{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "WEB003", "name": "Public web service has no security.txt", "shortDescription": {"text": "Public web service has no security.txt"}, "fullDescription": {"text": "security.txt gives researchers and customers a safe disclosure channel. Public web apps and APIs should publish it under /.well-known/security.txt."}, "properties": {"scanner": "repobility-web-presence", "category": "quality", "severity": "medium", "confidence": 0.78, "cwe": "", "owasp": ""}}, {"id": "JRN003", "name": "Frontend API reference is not matched by discovered backend routes", "shortDescription": {"text": "Frontend API reference is not matched by discovered backend routes"}, "fullDescription": {"text": "A frontend string references a same-origin API path that Repobility could not match to backend route inventory. This often causes live 404s in user journeys."}, "properties": {"scanner": "repobility-journey-contract", "category": "quality", "severity": "medium", "confidence": 0.74, "cwe": "", "owasp": ""}}, {"id": "AUC012", "name": "[AUC012] FastAPI interactive docs may be exposed by framework defaults: FastAPI exposes /docs, /redoc, and /openapi.json", "shortDescription": {"text": "[AUC012] FastAPI interactive docs may be exposed by framework defaults: FastAPI exposes /docs, /redoc, and /openapi.json by default. Public production APIs should explicitly disable those defaults, protect them behind admin authentication, "}, "fullDescription": {"text": "FastAPI exposes /docs, /redoc, and /openapi.json by default. Public production APIs should explicitly disable those defaults, protect them behind admin authentication, or publish a reviewed OpenAPI spec with declared security requirements."}, "properties": {"scanner": "repobility-access-control", "category": "auth", "severity": "medium", "confidence": 0.72, "cwe": "CWE-285", "owasp": "WSTG-AUTHZ"}}, {"id": "AUC009", "name": "[AUC009] Sensitive function route lacks elevated authorization evidence: A route appears to perform a sensitive function", "shortDescription": {"text": "[AUC009] Sensitive function route lacks elevated authorization evidence: A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: DELETE "}, "fullDescription": {"text": "A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: DELETE /clients/{client_id}."}, "properties": {"scanner": "repobility-access-control", "category": "auth", "severity": "medium", "confidence": 0.68, "cwe": "CWE-285", "owasp": "API5:2023 Broken Function Level Authorization"}}, {"id": "AUC004", "name": "[AUC004] Admin route does not show super_admin separation: An administrative route was detected without nearby evidence ", "shortDescription": {"text": "[AUC004] Admin route does not show super_admin separation: An administrative route was detected without nearby evidence that platform super_admin access is separated from tenant/application admin access. Endpoint: POST /{settings.api_prefix"}, "fullDescription": {"text": "An administrative route was detected without nearby evidence that platform super_admin access is separated from tenant/application admin access. Endpoint: POST /{settings.api_prefix}/dev/reset."}, "properties": {"scanner": "repobility-access-control", "category": "auth", "severity": "medium", "confidence": 0.66, "cwe": "CWE-285", "owasp": "API5:2023 Broken Function Level Authorization"}}, {"id": "AUC001", "name": "[AUC001] No Repobility access matrix policy found: The repository uses web/API frameworks but does not define .repobilit", "shortDescription": {"text": "[AUC001] No Repobility access matrix policy found: The repository uses web/API frameworks but does not define .repobility/access.yml or equivalent authorization documentation."}, "fullDescription": {"text": "The repository uses web/API frameworks but does not define .repobility/access.yml or equivalent authorization documentation."}, "properties": {"scanner": "repobility-access-control", "category": "auth", "severity": "medium", "confidence": 0.92, "cwe": "CWE-285", "owasp": "WSTG-AUTHZ"}}, {"id": "DKR003", "name": "Compose service `sensing-server` image uses the latest tag", "shortDescription": {"text": "Compose service `sensing-server` image uses the latest tag"}, "fullDescription": {"text": "The latest tag is mutable and can change without a code review, producing different images from the same source."}, "properties": {"scanner": "repobility-docker", "category": "docker", "severity": "medium", "confidence": 0.94, "cwe": "", "owasp": ""}}, {"id": "DKR001", "name": "Docker final stage has no non-root USER", "shortDescription": {"text": "Docker final stage has no non-root USER"}, "fullDescription": {"text": "Docker images run as root unless the image or Dockerfile switches to a non-root user."}, "properties": {"scanner": "repobility-docker", "category": "docker", "severity": "medium", "confidence": 0.82, "cwe": "", "owasp": ""}}, {"id": "DKR018", "name": "Database dump or local database file is included in Docker build context", "shortDescription": {"text": "Database dump or local database file is included in Docker build context"}, "fullDescription": {"text": "Database exports and local database files can contain production data, credentials, or large binary payloads that slow Docker builds and can be copied into images by broad COPY instructions."}, "properties": {"scanner": "repobility-docker", "category": "docker", "severity": "medium", "confidence": 0.86, "cwe": "", "owasp": ""}}, {"id": "ERR002", "name": "[ERR002] Empty Catch Block: Empty catch blocks hide errors.", "shortDescription": {"text": "[ERR002] Empty Catch Block: Empty catch blocks hide errors."}, "fullDescription": {"text": "Log the error or rethrow it. Use console.error() at minimum."}, "properties": {"scanner": "repobility-threat-engine", "category": "error_handling", "severity": "medium", "confidence": 1.0, "cwe": "", "owasp": ""}}, {"id": "SEC014", "name": "[SEC014] SSL Verification Disabled: SSL certificate verification is disabled, allowing man-in-the-middle attacks.", "shortDescription": {"text": "[SEC014] SSL Verification Disabled: SSL certificate verification is disabled, allowing man-in-the-middle attacks."}, "fullDescription": {"text": "Enable SSL verification. Use verify=True (default) for requests. Pin certificates if needed."}, "properties": {"scanner": "repobility-threat-engine", "category": "crypto", "severity": "medium", "confidence": 1.0, "cwe": "", "owasp": ""}}, {"id": "ERR001", "name": "[ERR001] Silent Exception Swallowing: Silently swallowing all exceptions hides bugs. Even in cleanup code, log at DEBUG ", "shortDescription": {"text": "[ERR001] Silent Exception Swallowing: Silently swallowing all exceptions hides bugs. Even in cleanup code, log at DEBUG level."}, "fullDescription": {"text": "Log the error: `except Exception: logger.debug('cleanup failed', exc_info=True)`. Or handle specific exception types."}, "properties": {"scanner": "repobility-threat-engine", "category": "error_handling", "severity": "medium", "confidence": 1.0, "cwe": "", "owasp": ""}}, {"id": "AGT012", "name": "Agent control bridge may listen on a network interface without visible auth", "shortDescription": {"text": "Agent control bridge may listen on a network interface without visible auth"}, "fullDescription": {"text": "Agent, MCP, sidecar, and command bridge servers often start as local helpers. Binding them to 0.0.0.0 or a default all-interface listener without an authorization guard can expose tool execution or session data to the LAN."}, "properties": {"scanner": "repobility-agent-runtime", "category": "quality", "severity": "medium", "confidence": 0.72, "cwe": "", "owasp": ""}}, {"id": "AGT015", "name": "Remote install command pipes network code directly to a shell", "shortDescription": {"text": "Remote install command pipes network code directly to a shell"}, "fullDescription": {"text": "Agent helper projects often publish one-line installers. `curl | sh` style commands are convenient, but they bypass review unless the script is pinned, signed, or checksum-verified."}, "properties": {"scanner": "repobility-agent-runtime", "category": "dependency", "severity": "medium", "confidence": 0.7, "cwe": "", "owasp": ""}}, {"id": "AIC003", "name": "Duplicated implementation block across source files", "shortDescription": {"text": "Duplicated implementation block across source files"}, "fullDescription": {"text": "Duplicated blocks are a common artifact when generated code is pasted or recreated instead of reused. They increase maintenance cost because every future bug fix must be found in multiple locations."}, "properties": {"scanner": "repobility-ai-code-hygiene", "category": "quality", "severity": "medium", "confidence": 0.86, "cwe": "", "owasp": ""}}, {"id": "DKC010", "name": "Compose service lacks no-new-privileges hardening", "shortDescription": {"text": "Compose service lacks no-new-privileges hardening"}, "fullDescription": {"text": "no-new-privileges prevents processes from gaining additional privileges through setuid binaries or file capabilities."}, "properties": {"scanner": "repobility-docker", "category": "docker", "severity": "low", "confidence": 0.62, "cwe": "", "owasp": ""}}, {"id": "DKC006", "name": "Compose service does not declare a runtime user", "shortDescription": {"text": "Compose service does not declare a runtime user"}, "fullDescription": {"text": "If the image does not define USER internally, this service may run as root."}, "properties": {"scanner": "repobility-docker", "category": "docker", "severity": "low", "confidence": 0.56, "cwe": "", "owasp": ""}}, {"id": "DKR008", "name": ".dockerignore misses sensitive defaults", "shortDescription": {"text": ".dockerignore misses sensitive defaults"}, "fullDescription": {"text": ".dockerignore exists but does not cover common secret or VCS patterns."}, "properties": {"scanner": "repobility-docker", "category": "docker", "severity": "low", "confidence": 0.72, "cwe": "", "owasp": ""}}, {"id": "AIC002", "name": "Source file name looks like an AI patch artifact", "shortDescription": {"text": "Source file name looks like an AI patch artifact"}, "fullDescription": {"text": "Files named as final, fixed, copy, new, or backup are often temporary patch artifacts. They may be legitimate, but they deserve review before becoming production surface area."}, "properties": {"scanner": "repobility-ai-code-hygiene", "category": "quality", "severity": "low", "confidence": 0.62, "cwe": "", "owasp": ""}}, {"id": "AIC006", "name": "Archive or legacy directory is mixed into the active repository root", "shortDescription": {"text": "Archive or legacy directory is mixed into the active repository root"}, "fullDescription": {"text": "Archive, old, backup, or legacy directories at the root often hide obsolete implementations that AI agents can copy from or accidentally rewire."}, "properties": {"scanner": "repobility-ai-code-hygiene", "category": "quality", "severity": "low", "confidence": 0.68, "cwe": "", "owasp": ""}}, {"id": "SEC015", "name": "[SEC015] Insecure Randomness for Security (and 3 more): Same pattern found in 3 additional files. Review if needed.", "shortDescription": {"text": "[SEC015] Insecure Randomness for Security (and 3 more): Same pattern found in 3 additional files. Review if needed."}, "fullDescription": {"text": "Use secrets module (Python) or crypto.getRandomValues() (JS) for security-sensitive randomness."}, "properties": {"scanner": "repobility-threat-engine", "category": "crypto", "severity": "info", "confidence": 0.2, "cwe": "", "owasp": ""}}, {"id": "SEC020", "name": "[SEC020] Secret Printed to Logs (and 7 more): Same pattern found in 7 additional files. Review if needed.", "shortDescription": {"text": "[SEC020] Secret Printed to Logs (and 7 more): Same pattern found in 7 additional files. Review if needed."}, "fullDescription": {"text": "Log only redacted, hashed, or last-four-style metadata. Rotate any secret that may have reached logs."}, "properties": {"scanner": "repobility-threat-engine", "category": "credential_exposure", "severity": "info", "confidence": 0.2, "cwe": "", "owasp": ""}}, {"id": "SEC011", "name": "[SEC011] Unsafe PyTorch Model Loading: torch.load() uses pickle internally and can execute arbitrary code from untrusted", "shortDescription": {"text": "[SEC011] Unsafe PyTorch Model Loading: torch.load() uses pickle internally and can execute arbitrary code from untrusted model files."}, "fullDescription": {"text": "Use torch.load(..., weights_only=True) or use safetensors format."}, "properties": {"scanner": "repobility-threat-engine", "category": "deserialization", "severity": "info", "confidence": 0.1, "cwe": "", "owasp": ""}}, {"id": "scanner-8ff4558134dce223", "name": "Possibly dead Python function: filter", "shortDescription": {"text": "Possibly dead Python function: filter"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5b78d3804f38e405", "name": "Possibly dead Python function: configure_third_party_loggers", "shortDescription": {"text": "Possibly dead Python function: configure_third_party_loggers"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3cbf31ecf2cb6e44", "name": "Possibly dead Python function: log_function_call", "shortDescription": {"text": "Possibly dead Python function: log_function_call"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-391ac23a62a71709", "name": "Possibly dead Python function: log_async_function_call", "shortDescription": {"text": "Possibly dead Python function: log_async_function_call"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-44855c5b63883b17", "name": "Possibly dead Python function: set_environment_override", "shortDescription": {"text": "Possibly dead Python function: set_environment_override"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9b116984e61aa6c2", "name": "Possibly dead Python function: clear_environment_overrides", "shortDescription": {"text": "Possibly dead Python function: clear_environment_overrides"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0efb740b0c61bdf0", "name": "Possibly dead Python function: validate_app_configuration", "shortDescription": {"text": "Possibly dead Python function: validate_app_configuration"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3c1c4b45c4b34dbf", "name": "Possibly dead Python function: reload_configuration", "shortDescription": {"text": "Possibly dead Python function: reload_configuration"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4fdac0cffa37e41a", "name": "Possibly dead Python function: load_domain_config_from_file", "shortDescription": {"text": "Possibly dead Python function: load_domain_config_from_file"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-65d62fb0785896fc", "name": "Possibly dead Python function: save_domain_config_to_file", "shortDescription": {"text": "Possibly dead Python function: save_domain_config_to_file"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-79b3e82b67a9d3ad", "name": "Possibly dead Python function: check_token_bucket", "shortDescription": {"text": "Possibly dead Python function: check_token_bucket"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2b92a977fe4b4b13", "name": "Possibly dead Python function: setup_rate_limiting", "shortDescription": {"text": "Possibly dead Python function: setup_rate_limiting"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9363ac046e4a7ac8", "name": "Possibly dead Python function: validate_rate_limit_config", "shortDescription": {"text": "Possibly dead Python function: validate_rate_limit_config"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2fdef7dc77bdbdb3", "name": "Possibly dead Python function: send_wrapper", "shortDescription": {"text": "Possibly dead Python function: send_wrapper"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-507fff714bf258d9", "name": "Possibly dead Python function: setup_cors_middleware", "shortDescription": {"text": "Possibly dead Python function: setup_cors_middleware"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-67dc7cd6d50b9fb0", "name": "Possibly dead Python function: validate_cors_config", "shortDescription": {"text": "Possibly dead Python function: validate_cors_config"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1438cd16162c16c0", "name": "Possibly dead Python function: update_user", "shortDescription": {"text": "Possibly dead Python function: update_user"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9999e52113d31cb8", "name": "Debug `console.log` remains in browser-facing code \u2014 v2/crates/homecore-server/ui/js/panels/seed-detail.js:82", "shortDescription": {"text": "Debug `console.log` remains in browser-facing code \u2014 v2/crates/homecore-server/ui/js/panels/seed-detail.js:82"}, "fullDescription": {"text": "Remove debug output or route intentional diagnostics through the project's structured logger. Browser console output can expose state and create noise; server and CLI output are outside this rule's scope.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 0.85}}, {"id": "scanner-a72ee9d7cff73730", "name": "Icon-only button without accessible name \u2014 v2/crates/wifi-densepose-desktop/ui/src/pages/NetworkDiscovery.tsx:1113", "shortDescription": {"text": "Icon-only button without accessible name \u2014 v2/crates/wifi-densepose-desktop/ui/src/pages/NetworkDiscovery.tsx:1113"}, "fullDescription": {"text": "A `<button>` whose only child is a single glyph or symbol needs `title=` or `aria-label=` so screen readers (and tooltips on hover) work.\n\nWhy: P3 in CHECKLIST.md \u2014 icon-only buttons skipped a title.\nRule id: fq.button.no-label"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 0.85}}, {"id": "scanner-38b70e83f638354f", "name": "Debug `console.log` remains in browser-facing code \u2014 ui/app.js:41", "shortDescription": {"text": "Debug `console.log` remains in browser-facing code \u2014 ui/app.js:41"}, "fullDescription": {"text": "Remove debug output or route intentional diagnostics through the project's structured logger. Browser console output can expose state and create noise; server and CLI output are outside this rule's scope.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 0.85}}, {"id": "scanner-d233eb7d9e44b6f6", "name": "Debug `console.log` remains in browser-facing code \u2014 ui/pose-fusion/js/cnn-embedder.js:97", "shortDescription": {"text": "Debug `console.log` remains in browser-facing code \u2014 ui/pose-fusion/js/cnn-embedder.js:97"}, "fullDescription": {"text": "Remove debug output or route intentional diagnostics through the project's structured logger. Browser console output can expose state and create noise; server and CLI output are outside this rule's scope.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 0.85}}, {"id": "scanner-439c7c7583421ab6", "name": "Debug `console.log` remains in browser-facing code \u2014 ui/pose-fusion/js/main.js:85", "shortDescription": {"text": "Debug `console.log` remains in browser-facing code \u2014 ui/pose-fusion/js/main.js:85"}, "fullDescription": {"text": "Remove debug output or route intentional diagnostics through the project's structured logger. Browser console output can expose state and create noise; server and CLI output are outside this rule's scope.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 0.85}}, {"id": "scanner-57c1f4d2d7cc8907", "name": "TODO/FIXME marker in shipping code \u2014 ui/pose-fusion/pkg/ruvector-attention/ruvector_attention_wasm.js:1274", "shortDescription": {"text": "TODO/FIXME marker in shipping code \u2014 ui/pose-fusion/pkg/ruvector-attention/ruvector_attention_wasm.js:1274"}, "fullDescription": {"text": "Track in /reviews or /issues, not as a code comment that rots.\n\nWhy: Drift control \u2014 shouldn't be the same as Quality TODO scanner.\nRule id: fq.todo-marker"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 0.7}}, {"id": "scanner-a83089012223a688", "name": "Debug `console.log` remains in browser-facing code \u2014 ui/pose-fusion/pkg/ruvector-attention/ruvector_attention_wasm.js:11", "shortDescription": {"text": "Debug `console.log` remains in browser-facing code \u2014 ui/pose-fusion/pkg/ruvector-attention/ruvector_attention_wasm.js:1112"}, "fullDescription": {"text": "Remove debug output or route intentional diagnostics through the project's structured logger. Browser console output can expose state and create noise; server and CLI output are outside this rule's scope.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 0.85}}, {"id": "scanner-fed598a8630f513f", "name": "Debug `console.log` remains in browser-facing code \u2014 ui/pose-fusion/pkg/ruvector-attention/ruvector_attention_browser.js", "shortDescription": {"text": "Debug `console.log` remains in browser-facing code \u2014 ui/pose-fusion/pkg/ruvector-attention/ruvector_attention_browser.js:567"}, "fullDescription": {"text": "Remove debug output or route intentional diagnostics through the project's structured logger. Browser console output can expose state and create noise; server and CLI output are outside this rule's scope.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 0.85}}, {"id": "scanner-35da4dd414799a9b", "name": "Debug `console.log` remains in browser-facing code \u2014 ui/observatory/js/main.js:451", "shortDescription": {"text": "Debug `console.log` remains in browser-facing code \u2014 ui/observatory/js/main.js:451"}, "fullDescription": {"text": "Remove debug output or route intentional diagnostics through the project's structured logger. Browser console output can expose state and create noise; server and CLI output are outside this rule's scope.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 0.85}}, {"id": "scanner-ba86de30696df3f8", "name": "Debug `console.log` remains in browser-facing code \u2014 ui/utils/pose-renderer.js:124", "shortDescription": {"text": "Debug `console.log` remains in browser-facing code \u2014 ui/utils/pose-renderer.js:124"}, "fullDescription": {"text": "Remove debug output or route intentional diagnostics through the project's structured logger. Browser console output can expose state and create noise; server and CLI output are outside this rule's scope.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 0.85}}, {"id": "scanner-1f5492abcf306fcb", "name": "Debug `console.log` remains in browser-facing code \u2014 ui/utils/backend-detector.js:23", "shortDescription": {"text": "Debug `console.log` remains in browser-facing code \u2014 ui/utils/backend-detector.js:23"}, "fullDescription": {"text": "Remove debug output or route intentional diagnostics through the project's structured logger. Browser console output can expose state and create noise; server and CLI output are outside this rule's scope.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 0.85}}, {"id": "scanner-bcc0a629bd3e3504", "name": "Debug `console.log` remains in browser-facing code \u2014 ui/utils/mock-server.js:221", "shortDescription": {"text": "Debug `console.log` remains in browser-facing code \u2014 ui/utils/mock-server.js:221"}, "fullDescription": {"text": "Remove debug output or route intentional diagnostics through the project's structured logger. Browser console output can expose state and create noise; server and CLI output are outside this rule's scope.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 0.85}}, {"id": "scanner-f7628a3bd68458fa", "name": "Icon-only button without accessible name \u2014 ui/components/PoseDetectionCanvas.js:1240", "shortDescription": {"text": "Icon-only button without accessible name \u2014 ui/components/PoseDetectionCanvas.js:1240"}, "fullDescription": {"text": "A `<button>` whose only child is a single glyph or symbol needs `title=` or `aria-label=` so screen readers (and tooltips on hover) work.\n\nWhy: P3 in CHECKLIST.md \u2014 icon-only buttons skipped a title.\nRule id: fq.button.no-label"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 0.85}}, {"id": "scanner-78a5dbea1b244639", "name": "Debug `console.log` remains in browser-facing code \u2014 ui/components/DashboardTab.js:56", "shortDescription": {"text": "Debug `console.log` remains in browser-facing code \u2014 ui/components/DashboardTab.js:56"}, "fullDescription": {"text": "Remove debug output or route intentional diagnostics through the project's structured logger. Browser console output can expose state and create noise; server and CLI output are outside this rule's scope.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 0.85}}, {"id": "scanner-863f989cc1bd6e61", "name": "Debug `console.log` remains in browser-facing code \u2014 ui/services/websocket.service.js:271", "shortDescription": {"text": "Debug `console.log` remains in browser-facing code \u2014 ui/services/websocket.service.js:271"}, "fullDescription": {"text": "Remove debug output or route intentional diagnostics through the project's structured logger. Browser console output can expose state and create noise; server and CLI output are outside this rule's scope.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 0.85}}, {"id": "scanner-661dbd90edcf77d7", "name": "Debug `console.log` remains in browser-facing code \u2014 ui/services/pose.service.js:492", "shortDescription": {"text": "Debug `console.log` remains in browser-facing code \u2014 ui/services/pose.service.js:492"}, "fullDescription": {"text": "Remove debug output or route intentional diagnostics through the project's structured logger. Browser console output can expose state and create noise; server and CLI output are outside this rule's scope.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 0.85}}, {"id": "scanner-80a0146b9d7c52ca", "name": "Debug `console.log` remains in browser-facing code \u2014 ui/services/websocket-client.js:57", "shortDescription": {"text": "Debug `console.log` remains in browser-facing code \u2014 ui/services/websocket-client.js:57"}, "fullDescription": {"text": "Remove debug output or route intentional diagnostics through the project's structured logger. Browser console output can expose state and create noise; server and CLI output are outside this rule's scope.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 0.85}}, {"id": "scanner-9c011dcfc07a1802", "name": "detect child process \u2014 .claude/helpers/statusline.cjs:71", "shortDescription": {"text": "detect child process \u2014 .claude/helpers/statusline.cjs:71"}, "fullDescription": {"text": "Detected calls to child_process from a function argument `cmd`. This could lead to a command injection if the input is user controllable. Try to avoid calls to child_process, and if it is needed ensure user input is correctly sanitized or sandboxed.\n\nRule: javascript.lang.security.detect-child-process.detect-child-process\nSeverity: ERROR\nOWASP: A01:2017 - Injection, A03:2021 - Injection, A05:2025 - Injection\nCWE: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')\nCategory: security\nContext: production"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.55}}, {"id": "scanner-d2067b1b786592f8", "name": "avoid bind to all interfaces \u2014 archive/v1/src/sensing/ws_server.py:216", "shortDescription": {"text": "avoid bind to all interfaces \u2014 archive/v1/src/sensing/ws_server.py:216"}, "fullDescription": {"text": "Running `socket.bind` to 0.0.0.0, or empty string could unexpectedly expose the server publicly as it binds to all available interfaces. Consider instead getting correct address from an environment variable or configuration file.\n\nRule: python.lang.security.audit.network.bind.avoid-bind-to-all-interfaces\nSeverity: INFO\nOWASP: A01:2021 - Broken Access Control, A01:2025 - Broken Access Control\nCWE: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor\nCategory: security\nContext: non-production"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 0.55}}, {"id": "scanner-db841f3aed038eed", "name": "dynamic urllib use detected \u2014 examples/happiness-vector/seed_query.py:33", "shortDescription": {"text": "dynamic urllib use detected \u2014 examples/happiness-vector/seed_query.py:33"}, "fullDescription": {"text": "Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead.\n\nRule: python.lang.security.audit.dynamic-urllib-use-detected.dynamic-urllib-use-detected\nSeverity: WARNING\nOWASP: A01:2017 - Injection\nCWE: CWE-939: Improper Authorization in Handler for Custom URL Scheme\nCategory: security\nContext: non-production"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.55}}, {"id": "scanner-39d76fc576fe5c0f", "name": "dynamic urllib use detected \u2014 examples/ruview_live.py:344", "shortDescription": {"text": "dynamic urllib use detected \u2014 examples/ruview_live.py:344"}, "fullDescription": {"text": "Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead.\n\nRule: python.lang.security.audit.dynamic-urllib-use-detected.dynamic-urllib-use-detected\nSeverity: WARNING\nOWASP: A01:2017 - Injection\nCWE: CWE-939: Improper Authorization in Handler for Custom URL Scheme\nCategory: security\nContext: non-production"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.55}}, {"id": "scanner-e85e42ee72bf5fa7", "name": "dynamic urllib use detected \u2014 examples/through-wall/wiflow_capture.py:38", "shortDescription": {"text": "dynamic urllib use detected \u2014 examples/through-wall/wiflow_capture.py:38"}, "fullDescription": {"text": "Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead.\n\nRule: python.lang.security.audit.dynamic-urllib-use-detected.dynamic-urllib-use-detected\nSeverity: WARNING\nOWASP: A01:2017 - Injection\nCWE: CWE-939: Improper Authorization in Handler for Custom URL Scheme\nCategory: security\nContext: non-production"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.55}}, {"id": "scanner-d6b79c612369671a", "name": "insecure use string copy fn \u2014 firmware/esp32-csi-node/main/c6_softap_he.c:126", "shortDescription": {"text": "insecure use string copy fn \u2014 firmware/esp32-csi-node/main/c6_softap_he.c:126"}, "fullDescription": {"text": "Finding triggers whenever there is a strcpy or strncpy used. This is an issue because strcpy does not affirm the size of the destination array and strncpy will not automatically NULL-terminate strings. This can lead to buffer overflows, which can cause program crashes and potentially let an attacker inject code in the program. Fix this by using strcpy_s instead (although note that strcpy_s is an optional part of the C11 standard, and so may not be available).\n\nRule: c.lang.security.insecure-use-string-copy-fn.insecure-use-string-copy-fn\nSeverity: WARNING\nOWASP: \u2014\nCWE: CWE-676: Use of Potentially Dangerous Function\nCategory: security\nContext: production"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.55}}, {"id": "scanner-e2cc311b337f09f9", "name": "insecure use string copy fn \u2014 firmware/esp32-csi-node/main/main.c:115", "shortDescription": {"text": "insecure use string copy fn \u2014 firmware/esp32-csi-node/main/main.c:115"}, "fullDescription": {"text": "Finding triggers whenever there is a strcpy or strncpy used. This is an issue because strcpy does not affirm the size of the destination array and strncpy will not automatically NULL-terminate strings. This can lead to buffer overflows, which can cause program crashes and potentially let an attacker inject code in the program. Fix this by using strcpy_s instead (although note that strcpy_s is an optional part of the C11 standard, and so may not be available).\n\nRule: c.lang.security.insecure-use-string-copy-fn.insecure-use-string-copy-fn\nSeverity: WARNING\nOWASP: \u2014\nCWE: CWE-676: Use of Potentially Dangerous Function\nCategory: security\nContext: production"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.55}}, {"id": "scanner-ae24c574dc0cebc5", "name": "insecure use string copy fn \u2014 firmware/esp32-csi-node/main/nvs_config.c:27", "shortDescription": {"text": "insecure use string copy fn \u2014 firmware/esp32-csi-node/main/nvs_config.c:27"}, "fullDescription": {"text": "Finding triggers whenever there is a strcpy or strncpy used. This is an issue because strcpy does not affirm the size of the destination array and strncpy will not automatically NULL-terminate strings. This can lead to buffer overflows, which can cause program crashes and potentially let an attacker inject code in the program. Fix this by using strcpy_s instead (although note that strcpy_s is an optional part of the C11 standard, and so may not be available).\n\nRule: c.lang.security.insecure-use-string-copy-fn.insecure-use-string-copy-fn\nSeverity: WARNING\nOWASP: \u2014\nCWE: CWE-676: Use of Potentially Dangerous Function\nCategory: security\nContext: production"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.55}}, {"id": "scanner-2fe39e68f6e18857", "name": "insecure use string copy fn \u2014 firmware/esp32-csi-node/main/wasm_runtime.c:789", "shortDescription": {"text": "insecure use string copy fn \u2014 firmware/esp32-csi-node/main/wasm_runtime.c:789"}, "fullDescription": {"text": "Finding triggers whenever there is a strcpy or strncpy used. This is an issue because strcpy does not affirm the size of the destination array and strncpy will not automatically NULL-terminate strings. This can lead to buffer overflows, which can cause program crashes and potentially let an attacker inject code in the program. Fix this by using strcpy_s instead (although note that strcpy_s is an optional part of the C11 standard, and so may not be available).