "scanner": "scanner-primary", "fingerprint": "f226fa986a7ee83f", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-1e6b24f49ae2aa39", "level": "none", "message": {"text": "Commented-code block (5 lines) in frontend/src/lib/nostr/pool.ts:37"}, "properties": {"repobilityId": "007cda5d00c86a02", "scanner": "scanner-primary", "fingerprint": "1e6b24f49ae2aa39", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-a68a1d3c76c88d17", "level": "none", "message": {"text": "Commented-code block (8 lines) in frontend/src/lib/nostr/queue.svelte.ts:72"}, "properties": {"repobilityId": "18a6e5677d0b61f7", "scanner": "scanner-primary", "fingerprint": "a68a1d3c76c88d17", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-d8155541da9a8c82", "level": "none", "message": {"text": "Commented-code block (5 lines) in frontend/src/lib/nostr/roundrobin.ts:4"}, "properties": {"repobilityId": "f47edeff9d563b8a", "scanner": "scanner-primary", "fingerprint": "d8155541da9a8c82", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-f2afe24e8b9bc537", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 frontend/src/lib/nostr/radiostream.ts:27"}, "properties": {"repobilityId": "c5d3a3575437732d", "scanner": "scanner-primary", "fingerprint": "f2afe24e8b9bc537", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-02dbccd0bf92e164", "level": "none", "message": {"text": "Commented-code block (6 lines) in frontend/src/lib/nostr/playlog.ts:3"}, "properties": {"repobilityId": "5c2cf8b355c28b46", "scanner": "scanner-primary", "fingerprint": "02dbccd0bf92e164", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-a8c8341cc20ea4dd", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 frontend/src/lib/nostr/blossom.ts:43"}, "properties": {"repobilityId": "910b2f6602ee8a9f", "scanner": "scanner-primary", "fingerprint": "a8c8341cc20ea4dd", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-4814ee6f7eceda95", "level": "none", "message": {"text": "Commented-code block (5 lines) in frontend/src/lib/nostr/profiles.svelte.ts:7"}, "properties": {"repobilityId": "7a3a75b170b3de93", "scanner": "scanner-primary", "fingerprint": "4814ee6f7eceda95", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-8614917c8ea3dc63", "level": "none", "message": {"text": "Commented-code block (5 lines) in frontend/src/lib/nostr/playlog.svelte.ts:6"}, "properties": {"repobilityId": "aa69e0134be1d6ab", "scanner": "scanner-primary", "fingerprint": "8614917c8ea3dc63", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-892f08f3b0e599b4", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 frontend/src/lib/nostr/admin.ts:36"}, "properties": {"repobilityId": "aaabcb7c10602402", "scanner": "scanner-primary", "fingerprint": "892f08f3b0e599b4", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-fbd80598cbd0cf41", "level": "none", "message": {"text": "Commented-code block (5 lines) in frontend/src/lib/nostr/leaderboard.ts:4"}, "properties": {"repobilityId": "f01311dfaae18351", "scanner": "scanner-primary", "fingerprint": "fbd80598cbd0cf41", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-af022f937dd5b7fd", "level": "note", "message": {"text": "9 env vars used in code but missing from .env.example"}, "properties": {"repobilityId": "5597384795dea7a4", "scanner": "scanner-primary", "fingerprint": "af022f937dd5b7fd", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "config-drift"]}}]}]}