\n\nRule: c.lang.security.insecure-use-string-copy-fn.insecure-use-string-copy-fn\nSeverity: WARNING\nOWASP: \u2014\nCWE: CWE-676: Use of Potentially Dangerous Function\nCategory: security\nContext: production"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.55}}, {"id": "scanner-3a880eeea7ef31f8", "name": "double free \u2014 firmware/esp32-csi-node/main/wasm_upload.c:186", "shortDescription": {"text": "double free \u2014 firmware/esp32-csi-node/main/wasm_upload.c:186"}, "fullDescription": {"text": "Variable 'buf' was freed twice. This can lead to undefined behavior.\n\nRule: c.lang.security.double-free.double-free\nSeverity: ERROR\nOWASP: A03:2021 - Injection, A01:2017 - Injection, A05:2025 - Injection\nCWE: CWE-415: Double Free\nCategory: security\nContext: production"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.55}}, {"id": "scanner-89f8044d4feeb990", "name": "dynamic urllib use detected \u2014 scripts/collect-ground-truth.py:102", "shortDescription": {"text": "dynamic urllib use detected \u2014 scripts/collect-ground-truth.py:102"}, "fullDescription": {"text": "Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead.\n\nRule: python.lang.security.audit.dynamic-urllib-use-detected.dynamic-urllib-use-detected\nSeverity: WARNING\nOWASP: A01:2017 - Injection\nCWE: CWE-939: Improper Authorization in Handler for Custom URL Scheme\nCategory: security\nContext: production"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.55}}, {"id": "scanner-3a769f32fc6ff528", "name": "avoid bind to all interfaces \u2014 scripts/collect-training-data.py:294", "shortDescription": {"text": "avoid bind to all interfaces \u2014 scripts/collect-training-data.py:294"}, "fullDescription": {"text": "Running `socket.bind` to 0.0.0.0, or empty string could unexpectedly expose the server publicly as it binds to all available interfaces. Consider instead getting correct address from an environment variable or configuration file.\n\nRule: python.lang.security.audit.network.bind.avoid-bind-to-all-interfaces\nSeverity: INFO\nOWASP: A01:2021 - Broken Access Control, A01:2025 - Broken Access Control\nCWE: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor\nCategory: security\nContext: production"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 0.7}}, {"id": "scanner-7235c1d7fa0b706c", "name": "dynamic urllib use detected \u2014 scripts/esp32_wasm_test.py:303", "shortDescription": {"text": "dynamic urllib use detected \u2014 scripts/esp32_wasm_test.py:303"}, "fullDescription": {"text": "Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead.\n\nRule: python.lang.security.audit.dynamic-urllib-use-detected.dynamic-urllib-use-detected\nSeverity: WARNING\nOWASP: A01:2017 - Injection\nCWE: CWE-939: Improper Authorization in Handler for Custom URL Scheme\nCategory: security\nContext: non-production"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.55}}, {"id": "scanner-52ae1e3ff733d93a", "name": "dynamic urllib use detected \u2014 scripts/occworld_retrain.py:64", "shortDescription": {"text": "dynamic urllib use detected \u2014 scripts/occworld_retrain.py:64"}, "fullDescription": {"text": "Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead.\n\nRule: python.lang.security.audit.dynamic-urllib-use-detected.dynamic-urllib-use-detected\nSeverity: WARNING\nOWASP: A01:2017 - Injection\nCWE: CWE-939: Improper Authorization in Handler for Custom URL Scheme\nCategory: security\nContext: production"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.55}}, {"id": "scanner-490de8fae193e99e", "name": "avoid bind to all interfaces \u2014 scripts/overnight-empty-capture.py:54", "shortDescription": {"text": "avoid bind to all interfaces \u2014 scripts/overnight-empty-capture.py:54"}, "fullDescription": {"text": "Running `socket.bind` to 0.0.0.0, or empty string could unexpectedly expose the server publicly as it binds to all available interfaces. Consider instead getting correct address from an environment variable or configuration file.\n\nRule: python.lang.security.audit.network.bind.avoid-bind-to-all-interfaces\nSeverity: INFO\nOWASP: A01:2021 - Broken Access Control, A01:2025 - Broken Access Control\nCWE: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor\nCategory: security\nContext: production"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 0.7}}, {"id": "scanner-7d431d35141017af", "name": "avoid bind to all interfaces \u2014 scripts/record-csi-udp.py:68", "shortDescription": {"text": "avoid bind to all interfaces \u2014 scripts/record-csi-udp.py:68"}, "fullDescription": {"text": "Running `socket.bind` to 0.0.0.0, or empty string could unexpectedly expose the server publicly as it binds to all available interfaces. Consider instead getting correct address from an environment variable or configuration file.\n\nRule: python.lang.security.audit.network.bind.avoid-bind-to-all-interfaces\nSeverity: INFO\nOWASP: A01:2021 - Broken Access Control, A01:2025 - Broken Access Control\nCWE: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor\nCategory: security\nContext: production"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 0.7}}, {"id": "scanner-e310457f06521717", "name": "dynamic urllib use detected \u2014 scripts/seed_csi_bridge.py:235", "shortDescription": {"text": "dynamic urllib use detected \u2014 scripts/seed_csi_bridge.py:235"}, "fullDescription": {"text": "Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead.\n\nRule: python.lang.security.audit.dynamic-urllib-use-detected.dynamic-urllib-use-detected\nSeverity: WARNING\nOWASP: A01:2017 - Injection\nCWE: CWE-939: Improper Authorization in Handler for Custom URL Scheme\nCategory: security\nContext: production"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.55}}, {"id": "scanner-f4e01324d3260418", "name": "CVE-2025-23042: gradio 5.9.1 \u2014 aether-arena/space/requirements.txt", "shortDescription": {"text": "CVE-2025-23042: gradio 5.9.1 \u2014 aether-arena/space/requirements.txt"}, "fullDescription": {"text": "Gradio Blocked Path ACL Bypass Vulnerability\n\nGradio is an open-source Python package that allows quick building of demos and web application for machine learning models, API, or any arbitrary Python function. Gradio's Access Control List (ACL) for file paths can be bypassed by altering the letter case of a blocked file or directory path. This vulnerability arises due to the lack of case normalization in the file path validation logic. On case-insensitive file systems, such as those used by Windows and macOS, this flaw enables attackers to \n\nPackage: gradio\nInstalled: 5.9.1\nFixed in: 5.11.0\nSeverity: CRITICAL\nFix: Upgrade gradio to 5.11.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-a9e9cd1bf1dd4ae3", "name": "CVE-2024-8966: gradio 5.9.1 \u2014 aether-arena/space/requirements.txt", "shortDescription": {"text": "CVE-2024-8966: gradio 5.9.1 \u2014 aether-arena/space/requirements.txt"}, "fullDescription": {"text": "Gradio DOS in multipart boundry while uploading the file\n\nA vulnerability in the file upload process of gradio-app/gradio version @gradio/video@0.10.2 allows for a Denial of Service (DoS) attack. An attacker can append a large number of characters to the end of a multipart boundary, causing the system to continuously process each character and issue warnings. This can render Gradio inaccessible for extended periods, disrupting services and causing significant downtime.\n\nPackage: gradio\nInstalled: 5.9.1\nFixed in: \u2014\nSeverity: HIGH\nFix: No fix version published yet"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-484227947e68e5a4", "name": "CVE-2026-28414: gradio 5.9.1 \u2014 aether-arena/space/requirements.txt", "shortDescription": {"text": "CVE-2026-28414: gradio 5.9.1 \u2014 aether-arena/space/requirements.txt"}, "fullDescription": {"text": "Gradio is Vulnerable to Absolute Path Traversal on Windows with Python 3.13+\n\nGradio is an open-source Python package designed for quick prototyping. Prior to version 6.7, Gradio apps running on Window with Python 3.13+ are vulnerable to an absolute path traversal issue that enables unauthenticated attackers to read arbitrary files from the file system. Python 3.13+ changed the definition of `os.path.isabs` so that root-relative paths like `/windows/win.ini` on Windows are no longer considered absolute paths, resulting in a vulnerability in Gradio's logic for joining path\n\nPackage: gradio\nInstalled: 5.9.1\nFixed in: 6.7.0\nSeverity: HIGH\nFix: Upgrade gradio to 6.7.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-1fcce4e3388fcc0a", "name": "CVE-2026-28416: gradio 5.9.1 \u2014 aether-arena/space/requirements.txt", "shortDescription": {"text": "CVE-2026-28416: gradio 5.9.1 \u2014 aether-arena/space/requirements.txt"}, "fullDescription": {"text": "Gradio: Gradio: Server-Side Request Forgery allows access to internal services via malicious Space loading\n\nGradio is an open-source Python package designed for quick prototyping. Prior to version 6.6.0, a Server-Side Request Forgery (SSRF) vulnerability in Gradio allows an attacker to make arbitrary HTTP requests from a victim's server by hosting a malicious Gradio Space. When a victim application uses `gr.load()` to load an attacker-controlled Space, the malicious `proxy_url` from the config is trusted and added to the allowlist, enabling the attacker to access internal services, cloud metadata endp\n\nPackage: gradio\nInstalled: 5.9.1\nFixed in: 6.6.0\nSeverity: HIGH\nFix: Upgrade gradio to 6.6.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-c834a030d84cafab", "name": "CVE-2026-48545: gradio 5.9.1 \u2014 aether-arena/space/requirements.txt", "shortDescription": {"text": "CVE-2026-48545: gradio 5.9.1 \u2014 aether-arena/space/requirements.txt"}, "fullDescription": {"text": "Gradio contains a cookie injection vulnerability\n\nGradio before version 6.15.0 contains a cookie injection vulnerability that allows remote attackers to perform cross-Space session fixation by exploiting a shared module-level HTTP client used across all users in the reverse proxy endpoint. Attackers controlling any HF Space can return a parent-domain cookie that the shared client stores and automatically replays into all subsequent proxy requests to other legitimate Spaces, affecting all users of the same Gradio deployment.\n\nPackage: gradio\nInstalled: 5.9.1\nFixed in: 6.15.0\nSeverity: HIGH\nFix: Upgrade gradio to 6.15.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-7adde57eee598a0c", "name": "CVE-2025-48889: gradio 5.9.1 \u2014 aether-arena/space/requirements.txt", "shortDescription": {"text": "CVE-2025-48889: gradio 5.9.1 \u2014 aether-arena/space/requirements.txt"}, "fullDescription": {"text": "Gradio Allows Unauthorized File Copy via Path Manipulation\n\nGradio is an open-source Python package that allows quick building of demos and web application for machine learning models, API, or any arbitrary Python function. Prior to version 5.31.0, an arbitrary file copy vulnerability in Gradio's flagging feature allows unauthenticated attackers to copy any readable file from the server's filesystem. While attackers can't read these copied files, they can cause DoS by copying large files (like /dev/urandom) to fill disk space. This issue has been patched\n\nPackage: gradio\nInstalled: 5.9.1\nFixed in: 5.31.0\nSeverity: MEDIUM\nFix: Upgrade gradio to 5.31.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-cac348b5ce558978", "name": "CVE-2026-28415: gradio 5.9.1 \u2014 aether-arena/space/requirements.txt", "shortDescription": {"text": "CVE-2026-28415: gradio 5.9.1 \u2014 aether-arena/space/requirements.txt"}, "fullDescription": {"text": "Gradio: Gradio: Open Redirect vulnerability allows redirection to arbitrary external URLs.\n\nGradio is an open-source Python package designed for quick prototyping. Prior to version 6.6.0, the _redirect_to_target() function in Gradio's OAuth flow accepts an unvalidated _target_url query parameter, allowing redirection to arbitrary external URLs. This affects the /logout and /login/callback endpoints on Gradio apps with OAuth enabled (i.e. apps running on Hugging Face Spaces with gr.LoginButton). Starting in version 6.6.0, the _target_url parameter is sanitized to only use the path, quer\n\nPackage: gradio\nInstalled: 5.9.1\nFixed in: 6.6.0\nSeverity: MEDIUM\nFix: Upgrade gradio to 6.6.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d49225f5fcbc2224", "name": "CVE-2025-5320: gradio 5.9.1 \u2014 aether-arena/space/requirements.txt", "shortDescription": {"text": "CVE-2025-5320: gradio 5.9.1 \u2014 aether-arena/space/requirements.txt"}, "fullDescription": {"text": "Gradio CORS Origin Validation Bypass Vulnerability\n\nA vulnerability classified as problematic has been found in gradio-app gradio up to 5.29.1. This affects the function is_valid_origin of the component CORS Handler. The manipulation of the argument localhost_aliases leads to erweiterte Rechte. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but d\n\nPackage: gradio\nInstalled: 5.9.1\nFixed in: \u2014\nSeverity: LOW\nFix: No fix version published yet"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c770d091d643e3df", "name": "CVE-2026-10783: gradio 5.9.1 \u2014 aether-arena/space/requirements.txt", "shortDescription": {"text": "CVE-2026-10783: gradio 5.9.1 \u2014 aether-arena/space/requirements.txt"}, "fullDescription": {"text": "Gradio: Audio cache key ignores metadata when saving numpy audio outputs\n\nA security flaw has been discovered in gradio-app gradio 6.14.0. This affects the function save_audio_to_cache of the component Audio Cache Key Handler. Performing a manipulation results in use of weak hash. The attack must be initiated from a local position. The attack is considered to have high complexity. It is indicated that the exploitability is difficult. The exploit has been released to the public and may be used for attacks. The patch is named 13394. To fix this issue, it is recommended \n\nPackage: gradio\nInstalled: 5.9.1\nFixed in: 6.15.1\nSeverity: LOW\nFix: Upgrade gradio to 6.15.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-653ec223ae029bc1", "name": "CVE-2026-27167: gradio 5.9.1 \u2014 aether-arena/space/requirements.txt", "shortDescription": {"text": "CVE-2026-27167: gradio 5.9.1 \u2014 aether-arena/space/requirements.txt"}, "fullDescription": {"text": "Gradio: Gradio: Information disclosure due to hardcoded secret in session cookie signing, allowing remote attackers to steal Hugging Face tokens.\n\nGradio is an open-source Python package designed for quick prototyping. Starting in version 4.16.0 and prior to version 6.6.0, Gradio applications running outside of Hugging Face Spaces automatically enable \"mocked\" OAuth routes when OAuth components (e.g. `gr.LoginButton`) are used. When a user visits `/login/huggingface`, the server retrieves its own Hugging Face access token via `huggingface_hub.get_token()` and stores it in the visitor's session cookie. If the application is network-accessib\n\nPackage: gradio\nInstalled: 5.9.1\nFixed in: 6.6.0\nSeverity: LOW\nFix: Upgrade gradio to 6.6.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7eb0587d33dc7732", "name": "GHSA-36hh-v3qg-5jq4: pyo3 0.22.6 \u2014 python/Cargo.lock", "shortDescription": {"text": "GHSA-36hh-v3qg-5jq4: pyo3 0.22.6 \u2014 python/Cargo.lock"}, "fullDescription": {"text": "PyO3 has an Out-of-bounds Read in `nth` / `nth_back` for `PyList` and `PyTuple` iterators\n\nPyO3 0.24.0 added optimized implementations of `Iterator::nth` and `DoubleEndedIterator::nth_back` for the `BoundListIterator` and `BoundTupleIterator` types. These implementations computed the target index using unchecked `usize` addition (`index + n`) before bounds-checking against the sequence length, then read the element via `get_item_unchecked`.\n\nIn `nth` methods, a sufficiently large `n` (combined with a non-zero internal index) could cause the addition to overflow and wrap around, produc\n\nPackage: pyo3\nInstalled: 0.22.6\nFixed in: 0.29.0\nSeverity: HIGH\nFix: Upgrade pyo3 to 0.29.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-da7c66a3e5c8ffe1", "name": "GHSA-chgr-c6px-7xpp: pyo3 0.22.6 \u2014 python/Cargo.lock", "shortDescription": {"text": "GHSA-chgr-c6px-7xpp: pyo3 0.22.6 \u2014 python/Cargo.lock"}, "fullDescription": {"text": "PyO3 has a missing `Sync` bound on `PyCFunction::new_closure` closures\n\n`PyCFunction::new_closure` (and the temporary `new_closure_bound` complement in the 0.21\u20130.22 series) required the supplied closure to be `Send + 'static` but not `Sync`. The resulting `PyCFunction` is a Python callable that can be invoked from any Python thread, which means the closure may be called concurrently from multiple threads, and needs a `Sync` bound to prevent possible data races.\n\nThe problem exists under all Python versions but is particularly vulnerable under the newer free-threade\n\nPackage: pyo3\nInstalled: 0.22.6\nFixed in: 0.29.0\nSeverity: MEDIUM\nFix: Upgrade pyo3 to 0.29.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a336ac1c886fca81", "name": "GHSA-pph8-gcv7-4qj5: pyo3 0.22.6 \u2014 python/Cargo.lock", "shortDescription": {"text": "GHSA-pph8-gcv7-4qj5: pyo3 0.22.6 \u2014 python/Cargo.lock"}, "fullDescription": {"text": "PyO3 Risk of buffer overflow in `PyString::from_object`\n\n`PyString::from_object` took `&str` arguments and forwarded them directly to the Python C API without checking for terminating nul bytes. This could lead the Python interpreter to read beyond the end of the `&str` data and potentially leak contents of the out-of-bounds read (by raising a Python exception containing a copy of the data including the overflow).\n\nIn PyO3 0.24.1 this function will now allocate a `CString` to guarantee a terminating nul bytes. PyO3 0.25 will likely offer an alternativ\n\nPackage: pyo3\nInstalled: 0.22.6\nFixed in: 0.24.1\nSeverity: LOW\nFix: Upgrade pyo3 to 0.24.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-410cf64286c7317a", "name": "GHSA-frvp-7c67-39w9: @hono/node-server 1.19.14 \u2014 tools/ruview-mcp/package-lock.json", "shortDescription": {"text": "GHSA-frvp-7c67-39w9: @hono/node-server 1.19.14 \u2014 tools/ruview-mcp/package-lock.json"}, "fullDescription": {"text": "Node.js Adapter for Hono: Path traversal in `serve-static` on Windows via encoded backslash (`%5C`)\n\nThe same as the `hono` core [Path traversal in `serve-static` on Windows via encoded backslash (`%5C`)](https://github.com/honojs/hono/security/advisories/GHSA-wwfh-h76j-fc44).\n\n### Summary\n\nOn Windows hosts, an encoded backslash (`%5C`) in the request path decodes to `\\`, which the Windows path resolver treats as a separator. `serve-static` then resolves a single URL segment such as `admin\\secret.txt` into a nested file under the root and serves it, letting an attacker read static files meant t\n\nPackage: @hono/node-server\nInstalled: 1.19.14\nFixed in: 2.0.5\nSeverity: MEDIUM\nFix: Upgrade @hono/node-server to 2.0.5"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7b93c6f207aeb97a", "name": "CVE-2026-12590: body-parser 2.2.2 \u2014 tools/ruview-mcp/package-lock.json", "shortDescription": {"text": "CVE-2026-12590: body-parser 2.2.2 \u2014 tools/ruview-mcp/package-lock.json"}, "fullDescription": {"text": "body-parser: body-parser: Denial of Service via invalid limit option\n\nImpact: In body-parser versions prior to 1.20.6 (1.x line) and 2.3.0 (2.x line), when the parser is configured with an invalid limit option value such as an unparseable string or NaN, bytes.parse returns null and the request body size check is silently skipped. Applications that rely on limit as their primary safeguard against oversized request bodies will accept arbitrarily large payloads, leading to excessive memory and CPU usage and denial of service. Patches: This issue is fixed in body-pars\n\nPackage: body-parser\nInstalled: 2.2.2\nFixed in: 1.20.6, 2.3.0\nSeverity: LOW\nFix: Upgrade body-parser to 1.20.6, 2.3.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-357c5cd09011724e", "name": "CVE-2026-13676: fast-uri 3.1.2 \u2014 tools/ruview-mcp/package-lock.json", "shortDescription": {"text": "CVE-2026-13676: fast-uri 3.1.2 \u2014 tools/ruview-mcp/package-lock.json"}, "fullDescription": {"text": "fast-uri: fast-uri: Security policy bypass due to improper Unicode hostname canonicalization\n\nfast-uri versions 2.3.1 through 3.1.2 and 4.0.0 fail to canonicalize Unicode (IDN) hostnames for HTTP-family URLs. The IDN conversion path calls a helper that does not exist on the global URL constructor, silently leaving the host in its original Unicode form while normalize() and equal() still return values that differ from a WHATWG-compatible URL parser. Applications that use fast-uri to enforce host-based policy (denylists, loopback filtering, redirect validation, outbound proxy routing) befo\n\nPackage: fast-uri\nInstalled: 3.1.2\nFixed in: 4.0.1, 3.1.3, 2.4.2\nSeverity: HIGH\nFix: Upgrade fast-uri to 4.0.1, 3.1.3, 2.4.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-2347fdfc0a1a5aaf", "name": "CVE-2026-16221: fast-uri 3.1.2 \u2014 tools/ruview-mcp/package-lock.json", "shortDescription": {"text": "CVE-2026-16221: fast-uri 3.1.2 \u2014 tools/ruview-mcp/package-lock.json"}, "fullDescription": {"text": "Impact: fast-uri versions from 2.3.1 through 4.1.0 (including the 3.x  ...\n\nImpact: fast-uri versions from 2.3.1 through 4.1.0 (including the 3.x line up to 3.1.3 and the 2.x line up to 2.4.2) do not treat a literal backslash character (U+005C) as an authority delimiter. Node's native WHATWG URL parser, used by fetch, undici, and Node's http and https clients, normalizes the backslash to a forward slash for special schemes such as http, https, ws, wss, ftp, and file. As a result, the two parsers extract different hosts from the same input string. Applications that use f\n\nPackage: fast-uri\nInstalled: 3.1.2\nFixed in: 2.4.3, 3.1.4, 4.1.1\nSeverity: HIGH\nFix: Upgrade fast-uri to 2.4.3, 3.1.4, 4.1.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-90d852456d13e472", "name": "CVE-2026-54290: hono 4.12.21 \u2014 tools/ruview-mcp/package-lock.json", "shortDescription": {"text": "CVE-2026-54290: hono 4.12.21 \u2014 tools/ruview-mcp/package-lock.json"}, "fullDescription": {"text": "hono: CORS Middleware reflects any Origin with credentials when `origin` defaults to the wildcard\n\nHono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.25, with credentials: true and no explicit origin (the default wildcard), the CORS Middleware reflects the request's Origin and sends Access-Control-Allow-Credentials: true. Any site can then make credentialed cross-origin requests and read the responses, exposing cookie-authenticated endpoints to arbitrary origins. This vulnerability is fixed in 4.12.25.\n\nPackage: hono\nInstalled: 4.12.21\nFixed in: 4.12.25\nSeverity: HIGH\nFix: Upgrade hono to 4.12.25"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-10de9d905fa99bf3", "name": "CVE-2026-54286: hono 4.12.21 \u2014 tools/ruview-mcp/package-lock.json", "shortDescription": {"text": "CVE-2026-54286: hono 4.12.21 \u2014 tools/ruview-mcp/package-lock.json"}, "fullDescription": {"text": "hono: Path traversal in `serve-static` on Windows via encoded backslash (`%5C`)\n\nHono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.25, on Windows hosts, an encoded backslash (%5C) in the request path decodes to \\, which the Windows path resolver treats as a separator. serve-static then resolves a single URL segment such as admin\\secret.txt into a nested file under the root and serves it, letting an attacker read static files meant to be protected behind prefix-mounted middleware. This vulnerability is fixed in 4.12.25.\n\nPackage: hono\nInstalled: 4.12.21\nFixed in: 4.12.25\nSeverity: MEDIUM\nFix: Upgrade hono to 4.12.25"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7de109c2876a6b2f", "name": "CVE-2026-54287: hono 4.12.21 \u2014 tools/ruview-mcp/package-lock.json", "shortDescription": {"text": "CVE-2026-54287: hono 4.12.21 \u2014 tools/ruview-mcp/package-lock.json"}, "fullDescription": {"text": "hono: AWS Lambda adapter merges multiple `Set-Cookie` headers into one value, dropping cookies on ALB single-header and Lattice\n\nHono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.25, on AWS Lambda, the ALB single-header response and the VPC Lattice v2 response join multiple Set-Cookie headers into one comma-separated value. Because commas also appear inside cookie attributes (for example Expires dates), clients cannot split the value back into individual cookies and silently drop or misparse them. This vulnerability is fixed in 4.12.25.\n\nPackage: hono\nInstalled: 4.12.21\nFixed in: 4.12.25\nSeverity: MEDIUM\nFix: Upgrade hono to 4.12.25"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1771116af149637d", "name": "CVE-2026-54288: hono 4.12.21 \u2014 tools/ruview-mcp/package-lock.json", "shortDescription": {"text": "CVE-2026-54288: hono 4.12.21 \u2014 tools/ruview-mcp/package-lock.json"}, "fullDescription": {"text": "hono: Body Limit Middleware can be bypassed on AWS Lambda by understating `Content-Length`\n\nHono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.25, the Body Limit Middleware trusts the request's Content-Length header to decide whether a body is within the limit. On AWS Lambda (API Gateway v1/v2, ALB, VPC Lattice, and Lambda@Edge) the body is delivered fully buffered and the adapter builds the request with the client-declared Content-Length, which need not match the actual payload. A client can declare a tiny Content-Length while sending a\n\nPackage: hono\nInstalled: 4.12.21\nFixed in: 4.12.25\nSeverity: MEDIUM\nFix: Upgrade hono to 4.12.25"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-cd6dc4de7e043c9e", "name": "CVE-2026-54289: hono 4.12.21 \u2014 tools/ruview-mcp/package-lock.json", "shortDescription": {"text": "CVE-2026-54289: hono 4.12.21 \u2014 tools/ruview-mcp/package-lock.json"}, "fullDescription": {"text": "hono: Lambda@Edge adapter keeps only the last value of a repeated request header, dropping the rest\n\nHono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.25, on AWS Lambda@Edge, CloudFront delivers a request header that appears more than once as several separate entries. The adapter writes each value with Headers.set instead of Headers.append, so every value overwrites the previous one and only the last reaches the application. Repeated request headers such as X-Forwarded-For, Forwarded, and Via are silently truncated to a single value. Request mid\n\nPackage: hono\nInstalled: 4.12.21\nFixed in: 4.12.25\nSeverity: MEDIUM\nFix: Upgrade hono to 4.12.25"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d45a296cfde0a436", "name": "CVE-2026-59895: hono 4.12.21 \u2014 tools/ruview-mcp/package-lock.json", "shortDescription": {"text": "CVE-2026-59895: hono 4.12.21 \u2014 tools/ruview-mcp/package-lock.json"}, "fullDescription": {"text": "Hono: Server-Side XSS via JSX Escaping Bypass in cx() Utility\n\nHono is a Web application framework that provides support for any JavaScript runtime. From 4.0.0 before 4.12.27, cx() in hono/css composes class names from plain strings but marks the result as already escaped without HTML-escaping the input, allowing untrusted className values used in a JSX class attribute during server-side rendering to break out of the attribute and inject arbitrary markup. This issue is fixed in version 4.12.27.\n\nPackage: hono\nInstalled: 4.12.21\nFixed in: 4.12.27\nSeverity: MEDIUM\nFix: Upgrade hono to 4.12.27"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3f8356552eefbf72", "name": "CVE-2026-59896: hono 4.12.21 \u2014 tools/ruview-mcp/package-lock.json", "shortDescription": {"text": "CVE-2026-59896: hono 4.12.21 \u2014 tools/ruview-mcp/package-lock.json"}, "fullDescription": {"text": "hono/jsx does not isolate context per request, leading to cross-request data disclosure\n\nHono is a Web application framework that provides support for any JavaScript runtime. From 4.11.8 before 4.12.27, hono/jsx did not isolate context values per request during server-side rendering, allowing createContext, useContext, jsxRenderer, or useRequestContext data from a different in-flight request to be used after an await in an async component. This issue is fixed in version 4.12.27.\n\nPackage: hono\nInstalled: 4.12.21\nFixed in: 4.12.27\nSeverity: MEDIUM\nFix: Upgrade hono to 4.12.27"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4fcf8aeb45bd85a4", "name": "CVE-2026-59897: hono 4.12.21 \u2014 tools/ruview-mcp/package-lock.json", "shortDescription": {"text": "CVE-2026-59897: hono 4.12.21 \u2014 tools/ruview-mcp/package-lock.json"}, "fullDescription": {"text": "Hono: API Gateway v1 adapter can drop a distinct repeated request header value during de-duplication\n\nHono is a Web application framework that provides support for any JavaScript runtime. From 4.3.3 before 4.12.27, the AWS API Gateway v1 adapter can drop a distinct repeated request header value because it de-duplicates values using a substring comparison instead of an exact match, so middleware or application logic that depends on the complete X-Forwarded-For chain, rate limiting, audit logging, or proxy-chain validation can receive incomplete data. This issue is fixed in version 4.12.27.\n\nPackage: hono\nInstalled: 4.12.21\nFixed in: 4.12.27\nSeverity: MEDIUM\nFix: Upgrade hono to 4.12.27"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-32c91dcdf7a3059d", "name": "CVE-2026-49356: @babel/core 7.29.0 \u2014 ui/mobile/package-lock.json", "shortDescription": {"text": "CVE-2026-49356: @babel/core 7.29.0 \u2014 ui/mobile/package-lock.json"}, "fullDescription": {"text": "@babel/core: @babel/core: Arbitrary file read via sourceMappingURL comment\n\nBabel is a compiler for writing next generation JavaScript. Prior to 8.0.0-rc.6 and 7.29.6, @babel/core affected by an arbitrary file read via a sourceMappingURL comment. Using @babel/core to compile maliciously crafted code can allow an attacker to read any source map from the system that is running Babel, if the attacker controls the input source code, can read the output source code, and knows the path of the source map file that they want to read. This vulnerability is fixed in 8.0.0-rc.6 an\n\nPackage: @babel/core\nInstalled: 7.29.0\nFixed in: 8.0.0-rc.6, 7.29.6\nSeverity: LOW\nFix: Upgrade @babel/core to 8.0.0-rc.6, 7.29.6"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-bfc18f6e1b61dc78", "name": "CVE-2026-44486: axios 1.15.2 \u2014 ui/mobile/package-lock.json", "shortDescription": {"text": "CVE-2026-44486: axios 1.15.2 \u2014 ui/mobile/package-lock.json"}, "fullDescription": {"text": "axios: Axios: Information disclosure of proxy credentials via HTTP redirects\n\nAxios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios\u2019 Node.js HTTP adapter can leak proxy credentials to a redirect target in affected versions. When a request is sent through an authenticated proxy, Axios may add a Proxy-Authorization header. If Axios then follows a redirect and the redirected request is no longer sent through that proxy, the stale Proxy-Authorization header can remain on the redirected request and be sent to the redirect target. T\n\nPackage: axios\nInstalled: 1.15.2\nFixed in: 1.16.0, 0.32.0\nSeverity: HIGH\nFix: Upgrade axios to 1.16.0, 0.32.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-41d0cd8ca362ad8e", "name": "CVE-2026-44487: axios 1.15.2 \u2014 ui/mobile/package-lock.json", "shortDescription": {"text": "CVE-2026-44487: axios 1.15.2 \u2014 ui/mobile/package-lock.json"}, "fullDescription": {"text": "axios: Axios: Information disclosure of proxy credentials via redirect flows\n\nAxios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios\u2019s Node.js HTTP adapter may forward a Proxy-Authorization header to a redirected origin during specific proxy-to-direct redirect flows. This affects Node.js usage, where an initial HTTP request is sent through an authenticated HTTP proxy, redirects are followed, and the redirected URL is no longer proxied. Under affected redirect shapes, the final origin can receive the proxy credential that was in\n\nPackage: axios\nInstalled: 1.15.2\nFixed in: 1.16.0, 0.32.0\nSeverity: HIGH\nFix: Upgrade axios to 1.16.0, 0.32.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-4f76862949130970", "name": "CVE-2026-44488: axios 1.15.2 \u2014 ui/mobile/package-lock.json", "shortDescription": {"text": "CVE-2026-44488: axios 1.15.2 \u2014 ui/mobile/package-lock.json"}, "fullDescription": {"text": "axios: Axios: Denial of Service due to unenforced request and response size limits\n\nAxios is a promise based HTTP client for the browser and Node.js. Axios versions 1.7.0 through 1.15.x did not enforce configured request and response size limits when requests were sent with the fetch adapter. Applications that selected adapter: 'fetch', or ran in environments where axios resolved to the fetch adapter, could receive or send bodies larger than maxContentLength or maxBodyLength despite those limits being explicitly configured. This can cause resource exhaustion in server-side usag\n\nPackage: axios\nInstalled: 1.15.2\nFixed in: 1.16.0\nSeverity: HIGH\nFix: Upgrade axios to 1.16.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-1cd5c11821bf8d94", "name": "CVE-2026-44492: axios 1.15.2 \u2014 ui/mobile/package-lock.json", "shortDescription": {"text": "CVE-2026-44492: axios 1.15.2 \u2014 ui/mobile/package-lock.json"}, "fullDescription": {"text": "axios: Axios: Proxy bypass via IPv4-mapped IPv6 address non-normalization\n\nAxios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios does not normalise IPv4-mapped IPv6 addresses. When NO_PROXY lists an IPv4 address such as 127.0.0.1 or 169.254.169.254, a request URL using the IPv4-mapped IPv6 form (::ffff:7f00:1, ::ffff:a9fe:a9fe) still routes through the configured proxy. Node.js resolves these addresses to the underlying IPv4 host, so the request reaches the internal service via the proxy rather than being blocked. This vuln\n\nPackage: axios\nInstalled: 1.15.2\nFixed in: 1.16.0, 0.32.0\nSeverity: HIGH\nFix: Upgrade axios to 1.16.0, 0.32.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-1fd7ed54d518700c", "name": "CVE-2026-44494: axios 1.15.2 \u2014 ui/mobile/package-lock.json", "shortDescription": {"text": "CVE-2026-44494: axios 1.15.2 \u2014 ui/mobile/package-lock.json"}, "fullDescription": {"text": "axios: Axios: Man-in-the-Middle (MITM) attack via Prototype Pollution\n\nAxios is a promise based HTTP client for the browser and Node.js. From 1.0.0 to before 1.16.0, the Axios library is vulnerable to a Prototype Pollution \"Gadget\" attack that allows any Object.prototype pollution in the application's dependency tree to be escalated into a full Man-in-the-Middle (MITM) attack \u2014 intercepting, reading, and modifying all HTTP traffic including authentication credentials. The HTTP adapter at lib/adapters/http.js:670 reads config.proxy via standard property access, whic\n\nPackage: axios\nInstalled: 1.15.2\nFixed in: 1.16.0\nSeverity: HIGH\nFix: Upgrade axios to 1.16.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-4f2507865c2b1c32", "name": "CVE-2026-44496: axios 1.15.2 \u2014 ui/mobile/package-lock.json", "shortDescription": {"text": "CVE-2026-44496: axios 1.15.2 \u2014 ui/mobile/package-lock.json"}, "fullDescription": {"text": "axios: Axios: Client-side Denial of Service via unescaped regex metacharacters in XSRF cookie name\n\nAxios is a promise based HTTP client for the browser and Node.js. Axios versions before 0.32.0 on the 0.x line and before 1.16.0 on the 1.x line build a regular expression from the configured XSRF cookie name without escaping regex metacharacters. In standard browser environments, an attacker who can influence the cookie name passed to axios can cause expensive regex backtracking while axios reads document.cookie. The practical impact is client-side availability degradation, such as freezing the\n\nPackage: axios\nInstalled: 1.15.2\nFixed in: 1.16.0, 0.32.0\nSeverity: HIGH\nFix: Upgrade axios to 1.16.0, 0.32.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-8f61e4424b5ef3f4", "name": "GHSA-gcfj-64vw-6mp9: axios 1.15.2 \u2014 ui/mobile/package-lock.json", "shortDescription": {"text": "GHSA-gcfj-64vw-6mp9: axios 1.15.2 \u2014 ui/mobile/package-lock.json"}, "fullDescription": {"text": "Axios Node HTTP adapter can use an inherited proxy after interceptor config cloning\n\n## Summary\n\nAxios\u2019 Node.js HTTP adapter can route requests through an attacker-controlled proxy when `Object.prototype.proxy` is polluted and request configuration is materialized as a regular object before dispatch.\n\nRecent axios releases harden merged request config by creating a null-prototype object. However, request interceptors run after that merge and may return a replacement config. A common immutable interceptor pattern such as `{...config}` or `Object.assign({}, config)` converts the h\n\nPackage: axios\nInstalled: 1.15.2\nFixed in: 0.33.0, 1.18.0\nSeverity: HIGH\nFix: Upgrade axios to 0.33.0, 1.18.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-e571e4307a21bdcb", "name": "CVE-2026-44490: axios 1.15.2 \u2014 ui/mobile/package-lock.json", "shortDescription": {"text": "CVE-2026-44490: axios 1.15.2 \u2014 ui/mobile/package-lock.json"}, "fullDescription": {"text": "axios: Axios: Information disclosure and denial of service due to prototype pollution\n\nAxios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, axios exposes two read-side prototype-pollution gadgets. When Object.prototype is polluted by an upstream dependency in the same process (e.g. lodash _.merge / CVE-2018-16487), axios silently picks up the polluted values. (1) lib/utils.js line 406 builds merge()'s accumulator as result = {}, so result[targetKey] (line 414) walks Object.prototype and the polluted bucket's own keys are copied into the mer\n\nPackage: axios\nInstalled: 1.15.2\nFixed in: 1.16.0, 0.32.0\nSeverity: MEDIUM\nFix: Upgrade axios to 1.16.0, 0.32.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-570e319244c838d2", "name": "GHSA-42h9-826w-cgv3: axios 1.15.2 \u2014 ui/mobile/package-lock.json", "shortDescription": {"text": "GHSA-42h9-826w-cgv3: axios 1.15.2 \u2014 ui/mobile/package-lock.json"}, "fullDescription": {"text": "Axios: Excessive recursion in formDataToJSON can cause denial of service\n\n## Summary\nAxios versions `0.28.0` and later contain uncontrolled recursion in `formDataToJSON`, the helper behind the public `axios.formToJSON()` / named `formToJSON` API and the default request transform used when FormData is sent with an `application/json` content type.\n\nApplications are affected when they pass attacker-controlled `FormData` field names into this functionality. A field name with thousands of nested bracket segments can exhaust the JavaScript call stack and throw `RangeError: \n\nPackage: axios\nInstalled: 1.15.2\nFixed in: 0.33.0, 1.18.0\nSeverity: MEDIUM\nFix: Upgrade axios to 0.33.0, 1.18.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-fa22a3bfc6ea9e0d", "name": "GHSA-7q8q-rj6j-mhjq: axios 1.15.2 \u2014 ui/mobile/package-lock.json", "shortDescription": {"text": "GHSA-7q8q-rj6j-mhjq: axios 1.15.2 \u2014 ui/mobile/package-lock.json"}, "fullDescription": {"text": "Axios: Nested axios option objects can consume polluted prototype values\n\n## Summary\n\nAxios can consume inherited properties from nested request option objects when the JavaScript process already has a polluted `Object.prototype`.\n\nThe top-level merged config is protected with a null prototype, but nested plain objects such as `auth` and `paramsSerializer` are cloned into ordinary objects. If application code passes placeholders such as `auth: {}` or `paramsSerializer: {}`, inherited `username`, `password`, `encode`, or `serialize` properties can influence outbound re\n\nPackage: axios\nInstalled: 1.15.2\nFixed in: 0.33.0, 1.18.0\nSeverity: MEDIUM\nFix: Upgrade axios to 0.33.0, 1.18.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b4181efc23005404", "name": "GHSA-f4gw-2p7v-4548: axios 1.15.2 \u2014 ui/mobile/package-lock.json", "shortDescription": {"text": "GHSA-f4gw-2p7v-4548: axios 1.15.2 \u2014 ui/mobile/package-lock.json"}, "fullDescription": {"text": "Axios: NO_PROXY bypass for 0.0.0.0 local addresses in axios\n\n## Summary\n\nAxios versions containing `lib/helpers/shouldBypassProxy.js` do not treat `0.0.0.0` as a local address when evaluating `NO_PROXY` rules. In Node.js applications that use `HTTP_PROXY` or `HTTPS_PROXY` together with `NO_PROXY=localhost,127.0.0.1,::1` or similar, a request to `http://0.0.0.0:<port>/` can be routed through the configured proxy instead of bypassing it.\n\nThe issue is exploitable when an attacker can influence the axios request URL or a followed redirect target, and when th\n\nPackage: axios\nInstalled: 1.15.2\nFixed in: 1.18.0, 0.33.0\nSeverity: MEDIUM\nFix: Upgrade axios to 1.18.0, 0.33.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-17995062a6d383d2", "name": "GHSA-hcpx-6fm6-wx23: axios 1.15.2 \u2014 ui/mobile/package-lock.json", "shortDescription": {"text": "GHSA-hcpx-6fm6-wx23: axios 1.15.2 \u2014 ui/mobile/package-lock.json"}, "fullDescription": {"text": "Axios form serializer maxDepth bypass via {} metatoken\n\n## Summary\n\nAxios versions in the fixed lines for GHSA-62hf-57xw-28j9 still contain an incomplete depth-limit bypass in `lib/helpers/toFormData.js`. When serializing an object with a top-level key ending in `{}`, axios calls `JSON.stringify()` on that value before the `formSerializer.maxDepth` guard can inspect the nested structure.\n\nAn attacker who can control object keys and nested values passed by an application into axios form or parameter serialization can trigger a raw `RangeError: Maximum\n\nPackage: axios\nInstalled: 1.15.2\nFixed in: 0.33.0, 1.18.0\nSeverity: MEDIUM\nFix: Upgrade axios to 0.33.0, 1.18.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-88a481fc6035d7c0", "name": "GHSA-jqh4-m9w3-8hp9: axios 1.15.2 \u2014 ui/mobile/package-lock.json", "shortDescription": {"text": "GHSA-jqh4-m9w3-8hp9: axios 1.15.2 \u2014 ui/mobile/package-lock.json"}, "fullDescription": {"text": "Axios: Fetch adapter `ReadableStream` uploads bypass `maxBodyLength`\n\n## Summary\n\naxios\u2019 fetch adapter does not enforce `maxBodyLength` for live WHATWG `ReadableStream` request bodies whose size cannot be determined before dispatch. Applications that use `adapter: \"fetch\"` and rely on `maxBodyLength` to cap untrusted upload/proxy streams can send the full stream even when it exceeds the configured limit.\n\nThis affects fetch-adapter usage in edge runtimes where fetch is selected, and in Node.js or browser environments where the fetch adapter is explicitly selected.\n\nPackage: axios\nInstalled: 1.15.2\nFixed in: 1.18.0\nSeverity: MEDIUM\nFix: Upgrade axios to 1.18.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-78da87c6f801f5b8", "name": "GHSA-mmx7-hfxf-jppx: axios 1.15.2 \u2014 ui/mobile/package-lock.json", "shortDescription": {"text": "GHSA-mmx7-hfxf-jppx: axios 1.15.2 \u2014 ui/mobile/package-lock.json"}, "fullDescription": {"text": "Axios: Prototype pollution gadgets can alter axios request construction\n\n## Summary\n\naxios is vulnerable to read-side prototype-pollution gadgets when `Object.prototype` has already been polluted by another vulnerability or dependency. The most broadly reachable issue is in the bodyless method aliases: `axios.get()`, `axios.delete()`, `axios.head()`, and `axios.options()` read inherited `data` before config normalization, causing attacker-controlled body data to be sent on requests that did not explicitly set a body.\n\nAdditional low-level paths affect consumers that \n\nPackage: axios\nInstalled: 1.15.2\nFixed in: 1.18.0, 0.33.0\nSeverity: MEDIUM\nFix: Upgrade axios to 1.18.0, 0.33.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e45630fb571597e5", "name": "GHSA-mwf2-3pr3-8698: axios 1.15.2 \u2014 ui/mobile/package-lock.json", "shortDescription": {"text": "GHSA-mwf2-3pr3-8698: axios 1.15.2 \u2014 ui/mobile/package-lock.json"}, "fullDescription": {"text": "Axios: HTTP/2 streamed uploads bypass `maxBodyLength`\n\n## Summary\n\nAxios versions with Node.js HTTP/2 support allow streamed request bodies to bypass `maxBodyLength` enforcement when requests are sent with `httpVersion: 2`.\n\nThis affects applications that rely on `maxBodyLength` as a hard cap while forwarding attacker-controlled streams, such as upload endpoints proxying user data to an upstream HTTP/2 service. Buffered request bodies are still checked before the request is sent.\n\n## Impact\n\nAn attacker who can control a stream passed to axios can c\n\nPackage: axios\nInstalled: 1.15.2\nFixed in: 1.18.0\nSeverity: MEDIUM\nFix: Upgrade axios to 1.18.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f54ebf6bc8395d74", "name": "GHSA-pmv8-rq9r-6j72: axios 1.15.2 \u2014 ui/mobile/package-lock.json", "shortDescription": {"text": "GHSA-pmv8-rq9r-6j72: axios 1.15.2 \u2014 ui/mobile/package-lock.json"}, "fullDescription": {"text": "Axios: Deep formToJSON Key Recursion Can Cause Denial of Service\n\n## Summary\n\nAxios versions starting with `0.28.0` contain uncontrolled recursion in `formDataToJSON`, which is exposed as `axios.formToJSON()` and used internally when axios serialises `FormData` with `Content-Type: application/json`.\n\nIf an application passes attacker-controlled `FormData` field names to this functionality, a field name with thousands of nested bracket segments can exhaust the JavaScript call stack and cause denial of service for that request or, in applications without appropr\n\nPackage: axios\nInstalled: 1.15.2\nFixed in: 0.33.0, 1.18.0\nSeverity: MEDIUM\nFix: Upgrade axios to 0.33.0, 1.18.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b4921970d90d6931", "name": "GHSA-xj6q-8x83-jv6g: axios 1.15.2 \u2014 ui/mobile/package-lock.json", "shortDescription": {"text": "GHSA-xj6q-8x83-jv6g: axios 1.15.2 \u2014 ui/mobile/package-lock.json"}, "fullDescription": {"text": "Axios: Prototype pollution auth subfields can inject Basic auth\n\n## Summary\n\nAxios versions after the `GHSA-q8qp-cvcw-x6jj` fix still contain prototype-pollution read-side gadgets in Basic auth subfield handling. If a host application is already affected by prototype pollution and then makes an axios request with an own `auth` object that omits `username` or `password`, axios reads inherited `Object.prototype.username` and `Object.prototype.password` values and uses them to construct an outbound `Authorization: Basic ...` header.\n\nThis does not mean axios its\n\nPackage: axios\nInstalled: 1.15.2\nFixed in: 1.18.0\nSeverity: MEDIUM\nFix: Upgrade axios to 1.18.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-75d0413ae8fe9fdd", "name": "CVE-2026-44489: axios 1.15.2 \u2014 ui/mobile/package-lock.json", "shortDescription": {"text": "CVE-2026-44489: axios 1.15.2 \u2014 ui/mobile/package-lock.json"}, "fullDescription": {"text": "axios: Axios: Information disclosure via Prototype Pollution\n\nAxios is a promise based HTTP client for the browser and Node.js. From 1.15.2 to before 1.16.0, nested objects created by utils.merge() (e.g., config.proxy) are still constructed as plain {} with Object.prototype in their chain. The setProxy() function at lib/adapters/http.js:209-223 reads proxy.username, proxy.password, and proxy.auth without hasOwnProperty checks. When Object.prototype.username is polluted, setProxy() constructs a Proxy-Authorization header with attacker-controlled credentials\n\nPackage: axios\nInstalled: 1.15.2\nFixed in: 1.16.0\nSeverity: LOW\nFix: Upgrade axios to 1.16.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-572725fca9e08098", "name": "CVE-2026-13149: brace-expansion 1.1.12 \u2014 ui/mobile/package-lock.json", "shortDescription": {"text": "CVE-2026-13149: brace-expansion 1.1.12 \u2014 ui/mobile/package-lock.json"}, "fullDescription": {"text": "brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity\n\nbrace-expansion through 5.0.6 is vulnerable to denial of service. The expand() function exhibits exponential-time complexity in the number of consecutive non-expanding '{}' brace groups. An attacker who passes a crafted string to expand(), directly or transitively, can cause significant CPU consumption and event-loop blocking. The max option does not mitigate this, as it bounds the output size rather than the recursion work.\n\nPackage: brace-expansion\nInstalled: 1.1.12\nFixed in: 5.0.7, 1.1.16, 2.1.2\nSeverity: HIGH\nFix: Upgrade brace-expansion to 5.0.7, 1.1.16, 2.1.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-3c186b53b4e13032", "name": "CVE-2026-33750: brace-expansion 1.1.12 \u2014 ui/mobile/package-lock.json", "shortDescription": {"text": "CVE-2026-33750: brace-expansion 1.1.12 \u2014 ui/mobile/package-lock.json"}, "fullDescription": {"text": "brace-expansion: brace-expansion: Denial of Service via zero step value in brace pattern\n\nThe brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to versions 5.0.5, 3.0.2, 2.0.3, and 1.1.13, a brace pattern with a zero step value (e.g., `{1..2..0}`) causes the sequence generation loop to run indefinitely, making the process hang for seconds and allocate heaps of memory. Versions 5.0.5, 3.0.2, 2.0.3, and 1.1.13 fix the issue. As a workaround, sanitize strings passed to `expand()` to ensure a step value of `0` is not used.\n\nPackage: brace-expansion\nInstalled: 1.1.12\nFixed in: 5.0.5, 3.0.2, 2.0.3, 1.1.13\nSeverity: MEDIUM\nFix: Upgrade brace-expansion to 5.0.5, 3.0.2, 2.0.3, 1.1.13"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-93de580ca1210ad4", "name": "CVE-2026-13149: brace-expansion 5.0.4 \u2014 ui/mobile/package-lock.json", "shortDescription": {"text": "CVE-2026-13149: brace-expansion 5.0.4 \u2014 ui/mobile/package-lock.json"}, "fullDescription": {"text": "brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity\n\nbrace-expansion through 5.0.6 is vulnerable to denial of service. The expand() function exhibits exponential-time complexity in the number of consecutive non-expanding '{}' brace groups. An attacker who passes a crafted string to expand(), directly or transitively, can cause significant CPU consumption and event-loop blocking. The max option does not mitigate this, as it bounds the output size rather than the recursion work.\n\nPackage: brace-expansion\nInstalled: 5.0.4\nFixed in: 5.0.7, 1.1.16, 2.1.2\nSeverity: HIGH\nFix: Upgrade brace-expansion to 5.0.7, 1.1.16, 2.1.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-6d49fd052be6b7ac", "name": "CVE-2026-33750: brace-expansion 5.0.4 \u2014 ui/mobile/package-lock.json", "shortDescription": {"text": "CVE-2026-33750: brace-expansion 5.0.4 \u2014 ui/mobile/package-lock.json"}, "fullDescription": {"text": "brace-expansion: brace-expansion: Denial of Service via zero step value in brace pattern\n\nThe brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to versions 5.0.5, 3.0.2, 2.0.3, and 1.1.13, a brace pattern with a zero step value (e.g., `{1..2..0}`) causes the sequence generation loop to run indefinitely, making the process hang for seconds and allocate heaps of memory. Versions 5.0.5, 3.0.2, 2.0.3, and 1.1.13 fix the issue. As a workaround, sanitize strings passed to `expand()` to ensure a step value of `0` is not used.\n\nPackage: brace-expansion\nInstalled: 5.0.4\nFixed in: 5.0.5, 3.0.2, 2.0.3, 1.1.13\nSeverity: MEDIUM\nFix: Upgrade brace-expansion to 5.0.5, 3.0.2, 2.0.3, 1.1.13"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9874fe5189adbaad", "name": "CVE-2026-45149: brace-expansion 5.0.4 \u2014 ui/mobile/package-lock.json", "shortDescription": {"text": "CVE-2026-45149: brace-expansion 5.0.4 \u2014 ui/mobile/package-lock.json"}, "fullDescription": {"text": "brace-expansion: brace-expansion: Denial of Service due to excessive memory allocation when expanding large numeric ranges\n\nThe brace-expansion library generates arbitrary strings containing a common prefix and suffix. From 5.0.0 to before 5.0.6, the max option was being applied too late. When expanding a single large numeric range like {1..10000000}, the sequence generation loop generates all 10 million intermediate elements before the max limit is applied With max=10, the output is correctly limited to 10 items, but the process still allocates ~505 MB and spends ~800ms building the full intermediate array. This vul\n\nPackage: brace-expansion\nInstalled: 5.0.4\nFixed in: 5.0.6\nSeverity: MEDIUM\nFix: Upgrade brace-expansion to 5.0.6"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2d504ec00baa3419", "name": "GHSA-r4q5-vmmm-2653: follow-redirects 1.15.11 \u2014 ui/mobile/package-lock.json", "shortDescription": {"text": "GHSA-r4q5-vmmm-2653: follow-redirects 1.15.11 \u2014 ui/mobile/package-lock.json"}, "fullDescription": {"text": "follow-redirects leaks Custom Authentication Headers to Cross-Domain Redirect Targets\n\n## Summary\n\nWhen an HTTP request follows a cross-domain redirect (301/302/307/308), `follow-redirects` only strips `authorization`, `proxy-authorization`, and `cookie` headers (matched by regex at index.js:469-476). Any custom authentication header (e.g., `X-API-Key`, `X-Auth-Token`, `Api-Key`, `Token`) is forwarded verbatim to the redirect target.\n\nSince `follow-redirects` is the redirect-handling dependency for **axios** (105K+ stars), this vulnerability affects the entire axios ecosystem.\n\n##\n\nPackage: follow-redirects\nInstalled: 1.15.11\nFixed in: 1.16.0\nSeverity: MEDIUM\nFix: Upgrade follow-redirects to 1.16.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-23f50bd5c9fb77ab", "name": "CVE-2026-12143: form-data 4.0.5 \u2014 ui/mobile/package-lock.json", "shortDescription": {"text": "CVE-2026-12143: form-data 4.0.5 \u2014 ui/mobile/package-lock.json"}, "fullDescription": {"text": "form-data: form-data: Form field override via CRLF injection\n\nform-data is a library for creating readable multipart/form-data streams. In versions through 4.0.5, the `field` argument to `FormData#append` and the `filename` option are concatenated verbatim into the `Content-Disposition` header without escaping carriage return (CR), line feed (LF), or double-quote (\") characters. An application that passes attacker-controlled data as a field name or filename (for example, an API gateway that turns JSON object keys into multipart field names) allows the atta\n\nPackage: form-data\nInstalled: 4.0.5\nFixed in: 2.5.6, 3.0.5, 4.0.6\nSeverity: HIGH\nFix: Upgrade form-data to 2.5.6, 3.0.5, 4.0.6"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-d594b65c9a3d7aaf", "name": "CVE-2026-59869: js-yaml 4.1.1 \u2014 ui/mobile/package-lock.json", "shortDescription": {"text": "CVE-2026-59869: js-yaml 4.1.1 \u2014 ui/mobile/package-lock.json"}, "fullDescription": {"text": "js-yaml: js-yaml: Denial of Service via crafted YAML documents\n\njs-yaml is a JavaScript YAML parser and dumper. From 3.0.0 before 3.15.0 and from 4.0.0 before 4.3.0, js-yaml can spend quadratic CPU time parsing a document whose size grows only linearly when a chain of mappings uses merge keys where each mapping merges the previous one. This issue is fixed in versions 3.15.0 and 4.3.0.\n\nPackage: js-yaml\nInstalled: 4.1.1\nFixed in: 3.15.0, 4.3.0\nSeverity: HIGH\nFix: Upgrade js-yaml to 3.15.0, 4.3.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-f1bbc3b1a5e227cf", "name": "CVE-2026-53550: js-yaml 4.1.1 \u2014 ui/mobile/package-lock.json", "shortDescription": {"text": "CVE-2026-53550: js-yaml 4.1.1 \u2014 ui/mobile/package-lock.json"}, "fullDescription": {"text": "js-yaml: js-yaml: Denial of Service via crafted YAML merge keys\n\njs-yaml is a JavaScript YAML parser and dumper. Prior to 4.2.0 and 3.15.0, a crafted YAML document can trigger algorithmic CPU exhaustion in js-yaml merge-key processing (<<) by repeating the same alias many times in a merge sequence. This causes quadratic parse-time behavior relative to input size and can block a Node.js worker/event loop for seconds with a relatively small payload (tens of KB), resulting in denial of service. The issue is in merge handling inside lib/loader.js. This vulnerabil\n\nPackage: js-yaml\nInstalled: 4.1.1\nFixed in: 4.2.0, 3.15.0\nSeverity: MEDIUM\nFix: Upgrade js-yaml to 4.2.0, 3.15.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f1b4176e41c8f9b0", "name": "CVE-2026-41305: postcss 8.4.49 \u2014 ui/mobile/package-lock.json", "shortDescription": {"text": "CVE-2026-41305: postcss 8.4.49 \u2014 ui/mobile/package-lock.json"}, "fullDescription": {"text": "postcss: PostCSS: Cross-Site Scripting (XSS) via improper escaping of style closing tags\n\nPostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Versions prior to 8.5.10 do not escape `</style>` sequences when stringifying CSS ASTs. When user-submitted CSS is parsed and re-stringified for embedding in HTML `<style>` tags, `</style>` in CSS values breaks out of the style context, enabling XSS. Version 8.5.10 fixes the issue.\n\nPackage: postcss\nInstalled: 8.4.49\nFixed in: 8.5.10\nSeverity: MEDIUM\nFix: Upgrade postcss to 8.5.10"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e5065b865f163197", "name": "CVE-2026-9277: shell-quote 1.8.3 \u2014 ui/mobile/package-lock.json", "shortDescription": {"text": "CVE-2026-9277: shell-quote 1.8.3 \u2014 ui/mobile/package-lock.json"}, "fullDescription": {"text": "shell-quote: shell-quote: Arbitrary code execution via command injection due to unescaped line terminators\n\nshell-quote's `quote()` function did not validate object-token inputs against the operator model used by `parse()`. The `.op` field was backslash-escaped character by character using `/(.)/g`, which in JavaScript does not match line terminators (\\n, \\r, U+2028, U+2029). A line terminator in `.op` therefore passed through unescaped into the output; POSIX shells treat a literal newline as a command separator, so any content after it would execute as a second command. The vulnerable code path is re\n\nPackage: shell-quote\nInstalled: 1.8.3\nFixed in: 1.8.4\nSeverity: CRITICAL\nFix: Upgrade shell-quote to 1.8.4"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-a9e796ddfd2e86df", "name": "CVE-2026-13311: shell-quote 1.8.3 \u2014 ui/mobile/package-lock.json", "shortDescription": {"text": "CVE-2026-13311: shell-quote 1.8.3 \u2014 ui/mobile/package-lock.json"}, "fullDescription": {"text": "shell-quote: shell-quote/parse: shell-quote: Denial of Service due to inefficient input parsing\n\nshell-quote prior to 1.8.5 finalizes parsed tokens in parse() using Array.prototype.concat as a reduce accumulator, which reallocates and copies the entire growing array on every iteration. As a result parse() runs in O(n^2) time relative to the number of input tokens. An attacker who can supply an attacker-controlled string to any code path that calls parse() (no shell metacharacters are required; plain space-separated words suffice) can block the single-threaded Node.js event loop for an exten\n\nPackage: shell-quote\nInstalled: 1.8.3\nFixed in: 1.9.0\nSeverity: HIGH\nFix: Upgrade shell-quote to 1.9.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-4e8ffef7ffec545d", "name": "CVE-2026-41907: uuid 7.0.3 \u2014 ui/mobile/package-lock.json", "shortDescription": {"text": "CVE-2026-41907: uuid 7.0.3 \u2014 ui/mobile/package-lock.json"}, "fullDescription": {"text": "uuid: uuid: Out-of-bounds write vulnerability impacts data integrity and confidentiality\n\nuuid is for the creation of RFC9562 (formerly RFC4122) UUIDs. Prior to 14.0.0, v3, v5, and v6 accept external output buffers but do not reject out-of-range writes (small buf or large offset). This allows silent partial writes into caller-provided buffers. This vulnerability is fixed in 14.0.0.\n\nPackage: uuid\nInstalled: 7.0.3\nFixed in: 11.1.1, 12.0.1, 13.0.1\nSeverity: MEDIUM\nFix: Upgrade uuid to 11.1.1, 12.0.1, 13.0.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-59b8bcd3f7036b1c", "name": "CVE-2026-48779: ws 7.5.10 \u2014 ui/mobile/package-lock.json", "shortDescription": {"text": "CVE-2026-48779: ws 7.5.10 \u2014 ui/mobile/package-lock.json"}, "fullDescription": {"text": "ws: ws: Denial of Service via memory exhaustion from small WebSocket fragments\n\nws is an open source WebSocket client and server for Node.js. All versions from 1.1.0 up to (but not including) 5.2.5, from 6.0.0 up to 6.2.4, from 7.0.0 up to 7.5.11, and from 8.0.0 up to 8.21.0 are affected by a memory exhaustion DoS vulnerability. A peer can send a high volume of exceptionally small fragments and data chunks, with modest network traffic, to force the remote peer into allocating and holding structural wrappers that consume far more memory than the default documented message-si\n\nPackage: ws\nInstalled: 7.5.10\nFixed in: 5.2.5, 6.2.4, 7.5.11, 8.21.0\nSeverity: HIGH\nFix: Upgrade ws to 5.2.5, 6.2.4, 7.5.11, 8.21.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-79caab45063d4fc3", "name": "CVE-2026-48779: ws 8.19.0 \u2014 ui/mobile/package-lock.json", "shortDescription": {"text": "CVE-2026-48779: ws 8.19.0 \u2014 ui/mobile/package-lock.json"}, "fullDescription": {"text": "ws: ws: Denial of Service via memory exhaustion from small WebSocket fragments\n\nws is an open source WebSocket client and server for Node.js. All versions from 1.1.0 up to (but not including) 5.2.5, from 6.0.0 up to 6.2.4, from 7.0.0 up to 7.5.11, and from 8.0.0 up to 8.21.0 are affected by a memory exhaustion DoS vulnerability. A peer can send a high volume of exceptionally small fragments and data chunks, with modest network traffic, to force the remote peer into allocating and holding structural wrappers that consume far more memory than the default documented message-si\n\nPackage: ws\nInstalled: 8.19.0\nFixed in: 5.2.5, 6.2.4, 7.5.11, 8.21.0\nSeverity: HIGH\nFix: Upgrade ws to 5.2.5, 6.2.4, 7.5.11, 8.21.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-25e960b140185a89", "name": "CVE-2026-45736: ws 8.19.0 \u2014 ui/mobile/package-lock.json", "shortDescription": {"text": "CVE-2026-45736: ws 8.19.0 \u2014 ui/mobile/package-lock.json"}, "fullDescription": {"text": "ws: ws: Uninitialized memory disclosure via `websocket.close()` with `TypedArray`\n\nws is an open source WebSocket client and server for Node.js. Prior to 8.20.1, the websocket.close() implementation is vulnerable to uninitialized memory disclosure when a TypedArray is passed as the reason argument. This vulnerability is fixed in 8.20.1.\n\nPackage: ws\nInstalled: 8.19.0\nFixed in: 8.20.1\nSeverity: MEDIUM\nFix: Upgrade ws to 8.20.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-aaeb6ee67d225d7e", "name": "CVE-2026-33532: yaml 2.8.2 \u2014 ui/mobile/package-lock.json", "shortDescription": {"text": "CVE-2026-33532: yaml 2.8.2 \u2014 ui/mobile/package-lock.json"}, "fullDescription": {"text": "yaml: yaml: Denial of Service via deeply nested YAML document parsing\n\n`yaml` is a YAML parser and serialiser for JavaScript. Parsing a YAML document with a version of `yaml` on the 1.x branch prior to 1.10.3 or on the 2.x branch prior to 2.8.3 may throw a RangeError due to a stack overflow. The node resolution/composition phase uses recursive function calls without a depth bound. An attacker who can supply YAML for parsing can trigger a `RangeError: Maximum call stack size exceeded` with a small payload (~2\u201310 KB). The `RangeError` is not a `YAMLParseError`, so ap\n\nPackage: yaml\nInstalled: 2.8.2\nFixed in: 2.8.3, 1.10.3\nSeverity: MEDIUM\nFix: Upgrade yaml to 2.8.3, 1.10.3"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c9bcf62777f61505", "name": "GHSA-wrw7-89jp-8q8g: glib 0.18.5 \u2014 v2/Cargo.lock", "shortDescription": {"text": "GHSA-wrw7-89jp-8q8g: glib 0.18.5 \u2014 v2/Cargo.lock"}, "fullDescription": {"text": "Unsoundness in `Iterator` and `DoubleEndedIterator` impls for `glib::VariantStrIter`\n\nThe `VariantStrIter::impl_get` function (called internally by implementations of the `Iterator` and `DoubleEndedIterator` traits for this type) was unsound, resulting in undefined behaviour.\n\nAn immutable reference `&p` to a `*mut libc::c_char` pointer initialized to `NULL` was passed as an argument to a C function that that mutates the pointer behind `&p` in-place (i.e. as an out-argument), which was unsound. After changes in recent versions of the Rust compiler, these unsound writes through `&\n\nPackage: glib\nInstalled: 0.18.5\nFixed in: 0.20.0\nSeverity: MEDIUM\nFix: Upgrade glib to 0.20.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3a086debfbb6af0b", "name": "GHSA-rhfx-m35p-ff5j: lru 0.12.5 \u2014 v2/Cargo.lock", "shortDescription": {"text": "GHSA-rhfx-m35p-ff5j: lru 0.12.5 \u2014 v2/Cargo.lock"}, "fullDescription": {"text": "`IterMut` violates Stacked Borrows by invalidating internal pointer\n\nAffected versions of this crate contain a soundness issue in the `IterMut` iterator implementation. The `IterMut::next` and `IterMut::next_back` methods temporarily create an exclusive reference to the key when dereferencing the internal node pointer.\n\nThis invalidates the shared pointer held by the internal `HashMap`, violating Stacked Borrows rules.\n\nPackage: lru\nInstalled: 0.12.5\nFixed in: 0.16.3\nSeverity: LOW\nFix: Upgrade lru to 0.16.3"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-bd08c3d70cbe69dd", "name": "CVE-2026-31812: quinn-proto 0.11.13 \u2014 v2/Cargo.lock", "shortDescription": {"text": "CVE-2026-31812: quinn-proto 0.11.13 \u2014 v2/Cargo.lock"}, "fullDescription": {"text": "quinn-proto: quinn-proto: Denial of Service via crafted QUIC Initial packet\n\nQuinn is a pure-Rust, async-compatible implementation of the IETF QUIC transport protocol. Prior to 0.11.14, a remote, unauthenticated attacker can trigger a denial of service in applications using vulnerable quinn versions by sending a crafted QUIC Initial packet containing malformed quic_transport_parameters. In quinn-proto parsing logic, attacker-controlled varints are decoded with unwrap(), so truncated encodings cause Err(UnexpectedEnd) and panic. This is reachable over the network with a s\n\nPackage: quinn-proto\nInstalled: 0.11.13\nFixed in: 0.11.14\nSeverity: HIGH\nFix: Upgrade quinn-proto to 0.11.14"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-4608de8edf5c0606", "name": "GHSA-cq8v-f236-94qc: rand 0.7.3 \u2014 v2/Cargo.lock", "shortDescription": {"text": "GHSA-cq8v-f236-94qc: rand 0.7.3 \u2014 v2/Cargo.lock"}, "fullDescription": {"text": "Rand is unsound with a custom logger using rand::rng()\n\nIt has been reported (by @lopopolo) that the `rand` library is [unsound](https://rust-lang.github.io/unsafe-code-guidelines/glossary.html#soundness-of-code--of-a-library) (i.e. that safe code using the public API can cause Undefined Behaviour) when all the following conditions are met:\n\n- The `log` and `thread_rng` features are enabled\n- A [custom logger](https://docs.rs/log/latest/log/#implementing-a-logger) is defined\n- The custom logger accesses `rand::rng()` (previously `rand::thread_rng()`)\n\nPackage: rand\nInstalled: 0.7.3\nFixed in: 0.9.3, 0.10.1, 0.8.6\nSeverity: LOW\nFix: Upgrade rand to 0.9.3, 0.10.1, 0.8.6"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2f5d57ed470314bc", "name": "GHSA-cq8v-f236-94qc: rand 0.8.5 \u2014 v2/Cargo.lock", "shortDescription": {"text": "GHSA-cq8v-f236-94qc: rand 0.8.5 \u2014 v2/Cargo.lock"}, "fullDescription": {"text": "Rand is unsound with a custom logger using rand::rng()\n\nIt has been reported (by @lopopolo) that the `rand` library is [unsound](https://rust-lang.github.io/unsafe-code-guidelines/glossary.html#soundness-of-code--of-a-library) (i.e. that safe code using the public API can cause Undefined Behaviour) when all the following conditions are met:\n\n- The `log` and `thread_rng` features are enabled\n- A [custom logger](https://docs.rs/log/latest/log/#implementing-a-logger) is defined\n- The custom logger accesses `rand::rng()` (previously `rand::thread_rng()`)\n\nPackage: rand\nInstalled: 0.8.5\nFixed in: 0.9.3, 0.10.1, 0.8.6\nSeverity: LOW\nFix: Upgrade rand to 0.9.3, 0.10.1, 0.8.6"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-287d16650f63ce0d", "name": "GHSA-cq8v-f236-94qc: rand 0.9.2 \u2014 v2/Cargo.lock", "shortDescription": {"text": "GHSA-cq8v-f236-94qc: rand 0.9.2 \u2014 v2/Cargo.lock"}, "fullDescription": {"text": "Rand is unsound with a custom logger using rand::rng()\n\nIt has been reported (by @lopopolo) that the `rand` library is [unsound](https://rust-lang.github.io/unsafe-code-guidelines/glossary.html#soundness-of-code--of-a-library) (i.e. that safe code using the public API can cause Undefined Behaviour) when all the following conditions are met:\n\n- The `log` and `thread_rng` features are enabled\n- A [custom logger](https://docs.rs/log/latest/log/#implementing-a-logger) is defined\n- The custom logger accesses `rand::rng()` (previously `rand::thread_rng()`)\n\nPackage: rand\nInstalled: 0.9.2\nFixed in: 0.9.3, 0.10.1, 0.8.6\nSeverity: LOW\nFix: Upgrade rand to 0.9.3, 0.10.1, 0.8.6"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-645ac750b169c31d", "name": "GHSA-vfvv-c25p-m7mm: rkyv 0.8.15 \u2014 v2/Cargo.lock", "shortDescription": {"text": "GHSA-vfvv-c25p-m7mm: rkyv 0.8.15 \u2014 v2/Cargo.lock"}, "fullDescription": {"text": "rkyv: Panic safety bugs in `InlineVec::clear` and `SerVec::clear` enable arbitrary code execution\n\n`InlineVec::clear()` and `SerVec::clear()` in `rkyv` were not panic-safe. Both functions iterate over their elements and call `drop_in_place` on each, updating `self.len` only *after* the loop. If an element's `Drop` implementation panics during the loop, `self.len` is left at its original value.\n\nA subsequent invocation of `clear()` on the same container then re-visits the already-freed elements:\n\n- `InlineVec::clear()` is called again from `InlineVec`'s own `Drop` implementation when the value\n\nPackage: rkyv\nInstalled: 0.8.15\nFixed in: 0.8.16\nSeverity: MEDIUM\nFix: Upgrade rkyv to 0.8.16"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b8d94b3d56abe930", "name": "GHSA-82j2-j2ch-gfr8: rustls-webpki 0.101.7 \u2014 v2/Cargo.lock", "shortDescription": {"text": "GHSA-82j2-j2ch-gfr8: rustls-webpki 0.101.7 \u2014 v2/Cargo.lock"}, "fullDescription": {"text": "rustls-webpki: Denial of service via panic on malformed CRL BIT STRING\n\n### Summary\n\n`bit_string_flags()` in `src/der.rs` panics with an index-out-of-bounds when given a BIT STRING whose content is exactly `[0x00]` (one byte: zero padding bits, zero data bytes). This is reachable through the public API `BorrowedCertRevocationList::from_der()` via the `issuingDistributionPoint` CRL extension.\n\n**Precondition**: CRL checking is opt-in in rustls-webpki. This vulnerability affects only applications that explicitly pass `RevocationOptions` to `verify_for_usage()` and loa\n\nPackage: rustls-webpki\nInstalled: 0.101.7\nFixed in: 0.103.13, 0.104.0-alpha.7\nSeverity: HIGH\nFix: Upgrade rustls-webpki to 0.103.13, 0.104.0-alpha.7"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-1c0dba1ea026708d", "name": "GHSA-965h-392x-2mh5: rustls-webpki 0.101.7 \u2014 v2/Cargo.lock", "shortDescription": {"text": "GHSA-965h-392x-2mh5: rustls-webpki 0.101.7 \u2014 v2/Cargo.lock"}, "fullDescription": {"text": "webpki: Name constraints for URI names were incorrectly accepted\n\nName constraints for URI names were ignored and therefore accepted.\n\nNote this library does not provide an API for asserting URI names, and URI name constraints are otherwise not implemented.  URI name constraints are now rejected unconditionally.\n\nSince name constraints are restrictions on otherwise properly-issued certificates, this bug is reachable only after signature verification and requires misissuance to exploit.\n\nPackage: rustls-webpki\nInstalled: 0.101.7\nFixed in: 0.103.12, 0.104.0-alpha.6\nSeverity: LOW\nFix: Upgrade rustls-webpki to 0.103.12, 0.104.0-alpha.6"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0c827a90da12221b", "name": "GHSA-xgp8-3hg3-c2mh: rustls-webpki 0.101.7 \u2014 v2/Cargo.lock", "shortDescription": {"text": "GHSA-xgp8-3hg3-c2mh: rustls-webpki 0.101.7 \u2014 v2/Cargo.lock"}, "fullDescription": {"text": "webpki: Name constraints were accepted for certificates asserting a wildcard name\n\nPermitted subtree name constraints for DNS names were accepted for certificates asserting a wildcard name.\n\nThis was incorrect because, given a name constraint of `accept.example.com`, `*.example.com` could feasibly allow a name of `reject.example.com` which is outside the constraint.\nThis is very similar to [CVE-2025-61727](https://go.dev/issue/76442).\n\nSince name constraints are restrictions on otherwise properly-issued certificates, this bug is reachable only after signature verification and \n\nPackage: rustls-webpki\nInstalled: 0.101.7\nFixed in: 0.103.12, 0.104.0-alpha.6\nSeverity: LOW\nFix: Upgrade rustls-webpki to 0.103.12, 0.104.0-alpha.6"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-132e297703cc1b09", "name": "GHSA-82j2-j2ch-gfr8: rustls-webpki 0.102.8 \u2014 v2/Cargo.lock", "shortDescription": {"text": "GHSA-82j2-j2ch-gfr8: rustls-webpki 0.102.8 \u2014 v2/Cargo.lock"}, "fullDescription": {"text": "rustls-webpki: Denial of service via panic on malformed CRL BIT STRING\n\n### Summary\n\n`bit_string_flags()` in `src/der.rs` panics with an index-out-of-bounds when given a BIT STRING whose content is exactly `[0x00]` (one byte: zero padding bits, zero data bytes). This is reachable through the public API `BorrowedCertRevocationList::from_der()` via the `issuingDistributionPoint` CRL extension.\n\n**Precondition**: CRL checking is opt-in in rustls-webpki. This vulnerability affects only applications that explicitly pass `RevocationOptions` to `verify_for_usage()` and loa\n\nPackage: rustls-webpki\nInstalled: 0.102.8\nFixed in: 0.103.13, 0.104.0-alpha.7\nSeverity: HIGH\nFix: Upgrade rustls-webpki to 0.103.13, 0.104.0-alpha.7"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-4f858743aa984d6a", "name": "GHSA-pwjx-qhcg-rvj4: rustls-webpki 0.102.8 \u2014 v2/Cargo.lock", "shortDescription": {"text": "GHSA-pwjx-qhcg-rvj4: rustls-webpki 0.102.8 \u2014 v2/Cargo.lock"}, "fullDescription": {"text": "webpki: CRLs not considered authoritative by Distribution Point due to faulty matching logic\n\nIf a certificate had more than one `distributionPoint`, then only the first `distributionPoint` would be considered against each CRL's `IssuingDistributionPoint` `distributionPoint`, and then the certificate's subsequent `distributionPoint`s would be ignored.\n\nThe impact was that correct provided CRLs would not be consulted to check revocation. With `UnknownStatusPolicy::Deny` (the default) this would lead to incorrect but safe `Error::UnknownRevocationStatus`. With `UnknownStatusPolicy::Allow` \n\nPackage: rustls-webpki\nInstalled: 0.102.8\nFixed in: 0.103.10, 0.104.0-alpha.5\nSeverity: MEDIUM\nFix: Upgrade rustls-webpki to 0.103.10, 0.104.0-alpha.5"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-165c0a13967b3ecf", "name": "GHSA-965h-392x-2mh5: rustls-webpki 0.102.8 \u2014 v2/Cargo.lock", "shortDescription": {"text": "GHSA-965h-392x-2mh5: rustls-webpki 0.102.8 \u2014 v2/Cargo.lock"}, "fullDescription": {"text": "webpki: Name constraints for URI names were incorrectly accepted\n\nName constraints for URI names were ignored and therefore accepted.\n\nNote this library does not provide an API for asserting URI names, and URI name constraints are otherwise not implemented.  URI name constraints are now rejected unconditionally.\n\nSince name constraints are restrictions on otherwise properly-issued certificates, this bug is reachable only after signature verification and requires misissuance to exploit.\n\nPackage: rustls-webpki\nInstalled: 0.102.8\nFixed in: 0.103.12, 0.104.0-alpha.6\nSeverity: LOW\nFix: Upgrade rustls-webpki to 0.103.12, 0.104.0-alpha.6"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-275d0eb07e28d915", "name": "GHSA-xgp8-3hg3-c2mh: rustls-webpki 0.102.8 \u2014 v2/Cargo.lock", "shortDescription": {"text": "GHSA-xgp8-3hg3-c2mh: rustls-webpki 0.102.8 \u2014 v2/Cargo.lock"}, "fullDescription": {"text": "webpki: Name constraints were accepted for certificates asserting a wildcard name\n\nPermitted subtree name constraints for DNS names were accepted for certificates asserting a wildcard name.\n\nThis was incorrect because, given a name constraint of `accept.example.com`, `*.example.com` could feasibly allow a name of `reject.example.com` which is outside the constraint.\nThis is very similar to [CVE-2025-61727](https://go.dev/issue/76442).\n\nSince name constraints are restrictions on otherwise properly-issued certificates, this bug is reachable only after signature verification and \n\nPackage: rustls-webpki\nInstalled: 0.102.8\nFixed in: 0.103.12, 0.104.0-alpha.6\nSeverity: LOW\nFix: Upgrade rustls-webpki to 0.103.12, 0.104.0-alpha.6"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-448bb5df44dc09b3", "name": "GHSA-7gcf-g7xr-8hxj: serde_with 3.17.0 \u2014 v2/Cargo.lock", "shortDescription": {"text": "GHSA-7gcf-g7xr-8hxj: serde_with 3.17.0 \u2014 v2/Cargo.lock"}, "fullDescription": {"text": "serde_with: KeyValueMap serialization panics on empty sequence or map entries\n\n### Summary\n\nThe public `KeyValueMap` serializer assumes that each mapped element has at least one field or item to use as the map key, but it subtracts `1` from the caller-visible length before validating that assumption. An application that serializes attacker-controlled data through `#[serde_as(as = \"KeyValueMap<_>\")]` can be crashed by an empty inner sequence or map entry.\n\n### Details\n\nThe affected public surface includes:\n\n- Serialization of `#[serde_as(as = \"KeyValueMap<_>\")]` values thro\n\nPackage: serde_with\nInstalled: 3.17.0\nFixed in: 3.21.0\nSeverity: MEDIUM\nFix: Upgrade serde_with to 3.21.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-28455b4bc8f7bd71", "name": "CVE-2024-58266: shlex 0.1.1 \u2014 v2/Cargo.lock", "shortDescription": {"text": "CVE-2024-58266: shlex 0.1.1 \u2014 v2/Cargo.lock"}, "fullDescription": {"text": "shlex: Shlex Command Injection Vulnerability\n\nThe shlex crate before 1.2.1 for Rust allows unquoted and unescaped instances of the { and \\xa0 characters, which may facilitate command injection.\n\nPackage: shlex\nInstalled: 0.1.1\nFixed in: 1.3.0\nSeverity: LOW\nFix: Upgrade shlex to 1.3.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-315735c1dcce390d", "name": "GHSA-3pv8-6f4r-ffg2: tar 0.4.45 \u2014 v2/Cargo.lock", "shortDescription": {"text": "GHSA-3pv8-6f4r-ffg2: tar 0.4.45 \u2014 v2/Cargo.lock"}, "fullDescription": {"text": "tar has a PAX header desynchronization issue\n\n### Summary\n\nWhen a tar stream contains multiple \"header\" entries prior to a file entry, tar-rs applies the PAX header (`x`) to the _next_ entry in the stream, regardless of type. For example, a stream of `x -> L -> file` (PAX, GNU longname, file) would result in `x`'s extensions being applied to `L` rather than to `file`.\n\n[Per POSIX pax](https://pubs.opengroup.org/onlinepubs/9799919799/utilities/pax.html), this is incorrect: a PAX header always applies to a file entry, not any intermediary ent\n\nPackage: tar\nInstalled: 0.4.45\nFixed in: 0.4.46\nSeverity: MEDIUM\nFix: Upgrade tar to 0.4.46"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-98add9fd63cbe1cd", "name": "CVE-2026-42184: tauri 2.10.3 \u2014 v2/Cargo.lock", "shortDescription": {"text": "CVE-2026-42184: tauri 2.10.3 \u2014 v2/Cargo.lock"}, "fullDescription": {"text": "Tauri has an Origin Confusion Issue that Allows Remote Pages to Invoke Local-Only IPC Commands\n\nTauri is a framework for building binaries for all major desktop platforms. From 2.0 to 2.11.0, a flaw in Tauri's is_local_url() function causes it to incorrectly classify remote URLs as trusted local origins on Windows and Android. On these systems, Tauri maps custom URI scheme protocols to http://<scheme>.localhost/ because those platforms' WebView implementations cannot serve custom URI schemes directly. The issue is that Tauri's check to see if the origin is local, only checks the first subd\n\nPackage: tauri\nInstalled: 2.10.3\nFixed in: 2.11.1\nSeverity: MEDIUM\nFix: Upgrade tauri to 2.11.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9f841459602c9b33", "name": "CVE-2022-39974: wasm3 0.3.1 \u2014 v2/Cargo.lock", "shortDescription": {"text": "CVE-2022-39974: wasm3 0.3.1 \u2014 v2/Cargo.lock"}, "fullDescription": {"text": "WASM3 Improper Input Validation vulnerability\n\nWASM3 v0.5.0 was discovered to contain a segmentation fault via the component op_Select_i32_srs in wasm3/source/m3_exec.h.\n\nPackage: wasm3\nInstalled: 0.3.1\nFixed in: \u2014\nSeverity: HIGH\nFix: No fix version published yet"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-92838106c5b834fe", "name": "CVE-2022-34529: wasm3 0.3.1 \u2014 v2/Cargo.lock", "shortDescription": {"text": "CVE-2022-34529: wasm3 0.3.1 \u2014 v2/Cargo.lock"}, "fullDescription": {"text": "WASM3 segmentation fault\n\nWASM3 v0.5.0 was discovered to contain a segmentation fault via the component Compile_Memory_CopyFill.\n\nPackage: wasm3\nInstalled: 0.3.1\nFixed in: \u2014\nSeverity: MEDIUM\nFix: No fix version published yet"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-74ac613e7e120928", "name": "CVE-2024-27529: wasm3 0.3.1 \u2014 v2/Cargo.lock", "shortDescription": {"text": "CVE-2024-27529: wasm3 0.3.1 \u2014 v2/Cargo.lock"}, "fullDescription": {"text": "wasm3 uncontrolled memory allocation vulnerability\n\nwasm3 139076a contains memory leaks in Read_utf8.\n\nPackage: wasm3\nInstalled: 0.3.1\nFixed in: \u2014\nSeverity: MEDIUM\nFix: No fix version published yet"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4a3c26043925246a", "name": "CVE-2026-44216: wasmtime 42.0.2 \u2014 v2/Cargo.lock", "shortDescription": {"text": "CVE-2026-44216: wasmtime 42.0.2 \u2014 v2/Cargo.lock"}, "fullDescription": {"text": "wasmtime: Wasmtime: Denial of Service via large WebAssembly table allocation\n\nWasmtime is a runtime for WebAssembly. From 30.0.0 to 36.0.8, 43.0.2, and 44.0.1, Wasmtime's allocation logic for a WebAssembly table contained checked arithmetic which panicked on overflow. This overflow is possible to trigger, and thus panic, when a table with an extremely large size is allocated. This is possible with the WebAssembly memory64 proposal where tables can have sizes in the 64-bit range as opposed to the previous 32-bit range which would not overflow. The panic happens when attemp\n\nPackage: wasmtime\nInstalled: 42.0.2\nFixed in: 36.0.8, 43.0.2\nSeverity: MEDIUM\nFix: Upgrade wasmtime to 36.0.8, 43.0.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-07ded30f5ea99bc8", "name": "CVE-2026-25541: bytes 1.11.0 \u2014 v2/patches/ruvector-crv/Cargo.lock", "shortDescription": {"text": "CVE-2026-25541: bytes 1.11.0 \u2014 v2/patches/ruvector-crv/Cargo.lock"}, "fullDescription": {"text": "Bytes is a utility library for working with bytes. From version 1.2.1  ...\n\nBytes is a utility library for working with bytes. From version 1.2.1 to before 1.11.1, Bytes is vulnerable to integer overflow in BytesMut::reserve. In the unique reclaim path of BytesMut::reserve, if the condition \"v_capacity >= new_cap + offset\" uses an unchecked addition. When new_cap + offset overflows usize in release builds, this condition may incorrectly pass, causing self.cap to be set to a value that exceeds the actual allocated capacity. Subsequent APIs such as spare_capacity_mut() th\n\nPackage: bytes\nInstalled: 1.11.0\nFixed in: 1.11.1\nSeverity: MEDIUM\nFix: Upgrade bytes to 1.11.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-60b25026c88a595b", "name": "GHSA-cq8v-f236-94qc: rand 0.8.5 \u2014 v2/patches/ruvector-crv/Cargo.lock", "shortDescription": {"text": "GHSA-cq8v-f236-94qc: rand 0.8.5 \u2014 v2/patches/ruvector-crv/Cargo.lock"}, "fullDescription": {"text": "Rand is unsound with a custom logger using rand::rng()\n\nIt has been reported (by @lopopolo) that the `rand` library is [unsound](https://rust-lang.github.io/unsafe-code-guidelines/glossary.html#soundness-of-code--of-a-library) (i.e. that safe code using the public API can cause Undefined Behaviour) when all the following conditions are met:\n\n- The `log` and `thread_rng` features are enabled\n- A [custom logger](https://docs.rs/log/latest/log/#implementing-a-logger) is defined\n- The custom logger accesses `rand::rng()` (previously `rand::thread_rng()`)\n\nPackage: rand\nInstalled: 0.8.5\nFixed in: 0.9.3, 0.10.1, 0.8.6\nSeverity: LOW\nFix: Upgrade rand to 0.9.3, 0.10.1, 0.8.6"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7d6d199d2d727225", "name": "GHSA-vfvv-c25p-m7mm: rkyv 0.8.12 \u2014 v2/patches/ruvector-crv/Cargo.lock", "shortDescription": {"text": "GHSA-vfvv-c25p-m7mm: rkyv 0.8.12 \u2014 v2/patches/ruvector-crv/Cargo.lock"}, "fullDescription": {"text": "rkyv: Panic safety bugs in `InlineVec::clear` and `SerVec::clear` enable arbitrary code execution\n\n`InlineVec::clear()` and `SerVec::clear()` in `rkyv` were not panic-safe. Both functions iterate over their elements and call `drop_in_place` on each, updating `self.len` only *after* the loop. If an element's `Drop` implementation panics during the loop, `self.len` is left at its original value.\n\nA subsequent invocation of `clear()` on the same container then re-visits the already-freed elements:\n\n- `InlineVec::clear()` is called again from `InlineVec`'s own `Drop` implementation when the value\n\nPackage: rkyv\nInstalled: 0.8.12\nFixed in: 0.8.16\nSeverity: MEDIUM\nFix: Upgrade rkyv to 0.8.16"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8a97d8d1d649617e", "name": "DS-0002: Image user should not be 'root' \u2014 docker/Dockerfile.python", "shortDescription": {"text": "DS-0002: Image user should not be 'root' \u2014 docker/Dockerfile.python"}, "fullDescription": {"text": "Image user should not be 'root'\n\nSpecify at least 1 USER command in Dockerfile with non-root user as argument\n\nRule: DS-0002\nSeverity: HIGH\nTarget: docker/Dockerfile.python"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-18fdfdc8a4eb56ed", "name": "DS-0026: No HEALTHCHECK defined \u2014 docker/Dockerfile.python", "shortDescription": {"text": "DS-0026: No HEALTHCHECK defined \u2014 docker/Dockerfile.python"}, "fullDescription": {"text": "No HEALTHCHECK defined\n\nAdd HEALTHCHECK instruction in your Dockerfile\n\nRule: DS-0026\nSeverity: LOW\nTarget: docker/Dockerfile.python"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-002a58f53a03ede1", "name": "DS-0002: Image user should not be 'root' \u2014 docker/Dockerfile.rust", "shortDescription": {"text": "DS-0002: Image user should not be 'root' \u2014 docker/Dockerfile.rust"}, "fullDescription": {"text": "Image user should not be 'root'\n\nSpecify at least 1 USER command in Dockerfile with non-root user as argument\n\nRule: DS-0002\nSeverity: HIGH\nTarget: docker/Dockerfile.rust"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-8e1556b9e68c13a4", "name": "DS-0026: No HEALTHCHECK defined \u2014 docker/Dockerfile.rust", "shortDescription": {"text": "DS-0026: No HEALTHCHECK defined \u2014 docker/Dockerfile.rust"}, "fullDescription": {"text": "No HEALTHCHECK defined\n\nAdd HEALTHCHECK instruction in your Dockerfile\n\nRule: DS-0026\nSeverity: LOW\nTarget: docker/Dockerfile.rust"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-49ffd3aff8b8a921", "name": "DS-0031: Secrets passed via `build-args` or envs or copied secret files \u2014 docker/Dockerfile.rust", "shortDescription": {"text": "DS-0031: Secrets passed via `build-args` or envs or copied secret files \u2014 docker/Dockerfile.rust"}, "fullDescription": {"text": "Secrets passed via `build-args` or envs or copied secret files\n\nPossible exposure of secret env \"RUVIEW_API_TOKEN\" in ENV\n\nRule: DS-0031\nSeverity: CRITICAL\nTarget: docker/Dockerfile.rust"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-6f6e99adfe23e933", "name": "KSV-0001: Can elevate its own privileges \u2014 logging/fluentd-config.yml", "shortDescription": {"text": "KSV-0001: Can elevate its own privileges \u2014 logging/fluentd-config.yml"}, "fullDescription": {"text": "Can elevate its own privileges\n\nContainer 'fluentd' of DaemonSet 'fluentd' should set 'securityContext.allowPrivilegeEscalation' to false\n\nRule: KSV-0001\nSeverity: MEDIUM\nTarget: logging/fluentd-config.yml"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9d4e60ff2d70ff01", "name": "KSV-0003: Default capabilities: some containers do not drop all \u2014 logging/fluentd-config.yml", "shortDescription": {"text": "KSV-0003: Default capabilities: some containers do not drop all \u2014 logging/fluentd-config.yml"}, "fullDescription": {"text": "Default capabilities: some containers do not drop all\n\nContainer 'fluentd' of DaemonSet 'fluentd' should add 'ALL' to 'securityContext.capabilities.drop'\n\nRule: KSV-0003\nSeverity: LOW\nTarget: logging/fluentd-config.yml"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c5e6ba9da3028453", "name": "KSV-0004: Default capabilities: some containers do not drop any \u2014 logging/fluentd-config.yml", "shortDescription": {"text": "KSV-0004: Default capabilities: some containers do not drop any \u2014 logging/fluentd-config.yml"}, "fullDescription": {"text": "Default capabilities: some containers do not drop any\n\nContainer 'fluentd' of 'daemonset' 'fluentd' in 'kube-system' namespace should set securityContext.capabilities.drop\n\nRule: KSV-0004\nSeverity: LOW\nTarget: logging/fluentd-config.yml"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9826465df4ac34b3", "name": "KSV-0012: Runs as root user \u2014 logging/fluentd-config.yml", "shortDescription": {"text": "KSV-0012: Runs as root user \u2014 logging/fluentd-config.yml"}, "fullDescription": {"text": "Runs as root user\n\nContainer 'fluentd' of DaemonSet 'fluentd' should set 'securityContext.runAsNonRoot' to true\n\nRule: KSV-0012\nSeverity: MEDIUM\nTarget: logging/fluentd-config.yml"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-42127da9f745774b", "name": "KSV-0014: Root file system is not read-only \u2014 logging/fluentd-config.yml", "shortDescription": {"text": "KSV-0014: Root file system is not read-only \u2014 logging/fluentd-config.yml"}, "fullDescription": {"text": "Root file system is not read-only\n\nContainer 'fluentd' of DaemonSet 'fluentd' should set 'securityContext.readOnlyRootFilesystem' to true\n\nRule: KSV-0014\nSeverity: HIGH\nTarget: logging/fluentd-config.yml"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-fcd951ec11cef8b8", "name": "KSV-0020: Runs with UID <= 10000 \u2014 logging/fluentd-config.yml", "shortDescription": {"text": "KSV-0020: Runs with UID <= 10000 \u2014 logging/fluentd-config.yml"}, "fullDescription": {"text": "Runs with UID <= 10000\n\nContainer 'fluentd' of DaemonSet 'fluentd' should set 'securityContext.runAsUser' > 10000\n\nRule: KSV-0020\nSeverity: LOW\nTarget: logging/fluentd-config.yml"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-58a0c3cdda191e36", "name": "KSV-0021: Runs with GID <= 10000 \u2014 logging/fluentd-config.yml", "shortDescription": {"text": "KSV-0021: Runs with GID <= 10000 \u2014 logging/fluentd-config.yml"}, "fullDescription": {"text": "Runs with GID <= 10000\n\nContainer 'fluentd' of DaemonSet 'fluentd' should set 'securityContext.runAsGroup' > 10000\n\nRule: KSV-0021\nSeverity: LOW\nTarget: logging/fluentd-config.yml"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-dd0ecc43a914742b", "name": "KSV-0023: hostPath volumes mounted \u2014 logging/fluentd-config.yml", "shortDescription": {"text": "KSV-0023: hostPath volumes mounted \u2014 logging/fluentd-config.yml"}, "fullDescription": {"text": "hostPath volumes mounted\n\nDaemonSet 'fluentd' should not set 'spec.template.volumes.hostPath'\n\nRule: KSV-0023\nSeverity: MEDIUM\nTarget: logging/fluentd-config.yml"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-44f4bf69a36d0991", "name": "KSV-0030: Runtime/Default Seccomp profile not set \u2014 logging/fluentd-config.yml", "shortDescription": {"text": "KSV-0030: Runtime/Default Seccomp profile not set \u2014 logging/fluentd-config.yml"}, "fullDescription": {"text": "Runtime/Default Seccomp profile not set\n\nEither Pod or Container should set 'securityContext.seccompProfile.type' to 'RuntimeDefault'\n\nRule: KSV-0030\nSeverity: LOW\nTarget: logging/fluentd-config.yml"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0847940ec5498e75", "name": "KSV-0037: User resources should not be placed in kube-system namespace \u2014 logging/fluentd-config.yml", "shortDescription": {"text": "KSV-0037: User resources should not be placed in kube-system namespace \u2014 logging/fluentd-config.yml"}, "fullDescription": {"text": "User resources should not be placed in kube-system namespace\n\nDaemonSet 'fluentd' should not be set with 'kube-system' namespace\n\nRule: KSV-0037\nSeverity: MEDIUM\nTarget: logging/fluentd-config.yml"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1cb0309121f5a5ff", "name": "KSV-0104: Seccomp policies disabled \u2014 logging/fluentd-config.yml", "shortDescription": {"text": "KSV-0104: Seccomp policies disabled \u2014 logging/fluentd-config.yml"}, "fullDescription": {"text": "Seccomp policies disabled\n\ncontainer \"fluentd\" of daemonset \"fluentd\" in \"kube-system\" namespace should specify a seccomp profile\n\nRule: KSV-0104\nSeverity: MEDIUM\nTarget: logging/fluentd-config.yml"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b1b21e8a99340b75", "name": "KSV-0106: Container capabilities must only include NET_BIND_SERVICE \u2014 logging/fluentd-config.yml", "shortDescription": {"text": "KSV-0106: Container capabilities must only include NET_BIND_SERVICE \u2014 logging/fluentd-config.yml"}, "fullDescription": {"text": "Container capabilities must only include NET_BIND_SERVICE\n\ncontainer should drop all\n\nRule: KSV-0106\nSeverity: LOW\nTarget: logging/fluentd-config.yml"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d66029db5848aac9", "name": "KSV-0118: Default security context configured \u2014 logging/fluentd-config.yml", "shortDescription": {"text": "KSV-0118: Default security context configured \u2014 logging/fluentd-config.yml"}, "fullDescription": {"text": "Default security context configured\n\ncontainer fluentd in kube-system namespace is using the default security context\n\nRule: KSV-0118\nSeverity: HIGH\nTarget: logging/fluentd-config.yml"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-7619548f4fa51cdc", "name": "KSV-0125: Restrict container images to trusted registries \u2014 logging/fluentd-config.yml", "shortDescription": {"text": "KSV-0125: Restrict container images to trusted registries \u2014 logging/fluentd-config.yml"}, "fullDescription": {"text": "Restrict container images to trusted registries\n\nContainer fluentd in daemonset fluentd (namespace: kube-system) uses an image from an untrusted registry.\n\nRule: KSV-0125\nSeverity: MEDIUM\nTarget: logging/fluentd-config.yml"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-cc55229a7a3c078d", "name": "Agent authority lacks a verifier contract: .mcp.json", "shortDescription": {"text": "Agent authority lacks a verifier contract: .mcp.json"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-bea357a6497a2d5d", "name": "Agent authority lacks a verifier contract: CLAUDE.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: CLAUDE.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-24f2ea4bd14badc1", "name": "Agent instruction contains unpinned remote install: CLAUDE.md", "shortDescription": {"text": "Agent instruction contains unpinned remote install: CLAUDE.md"}, "fullDescription": {"text": "Remote install commands in agent instructions are a supply-chain risk, especially when an agent can execute shell commands."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-122f91b7f2906dc4", "name": "Agent authority lacks a verifier contract: .claude/settings.json", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/settings.json"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e2d5ba504ad8cc73", "name": "Agent instruction contains unpinned remote install: .claude/commands/claude-flow-help.md", "shortDescription": {"text": "Agent instruction contains unpinned remote install: .claude/commands/claude-flow-help.md"}, "fullDescription": {"text": "Remote install commands in agent instructions are a supply-chain risk, especially when an agent can execute shell commands."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-133522674206264c", "name": "Agent authority lacks a verifier contract: .claude/commands/automation/smart-spawn.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/commands/automation/smart-spawn.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-943b1b5c941fc9b4", "name": "Agent authority lacks a verifier contract: .claude/commands/automation/workflow-select.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/commands/automation/workflow-select.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2e5cf38d9fb6f954", "name": "Agent authority lacks a verifier contract: .claude/commands/automation/smart-agents.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/commands/automation/smart-agents.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-fd95ed8feae32ca7", "name": "Agent authority lacks a verifier contract: .claude/commands/monitoring/status.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/commands/monitoring/status.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-197f2e1f333a466e", "name": "Agent authority lacks a verifier contract: .claude/commands/monitoring/agent-metrics.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/commands/monitoring/agent-metrics.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e836aeb64cdfe6d5", "name": "Agent authority lacks a verifier contract: .claude/commands/monitoring/swarm-monitor.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/commands/monitoring/swarm-monitor.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0e99365509cea0e5", "name": "Agent authority lacks a verifier contract: .claude/commands/monitoring/real-time-view.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/commands/monitoring/real-time-view.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-17bf2bdb3e215bda", "name": "Agent authority lacks a verifier contract: .claude/commands/monitoring/agents.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/commands/monitoring/agents.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4d71cd6e47c02529", "name": "Agent instruction/config may expose a secret: .claude/commands/github/issue-tracker.md", "shortDescription": {"text": "Agent instruction/config may expose a secret: .claude/commands/github/issue-tracker.md"}, "fullDescription": {"text": "Agent-facing files are routinely pasted into LLM/tool contexts. Move literal tokens, keys, and passwords into a secret manager or document them as placeholders only."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-a48f0a7a322b4fc3", "name": "Agent authority lacks a verifier contract: .claude/commands/github/repo-analyze.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/commands/github/repo-analyze.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-46e699e02194410f", "name": "Agent instruction/config may expose a secret: .claude/commands/github/sync-coordinator.md", "shortDescription": {"text": "Agent instruction/config may expose a secret: .claude/commands/github/sync-coordinator.md"}, "fullDescription": {"text": "Agent-facing files are routinely pasted into LLM/tool contexts. Move literal tokens, keys, and passwords into a secret manager or document them as placeholders only."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-74dbb6bacaa064ee", "name": "Agent authority lacks a verifier contract: .claude/commands/github/pr-enhance.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/commands/github/pr-enhance.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-be6f6fc1affd2640", "name": "Agent authority lacks a verifier contract: .claude/commands/github/issue-triage.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/commands/github/issue-triage.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f7e4ace6dab989c8", "name": "Agent authority lacks a verifier contract: .claude/commands/github/code-review.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/commands/github/code-review.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9d5c01a7a814dd1f", "name": "Agent instruction/config may expose a secret: .claude/commands/github/release-manager.md", "shortDescription": {"text": "Agent instruction/config may expose a secret: .claude/commands/github/release-manager.md"}, "fullDescription": {"text": "Agent-facing files are routinely pasted into LLM/tool contexts. Move literal tokens, keys, and passwords into a secret manager or document them as placeholders only."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-96e852ec787b8741", "name": "Agent instruction/config may expose a secret: .claude/commands/github/repo-architect.md", "shortDescription": {"text": "Agent instruction/config may expose a secret: .claude/commands/github/repo-architect.md"}, "fullDescription": {"text": "Agent-facing files are routinely pasted into LLM/tool contexts. Move literal tokens, keys, and passwords into a secret manager or document them as placeholders only."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-a38504332b02e084", "name": "Agent instruction/config may expose a secret: .claude/commands/github/pr-manager.md", "shortDescription": {"text": "Agent instruction/config may expose a secret: .claude/commands/github/pr-manager.md"}, "fullDescription": {"text": "Agent-facing files are routinely pasted into LLM/tool contexts. Move literal tokens, keys, and passwords into a secret manager or document them as placeholders only."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-fadb96a708125716", "name": "Agent authority lacks a verifier contract: .claude/commands/github/swarm-issue.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/commands/github/swarm-issue.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-54f30e6a9ab71fa5", "name": "Agent authority lacks a verifier contract: .claude/commands/github/project-board-sync.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/commands/github/project-board-sync.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d778eb83136e55c5", "name": "Agent authority lacks a verifier contract: .claude/commands/analysis/token-efficiency.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/commands/analysis/token-efficiency.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3f96df1e6af32a81", "name": "Agent authority lacks a verifier contract: .claude/commands/analysis/performance-report.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/commands/analysis/performance-report.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-62f9d659cb6b42aa", "name": "Agent authority lacks a verifier contract: .claude/commands/analysis/COMMAND_COMPLIANCE_REPORT.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/commands/analysis/COMMAND_COMPLIANCE_REPORT.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-cd5713fd6351dd24", "name": "Agent authority lacks a verifier contract: .claude/commands/analysis/token-usage.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/commands/analysis/token-usage.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-18fb49cea8f73784", "name": "Agent authority lacks a verifier contract: .claude/commands/analysis/bottleneck-detect.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/commands/analysis/bottleneck-detect.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-678f0006e3f742bd", "name": "Agent authority lacks a verifier contract: .claude/commands/optimization/auto-topology.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/commands/optimization/auto-topology.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7b91db97d1267c82", "name": "Agent authority lacks a verifier contract: .claude/commands/optimization/README.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/commands/optimization/README.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-984755b4953bba20", "name": "Agent authority lacks a verifier contract: .claude/commands/optimization/topology-optimize.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/commands/optimization/topology-optimize.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2b5a994140b678e1", "name": "Agent authority lacks a verifier contract: .claude/commands/optimization/parallel-execute.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/commands/optimization/parallel-execute.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-5ecd9dbc8e691615", "name": "Agent authority lacks a verifier contract: .claude/commands/optimization/cache-manage.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/commands/optimization/cache-manage.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-58e1f00dd6a50d82", "name": "Agent instruction/config may expose a secret: .claude/commands/hooks/post-task.md", "shortDescription": {"text": "Agent instruction/config may expose a secret: .claude/commands/hooks/post-task.md"}, "fullDescription": {"text": "Agent-facing files are routinely pasted into LLM/tool contexts. Move literal tokens, keys, and passwords into a secret manager or document them as placeholders only."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-786493ca2daa6c83", "name": "Agent authority lacks a verifier contract: .claude/commands/hooks/post-task.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/commands/hooks/post-task.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d17cebdb2d322e78", "name": "Agent authority lacks a verifier contract: .claude/commands/hooks/pre-task.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/commands/hooks/pre-task.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8b5937b7ffe10288", "name": "Agent authority lacks a verifier contract: .claude/commands/hooks/session-end.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/commands/hooks/session-end.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-cf983c6eea41bf76", "name": "Agent authority lacks a verifier contract: .claude/commands/hooks/post-edit.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/commands/hooks/post-edit.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9b55f692e2f5a4b2", "name": "Agent authority lacks a verifier contract: .claude/commands/sparc/innovator.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/commands/sparc/innovator.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-145b25e83dfae7c1", "name": "Agent instruction/config may expose a secret: .claude/commands/sparc/tutorial.md", "shortDescription": {"text": "Agent instruction/config may expose a secret: .claude/commands/sparc/tutorial.md"}, "fullDescription": {"text": "Agent-facing files are routinely pasted into LLM/tool contexts. Move literal tokens, keys, and passwords into a secret manager or document them as placeholders only."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-aea9ce8500651411", "name": "Agent authority lacks a verifier contract: .claude/commands/sparc/tutorial.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/commands/sparc/tutorial.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-56e25ec61fbe48c6", "name": "Agent instruction/config may expose a secret: .claude/commands/sparc/code.md", "shortDescription": {"text": "Agent instruction/config may expose a secret: .claude/commands/sparc/code.md"}, "fullDescription": {"text": "Agent-facing files are routinely pasted into LLM/tool contexts. Move literal tokens, keys, and passwords into a secret manager or document them as placeholders only."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-9a1e2a0d2f2fee34", "name": "Agent instruction/config may expose a secret: .claude/commands/sparc/sparc.md", "shortDescription": {"text": "Agent instruction/config may expose a secret: .claude/commands/sparc/sparc.md"}, "fullDescription": {"text": "Agent-facing files are routinely pasted into LLM/tool contexts. Move literal tokens, keys, and passwords into a secret manager or document them as placeholders only."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-03086e0a7e44b2e6", "name": "Agent authority lacks a verifier contract: .claude/commands/sparc/batch-executor.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/commands/sparc/batch-executor.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ffea67f8ea442865", "name": "Agent instruction/config may expose a secret: .claude/commands/sparc/post-deployment-monitoring-mode.md", "shortDescription": {"text": "Agent instruction/config may expose a secret: .claude/commands/sparc/post-deployment-monitoring-mode.md"}, "fullDescription": {"text": "Agent-facing files are routinely pasted into LLM/tool contexts. Move literal tokens, keys, and passwords into a secret manager or document them as placeholders only."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-62660382aa28e045", "name": "Agent authority lacks a verifier contract: .claude/commands/sparc/post-deployment-monitoring-mode.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/commands/sparc/post-deployment-monitoring-mode.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9f238695ce7739da", "name": "Agent authority lacks a verifier contract: .claude/commands/sparc/documenter.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/commands/sparc/documenter.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-fc86c8b7b9fe2245", "name": "Agent authority lacks a verifier contract: .claude/commands/sparc/designer.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/commands/sparc/designer.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-880c8be4effa2bda", "name": "Agent authority lacks a verifier contract: .claude/commands/sparc/architect.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/commands/sparc/architect.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1b2f2449b22375e8", "name": "Agent instruction/config may expose a secret: .claude/commands/sparc/refinement-optimization-mode.md", "shortDescription": {"text": "Agent instruction/config may expose a secret: .claude/commands/sparc/refinement-optimization-mode.md"}, "fullDescription": {"text": "Agent-facing files are routinely pasted into LLM/tool contexts. Move literal tokens, keys, and passwords into a secret manager or document them as placeholders only."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-f14bb75e6f4acd31", "name": "Agent authority lacks a verifier contract: .claude/commands/sparc/refinement-optimization-mode.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/commands/sparc/refinement-optimization-mode.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-811fd948456e9b41", "name": "Agent instruction/config may expose a secret: .claude/commands/sparc/docs-writer.md", "shortDescription": {"text": "Agent instruction/config may expose a secret: .claude/commands/sparc/docs-writer.md"}, "fullDescription": {"text": "Agent-facing files are routinely pasted into LLM/tool contexts. Move literal tokens, keys, and passwords into a secret manager or document them as placeholders only."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-c55825c879d8d930", "name": "Agent authority lacks a verifier contract: .claude/commands/sparc/docs-writer.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/commands/sparc/docs-writer.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-34a932f2da704d40", "name": "Agent instruction/config may expose a secret: .claude/commands/sparc/integration.md", "shortDescription": {"text": "Agent instruction/config may expose a secret: .claude/commands/sparc/integration.md"}, "fullDescription": {"text": "Agent-facing files are routinely pasted into LLM/tool contexts. Move literal tokens, keys, and passwords into a secret manager or document them as placeholders only."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-06a970c127cfbcb5", "name": "Agent instruction/config may expose a secret: .claude/commands/sparc/supabase-admin.md", "shortDescription": {"text": "Agent instruction/config may expose a secret: .claude/commands/sparc/supabase-admin.md"}, "fullDescription": {"text": "Agent-facing files are routinely pasted into LLM/tool contexts. Move literal tokens, keys, and passwords into a secret manager or document them as placeholders only."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-685aa2132bda1aff", "name": "Agent instruction/config may expose a secret: .claude/commands/sparc/security-review.md", "shortDescription": {"text": "Agent instruction/config may expose a secret: .claude/commands/sparc/security-review.md"}, "fullDescription": {"text": "Agent-facing files are routinely pasted into LLM/tool contexts. Move literal tokens, keys, and passwords into a secret manager or document them as placeholders only."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-afb3800368c145df", "name": "Agent authority lacks a verifier contract: .claude/commands/sparc/security-review.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/commands/sparc/security-review.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-013ed90594cd468d", "name": "Agent authority lacks a verifier contract: .claude/commands/sparc/swarm-coordinator.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/commands/sparc/swarm-coordinator.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b8b3058f1936119c", "name": "Agent instruction/config may expose a secret: .claude/commands/sparc/spec-pseudocode.md", "shortDescription": {"text": "Agent instruction/config may expose a secret: .claude/commands/sparc/spec-pseudocode.md"}, "fullDescription": {"text": "Agent-facing files are routinely pasted into LLM/tool contexts. Move literal tokens, keys, and passwords into a secret manager or document them as placeholders only."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-4431dc38d13dcfe5", "name": "Agent authority lacks a verifier contract: .claude/commands/sparc/spec-pseudocode.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/commands/sparc/spec-pseudocode.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-dacd3f2e07bb2e45", "name": "Agent authority lacks a verifier contract: .claude/commands/sparc/analyzer.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/commands/sparc/analyzer.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3e9d1fae51a22527", "name": "Agent instruction/config may expose a secret: .claude/commands/sparc/devops.md", "shortDescription": {"text": "Agent instruction/config may expose a secret: .claude/commands/sparc/devops.md"}, "fullDescription": {"text": "Agent-facing files are routinely pasted into LLM/tool contexts. Move literal tokens, keys, and passwords into a secret manager or document them as placeholders only."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-ebd1ad4ddfd06917", "name": "Agent authority lacks a verifier contract: .claude/commands/sparc/workflow-manager.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/commands/sparc/workflow-manager.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a2dfbcd5e1a10cb2", "name": "Agent instruction/config may expose a secret: .claude/commands/sparc/debug.md", "shortDescription": {"text": "Agent instruction/config may expose a secret: .claude/commands/sparc/debug.md"}, "fullDescription": {"text": "Agent-facing files are routinely pasted into LLM/tool contexts. Move literal tokens, keys, and passwords into a secret manager or document them as placeholders only."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-6d2db4e8dba14dfc", "name": "Agent authority lacks a verifier contract: .claude/commands/sparc/debug.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/commands/sparc/debug.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a35e881035e8730c", "name": "Agent authority lacks a verifier contract: .claude/commands/sparc/memory-manager.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/commands/sparc/memory-manager.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-dd5eb8d74e9c847c", "name": "Agent instruction/config may expose a secret: .claude/agents/swarm/hierarchical-coordinator.md", "shortDescription": {"text": "Agent instruction/config may expose a secret: .claude/agents/swarm/hierarchical-coordinator.md"}, "fullDescription": {"text": "Agent-facing files are routinely pasted into LLM/tool contexts. Move literal tokens, keys, and passwords into a secret manager or document them as placeholders only."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-b2e07a98e586d672", "name": "Agent instruction/config may expose a secret: .claude/agents/swarm/adaptive-coordinator.md", "shortDescription": {"text": "Agent instruction/config may expose a secret: .claude/agents/swarm/adaptive-coordinator.md"}, "fullDescription": {"text": "Agent-facing files are routinely pasted into LLM/tool contexts. Move literal tokens, keys, and passwords into a secret manager or document them as placeholders only."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-5fae87c2ae599549", "name": "Agent instruction/config may expose a secret: .claude/agents/swarm/mesh-coordinator.md", "shortDescription": {"text": "Agent instruction/config may expose a secret: .claude/agents/swarm/mesh-coordinator.md"}, "fullDescription": {"text": "Agent-facing files are routinely pasted into LLM/tool contexts. Move literal tokens, keys, and passwords into a secret manager or document them as placeholders only."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-36fb71af44f9d256", "name": "Agent authority lacks a verifier contract: .claude/agents/testing/production-validator.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/agents/testing/production-validator.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-579763e824e0bbbc", "name": "Agent instruction/config may expose a secret: .claude/agents/github/swarm-pr.md", "shortDescription": {"text": "Agent instruction/config may expose a secret: .claude/agents/github/swarm-pr.md"}, "fullDescription": {"text": "Agent-facing files are routinely pasted into LLM/tool contexts. Move literal tokens, keys, and passwords into a secret manager or document them as placeholders only."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-7eee98f79923c490", "name": "Agent instruction/config may expose a secret: .claude/agents/github/issue-tracker.md", "shortDescription": {"text": "Agent instruction/config may expose a secret: .claude/agents/github/issue-tracker.md"}, "fullDescription": {"text": "Agent-facing files are routinely pasted into LLM/tool contexts. Move literal tokens, keys, and passwords into a secret manager or document them as placeholders only."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-7edfb78773ba0b09", "name": "Agent instruction/config may expose a secret: .claude/agents/github/workflow-automation.md", "shortDescription": {"text": "Agent instruction/config may expose a secret: .claude/agents/github/workflow-automation.md"}, "fullDescription": {"text": "Agent-facing files are routinely pasted into LLM/tool contexts. Move literal tokens, keys, and passwords into a secret manager or document them as placeholders only."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-dd6b9d8c7a5f1f6d", "name": "Agent instruction/config may expose a secret: .claude/agents/github/sync-coordinator.md", "shortDescription": {"text": "Agent instruction/config may expose a secret: .claude/agents/github/sync-coordinator.md"}, "fullDescription": {"text": "Agent-facing files are routinely pasted into LLM/tool contexts. Move literal tokens, keys, and passwords into a secret manager or document them as placeholders only."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-2586ecab8d9e229d", "name": "Agent instruction/config may expose a secret: .claude/agents/github/release-manager.md", "shortDescription": {"text": "Agent instruction/config may expose a secret: .claude/agents/github/release-manager.md"}, "fullDescription": {"text": "Agent-facing files are routinely pasted into LLM/tool contexts. Move literal tokens, keys, and passwords into a secret manager or document them as placeholders only."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-83ff40bc16f3a11f", "name": "Agent instruction/config may expose a secret: .claude/agents/github/repo-architect.md", "shortDescription": {"text": "Agent instruction/config may expose a secret: .claude/agents/github/repo-architect.md"}, "fullDescription": {"text": "Agent-facing files are routinely pasted into LLM/tool contexts. Move literal tokens, keys, and passwords into a secret manager or document them as placeholders only."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-6e4a8da633786e2b", "name": "Agent instruction/config may expose a secret: .claude/agents/github/pr-manager.md", "shortDescription": {"text": "Agent instruction/config may expose a secret: .claude/agents/github/pr-manager.md"}, "fullDescription": {"text": "Agent-facing files are routinely pasted into LLM/tool contexts. Move literal tokens, keys, and passwords into a secret manager or document them as placeholders only."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-c8dc8b686f0691cd", "name": "Agent authority lacks a verifier contract: .claude/agents/github/swarm-issue.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/agents/github/swarm-issue.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b194af1a6233fd05", "name": "Agent authority lacks a verifier contract: .claude/agents/github/project-board-sync.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/agents/github/project-board-sync.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b7a96fbdae4f2347", "name": "Agent authority lacks a verifier contract: .claude/agents/architecture/arch-system-design.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/agents/architecture/arch-system-design.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3c5ccc0ad99d0714", "name": "Agent authority lacks a verifier contract: .claude/agents/architecture/system-design/arch-system-design.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/agents/architecture/system-design/arch-system-design.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e61e17cf59f7a25d", "name": "Agent authority lacks a verifier contract: .claude/agents/development/dev-backend-api.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/agents/development/dev-backend-api.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2b823d5c65498515", "name": "Agent authority lacks a verifier contract: .claude/agents/development/backend/dev-backend-api.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/agents/development/backend/dev-backend-api.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-97feea90675db00b", "name": "Agent authority lacks a verifier contract: .claude/agents/consensus/performance-benchmarker.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/agents/consensus/performance-benchmarker.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-fe259f4c78ac36b0", "name": "Agent authority lacks a verifier contract: .claude/agents/consensus/gossip-coordinator.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/agents/consensus/gossip-coordinator.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-eeb9543f41c2a7d6", "name": "Agent instruction/config may expose a secret: .claude/agents/consensus/security-manager.md", "shortDescription": {"text": "Agent instruction/config may expose a secret: .claude/agents/consensus/security-manager.md"}, "fullDescription": {"text": "Agent-facing files are routinely pasted into LLM/tool contexts. Move literal tokens, keys, and passwords into a secret manager or document them as placeholders only."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-f29f2979e4a043f5", "name": "Agent authority lacks a verifier contract: .claude/agents/templates/implementer-sparc-coder.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/agents/templates/implementer-sparc-coder.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2c0728009383fae8", "name": "Agent authority lacks a verifier contract: .claude/agents/templates/sparc-coordinator.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/agents/templates/sparc-coordinator.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-132b4541d9fcd878", "name": "Agent authority lacks a verifier contract: .claude/agents/templates/coordinator-swarm-init.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/agents/templates/coordinator-swarm-init.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d247ecd5855c4986", "name": "Agent authority lacks a verifier contract: .claude/agents/optimization/load-balancer.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/agents/optimization/load-balancer.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0322f93ac74bf40c", "name": "Agent authority lacks a verifier contract: .claude/agents/optimization/resource-allocator.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/agents/optimization/resource-allocator.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-27e6ddbc278993a8", "name": "Agent authority lacks a verifier contract: .claude/agents/optimization/performance-monitor.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/agents/optimization/performance-monitor.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-77e284ede4b834f8", "name": "Agent authority lacks a verifier contract: .claude/agents/optimization/topology-optimizer.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/agents/optimization/topology-optimizer.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-87803d520586d33f", "name": "Agent instruction/config may expose a secret: .claude/agents/payments/agentic-payments.md", "shortDescription": {"text": "Agent instruction/config may expose a secret: .claude/agents/payments/agentic-payments.md"}, "fullDescription": {"text": "Agent-facing files are routinely pasted into LLM/tool contexts. Move literal tokens, keys, and passwords into a secret manager or document them as placeholders only."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-aae903b86389ba8b", "name": "Agent instruction/config may expose a secret: .claude/agents/flow-nexus/app-store.md", "shortDescription": {"text": "Agent instruction/config may expose a secret: .claude/agents/flow-nexus/app-store.md"}, "fullDescription": {"text": "Agent-facing files are routinely pasted into LLM/tool contexts. Move literal tokens, keys, and passwords into a secret manager or document them as placeholders only."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-b725b54cbddb0440", "name": "Agent authority lacks a verifier contract: .claude/agents/flow-nexus/app-store.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/agents/flow-nexus/app-store.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ec796bf7604ba2b5", "name": "Agent authority lacks a verifier contract: .claude/agents/flow-nexus/neural-network.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/agents/flow-nexus/neural-network.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2bcb6a29f75dc3dd", "name": "Agent instruction/config may expose a secret: .claude/agents/goal/goal-planner.md", "shortDescription": {"text": "Agent instruction/config may expose a secret: .claude/agents/goal/goal-planner.md"}, "fullDescription": {"text": "Agent-facing files are routinely pasted into LLM/tool contexts. Move literal tokens, keys, and passwords into a secret manager or document them as placeholders only."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-50a7d2d5206f243a", "name": "Agent authority lacks a verifier contract: .claude/agents/goal/goal-planner.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/agents/goal/goal-planner.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4cd5cf3f6830a7c8", "name": "Agent instruction/config may expose a secret: .claude/agents/v3/v3-integration-architect.md", "shortDescription": {"text": "Agent instruction/config may expose a secret: .claude/agents/v3/v3-integration-architect.md"}, "fullDescription": {"text": "Agent-facing files are routinely pasted into LLM/tool contexts. Move literal tokens, keys, and passwords into a secret manager or document them as placeholders only."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-5ce5b35dab799a7f", "name": "Agent instruction/config may expose a secret: .claude/agents/v3/reasoningbank-learner.md", "shortDescription": {"text": "Agent instruction/config may expose a secret: .claude/agents/v3/reasoningbank-learner.md"}, "fullDescription": {"text": "Agent-facing files are routinely pasted into LLM/tool contexts. Move literal tokens, keys, and passwords into a secret manager or document them as placeholders only."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-8ef21dd1be17ca6d", "name": "Agent authority lacks a verifier contract: .claude/agents/v3/reasoningbank-learner.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/agents/v3/reasoningbank-learner.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-787c1e5439d9b774", "name": "Agent instruction/config may expose a secret: .claude/agents/v3/security-architect.md", "shortDescription": {"text": "Agent instruction/config may expose a secret: .claude/agents/v3/security-architect.md"}, "fullDescription": {"text": "Agent-facing files are routinely pasted into LLM/tool contexts. Move literal tokens, keys, and passwords into a secret manager or document them as placeholders only."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-97873c1b4db61af9", "name": "Agent authority lacks a verifier contract: .claude/agents/v3/security-architect.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/agents/v3/security-architect.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b028d7adbc4d89c9", "name": "Agent instruction/config may expose a secret: .claude/agents/v3/memory-specialist.md", "shortDescription": {"text": "Agent instruction/config may expose a secret: .claude/agents/v3/memory-specialist.md"}, "fullDescription": {"text": "Agent-facing files are routinely pasted into LLM/tool contexts. Move literal tokens, keys, and passwords into a secret manager or document them as placeholders only."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-c655dd0ebfed65b8", "name": "Agent authority lacks a verifier contract: .claude/agents/v3/adr-architect.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/agents/v3/adr-architect.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f2526402460fb434", "name": "Agent instruction/config may expose a secret: .claude/agents/v3/collective-intelligence-coordinator.md", "shortDescription": {"text": "Agent instruction/config may expose a secret: .claude/agents/v3/collective-intelligence-coordinator.md"}, "fullDescription": {"text": "Agent-facing files are routinely pasted into LLM/tool contexts. Move literal tokens, keys, and passwords into a secret manager or document them as placeholders only."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-189c347862131ca4", "name": "Agent instruction/config may expose a secret: .claude/agents/v3/sparc-orchestrator.md", "shortDescription": {"text": "Agent instruction/config may expose a secret: .claude/agents/v3/sparc-orchestrator.md"}, "fullDescription": {"text": "Agent-facing files are routinely pasted into LLM/tool contexts. Move literal tokens, keys, and passwords into a secret manager or document them as placeholders only."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-155860d3bb68a326", "name": "Agent instruction/config may expose a secret: .claude/agents/v3/security-auditor.md", "shortDescription": {"text": "Agent instruction/config may expose a secret: .claude/agents/v3/security-auditor.md"}, "fullDescription": {"text": "Agent-facing files are routinely pasted into LLM/tool contexts. Move literal tokens, keys, and passwords into a secret manager or document them as placeholders only."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-c3daca15335b91d5", "name": "Agent authority lacks a verifier contract: .claude/agents/v3/aidefence-guardian.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/agents/v3/aidefence-guardian.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-86997909df3848e3", "name": "Agent instruction/config may expose a secret: .claude/agents/v3/swarm-memory-manager.md", "shortDescription": {"text": "Agent instruction/config may expose a secret: .claude/agents/v3/swarm-memory-manager.md"}, "fullDescription": {"text": "Agent-facing files are routinely pasted into LLM/tool contexts. Move literal tokens, keys, and passwords into a secret manager or document them as placeholders only."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-1087c1c7c1692ea4", "name": "Agent authority lacks a verifier contract: .claude/agents/v3/swarm-memory-manager.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/agents/v3/swarm-memory-manager.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c8a0475f3163007c", "name": "Agent authority lacks a verifier contract: .claude/agents/v3/injection-analyst.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/agents/v3/injection-analyst.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ebd2fdb57dadc14a", "name": "Agent instruction/config may expose a secret: .claude/agents/v3/ddd-domain-expert.md", "shortDescription": {"text": "Agent instruction/config may expose a secret: .claude/agents/v3/ddd-domain-expert.md"}, "fullDescription": {"text": "Agent-facing files are routinely pasted into LLM/tool contexts. Move literal tokens, keys, and passwords into a secret manager or document them as placeholders only."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-cec197691a9202c8", "name": "Agent authority lacks a verifier contract: .claude/agents/v3/ddd-domain-expert.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/agents/v3/ddd-domain-expert.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9713a2fe325a1f0f", "name": "Agent instruction/config may expose a secret: .claude/agents/v3/performance-engineer.md", "shortDescription": {"text": "Agent instruction/config may expose a secret: .claude/agents/v3/performance-engineer.md"}, "fullDescription": {"text": "Agent-facing files are routinely pasted into LLM/tool contexts. Move literal tokens, keys, and passwords into a secret manager or document them as placeholders only."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-3831123413a49709", "name": "Agent authority lacks a verifier contract: .claude/agents/core/tester.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/agents/core/tester.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-cc7f015e479f876b", "name": "Agent instruction/config may expose a secret: .claude/agents/sublinear/pagerank-analyzer.md", "shortDescription": {"text": "Agent instruction/config may expose a secret: .claude/agents/sublinear/pagerank-analyzer.md"}, "fullDescription": {"text": "Agent-facing files are routinely pasted into LLM/tool contexts. Move literal tokens, keys, and passwords into a secret manager or document them as placeholders only."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-069ae2cd2994cd22", "name": "Agent instruction/config may expose a secret: .claude/agents/sparc/architecture.md", "shortDescription": {"text": "Agent instruction/config may expose a secret: .claude/agents/sparc/architecture.md"}, "fullDescription": {"text": "Agent-facing files are routinely pasted into LLM/tool contexts. Move literal tokens, keys, and passwords into a secret manager or document them as placeholders only."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-176167ecb8446c71", "name": "Agent instruction/config may expose a secret: .claude/agents/sparc/refinement.md", "shortDescription": {"text": "Agent instruction/config may expose a secret: .claude/agents/sparc/refinement.md"}, "fullDescription": {"text": "Agent-facing files are routinely pasted into LLM/tool contexts. Move literal tokens, keys, and passwords into a secret manager or document them as placeholders only."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-1f574e7ba291366c", "name": "Agent authority lacks a verifier contract: .claude/agents/sparc/refinement.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/agents/sparc/refinement.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f1246529183053ac", "name": "Agent instruction/config may expose a secret: .claude/skills/github-release-management/SKILL.md", "shortDescription": {"text": "Agent instruction/config may expose a secret: .claude/skills/github-release-management/SKILL.md"}, "fullDescription": {"text": "Agent-facing files are routinely pasted into LLM/tool contexts. Move literal tokens, keys, and passwords into a secret manager or document them as placeholders only."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-6983649e7d7e43ac", "name": "Agent instruction/config may expose a secret: .claude/skills/v3-mcp-optimization/SKILL.md", "shortDescription": {"text": "Agent instruction/config may expose a secret: .claude/skills/v3-mcp-optimization/SKILL.md"}, "fullDescription": {"text": "Agent-facing files are routinely pasted into LLM/tool contexts. Move literal tokens, keys, and passwords into a secret manager or document them as placeholders only."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-a62c458cb61c4e61", "name": "Agent instruction/config may expose a secret: .claude/skills/agentdb-memory-patterns/SKILL.md", "shortDescription": {"text": "Agent instruction/config may expose a secret: .claude/skills/agentdb-memory-patterns/SKILL.md"}, "fullDescription": {"text": "Agent-facing files are routinely pasted into LLM/tool contexts. Move literal tokens, keys, and passwords into a secret manager or document them as placeholders only."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-da91f6524b65a9da", "name": "Agent authority lacks a verifier contract: .claude/skills/agentdb-memory-patterns/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/skills/agentdb-memory-patterns/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e01c464e06447d96", "name": "Agent instruction/config may expose a secret: .claude/skills/v3-security-overhaul/SKILL.md", "shortDescription": {"text": "Agent instruction/config may expose a secret: .claude/skills/v3-security-overhaul/SKILL.md"}, "fullDescription": {"text": "Agent-facing files are routinely pasted into LLM/tool contexts. Move literal tokens, keys, and passwords into a secret manager or document them as placeholders only."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-21ec62032ac1355a", "name": "Agent instruction contains unpinned remote install: .claude/skills/swarm-advanced/SKILL.md", "shortDescription": {"text": "Agent instruction contains unpinned remote install: .claude/skills/swarm-advanced/SKILL.md"}, "fullDescription": {"text": "Remote install commands in agent instructions are a supply-chain risk, especially when an agent can execute shell commands."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8e65337e518ac9af", "name": "Agent authority lacks a verifier contract: .claude/skills/v3-cli-modernization/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/skills/v3-cli-modernization/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-de924889b300be84", "name": "Agent instruction/config may expose a secret: .claude/skills/sparc-methodology/SKILL.md", "shortDescription": {"text": "Agent instruction/config may expose a secret: .claude/skills/sparc-methodology/SKILL.md"}, "fullDescription": {"text": "Agent-facing files are routinely pasted into LLM/tool contexts. Move literal tokens, keys, and passwords into a secret manager or document them as placeholders only."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-c6429d215bd94462", "name": "Agent authority lacks a verifier contract: .claude/skills/v3-performance-optimization/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/skills/v3-performance-optimization/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0cd7ca04e6382d99", "name": "Agent authority lacks a verifier contract: .claude/skills/v3-memory-unification/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/skills/v3-memory-unification/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3603ed6d8e3dab44", "name": "Agent authority lacks a verifier contract: .claude/skills/v3-integration-deep/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/skills/v3-integration-deep/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-cf01fd75262fa110", "name": "Agent instruction/config may expose a secret: .claude/skills/github-multi-repo/SKILL.md", "shortDescription": {"text": "Agent instruction/config may expose a secret: .claude/skills/github-multi-repo/SKILL.md"}, "fullDescription": {"text": "Agent-facing files are routinely pasted into LLM/tool contexts. Move literal tokens, keys, and passwords into a secret manager or document them as placeholders only."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-ff1b04715d1cd44b", "name": "Agent instruction/config may expose a secret: .claude/skills/reasoningbank-intelligence/SKILL.md", "shortDescription": {"text": "Agent instruction/config may expose a secret: .claude/skills/reasoningbank-intelligence/SKILL.md"}, "fullDescription": {"text": "Agent-facing files are routinely pasted into LLM/tool contexts. Move literal tokens, keys, and passwords into a secret manager or document them as placeholders only."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-a58c814f49ae7cf5", "name": "Agent authority lacks a verifier contract: .claude/skills/reasoningbank-intelligence/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/skills/reasoningbank-intelligence/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-03f10e7d59a3abfb", "name": "Agent instruction/config may expose a secret: .claude/skills/agentdb-vector-search/SKILL.md", "shortDescription": {"text": "Agent instruction/config may expose a secret: .claude/skills/agentdb-vector-search/SKILL.md"}, "fullDescription": {"text": "Agent-facing files are routinely pasted into LLM/tool contexts. Move literal tokens, keys, and passwords into a secret manager or document them as placeholders only."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-3e97402e422e2021", "name": "Agent instruction/config may expose a secret: .claude/skills/hooks-automation/SKILL.md", "shortDescription": {"text": "Agent instruction/config may expose a secret: .claude/skills/hooks-automation/SKILL.md"}, "fullDescription": {"text": "Agent-facing files are routinely pasted into LLM/tool contexts. Move literal tokens, keys, and passwords into a secret manager or document them as placeholders only."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-6f46d2ab1ba22022", "name": "Agent instruction contains unpinned remote install: .claude/skills/hooks-automation/SKILL.md", "shortDescription": {"text": "Agent instruction contains unpinned remote install: .claude/skills/hooks-automation/SKILL.md"}, "fullDescription": {"text": "Remote install commands in agent instructions are a supply-chain risk, especially when an agent can execute shell commands."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ab321361b36d8da9", "name": "Agent instruction/config may expose a secret: .claude/skills/github-workflow-automation/SKILL.md", "shortDescription": {"text": "Agent instruction/config may expose a secret: .claude/skills/github-workflow-automation/SKILL.md"}, "fullDescription": {"text": "Agent-facing files are routinely pasted into LLM/tool contexts. Move literal tokens, keys, and passwords into a secret manager or document them as placeholders only."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-0a761f0bb4b48b29", "name": "Agent instruction contains unpinned remote install: .claude/skills/github-workflow-automation/SKILL.md", "shortDescription": {"text": "Agent instruction contains unpinned remote install: .claude/skills/github-workflow-automation/SKILL.md"}, "fullDescription": {"text": "Remote install commands in agent instructions are a supply-chain risk, especially when an agent can execute shell commands."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3aac565d04eedcd7", "name": "Agent instruction/config may expose a secret: .claude/skills/agentdb-advanced/SKILL.md", "shortDescription": {"text": "Agent instruction/config may expose a secret: .claude/skills/agentdb-advanced/SKILL.md"}, "fullDescription": {"text": "Agent-facing files are routinely pasted into LLM/tool contexts. Move literal tokens, keys, and passwords into a secret manager or document them as placeholders only."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-9ddfe6ab99078478", "name": "Agent instruction contains unpinned remote install: .claude/skills/skill-builder/SKILL.md", "shortDescription": {"text": "Agent instruction contains unpinned remote install: .claude/skills/skill-builder/SKILL.md"}, "fullDescription": {"text": "Remote install commands in agent instructions are a supply-chain risk, especially when an agent can execute shell commands."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9a29aa6ba5456e85", "name": "Agent authority lacks a verifier contract: .claude/skills/pair-programming/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/skills/pair-programming/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9aeb2209d2141de7", "name": "Agent instruction contains unpinned remote install: .claude/skills/pair-programming/SKILL.md", "shortDescription": {"text": "Agent instruction contains unpinned remote install: .claude/skills/pair-programming/SKILL.md"}, "fullDescription": {"text": "Remote install commands in agent instructions are a supply-chain risk, especially when an agent can execute shell commands."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-82f673df4b902287", "name": "Agent authority lacks a verifier contract: plugins/ruview/codex/AGENTS.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: plugins/ruview/codex/AGENTS.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0038dea688dd9031", "name": "Agent instruction contains unpinned remote install: plugins/ruview/skills/ruview-rvagent/SKILL.md", "shortDescription": {"text": "Agent instruction contains unpinned remote install: plugins/ruview/skills/ruview-rvagent/SKILL.md"}, "fullDescription": {"text": "Remote install commands in agent instructions are a supply-chain risk, especially when an agent can execute shell commands."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-23924d984e417cb6", "name": "Agent authority lacks a verifier contract: plugins/ruview/skills/ruview-configure/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: plugins/ruview/skills/ruview-configure/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c1a2d72f4bc28961", "name": "Agent authority lacks a verifier contract: plugins/ruview/skills/ruview-verify/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: plugins/ruview/skills/ruview-verify/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e227fc1fd2f56d0c", "name": "Agent authority lacks a verifier contract: harness/ruview/CLAUDE.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: harness/ruview/CLAUDE.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-5f82775317387cae", "name": "Agent authority lacks a verifier contract: harness/ruview/.claude/settings.json", "shortDescription": {"text": "Agent authority lacks a verifier contract: harness/ruview/.claude/settings.json"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e2fe3d82eb96cdcc", "name": "Agent authority lacks a verifier contract: harness/ruview/.claude/skills/verify/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: harness/ruview/.claude/skills/verify/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6a992022ef1ff799", "name": "Agent authority lacks a verifier contract: harness/ruview/.claude/skills/calibrate-room/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: harness/ruview/.claude/skills/calibrate-room/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-86339cac97410d89", "name": "SkillSpector RA2 (rogue-agent) in .claude/skills/agentdb-memory-patterns/SKILL.md", "shortDescription": {"text": "SkillSpector RA2 (rogue-agent) in .claude/skills/agentdb-memory-patterns/SKILL.md"}, "fullDescription": {"text": "maintain context across sessions\n\nSkill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.\n\nSkill: AgentDB Memory Patterns\nRule: RA2  Category: rogue-agent\nSeverity: MEDIUM  Confidence: 0.75\n\nRemediation: Remove any persistence mechanisms (cron jobs, startup scripts, state files). Skills should not maintain state across sessions without explicit user consent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.75}}, {"id": "scanner-ea09b02f64b2748c", "name": "SkillSpector MP2 (memory-poisoning) in .claude/skills/browser/SKILL.md", "shortDescription": {"text": "SkillSpector MP2 (memory-poisoning) in .claude/skills/browser/SKILL.md"}, "fullDescription": {"text": "fill input\n\nSkill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.\n\nSkill: browser\nRule: MP2  Category: memory-poisoning\nSeverity: MEDIUM  Confidence: 0.85\n\nRemediation: Implement context-window management that detects and rejects padding or stuffing attempts. Prioritize system instructions over user-injected content."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.85}}, {"id": "scanner-212cccd3f959a4e8", "name": "SkillSpector P2 (prompt-injection) in .claude/skills/github-code-review/SKILL.md", "shortDescription": {"text": "SkillSpector P2 (prompt-injection) in .claude/skills/github-code-review/SKILL.md"}, "fullDescription": {"text": "<!-- In PR comment -->\n/swarm init mesh 6\n/swarm spawn coder \"Implement authentication\"\n/swarm spawn tester \"Write unit tests\"\n/swarm status\n/swarm review --agents security,performance\n```\n\n<details>\n\nHidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.\n\nSkill: github-code-review\nRule: P2  Category: prompt-injection\nSeverity: HIGH  Confidence: 0.70\n\nRemediation: Audit all comments and invisible characters. Remove any instructions that direct the agent to perform unauthorized actions. Use plain, reviewable content."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.7}}, {"id": "scanner-adb65864c9941c3d", "name": "SkillSpector E1 (data-exfil) in .claude/skills/github-project-management/SKILL.md", "shortDescription": {"text": "SkillSpector E1 (data-exfil) in .claude/skills/github-project-management/SKILL.md"}, "fullDescription": {"text": "https://api.example.com/\n\nData is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.\n\nSkill: github-project-management\nRule: E1  Category: data-exfil\nSeverity: MEDIUM  Confidence: 0.50\n\nRemediation: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.5}}, {"id": "scanner-86c212e3a2b19bed", "name": "SkillSpector P2 (prompt-injection) in .claude/skills/github-project-management/SKILL.md", "shortDescription": {"text": "SkillSpector P2 (prompt-injection) in .claude/skills/github-project-management/SKILL.md"}, "fullDescription": {"text": "<!-- In issue comment -->\n/swarm analyze\n/swarm decompose 5\n/swarm assign @agent-coder\n/swarm estimate\n/swarm start\n```\n\n</details>\n\n<details>\n<summary><strong>Automated Issue Triage</strong></summary\n\nHidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.\n\nSkill: github-project-management\nRule: P2  Category: prompt-injection\nSeverity: HIGH  Confidence: 0.70\n\nRemediation: Audit all comments and invisible characters. Remove any instructions that direct the agent to perform unauthorized actions. Use plain, reviewable content."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.7}}, {"id": "scanner-ca893afcd6a5ea6e", "name": "SkillSpector RA2 (rogue-agent) in .claude/skills/github-project-management/SKILL.md", "shortDescription": {"text": "SkillSpector RA2 (rogue-agent) in .claude/skills/github-project-management/SKILL.md"}, "fullDescription": {"text": "Create a task for\n\nSkill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.\n\nSkill: github-project-management\nRule: RA2  Category: rogue-agent\nSeverity: MEDIUM  Confidence: 0.80\n\nRemediation: Remove any persistence mechanisms (cron jobs, startup scripts, state files). Skills should not maintain state across sessions without explicit user consent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.8}}, {"id": "scanner-c58b390228949246", "name": "SkillSpector EA2 (excessive-agency) in .claude/skills/github-release-management/SKILL.md", "shortDescription": {"text": "SkillSpector EA2 (excessive-agency) in .claude/skills/github-release-management/SKILL.md"}, "fullDescription": {"text": "auto-deploy\n\nSkill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.\n\nSkill: github-release-management\nRule: EA2  Category: excessive-agency\nSeverity: MEDIUM  Confidence: 0.85\n\nRemediation: Add human-in-the-loop confirmation for destructive, irreversible, or high-impact operations. Never auto-execute commands that modify files, send data, or alter system state."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.85}}, {"id": "scanner-253a0466c70e6368", "name": "SkillSpector PE3 (priv-esc) in .claude/skills/github-release-management/SKILL.md", "shortDescription": {"text": "SkillSpector PE3 (priv-esc) in .claude/skills/github-release-management/SKILL.md"}, "fullDescription": {"text": ".npmrc\n\nCode accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.\n\nSkill: github-release-management\nRule: PE3  Category: priv-esc\nSeverity: HIGH  Confidence: 0.70\n\nRemediation: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.7}}, {"id": "scanner-d7db0c2ef7f0bad7", "name": "SkillSpector EA1 (excessive-agency) in .claude/skills/hooks-automation/SKILL.md", "shortDescription": {"text": "SkillSpector EA1 (excessive-agency) in .claude/skills/hooks-automation/SKILL.md"}, "fullDescription": {"text": "tools:\n\n*\n\nSkill grants unrestricted tool access without appropriate constraints. An agent with unfettered tool access can perform arbitrary actions including file modification, network requests, and code execution.\n\nSkill: Hooks Automation\nRule: EA1  Category: excessive-agency\nSeverity: MEDIUM  Confidence: 0.85\n\nRemediation: Restrict tool access to only the tools required for the skill's stated purpose. Use an explicit allowlist rather than granting blanket access."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.85}}, {"id": "scanner-b3972ca73d76c98e", "name": "SkillSpector PE3 (priv-esc) in .claude/skills/hooks-automation/SKILL.md", "shortDescription": {"text": "SkillSpector PE3 (priv-esc) in .claude/skills/hooks-automation/SKILL.md"}, "fullDescription": {"text": ".env.production\"\n\nCode accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.\n\nSkill: Hooks Automation\nRule: PE3  Category: priv-esc\nSeverity: HIGH  Confidence: 0.60\n\nRemediation: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.6}}, {"id": "scanner-4b55d32b32109034", "name": "SkillSpector P1 (prompt-injection) in .claude/skills/hooks-automation/SKILL.md", "shortDescription": {"text": "SkillSpector P1 (prompt-injection) in .claude/skills/hooks-automation/SKILL.md"}, "fullDescription": {"text": "Enable debug mode\n\nThis pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.\n\nSkill: Hooks Automation\nRule: P1  Category: prompt-injection\nSeverity: HIGH  Confidence: 0.70\n\nRemediation: Remove or rewrite any text that instructs the agent to ignore prompts, override safety rules, or trust unverified content. Ensure skill content cannot be injected to alter agent behavior."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.7}}, {"id": "scanner-d92535e162c49863", "name": "SkillSpector RA2 (rogue-agent) in .claude/skills/hooks-automation/SKILL.md", "shortDescription": {"text": "SkillSpector RA2 (rogue-agent) in .claude/skills/hooks-automation/SKILL.md"}, "fullDescription": {"text": "Load previous context\n\nSkill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.\n\nSkill: Hooks Automation\nRule: RA2  Category: rogue-agent\nSeverity: MEDIUM  Confidence: 0.55\n\nRemediation: Remove any persistence mechanisms (cron jobs, startup scripts, state files). Skills should not maintain state across sessions without explicit user consent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.55}}, {"id": "scanner-17754be427edccdd", "name": "SkillSpector TM1 (tool-misuse) in .claude/skills/hooks-automation/SKILL.md", "shortDescription": {"text": "SkillSpector TM1 (tool-misuse) in .claude/skills/hooks-automation/SKILL.md"}, "fullDescription": {"text": "rm -rf /\n\nTool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).\n\nSkill: Hooks Automation\nRule: TM1  Category: tool-misuse\nSeverity: LOW  Confidence: 0.15\n\nRemediation: Validate all tool parameters against an allowlist. Reject dangerous parameter values (shell=True, --force, -rf /) and use safe defaults."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 0.15}}, {"id": "scanner-9467a560a4a91f77", "name": "SkillSpector TM1 (tool-misuse) in .claude/skills/pair-programming/SKILL.md", "shortDescription": {"text": "SkillSpector TM1 (tool-misuse) in .claude/skills/pair-programming/SKILL.md"}, "fullDescription": {"text": "DELETE /api/posts/:id\n\nTool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).\n\nSkill: Pair Programming\nRule: TM1  Category: tool-misuse\nSeverity: HIGH  Confidence: 0.80\n\nRemediation: Validate all tool parameters against an allowlist. Reject dangerous parameter values (shell=True, --force, -rf /) and use safe defaults."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.8}}, {"id": "scanner-c4a13f789404c449", "name": "SkillSpector RA2 (rogue-agent) in .claude/skills/skill-builder/SKILL.md", "shortDescription": {"text": "SkillSpector RA2 (rogue-agent) in .claude/skills/skill-builder/SKILL.md"}, "fullDescription": {"text": "Create new Claude Code Skills with proper YAML frontmatter, progressive disclosure structure, and complete directory organization. Use when you need to build custom skills for specific workflows, gene\n\nSkill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.\n\nSkill: Skill Builder\nRule: RA2  Category: rogue-agent\nSeverity: MEDIUM  Confidence: 0.60\n\nRemediation: Remove any persistence mechanisms (cron jobs, startup scripts, state files). Skills should not maintain state across sessions without explicit user consent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.6}}, {"id": "scanner-a28892bd66bc9a82", "name": "SkillSpector EA2 (excessive-agency) in .claude/skills/sparc-methodology/SKILL.md", "shortDescription": {"text": "SkillSpector EA2 (excessive-agency) in .claude/skills/sparc-methodology/SKILL.md"}, "fullDescription": {"text": "automatically run\n\nSkill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.\n\nSkill: sparc-methodology\nRule: EA2  Category: excessive-agency\nSeverity: MEDIUM  Confidence: 0.80\n\nRemediation: Add human-in-the-loop confirmation for destructive, irreversible, or high-impact operations. Never auto-execute commands that modify files, send data, or alter system state."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.8}}, {"id": "scanner-a73cc99e1856a902", "name": "SkillSpector P1 (prompt-injection) in .claude/skills/stream-chain/SKILL.md", "shortDescription": {"text": "SkillSpector P1 (prompt-injection) in .claude/skills/stream-chain/SKILL.md"}, "fullDescription": {"text": "Enable debug mode\n\nThis pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.\n\nSkill: stream-chain\nRule: P1  Category: prompt-injection\nSeverity: HIGH  Confidence: 0.70\n\nRemediation: Remove or rewrite any text that instructs the agent to ignore prompts, override safety rules, or trust unverified content. Ensure skill content cannot be injected to alter agent behavior."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.7}}, {"id": "scanner-e637c415447867e4", "name": "Run SkillSpector's LLM-backed analysis in your own pipeline", "shortDescription": {"text": "Run SkillSpector's LLM-backed analysis in your own pipeline"}, "fullDescription": {"text": "Repobility ran SkillSpector's static rules server-side. The deeper LLM-backed analyzers \u2014 tool-poisoning (TP*), semantic security discovery (SSD*), developer-intent mismatch (SDI*) \u2014 are meant to run on YOUR machine with YOUR model; repobility never sends your code to an LLM. Recipe:\n\n# 1. Install SkillSpector in your own isolated env\npipx install \"skillspector @ git+https://github.com/NVIDIA/SkillSpector.git\"\n\n# 2. Point it at YOUR LLM pipeline (pick one) - your code stays on your machine\nexport SKILLSPECTOR_PROVIDER=anthropic && export ANTHROPIC_API_KEY=sk-ant-...\n# export SKILLSPECTOR_PROVIDER=openai   && export OPENAI_API_KEY=sk-...\n# export SKILLSPECTOR_PROVIDER=openai OPENAI_API_KEY=ollama OPENAI_BASE_URL=http://localhost:11434/v1 SKILLSPECTOR_MODEL=llama3.1:8b\n# export SKILLSPECTOR_PROVIDER=nv_build && export NVIDIA_INFERENCE_KEY=nvapi-...\n\n# 3. Run the LLM-backed scan per skill (omit --no-llm to enable the LLM analyzers)\nskillspector scan .claude/skills/agentdb-advanced --forma"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "info", "confidence": 1.0}}, {"id": "scanner-3b68aac4db558ee4", "name": "Privileged port 52 in use", "shortDescription": {"text": "Privileged port 52 in use"}, "fullDescription": {"text": "Port 52 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-69fafe084287960e", "name": "Privileged port 54 in use", "shortDescription": {"text": "Privileged port 54 in use"}, "fullDescription": {"text": "Port 54 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6d86d153c613abbc", "name": "Privileged port 1 in use", "shortDescription": {"text": "Privileged port 1 in use"}, "fullDescription": {"text": "Port 1 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1713a10ee9ec5426", "name": "Privileged port 23 in use", "shortDescription": {"text": "Privileged port 23 in use"}, "fullDescription": {"text": "Port 23 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-264164d174e3cbdf", "name": "Docker base image is tag-pinned but not digest-pinned: rust:1.81-slim-bookworm", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: rust:1.81-slim-bookworm"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9484af26b72335d7", "name": "Docker base image is tag-pinned but not digest-pinned: debian:bookworm-slim", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: debian:bookworm-slim"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-efa63d098a74a3d8", "name": "Insecure pattern 'direct_innerhtml_assignment' in v2/crates/homecore-server/ui/js/ui.js:24", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in v2/crates/homecore-server/ui/js/ui.js:24"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.65}}, {"id": "scanner-eb2d6079edd9db4c", "name": "Possible secret in v2/crates/wifi-densepose-desktop/tests/api_integration.rs", "shortDescription": {"text": "Possible secret in v2/crates/wifi-densepose-desktop/tests/api_integration.rs"}, "fullDescription": {"text": "Detected 1 occurrence(s) matching password_literal. Rotate real credentials and move them to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.58}}, {"id": "scanner-92b5d4ee35665267", "name": "Insecure pattern 'debug_true' in archive/v1/src/cli.py:110", "shortDescription": {"text": "Insecure pattern 'debug_true' in archive/v1/src/cli.py:110"}, "fullDescription": {"text": "Found a known-risky pattern (debug_true). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d1a39860910a55a7", "name": "Insecure pattern 'debug_true' in archive/v1/src/config/settings.py:407", "shortDescription": {"text": "Insecure pattern 'debug_true' in archive/v1/src/config/settings.py:407"}, "fullDescription": {"text": "Found a known-risky pattern (debug_true). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f4abfed92025559e", "name": "Insecure pattern 'direct_innerhtml_assignment' in ui/observatory/js/hud-controller.js:542", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in ui/observatory/js/hud-controller.js:542"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.65}}, {"id": "scanner-3eb8804bdb2eacf9", "name": "Insecure pattern 'direct_innerhtml_assignment' in ui/utils/notification-center.js:27", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in ui/utils/notification-center.js:27"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.65}}, {"id": "scanner-e7809d571f9c8b7e", "name": "Insecure pattern 'direct_innerhtml_assignment' in ui/utils/perf-monitor.js:25", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in ui/utils/perf-monitor.js:25"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.65}}, {"id": "scanner-764bca6a10063f0c", "name": "Insecure pattern 'direct_innerhtml_assignment' in ui/utils/activity-log.js:25", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in ui/utils/activity-log.js:25"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.65}}, {"id": "scanner-ec0f9dbde47c2fd5", "name": "Insecure pattern 'direct_innerhtml_assignment' in ui/utils/onboarding.js:120", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in ui/utils/onboarding.js:120"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.65}}, {"id": "scanner-ae8c2514292d2b93", "name": "Insecure pattern 'direct_innerhtml_assignment' in ui/utils/toast.js:47", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in ui/utils/toast.js:47"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.65}}, {"id": "scanner-3af5287af9be0c4c", "name": "Insecure pattern 'direct_innerhtml_assignment' in ui/utils/theme-toggle.js:55", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in ui/utils/theme-toggle.js:55"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.65}}, {"id": "scanner-799f8bf2f6388ec8", "name": "Insecure pattern 'direct_innerhtml_assignment' in ui/utils/command-palette.js:116", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in ui/utils/command-palette.js:116"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.65}}, {"id": "scanner-d6e3510149e026af", "name": "Insecure pattern 'direct_innerhtml_assignment' in ui/utils/keyboard-shortcuts.js:89", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in ui/utils/keyboard-shortcuts.js:89"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.65}}, {"id": "scanner-6529c745de3402a1", "name": "Insecure pattern 'direct_innerhtml_assignment' in ui/utils/data-export.js:52", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in ui/utils/data-export.js:52"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.65}}, {"id": "scanner-8640923a01fd78e7", "name": "Insecure pattern 'direct_innerhtml_assignment' in ui/utils/connection-status.js:22", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in ui/utils/connection-status.js:22"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.65}}, {"id": "scanner-1d83c6c7b9056adb", "name": "Insecure pattern 'direct_innerhtml_assignment' in ui/components/LiveDemoTab.js:326", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in ui/components/LiveDemoTab.js:326"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.65}}, {"id": "scanner-a3b43d61c4937432", "name": "Insecure pattern 'direct_innerhtml_assignment' in ui/components/PoseDetectionCanvas.js:86", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in ui/components/PoseDetectionCanvas.js:86"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.65}}, {"id": "scanner-09095d78210e361f", "name": "Insecure pattern 'direct_innerhtml_assignment' in ui/components/dashboard-hud.js:33", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in ui/components/dashboard-hud.js:33"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.65}}, {"id": "scanner-2c7f0b4778118c2f", "name": "Insecure pattern 'direct_innerhtml_assignment' in ui/components/SensingTab.js:34", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in ui/components/SensingTab.js:34"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.65}}, {"id": "scanner-7a46a6cc8643032c", "name": "Insecure pattern 'direct_innerhtml_assignment' in ui/components/SettingsPanel.js:119", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in ui/components/SettingsPanel.js:119"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.65}}, {"id": "scanner-9746b81d162ef851", "name": "Insecure pattern 'exec_used' in dashboard/src/components/nv-console.ts:119", "shortDescription": {"text": "Insecure pattern 'exec_used' in dashboard/src/components/nv-console.ts:119"}, "fullDescription": {"text": "Found a known-risky pattern (exec_used). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-0218c5e58a629d27", "name": "Insecure pattern 'direct_innerhtml_assignment' in dashboard/src/components/nv-console.ts:254", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in dashboard/src/components/nv-console.ts:254"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.65}}, {"id": "scanner-fa5b6bb371fcd88d", "name": "Insecure pattern 'direct_innerhtml_assignment' in dashboard/src/components/nv-onboarding.ts:375", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in dashboard/src/components/nv-onboarding.ts:375"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.65}}, {"id": "scanner-6ef029e09bdf6b0a", "name": "Insecure pattern 'direct_innerhtml_assignment' in dashboard/src/components/nv-modal.ts:140", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in dashboard/src/components/nv-modal.ts:140"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.65}}, {"id": "scanner-c059cd940154f5d1", "name": "Insecure pattern 'direct_innerhtml_assignment' in dashboard/src/components/nv-help.ts:347", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in dashboard/src/components/nv-help.ts:347"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.65}}, {"id": "scanner-4fee2f9ce8583df9", "name": "Insecure pattern 'node_child_process' in .claude/helpers/github-safe.js:12", "shortDescription": {"text": "Insecure pattern 'node_child_process' in .claude/helpers/github-safe.js:12"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.9}}, {"id": "scanner-68ce8f3bdd5109ba", "name": "Insecure pattern 'node_child_process' in .claude/helpers/metrics-db.mjs:12", "shortDescription": {"text": "Insecure pattern 'node_child_process' in .claude/helpers/metrics-db.mjs:12"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.9}}, {"id": "scanner-ecd34fb455fa14ee", "name": "Insecure pattern 'node_child_process' in .claude/helpers/statusline.cjs:19", "shortDescription": {"text": "Insecure pattern 'node_child_process' in .claude/helpers/statusline.cjs:19"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.9}}, {"id": "scanner-035e3001a0c57ad1", "name": "Insecure pattern 'node_child_process' in .claude/helpers/statusline.js:11", "shortDescription": {"text": "Insecure pattern 'node_child_process' in .claude/helpers/statusline.js:11"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.9}}, {"id": "scanner-a3d049e794f5c8be", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "docker/login-action@v3 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-317d9044b94be58e", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8253322df11538dc", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "dtolnay/rust-toolchain@stable can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e0662b204e97cff6", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-99613dc1ad09765c", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c098ebdea4e7053a", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2a776c16dd0fe7d7", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e3b3ce5c668ed0df", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-746c31a1f6b7f70e", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/upload-artifact@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-530f7a4ca135f065", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-27924aa79fa4a517", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-64192a3c67110d01", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a27d51649a1bbd2d", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3f7c1423cc9b422d", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8624e3983b173174", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/upload-artifact@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f01c3712ada95f9a", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6d01f13bb130f536", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "dtolnay/rust-toolchain@stable can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-183fe5addf2d2c46", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d6e3107b94b42841", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0be68d74c2ba7f54", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "docker/setup-qemu-action@v3 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-85765ab67e39bd96", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-658e95f58a731bfb", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9f1cbecfd5c42193", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/cache@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-140f3244824794d0", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/cache@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-bb5d3556f833c398", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "docker/metadata-action@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-fa59bee241142ed2", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-11e08a7aff298fde", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3daccc541395ad13", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-89ad4c59baf55eeb", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/cache@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3c42bf95e7fe6f02", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d1456233361847e2", "name": "Very large file: v2/crates/wifi-densepose-ruvector/src/crv/mod.rs (1439 lines)", "shortDescription": {"text": "Very large file: v2/crates/wifi-densepose-ruvector/src/crv/mod.rs (1439 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b456e6c971eb6a68", "name": "Very large file: v2/crates/wifi-densepose-sensing-server/src/training_api.rs (2135 lines)", "shortDescription": {"text": "Very large file: v2/crates/wifi-densepose-sensing-server/src/training_api.rs (2135 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-017d71867f46115f", "name": "Very large file: v2/crates/wifi-densepose-sensing-server/src/embedding.rs (1589 lines)", "shortDescription": {"text": "Very large file: v2/crates/wifi-densepose-sensing-server/src/embedding.rs (1589 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-60ecf1e43d798a9e", "name": "Very large file: v2/crates/wifi-densepose-sensing-server/src/trainer.rs (1684 lines)", "shortDescription": {"text": "Very large file: v2/crates/wifi-densepose-sensing-server/src/trainer.rs (1684 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b212c0681da9d34e", "name": "Very large file: v2/crates/wifi-densepose-sensing-server/src/main.rs (9065 lines)", "shortDescription": {"text": "Very large file: v2/crates/wifi-densepose-sensing-server/src/main.rs (9065 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-04a86017a3d9e973", "name": "Very large file: v2/crates/wifi-densepose-wasm/src/mat.rs (1696 lines)", "shortDescription": {"text": "Very large file: v2/crates/wifi-densepose-wasm/src/mat.rs (1696 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cacbdadfc859a67d", "name": "Very large file: v2/crates/wifi-densepose-mat/src/integration/hardware_adapter.rs (1655 lines)", "shortDescription": {"text": "Very large file: v2/crates/wifi-densepose-mat/src/integration/hardware_adapter.rs (1655 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-01e30b584364fb29", "name": "Very large file: v2/crates/wifi-densepose-signal/src/ruvsense/cir.rs (1547 lines)", "shortDescription": {"text": "Very large file: v2/crates/wifi-densepose-signal/src/ruvsense/cir.rs (1547 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ec66505395293737", "name": "Very large file: v2/crates/wifi-densepose-signal/src/ruvsense/pose_tracker.rs (1577 lines)", "shortDescription": {"text": "Very large file: v2/crates/wifi-densepose-signal/src/ruvsense/pose_tracker.rs (1577 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-27d08ebe89285419", "name": "Very large file: v2/crates/wifi-densepose-signal/src/ruvsense/multistatic.rs (1250 lines)", "shortDescription": {"text": "Very large file: v2/crates/wifi-densepose-signal/src/ruvsense/multistatic.rs (1250 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ae70244a6fb0a48c", "name": "Very large file: v2/crates/wifi-densepose-signal/src/ruvsense/field_model.rs (1476 lines)", "shortDescription": {"text": "Very large file: v2/crates/wifi-densepose-signal/src/ruvsense/field_model.rs (1476 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-034b804386d1cd0b", "name": "Very large file: v2/crates/wifi-densepose-desktop/ui/src/pages/EdgeModules.tsx (1822 lines)", "shortDescription": {"text": "Very large file: v2/crates/wifi-densepose-desktop/ui/src/pages/EdgeModules.tsx (1822 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-49e714575329ffcd", "name": "Very large file: v2/crates/wifi-densepose-core/src/types.rs (1802 lines)", "shortDescription": {"text": "Very large file: v2/crates/wifi-densepose-core/src/types.rs (1802 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-81774e8b88386a12", "name": "Very large file: v2/crates/wifi-densepose-train/src/metrics.rs (1653 lines)", "shortDescription": {"text": "Very large file: v2/crates/wifi-densepose-train/src/metrics.rs (1653 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c9c318cc090cb3c7", "name": "Very large file: v2/crates/wifi-densepose-train/src/dataset.rs (1518 lines)", "shortDescription": {"text": "Very large file: v2/crates/wifi-densepose-train/src/dataset.rs (1518 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9d6b9dfdeaf14103", "name": "Very large file: v2/crates/wifi-densepose-engine/src/lib.rs (1362 lines)", "shortDescription": {"text": "Very large file: v2/crates/wifi-densepose-engine/src/lib.rs (1362 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cee9332605417bed", "name": "Very large file: v2/crates/wifi-densepose-cli/src/calibrate_api.rs (1208 lines)", "shortDescription": {"text": "Very large file: v2/crates/wifi-densepose-cli/src/calibrate_api.rs (1208 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-87ae2e30b8151c1a", "name": "Very large file: ui/observatory/js/demo-data.js (1794 lines)", "shortDescription": {"text": "Very large file: ui/observatory/js/demo-data.js (1794 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-227af50706e8d70d", "name": "Very large file: ui/components/LiveDemoTab.js (1885 lines)", "shortDescription": {"text": "Very large file: ui/components/LiveDemoTab.js (1885 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-08ccc4c098c0a7f9", "name": "Very large file: scripts/train-wiflow-supervised.js (1657 lines)", "shortDescription": {"text": "Very large file: scripts/train-wiflow-supervised.js (1657 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4a1bebaefedba21a", "name": "Very large file: scripts/train-camera-free.js (2489 lines)", "shortDescription": {"text": "Very large file: scripts/train-camera-free.js (2489 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-befdb2c35dc95c2b", "name": "Very large file: scripts/train-ruvllm.js (1745 lines)", "shortDescription": {"text": "Very large file: scripts/train-ruvllm.js (1745 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ea3b5e389d8c9c0f", "name": "Low test-to-source ratio", "shortDescription": {"text": "Low test-to-source ratio"}, "fullDescription": {"text": "230 tests / 1045 src (ratio 0.22)."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 2759 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-72b2a6250083a784", "name": "Placeholder or mock-heavy implementation detected", "shortDescription": {"text": "Placeholder or mock-heavy implementation detected"}, "fullDescription": {"text": "Found 362 placeholder/mock markers across 123 source files. This often means the repo looks complete while core flows still use generated scaffolding or fake data."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-245e5285ebacad4d", "name": "Legacy-named symbol `pose_v1` in aether-arena/calibration/cog_calibrate.py:2", "shortDescription": {"text": "Legacy-named symbol `pose_v1` in aether-arena/calibration/cog_calibrate.py:2"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-22ba68229f6045d1", "name": "Legacy-named symbol `run_periodic_backup` in archive/v1/src/commands/start.py:175", "shortDescription": {"text": "Legacy-named symbol `run_periodic_backup` in archive/v1/src/commands/start.py:175"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-760b7c0fc68e1de8", "name": "Legacy-named symbol `execute_backup` in archive/v1/src/tasks/backup.py:39", "shortDescription": {"text": "Legacy-named symbol `execute_backup` in archive/v1/src/tasks/backup.py:39"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9e44d5b94682fd9e", "name": "Legacy-named symbol `ht_legacy` in archive/v1/src/hardware/csi_extractor.py:174", "shortDescription": {"text": "Legacy-named symbol `ht_legacy` in archive/v1/src/hardware/csi_extractor.py:174"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b81d6a102f758485", "name": "Legacy-named symbol `sample_copy` in archive/v1/src/services/hardware_service.py:360", "shortDescription": {"text": "Legacy-named symbol `sample_copy` in archive/v1/src/services/hardware_service.py:360"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cd78478572a50392", "name": "Network/subprocess call without timeout or try/except \u2014 scripts/generate_nvs_matrix.py:320", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/generate_nvs_matrix.py:320"}, "fullDescription": {"text": "`subprocess.check_call(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 0.85}}, {"id": "scanner-41aa7a3202a55fdb", "name": "Legacy-named symbol `count_v1` in scripts/train-count.py:10", "shortDescription": {"text": "Legacy-named symbol `count_v1` in scripts/train-count.py:10"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f7db6be1a0053328", "name": "Commented-code block (5 lines) in scripts/ruview-hap-bridge.py:117", "shortDescription": {"text": "Commented-code block (5 lines) in scripts/ruview-hap-bridge.py:117"}, "fullDescription": {"text": "4 of 5 consecutive comment lines look like executable statements. Confirm the block is obsolete, then delete it or recover it from git history when needed."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 0.72}}, {"id": "scanner-e339c868414e663e", "name": "Network/subprocess call without timeout or try/except \u2014 scripts/provision.py:106", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/provision.py:106"}, "fullDescription": {"text": "`subprocess.check_call(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 0.85}}, {"id": "scanner-f17dbf95d304eee1", "name": "Legacy-named symbol `pose_v1` in scripts/export-onnx.py:2", "shortDescription": {"text": "Legacy-named symbol `pose_v1` in scripts/export-onnx.py:2"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f38ae9ac3a4024eb", "name": "Network/subprocess call without timeout or try/except \u2014 firmware/esp32-csi-node/provision.py:267", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 firmware/esp32-csi-node/provision.py:267"}, "fullDescription": {"text": "`subprocess.check_call(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 0.85}}, {"id": "scanner-ea149c43b0af2624", "name": "Network/subprocess call without timeout or try/except \u2014 examples/through-wall/wiflow_capture.py:38", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 examples/through-wall/wiflow_capture.py:38"}, "fullDescription": {"text": "`urllib.request.urlretrieve(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 0.85}}, {"id": "scanner-0cb71633a7dca2a3", "name": "Legacy-named symbol `count_v1` in examples/research-sota/03-spatial-intelligence/r5_subcarrier_saliency.py:9", "shortDescription": {"text": "Legacy-named symbol `count_v1` in examples/research-sota/03-spatial-intelligence/r5_subcarrier_saliency.py:9"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b6f6fc7cd1ce0df6", "name": "Legacy-named symbol `count_v1` in tools/ruview-mcp/src/tools/train-count.ts:8", "shortDescription": {"text": "Legacy-named symbol `count_v1` in tools/ruview-mcp/src/tools/train-count.ts:8"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-65df07ab4020db79", "name": "18 env vars used in code but missing from .env.example", "shortDescription": {"text": "18 env vars used in code but missing from .env.example"}, "fullDescription": {"text": "Drift between code and config docs. The first few: `ANTHROPIC_API_KEY`, `BASE_URL`, `CI`, `IDF_PATH`, `OPENAI_API_KEY`, `PATH`, `PATHEXT`, `PORT` + 10 more. Add them (with a placeholder/comment) to .env.example so onboarding doesn't break."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2c04133e54348533", "name": "Near-duplicate function bodies in 2 places", "shortDescription": {"text": "Near-duplicate function bodies in 2 places"}, "fullDescription": {"text": "Functions with the same substantial AST body hash:\narchive/v1/src/commands/start.py:328:get_server_status, archive/v1/src/commands/stop.py:132:get_server_status\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-be46ea126aa5d8dc", "name": "Near-duplicate function bodies in 3 places", "shortDescription": {"text": "Near-duplicate function bodies in 3 places"}, "fullDescription": {"text": "Functions with the same substantial AST body hash:\narchive/v1/src/tasks/backup.py:516:run_task, archive/v1/src/tasks/monitoring.py:707:run_task, archive/v1/src/tasks/cleanup.py:520:run_task\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b61635ed512d2c37", "name": "FastAPI POST `dev_reset` without auth dependency \u2014 archive/v1/src/app.py:312", "shortDescription": {"text": "FastAPI POST `dev_reset` without auth dependency \u2014 archive/v1/src/app.py:312"}, "fullDescription": {"text": "`@app.post` has no route-local auth dependency, and `app` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.5}}, {"id": "scanner-3a6c8682263a25e9", "name": "FastAPI POST `dev_reset` without auth dependency \u2014 archive/v1/src/api/main.py:405", "shortDescription": {"text": "FastAPI POST `dev_reset` without auth dependency \u2014 archive/v1/src/api/main.py:405"}, "fullDescription": {"text": "`@app.post` has no route-local auth dependency, and `app` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.5}}, {"id": "scanner-a3d65b3d3a1d8d9f", "name": "Vulnerable dependency vite 5.4.21: GHSA-4w7w-66w2-5vf9", "shortDescription": {"text": "Vulnerable dependency vite 5.4.21: GHSA-4w7w-66w2-5vf9"}, "fullDescription": {"text": "OSV.dev reports `vite` at version `5.4.21` (resolved in `dashboard/package-lock.json`) is affected by GHSA-4w7w-66w2-5vf9 (aka CVE-2026-39365).\n\nVite Vulnerable to Path Traversal in Optimized Deps `.map` Handling\n\nAliases: CVE-2026-39365\nAdvisory: https://osv.dev/vulnerability/GHSA-4w7w-66w2-5vf9\nFix: upgrade `vite` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-3f6aaa6fcd282f8a", "name": "Vulnerable dependency vite 5.4.21: GHSA-fx2h-pf6j-xcff", "shortDescription": {"text": "Vulnerable dependency vite 5.4.21: GHSA-fx2h-pf6j-xcff"}, "fullDescription": {"text": "OSV.dev reports `vite` at version `5.4.21` (resolved in `dashboard/package-lock.json`) is affected by GHSA-fx2h-pf6j-xcff (aka CVE-2026-53571).\n\nvite: `server.fs.deny` bypass on Windows alternate paths\n\nAliases: CVE-2026-53571\nAdvisory: https://osv.dev/vulnerability/GHSA-fx2h-pf6j-xcff\nFix: upgrade `vite` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 0.9}}, {"id": "scanner-c2ca33f314aadf10", "name": "Vulnerable dependency vite 5.4.21: GHSA-v6wh-96g9-6wx3", "shortDescription": {"text": "Vulnerable dependency vite 5.4.21: GHSA-v6wh-96g9-6wx3"}, "fullDescription": {"text": "OSV.dev reports `vite` at version `5.4.21` (resolved in `dashboard/package-lock.json`) is affected by GHSA-v6wh-96g9-6wx3 (aka CVE-2026-53632).\n\nlaunch-editor: NTLMv2 hash disclosure via UNC path handling on Windows\n\nAliases: CVE-2026-53632\nAdvisory: https://osv.dev/vulnerability/GHSA-v6wh-96g9-6wx3\nFix: upgrade `vite` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-16f6a8a051b52738", "name": "Vulnerable dependency vitest 2.1.9: GHSA-5xrq-8626-4rwp", "shortDescription": {"text": "Vulnerable dependency vitest 2.1.9: GHSA-5xrq-8626-4rwp"}, "fullDescription": {"text": "OSV.dev reports `vitest` at version `2.1.9` (resolved in `dashboard/package-lock.json`) is affected by GHSA-5xrq-8626-4rwp (aka CVE-2026-47429).\n\nWhen Vitest UI server is listening, arbitrary file can be read and executed\n\nAliases: CVE-2026-47429\nAdvisory: https://osv.dev/vulnerability/GHSA-5xrq-8626-4rwp\nFix: upgrade `vitest` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 0.9}}, {"id": "scanner-fa07bca0883e94f3", "name": "Vulnerable dependency vite 6.4.2: GHSA-fx2h-pf6j-xcff", "shortDescription": {"text": "Vulnerable dependency vite 6.4.2: GHSA-fx2h-pf6j-xcff"}, "fullDescription": {"text": "OSV.dev reports `vite` at version `6.4.2` (resolved in `examples/frontend/package-lock.json`) is affected by GHSA-fx2h-pf6j-xcff (aka CVE-2026-53571).\n\nvite: `server.fs.deny` bypass on Windows alternate paths\n\nAliases: CVE-2026-53571\nAdvisory: https://osv.dev/vulnerability/GHSA-fx2h-pf6j-xcff\nFix: upgrade `vite` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 0.9}}, {"id": "scanner-4efd7492e6fa40fd", "name": "Vulnerable dependency vite 6.4.2: GHSA-v6wh-96g9-6wx3", "shortDescription": {"text": "Vulnerable dependency vite 6.4.2: GHSA-v6wh-96g9-6wx3"}, "fullDescription": {"text": "OSV.dev reports `vite` at version `6.4.2` (resolved in `examples/frontend/package-lock.json`) is affected by GHSA-v6wh-96g9-6wx3 (aka CVE-2026-53632).\n\nlaunch-editor: NTLMv2 hash disclosure via UNC path handling on Windows\n\nAliases: CVE-2026-53632\nAdvisory: https://osv.dev/vulnerability/GHSA-v6wh-96g9-6wx3\nFix: upgrade `vite` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-5f1f6b5e80067783", "name": "Vulnerable dependency anyhow 1.0.102: RUSTSEC-2026-0190", "shortDescription": {"text": "Vulnerable dependency anyhow 1.0.102: RUSTSEC-2026-0190"}, "fullDescription": {"text": "OSV.dev reports `anyhow` at version `1.0.102` (resolved in `v2/Cargo.lock`) is affected by RUSTSEC-2026-0190.\n\nUnsoundness in `Error::downcast_mut()`\n\nAdvisory: https://osv.dev/vulnerability/RUSTSEC-2026-0190\nFix: upgrade `anyhow` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2accc5891a61e565", "name": "Vulnerable dependency pyo3 0.22.6: GHSA-36hh-v3qg-5jq4", "shortDescription": {"text": "Vulnerable dependency pyo3 0.22.6: GHSA-36hh-v3qg-5jq4"}, "fullDescription": {"text": "OSV.dev reports `pyo3` at version `0.22.6` (resolved in `python/Cargo.lock`) is affected by GHSA-36hh-v3qg-5jq4.\n\nPyO3 has an Out-of-bounds Read in `nth` / `nth_back` for `PyList` and `PyTuple` iterators\n\nAliases: RUSTSEC-2026-0176\nAdvisory: https://osv.dev/vulnerability/GHSA-36hh-v3qg-5jq4\nFix: upgrade `pyo3` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 1.0}}, {"id": "scanner-1384b5d4ae3b4326", "name": "Vulnerable dependency pyo3 0.22.6: GHSA-chgr-c6px-7xpp", "shortDescription": {"text": "Vulnerable dependency pyo3 0.22.6: GHSA-chgr-c6px-7xpp"}, "fullDescription": {"text": "OSV.dev reports `pyo3` at version `0.22.6` (resolved in `python/Cargo.lock`) is affected by GHSA-chgr-c6px-7xpp.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-chgr-c6px-7xpp\nFix: upgrade `pyo3` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-acd70946754d3bbd", "name": "Vulnerable dependency pyo3 0.22.6: GHSA-pph8-gcv7-4qj5", "shortDescription": {"text": "Vulnerable dependency pyo3 0.22.6: GHSA-pph8-gcv7-4qj5"}, "fullDescription": {"text": "OSV.dev reports `pyo3` at version `0.22.6` (resolved in `python/Cargo.lock`) is affected by GHSA-pph8-gcv7-4qj5.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-pph8-gcv7-4qj5\nFix: upgrade `pyo3` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a3c2e6a99debc235", "name": "Vulnerable dependency pyo3 0.22.6: RUSTSEC-2025-0020", "shortDescription": {"text": "Vulnerable dependency pyo3 0.22.6: RUSTSEC-2025-0020"}, "fullDescription": {"text": "OSV.dev reports `pyo3` at version `0.22.6` (resolved in `python/Cargo.lock`) is affected by RUSTSEC-2025-0020.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/RUSTSEC-2025-0020\nFix: upgrade `pyo3` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-bda556c5f5526821", "name": "Vulnerable dependency pyo3 0.22.6: RUSTSEC-2026-0177", "shortDescription": {"text": "Vulnerable dependency pyo3 0.22.6: RUSTSEC-2026-0177"}, "fullDescription": {"text": "OSV.dev reports `pyo3` at version `0.22.6` (resolved in `python/Cargo.lock`) is affected by RUSTSEC-2026-0177.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/RUSTSEC-2026-0177\nFix: upgrade `pyo3` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-bdf36a3b4e7c2df5", "name": "Vulnerable dependency axios 1.15.2: GHSA-35jp-ww65-95wh", "shortDescription": {"text": "Vulnerable dependency axios 1.15.2: GHSA-35jp-ww65-95wh"}, "fullDescription": {"text": "OSV.dev reports `axios` at version `1.15.2` (resolved in `ui/mobile/package-lock.json`) is affected by GHSA-35jp-ww65-95wh (aka CVE-2026-44494).\n\naxios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy`\n\nAliases: CVE-2026-44494\nAdvisory: https://osv.dev/vulnerability/GHSA-35jp-ww65-95wh\nFix: upgrade `axios` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 1.0}}, {"id": "scanner-701330646ac2c677", "name": "Vulnerable dependency axios 1.15.2: GHSA-42h9-826w-cgv3", "shortDescription": {"text": "Vulnerable dependency axios 1.15.2: GHSA-42h9-826w-cgv3"}, "fullDescription": {"text": "OSV.dev reports `axios` at version `1.15.2` (resolved in `ui/mobile/package-lock.json`) is affected by GHSA-42h9-826w-cgv3.\n\nAxios: Excessive recursion in formDataToJSON can cause denial of service\n\nAdvisory: https://osv.dev/vulnerability/GHSA-42h9-826w-cgv3\nFix: upgrade `axios` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-357f6abebf247797", "name": "Vulnerable dependency axios 1.15.2: GHSA-654m-c8p4-x5fp", "shortDescription": {"text": "Vulnerable dependency axios 1.15.2: GHSA-654m-c8p4-x5fp"}, "fullDescription": {"text": "OSV.dev reports `axios` at version `1.15.2` (resolved in `ui/mobile/package-lock.json`) is affected by GHSA-654m-c8p4-x5fp (aka CVE-2026-44489).\n\nAxios has a Patch Bypass: Proxy-Authorization Header Injection via Prototype Pollution \u2014 Incomplete Null-Prototype Fix\n\nAliases: CVE-2026-44489\nAdvisory: https://osv.dev/vulnerability/GHSA-654m-c8p4-x5fp\nFix: upgrade `axios` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "low", "confidence": 1.0}}, {"id": "scanner-731b8a93aa26d8f6", "name": "Vulnerable dependency axios 1.15.2: GHSA-777c-7fjr-54vf", "shortDescription": {"text": "Vulnerable dependency axios 1.15.2: GHSA-777c-7fjr-54vf"}, "fullDescription": {"text": "OSV.dev reports `axios` at version `1.15.2` (resolved in `ui/mobile/package-lock.json`) is affected by GHSA-777c-7fjr-54vf.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-777c-7fjr-54vf\nFix: upgrade `axios` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-fc0168187b1e8d74", "name": "Vulnerable dependency axios 1.15.2: GHSA-7q8q-rj6j-mhjq", "shortDescription": {"text": "Vulnerable dependency axios 1.15.2: GHSA-7q8q-rj6j-mhjq"}, "fullDescription": {"text": "OSV.dev reports `axios` at version `1.15.2` (resolved in `ui/mobile/package-lock.json`) is affected by GHSA-7q8q-rj6j-mhjq.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-7q8q-rj6j-mhjq\nFix: upgrade `axios` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6d0aa722656ad809", "name": "Vulnerable dependency axios 1.15.2: GHSA-898c-q2cr-xwhg", "shortDescription": {"text": "Vulnerable dependency axios 1.15.2: GHSA-898c-q2cr-xwhg"}, "fullDescription": {"text": "OSV.dev reports `axios` at version `1.15.2` (resolved in `ui/mobile/package-lock.json`) is affected by GHSA-898c-q2cr-xwhg.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-898c-q2cr-xwhg\nFix: upgrade `axios` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-773de9ecd0cdb1b5", "name": "Vulnerable dependency axios 1.15.2: GHSA-f4gw-2p7v-4548", "shortDescription": {"text": "Vulnerable dependency axios 1.15.2: GHSA-f4gw-2p7v-4548"}, "fullDescription": {"text": "OSV.dev reports `axios` at version `1.15.2` (resolved in `ui/mobile/package-lock.json`) is affected by GHSA-f4gw-2p7v-4548.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-f4gw-2p7v-4548\nFix: upgrade `axios` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-bbfd40bcb1a9ce72", "name": "Vulnerable dependency axios 1.15.2: GHSA-gcfj-64vw-6mp9", "shortDescription": {"text": "Vulnerable dependency axios 1.15.2: GHSA-gcfj-64vw-6mp9"}, "fullDescription": {"text": "OSV.dev reports `axios` at version `1.15.2` (resolved in `ui/mobile/package-lock.json`) is affected by GHSA-gcfj-64vw-6mp9.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-gcfj-64vw-6mp9\nFix: upgrade `axios` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4d8104e475dca2b0", "name": "Vulnerable dependency axios 1.15.2: GHSA-hcpx-6fm6-wx23", "shortDescription": {"text": "Vulnerable dependency axios 1.15.2: GHSA-hcpx-6fm6-wx23"}, "fullDescription": {"text": "OSV.dev reports `axios` at version `1.15.2` (resolved in `ui/mobile/package-lock.json`) is affected by GHSA-hcpx-6fm6-wx23.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-hcpx-6fm6-wx23\nFix: upgrade `axios` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-50f8aba4fd4aab2b", "name": "Vulnerable dependency axios 1.15.2: GHSA-hfxv-24rg-xrqf", "shortDescription": {"text": "Vulnerable dependency axios 1.15.2: GHSA-hfxv-24rg-xrqf"}, "fullDescription": {"text": "OSV.dev reports `axios` at version `1.15.2` (resolved in `ui/mobile/package-lock.json`) is affected by GHSA-hfxv-24rg-xrqf.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-hfxv-24rg-xrqf\nFix: upgrade `axios` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7ae5dac514331cf4", "name": "Vulnerable dependency axios 1.15.2: GHSA-j5f8-grm9-p9fc", "shortDescription": {"text": "Vulnerable dependency axios 1.15.2: GHSA-j5f8-grm9-p9fc"}, "fullDescription": {"text": "OSV.dev reports `axios` at version `1.15.2` (resolved in `ui/mobile/package-lock.json`) is affected by GHSA-j5f8-grm9-p9fc.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-j5f8-grm9-p9fc\nFix: upgrade `axios` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-94dc465509993d28", "name": "Vulnerable dependency axios 1.15.2: GHSA-jqh4-m9w3-8hp9", "shortDescription": {"text": "Vulnerable dependency axios 1.15.2: GHSA-jqh4-m9w3-8hp9"}, "fullDescription": {"text": "OSV.dev reports `axios` at version `1.15.2` (resolved in `ui/mobile/package-lock.json`) is affected by GHSA-jqh4-m9w3-8hp9.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-jqh4-m9w3-8hp9\nFix: upgrade `axios` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0262e0ebb79e5e3b", "name": "Vulnerable dependency axios 1.15.2: GHSA-mmx7-hfxf-jppx", "shortDescription": {"text": "Vulnerable dependency axios 1.15.2: GHSA-mmx7-hfxf-jppx"}, "fullDescription": {"text": "OSV.dev reports `axios` at version `1.15.2` (resolved in `ui/mobile/package-lock.json`) is affected by GHSA-mmx7-hfxf-jppx.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-mmx7-hfxf-jppx\nFix: upgrade `axios` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-fafde89cd1ab24f0", "name": "Vulnerable dependency axios 1.15.2: GHSA-mwf2-3pr3-8698", "shortDescription": {"text": "Vulnerable dependency axios 1.15.2: GHSA-mwf2-3pr3-8698"}, "fullDescription": {"text": "OSV.dev reports `axios` at version `1.15.2` (resolved in `ui/mobile/package-lock.json`) is affected by GHSA-mwf2-3pr3-8698.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-mwf2-3pr3-8698\nFix: upgrade `axios` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c89b290bfdb016ca", "name": "Vulnerable dependency axios 1.15.2: GHSA-p92q-9vqr-4j8v", "shortDescription": {"text": "Vulnerable dependency axios 1.15.2: GHSA-p92q-9vqr-4j8v"}, "fullDescription": {"text": "OSV.dev reports `axios` at version `1.15.2` (resolved in `ui/mobile/package-lock.json`) is affected by GHSA-p92q-9vqr-4j8v.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-p92q-9vqr-4j8v\nFix: upgrade `axios` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-376e7e7da7e8bb83", "name": "Vulnerable dependency axios 1.15.2: GHSA-pjwm-pj3p-43mv", "shortDescription": {"text": "Vulnerable dependency axios 1.15.2: GHSA-pjwm-pj3p-43mv"}, "fullDescription": {"text": "OSV.dev reports `axios` at version `1.15.2` (resolved in `ui/mobile/package-lock.json`) is affected by GHSA-pjwm-pj3p-43mv.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-pjwm-pj3p-43mv\nFix: upgrade `axios` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4040860d05752b65", "name": "Vulnerable dependency axios 1.15.2: GHSA-pmv8-rq9r-6j72", "shortDescription": {"text": "Vulnerable dependency axios 1.15.2: GHSA-pmv8-rq9r-6j72"}, "fullDescription": {"text": "OSV.dev reports `axios` at version `1.15.2` (resolved in `ui/mobile/package-lock.json`) is affected by GHSA-pmv8-rq9r-6j72.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-pmv8-rq9r-6j72\nFix: upgrade `axios` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1c04c4bcea952336", "name": "Vulnerable dependency axios 1.15.2: GHSA-xj6q-8x83-jv6g", "shortDescription": {"text": "Vulnerable dependency axios 1.15.2: GHSA-xj6q-8x83-jv6g"}, "fullDescription": {"text": "OSV.dev reports `axios` at version `1.15.2` (resolved in `ui/mobile/package-lock.json`) is affected by GHSA-xj6q-8x83-jv6g.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-xj6q-8x83-jv6g\nFix: upgrade `axios` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-5a1bbf5b20306289", "name": "Vulnerable dependency memmap2 0.9.10: RUSTSEC-2026-0186", "shortDescription": {"text": "Vulnerable dependency memmap2 0.9.10: RUSTSEC-2026-0186"}, "fullDescription": {"text": "OSV.dev reports `memmap2` at version `0.9.10` (resolved in `v2/Cargo.lock`) is affected by RUSTSEC-2026-0186.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/RUSTSEC-2026-0186\nFix: upgrade `memmap2` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-fd231f714a362434", "name": "Vulnerable dependency rand 0.7.3: GHSA-cq8v-f236-94qc", "shortDescription": {"text": "Vulnerable dependency rand 0.7.3: GHSA-cq8v-f236-94qc"}, "fullDescription": {"text": "OSV.dev reports `rand` at version `0.7.3` (resolved in `v2/Cargo.lock`) is affected by GHSA-cq8v-f236-94qc.\n\nRand is unsound with a custom logger using rand::rng()\n\nAliases: GHSA-cq8v-f236-94qc, RUSTSEC-2026-0097\nAdvisory: https://osv.dev/vulnerability/GHSA-cq8v-f236-94qc\nFix: upgrade `rand` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-650cc16aff63adbc", "name": "Vulnerable dependency rand 0.8.5: GHSA-cq8v-f236-94qc", "shortDescription": {"text": "Vulnerable dependency rand 0.8.5: GHSA-cq8v-f236-94qc"}, "fullDescription": {"text": "OSV.dev reports `rand` at version `0.8.5` (resolved in `v2/Cargo.lock`) is affected by GHSA-cq8v-f236-94qc.\n\nRand is unsound with a custom logger using rand::rng()\n\nAliases: GHSA-cq8v-f236-94qc, RUSTSEC-2026-0097\nAdvisory: https://osv.dev/vulnerability/GHSA-cq8v-f236-94qc\nFix: upgrade `rand` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-100d88a63f1c00c5", "name": "Vulnerable dependency rand 0.9.2: GHSA-cq8v-f236-94qc", "shortDescription": {"text": "Vulnerable dependency rand 0.9.2: GHSA-cq8v-f236-94qc"}, "fullDescription": {"text": "OSV.dev reports `rand` at version `0.9.2` (resolved in `v2/Cargo.lock`) is affected by GHSA-cq8v-f236-94qc.\n\nRand is unsound with a custom logger using rand::rng()\n\nAliases: GHSA-cq8v-f236-94qc, RUSTSEC-2026-0097\nAdvisory: https://osv.dev/vulnerability/GHSA-cq8v-f236-94qc\nFix: upgrade `rand` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8203ce3539e39784", "name": "Vulnerable dependency tauri 2.10.3: GHSA-7gmj-67g7-phm9", "shortDescription": {"text": "Vulnerable dependency tauri 2.10.3: GHSA-7gmj-67g7-phm9"}, "fullDescription": {"text": "OSV.dev reports `tauri` at version `2.10.3` (resolved in `v2/Cargo.lock`) is affected by GHSA-7gmj-67g7-phm9.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-7gmj-67g7-phm9\nFix: upgrade `tauri` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e42714a1ac6fa9a1", "name": "Vulnerable dependency wasm3 0.3.1: GHSA-crf8-h2wq-2h9x", "shortDescription": {"text": "Vulnerable dependency wasm3 0.3.1: GHSA-crf8-h2wq-2h9x"}, "fullDescription": {"text": "OSV.dev reports `wasm3` at version `0.3.1` (resolved in `v2/Cargo.lock`) is affected by GHSA-crf8-h2wq-2h9x.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-crf8-h2wq-2h9x\nFix: upgrade `wasm3` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e0701c78f9adbb0b", "name": "Vulnerable dependency wasm3 0.3.1: GHSA-fmq6-4w57-2w3v", "shortDescription": {"text": "Vulnerable dependency wasm3 0.3.1: GHSA-fmq6-4w57-2w3v"}, "fullDescription": {"text": "OSV.dev reports `wasm3` at version `0.3.1` (resolved in `v2/Cargo.lock`) is affected by GHSA-fmq6-4w57-2w3v.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-fmq6-4w57-2w3v\nFix: upgrade `wasm3` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e10b2fe2ab7bcc25", "name": "Vulnerable dependency wasm3 0.3.1: GHSA-gq4p-4hxv-5rg9", "shortDescription": {"text": "Vulnerable dependency wasm3 0.3.1: GHSA-gq4p-4hxv-5rg9"}, "fullDescription": {"text": "OSV.dev reports `wasm3` at version `0.3.1` (resolved in `v2/Cargo.lock`) is affected by GHSA-gq4p-4hxv-5rg9.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-gq4p-4hxv-5rg9\nFix: upgrade `wasm3` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e5b5f1152bd4c595", "name": "Vulnerable dependency wasmtime 42.0.2: GHSA-p8xm-42r7-89xg", "shortDescription": {"text": "Vulnerable dependency wasmtime 42.0.2: GHSA-p8xm-42r7-89xg"}, "fullDescription": {"text": "OSV.dev reports `wasmtime` at version `42.0.2` (resolved in `v2/Cargo.lock`) is affected by GHSA-p8xm-42r7-89xg.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-p8xm-42r7-89xg\nFix: upgrade `wasmtime` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2a9da560db6f2887", "name": "Vulnerable dependency wasmtime 42.0.2: RUSTSEC-2026-0114", "shortDescription": {"text": "Vulnerable dependency wasmtime 42.0.2: RUSTSEC-2026-0114"}, "fullDescription": {"text": "OSV.dev reports `wasmtime` at version `42.0.2` (resolved in `v2/Cargo.lock`) is affected by RUSTSEC-2026-0114.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/RUSTSEC-2026-0114\nFix: upgrade `wasmtime` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-23542a1d2a67d5c4", "name": "Vulnerable dependency vite 6.4.1: GHSA-4w7w-66w2-5vf9", "shortDescription": {"text": "Vulnerable dependency vite 6.4.1: GHSA-4w7w-66w2-5vf9"}, "fullDescription": {"text": "OSV.dev reports `vite` at version `6.4.1` (resolved in `v2/crates/wifi-densepose-desktop/ui/package-lock.json`) is affected by GHSA-4w7w-66w2-5vf9 (aka CVE-2026-39365).\n\nVite Vulnerable to Path Traversal in Optimized Deps `.map` Handling\n\nAliases: CVE-2026-39365\nAdvisory: https://osv.dev/vulnerability/GHSA-4w7w-66w2-5vf9\nFix: upgrade `vite` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-3c12e884bd940cf4", "name": "Vulnerable dependency vite 6.4.1: GHSA-fx2h-pf6j-xcff", "shortDescription": {"text": "Vulnerable dependency vite 6.4.1: GHSA-fx2h-pf6j-xcff"}, "fullDescription": {"text": "OSV.dev reports `vite` at version `6.4.1` (resolved in `v2/crates/wifi-densepose-desktop/ui/package-lock.json`) is affected by GHSA-fx2h-pf6j-xcff (aka CVE-2026-53571).\n\nvite: `server.fs.deny` bypass on Windows alternate paths\n\nAliases: CVE-2026-53571\nAdvisory: https://osv.dev/vulnerability/GHSA-fx2h-pf6j-xcff\nFix: upgrade `vite` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 0.9}}, {"id": "scanner-2d45ebb04f4c4df9", "name": "Vulnerable dependency vite 6.4.1: GHSA-p9ff-h696-f583", "shortDescription": {"text": "Vulnerable dependency vite 6.4.1: GHSA-p9ff-h696-f583"}, "fullDescription": {"text": "OSV.dev reports `vite` at version `6.4.1` (resolved in `v2/crates/wifi-densepose-desktop/ui/package-lock.json`) is affected by GHSA-p9ff-h696-f583.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-p9ff-h696-f583\nFix: upgrade `vite` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-dcbd6df70eea9c92", "name": "Vulnerable dependency vite 6.4.1: GHSA-v6wh-96g9-6wx3", "shortDescription": {"text": "Vulnerable dependency vite 6.4.1: GHSA-v6wh-96g9-6wx3"}, "fullDescription": {"text": "OSV.dev reports `vite` at version `6.4.1` (resolved in `v2/crates/wifi-densepose-desktop/ui/package-lock.json`) is affected by GHSA-v6wh-96g9-6wx3 (aka CVE-2026-53632).\n\nlaunch-editor: NTLMv2 hash disclosure via UNC path handling on Windows\n\nAliases: CVE-2026-53632\nAdvisory: https://osv.dev/vulnerability/GHSA-v6wh-96g9-6wx3\nFix: upgrade `vite` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-1942cfe4f41fcc96", "name": "Vulnerable dependency anyhow 1.0.100: RUSTSEC-2026-0190", "shortDescription": {"text": "Vulnerable dependency anyhow 1.0.100: RUSTSEC-2026-0190"}, "fullDescription": {"text": "OSV.dev reports `anyhow` at version `1.0.100` (resolved in `v2/patches/ruvector-crv/Cargo.lock`) is affected by RUSTSEC-2026-0190.\n\nUnsoundness in `Error::downcast_mut()`\n\nAdvisory: https://osv.dev/vulnerability/RUSTSEC-2026-0190\nFix: upgrade `anyhow` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-af3adc90b6c0e9ce", "name": "Vulnerable dependency gradio 5.9.1: GHSA-39mp-8hj3-5c49", "shortDescription": {"text": "Vulnerable dependency gradio 5.9.1: GHSA-39mp-8hj3-5c49"}, "fullDescription": {"text": "OSV.dev reports `gradio` at version `5.9.1` (declared in `aether-arena/space/requirements.txt`) is affected by GHSA-39mp-8hj3-5c49 (aka CVE-2026-28414).\n\nGradio is Vulnerable to Absolute Path Traversal on Windows with Python 3.13+\n\nAliases: CVE-2026-28414, PYSEC-2026-64\nAdvisory: https://osv.dev/vulnerability/GHSA-39mp-8hj3-5c49\nFix: upgrade `gradio` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 1.0}}, {"id": "scanner-fe2e4c63b73cdf2b", "name": "Vulnerable dependency gradio 5.9.1: GHSA-5cpq-9538-jm2j", "shortDescription": {"text": "Vulnerable dependency gradio 5.9.1: GHSA-5cpq-9538-jm2j"}, "fullDescription": {"text": "OSV.dev reports `gradio` at version `5.9.1` (declared in `aether-arena/space/requirements.txt`) is affected by GHSA-5cpq-9538-jm2j (aka CVE-2024-8966).\n\nGradio DOS in multipart boundry while uploading the file\n\nAliases: CVE-2024-8966, PYSEC-2026-1410\nAdvisory: https://osv.dev/vulnerability/GHSA-5cpq-9538-jm2j\nFix: upgrade `gradio` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 1.0}}, {"id": "scanner-c857ba00df7c2150", "name": "Vulnerable dependency gradio 5.9.1: GHSA-6655-8ph2-63j3", "shortDescription": {"text": "Vulnerable dependency gradio 5.9.1: GHSA-6655-8ph2-63j3"}, "fullDescription": {"text": "OSV.dev reports `gradio` at version `5.9.1` (declared in `aether-arena/space/requirements.txt`) is affected by GHSA-6655-8ph2-63j3 (aka CVE-2026-10783).\n\nGradio: Audio cache key ignores metadata when saving numpy audio outputs\n\nAliases: CVE-2026-10783, PYSEC-2026-211\nAdvisory: https://osv.dev/vulnerability/GHSA-6655-8ph2-63j3\nFix: upgrade `gradio` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-49ac708e9a46dd70", "name": "Vulnerable dependency gradio 5.9.1: GHSA-7hp7-4p35-3cx2", "shortDescription": {"text": "Vulnerable dependency gradio 5.9.1: GHSA-7hp7-4p35-3cx2"}, "fullDescription": {"text": "OSV.dev reports `gradio` at version `5.9.1` (declared in `aether-arena/space/requirements.txt`) is affected by GHSA-7hp7-4p35-3cx2.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-7hp7-4p35-3cx2\nFix: upgrade `gradio` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-5df9b40425e57492", "name": "Vulnerable dependency gradio 5.9.1: GHSA-8jw3-6x8j-v96g", "shortDescription": {"text": "Vulnerable dependency gradio 5.9.1: GHSA-8jw3-6x8j-v96g"}, "fullDescription": {"text": "OSV.dev reports `gradio` at version `5.9.1` (declared in `aether-arena/space/requirements.txt`) is affected by GHSA-8jw3-6x8j-v96g.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-8jw3-6x8j-v96g\nFix: upgrade `gradio` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-90522bea54acb2ea", "name": "Vulnerable dependency gradio 5.9.1: GHSA-h3h8-3v2v-rg7m", "shortDescription": {"text": "Vulnerable dependency gradio 5.9.1: GHSA-h3h8-3v2v-rg7m"}, "fullDescription": {"text": "OSV.dev reports `gradio` at version `5.9.1` (declared in `aether-arena/space/requirements.txt`) is affected by GHSA-h3h8-3v2v-rg7m.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-h3h8-3v2v-rg7m\nFix: upgrade `gradio` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-85629fff7bb936ea", "name": "Vulnerable dependency gradio 5.9.1: GHSA-j2jg-fq62-7c3h", "shortDescription": {"text": "Vulnerable dependency gradio 5.9.1: GHSA-j2jg-fq62-7c3h"}, "fullDescription": {"text": "OSV.dev reports `gradio` at version `5.9.1` (declared in `aether-arena/space/requirements.txt`) is affected by GHSA-j2jg-fq62-7c3h.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-j2jg-fq62-7c3h\nFix: upgrade `gradio` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e3485569be58ec99", "name": "Vulnerable dependency gradio 5.9.1: GHSA-jmh7-g254-2cq9", "shortDescription": {"text": "Vulnerable dependency gradio 5.9.1: GHSA-jmh7-g254-2cq9"}, "fullDescription": {"text": "OSV.dev reports `gradio` at version `5.9.1` (declared in `aether-arena/space/requirements.txt`) is affected by GHSA-jmh7-g254-2cq9.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-jmh7-g254-2cq9\nFix: upgrade `gradio` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a6a2114e3e01cc22", "name": "Vulnerable dependency gradio 5.9.1: GHSA-pfjf-5gxr-995x", "shortDescription": {"text": "Vulnerable dependency gradio 5.9.1: GHSA-pfjf-5gxr-995x"}, "fullDescription": {"text": "OSV.dev reports `gradio` at version `5.9.1` (declared in `aether-arena/space/requirements.txt`) is affected by GHSA-pfjf-5gxr-995x.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-pfjf-5gxr-995x\nFix: upgrade `gradio` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2dbdeedbaee83b92", "name": "Vulnerable dependency gradio 5.9.1: GHSA-wmjh-cpqj-4v6x", "shortDescription": {"text": "Vulnerable dependency gradio 5.9.1: GHSA-wmjh-cpqj-4v6x"}, "fullDescription": {"text": "OSV.dev reports `gradio` at version `5.9.1` (declared in `aether-arena/space/requirements.txt`) is affected by GHSA-wmjh-cpqj-4v6x.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-wmjh-cpqj-4v6x\nFix: upgrade `gradio` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d62f0bb16e90bf36", "name": "Vulnerable dependency gradio 5.9.1: PYSEC-2026-1423", "shortDescription": {"text": "Vulnerable dependency gradio 5.9.1: PYSEC-2026-1423"}, "fullDescription": {"text": "OSV.dev reports `gradio` at version `5.9.1` (declared in `aether-arena/space/requirements.txt`) is affected by PYSEC-2026-1423.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-1423\nFix: upgrade `gradio` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-17acbdb9a038dacf", "name": "Vulnerable dependency gradio 5.9.1: PYSEC-2026-2178", "shortDescription": {"text": "Vulnerable dependency gradio 5.9.1: PYSEC-2026-2178"}, "fullDescription": {"text": "OSV.dev reports `gradio` at version `5.9.1` (declared in `aether-arena/space/requirements.txt`) is affected by PYSEC-2026-2178.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-2178\nFix: upgrade `gradio` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-65f0b5f96f2761fd", "name": "Vulnerable dependency gradio 5.9.1: PYSEC-2026-2179", "shortDescription": {"text": "Vulnerable dependency gradio 5.9.1: PYSEC-2026-2179"}, "fullDescription": {"text": "OSV.dev reports `gradio` at version `5.9.1` (declared in `aether-arena/space/requirements.txt`) is affected by PYSEC-2026-2179.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-2179\nFix: upgrade `gradio` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6d7b1883f0e3fd69", "name": "Vulnerable dependency gradio 5.9.1: PYSEC-2026-63", "shortDescription": {"text": "Vulnerable dependency gradio 5.9.1: PYSEC-2026-63"}, "fullDescription": {"text": "OSV.dev reports `gradio` at version `5.9.1` (declared in `aether-arena/space/requirements.txt`) is affected by PYSEC-2026-63.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-63\nFix: upgrade `gradio` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d12fe13f6ba7e602", "name": "Vulnerable dependency gradio 5.9.1: PYSEC-2026-65", "shortDescription": {"text": "Vulnerable dependency gradio 5.9.1: PYSEC-2026-65"}, "fullDescription": {"text": "OSV.dev reports `gradio` at version `5.9.1` (declared in `aether-arena/space/requirements.txt`) is affected by PYSEC-2026-65.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-65\nFix: upgrade `gradio` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-044b0df4c950e7e6", "name": "Vulnerable dependency gradio 5.9.1: PYSEC-2026-66", "shortDescription": {"text": "Vulnerable dependency gradio 5.9.1: PYSEC-2026-66"}, "fullDescription": {"text": "OSV.dev reports `gradio` at version `5.9.1` (declared in `aether-arena/space/requirements.txt`) is affected by PYSEC-2026-66.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-66\nFix: upgrade `gradio` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d451a8ca1fd35465", "name": "Vulnerable dependency @babel/core 7.29.0: GHSA-4x5r-pxfx-6jf8", "shortDescription": {"text": "Vulnerable dependency @babel/core 7.29.0: GHSA-4x5r-pxfx-6jf8"}, "fullDescription": {"text": "OSV.dev reports `@babel/core` at version `7.29.0` (resolved in `dashboard/package-lock.json`) is affected by GHSA-4x5r-pxfx-6jf8 (aka CVE-2026-49356).\nNote: `@babel/core` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\n@babel/core: Arbitrary File Read via sourceMappingURL Comment\n\nAliases: CVE-2026-49356\nAdvisory: https://osv.dev/vulnerability/GHSA-4x5r-pxfx-6jf8\nFix: upgrade `@babel/core` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "low", "confidence": 0.9}}, {"id": "scanner-66c99a1590ffca72", "name": "Vulnerable dependency @babel/plugin-transform-modules-systemjs 7.29.0: GHSA-fv7c-fp4j-7gwp", "shortDescription": {"text": "Vulnerable dependency @babel/plugin-transform-modules-systemjs 7.29.0: GHSA-fv7c-fp4j-7gwp"}, "fullDescription": {"text": "OSV.dev reports `@babel/plugin-transform-modules-systemjs` at version `7.29.0` (resolved in `dashboard/package-lock.json`) is affected by GHSA-fv7c-fp4j-7gwp.\nNote: `@babel/plugin-transform-modules-systemjs` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-fv7c-fp4j-7gwp\nFix: upgrade `@babel/plugin-transform-modules-systemjs` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-5847001aa44b14a8", "name": "Vulnerable dependency brace-expansion 5.0.5: GHSA-3jxr-9vmj-r5cp", "shortDescription": {"text": "Vulnerable dependency brace-expansion 5.0.5: GHSA-3jxr-9vmj-r5cp"}, "fullDescription": {"text": "OSV.dev reports `brace-expansion` at version `5.0.5` (resolved in `dashboard/package-lock.json`) is affected by GHSA-3jxr-9vmj-r5cp (aka CVE-2026-13149).\nNote: `brace-expansion` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nbrace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups\n\nAliases: CVE-2026-13149\nAdvisory: https://osv.dev/vulnerability/GHSA-3jxr-9vmj-r5cp\nFix: upgrade `brace-expansion` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 0.9}}, {"id": "scanner-c1ea30621303716e", "name": "Vulnerable dependency brace-expansion 5.0.5: GHSA-jxxr-4gwj-5jf2", "shortDescription": {"text": "Vulnerable dependency brace-expansion 5.0.5: GHSA-jxxr-4gwj-5jf2"}, "fullDescription": {"text": "OSV.dev reports `brace-expansion` at version `5.0.5` (resolved in `dashboard/package-lock.json`) is affected by GHSA-jxxr-4gwj-5jf2.\nNote: `brace-expansion` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-jxxr-4gwj-5jf2\nFix: upgrade `brace-expansion` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-40651b83e54fdd7b", "name": "Vulnerable dependency esbuild 0.21.5: GHSA-67mh-4wv8-2f99", "shortDescription": {"text": "Vulnerable dependency esbuild 0.21.5: GHSA-67mh-4wv8-2f99"}, "fullDescription": {"text": "OSV.dev reports `esbuild` at version `0.21.5` (resolved in `dashboard/package-lock.json`) is affected by GHSA-67mh-4wv8-2f99.\nNote: `esbuild` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-67mh-4wv8-2f99\nFix: upgrade `esbuild` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-02a8133c16c1b381", "name": "Vulnerable dependency fast-uri 3.1.0: GHSA-4c8g-83qw-93j6", "shortDescription": {"text": "Vulnerable dependency fast-uri 3.1.0: GHSA-4c8g-83qw-93j6"}, "fullDescription": {"text": "OSV.dev reports `fast-uri` at version `3.1.0` (resolved in `dashboard/package-lock.json`) is affected by GHSA-4c8g-83qw-93j6 (aka CVE-2026-13676).\nNote: `fast-uri` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nfast-uri vulnerable to host confusion via failed IDN canonicalization\n\nAliases: CVE-2026-13676\nAdvisory: https://osv.dev/vulnerability/GHSA-4c8g-83qw-93j6\nFix: upgrade `fast-uri` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 0.9}}, {"id": "scanner-5245649defb1f493", "name": "Vulnerable dependency fast-uri 3.1.0: GHSA-q3j6-qgpj-74h6", "shortDescription": {"text": "Vulnerable dependency fast-uri 3.1.0: GHSA-q3j6-qgpj-74h6"}, "fullDescription": {"text": "OSV.dev reports `fast-uri` at version `3.1.0` (resolved in `dashboard/package-lock.json`) is affected by GHSA-q3j6-qgpj-74h6.\nNote: `fast-uri` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-q3j6-qgpj-74h6\nFix: upgrade `fast-uri` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-a78b40675f1202ba", "name": "Vulnerable dependency fast-uri 3.1.0: GHSA-v2hh-gcrm-f6hx", "shortDescription": {"text": "Vulnerable dependency fast-uri 3.1.0: GHSA-v2hh-gcrm-f6hx"}, "fullDescription": {"text": "OSV.dev reports `fast-uri` at version `3.1.0` (resolved in `dashboard/package-lock.json`) is affected by GHSA-v2hh-gcrm-f6hx.\nNote: `fast-uri` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-v2hh-gcrm-f6hx\nFix: upgrade `fast-uri` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-faf380dd883d5484", "name": "Vulnerable dependency fast-uri 3.1.0: GHSA-v39h-62p7-jpjc", "shortDescription": {"text": "Vulnerable dependency fast-uri 3.1.0: GHSA-v39h-62p7-jpjc"}, "fullDescription": {"text": "OSV.dev reports `fast-uri` at version `3.1.0` (resolved in `dashboard/package-lock.json`) is affected by GHSA-v39h-62p7-jpjc.\nNote: `fast-uri` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-v39h-62p7-jpjc\nFix: upgrade `fast-uri` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-317d586d319e2152", "name": "Vulnerable dependency brace-expansion 2.1.0: GHSA-3jxr-9vmj-r5cp", "shortDescription": {"text": "Vulnerable dependency brace-expansion 2.1.0: GHSA-3jxr-9vmj-r5cp"}, "fullDescription": {"text": "OSV.dev reports `brace-expansion` at version `2.1.0` (resolved in `dashboard/package-lock.json`) is affected by GHSA-3jxr-9vmj-r5cp (aka CVE-2026-13149).\nNote: `brace-expansion` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nbrace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups\n\nAliases: CVE-2026-13149\nAdvisory: https://osv.dev/vulnerability/GHSA-3jxr-9vmj-r5cp\nFix: upgrade `brace-expansion` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 0.9}}, {"id": "scanner-56efa0f976e30e40", "name": "Dependency colored is a major version behind", "shortDescription": {"text": "Dependency colored is a major version behind"}, "fullDescription": {"text": "`colored` is pinned at `2.1` in `v2/crates/wifi-densepose-cli/Cargo.toml` while the latest release on the cargo registry is `3.1.1` \u2014 1 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `colored` to `3.1.1`."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "low", "confidence": 0.9}}, {"id": "scanner-f81bccbf4cdeb67a", "name": "Dependency dirs is a major version behind", "shortDescription": {"text": "Dependency dirs is a major version behind"}, "fullDescription": {"text": "`dirs` is pinned at `5` in `v2/crates/wifi-densepose-pointcloud/Cargo.toml` while the latest release on the cargo registry is `6.0.0` \u2014 1 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `dirs` to `6.0.0`."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "low", "confidence": 0.9}}, {"id": "scanner-e6ae1beeb662afc2", "name": "Dependency ed25519-dalek is a major version behind", "shortDescription": {"text": "Dependency ed25519-dalek is a major version behind"}, "fullDescription": {"text": "`ed25519-dalek` is pinned at `2.1` in `v2/crates/cog-ha-matter/Cargo.toml` while the latest release on the cargo registry is `3.0.0` \u2014 1 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `ed25519-dalek` to `3.0.0`."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "low", "confidence": 0.9}}, {"id": "scanner-d2f08ce387d95f52", "name": "Dangling fetch: DELETE /api/states/${encodeURIComponent(target.entity_id)} (examples/frontend/src/pages/Dashboard.ts:158", "shortDescription": {"text": "Dangling fetch: DELETE /api/states/${encodeURIComponent(target.entity_id)} (examples/frontend/src/pages/Dashboard.ts:158)"}, "fullDescription": {"text": "`examples/frontend/src/pages/Dashboard.ts:158` calls `DELETE /api/states/${encodeURIComponent(target.entity_id)}` but no backend route in the scanned graph matches that path. The path appears development/example-only, so verify its custom dev server or proxy registration.\n\nTool: fetch\nNormalized path used for matching: `/states/<p>`"}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "medium", "confidence": 0.55}}, {"id": "scanner-4f285b6dce2314dc", "name": "Dangling fetch: POST /api/states/${encodeURIComponent(entity_id)} (examples/frontend/src/pages/Dashboard.ts:179)", "shortDescription": {"text": "Dangling fetch: POST /api/states/${encodeURIComponent(entity_id)} (examples/frontend/src/pages/Dashboard.ts:179)"}, "fullDescription": {"text": "`examples/frontend/src/pages/Dashboard.ts:179` calls `POST /api/states/${encodeURIComponent(entity_id)}` but no backend route in the scanned graph matches that path. The path appears development/example-only, so verify its custom dev server or proxy registration.\n\nTool: fetch\nNormalized path used for matching: `/states/<p>`"}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "medium", "confidence": 0.55}}, {"id": "scanner-03cc1f9bb2736128", "name": "Dangling fetch: GET /api/config (examples/frontend/src/pages/Settings.ts:118)", "shortDescription": {"text": "Dangling fetch: GET /api/config (examples/frontend/src/pages/Settings.ts:118)"}, "fullDescription": {"text": "`examples/frontend/src/pages/Settings.ts:118` calls `GET /api/config` but no backend route in the scanned graph matches that path. The path appears development/example-only, so verify its custom dev server or proxy registration.\n\nTool: fetch\nNormalized path used for matching: `/config`"}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "medium", "confidence": 0.55}}, {"id": "scanner-66cf29f958eb227d", "name": "Dangling fetch: GET /api/services (examples/frontend/src/pages/Services.ts:125)", "shortDescription": {"text": "Dangling fetch: GET /api/services (examples/frontend/src/pages/Services.ts:125)"}, "fullDescription": {"text": "`examples/frontend/src/pages/Services.ts:125` calls `GET /api/services` but no backend route in the scanned graph matches that path. The path appears development/example-only, so verify its custom dev server or proxy registration.\n\nTool: fetch\nNormalized path used for matching: `/services`"}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "medium", "confidence": 0.55}}, {"id": "scanner-12c58f342e0e01d8", "name": "Dangling fetch: POST /api/services/${encodeURIComponent(domain)}/${encodeURIComponent(service)} (examples/frontend/src/p", "shortDescription": {"text": "Dangling fetch: POST /api/services/${encodeURIComponent(domain)}/${encodeURIComponent(service)} (examples/frontend/src/pages/Services.ts:177)"}, "fullDescription": {"text": "`examples/frontend/src/pages/Services.ts:177` calls `POST /api/services/${encodeURIComponent(domain)}/${encodeURIComponent(service)}` but no backend route in the scanned graph matches that path. The path appears development/example-only, so verify its custom dev server or proxy registration.\n\nTool: fetch\nNormalized path used for matching: `/services/<p>/<p>`"}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "medium", "confidence": 0.55}}, {"id": "scanner-523c9550836aa90f", "name": "28 backend endpoints not called by scanned frontend", "shortDescription": {"text": "28 backend endpoints not called by scanned frontend"}, "fullDescription": {"text": "No scanned frontend call matched these backend routes. Sample: POST /start, POST /stop, GET /clients, DELETE /clients/{client_id}, POST /broadcast, GET /current, POST /analyze, GET /zones/{zone_id}/occupancy + 20 more. This is fine when endpoints serve external clients (mobile apps, SDKs, third-party integrations, server-side webhooks). Otherwise document consumers or remove dead routes."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/391"}, "properties": {"repository": "ruvnet/RuView", "repoUrl": "https://github.com/ruvnet/RuView", "branch": "main"}, "results": [{"ruleId": "WEB003", "level": "warning", "message": {"text": "Public web service has no security.txt"}, "properties": {"repobilityId": 12748, "scanner": "repobility-web-presence", "fingerprint": "5cd26606c5a53c9f403ff7a92a6917c19cf440a23ce03e2b90e8c493312ef8cd", "category": "quality", "severity": "medium", "confidence": 0.78, "triageState": "open", "verdict": "likely", "isResolved": false, "reason": "Repository looks like a public web app/API but no security.txt file or route was discovered.", "evidence": {"rule_id": "WEB003", "scanner": "repobility-web-presence", "references": ["https://www.rfc-editor.org/rfc/rfc9116", "https://github.com/Lissy93/web-check"], "correlation_key": "fp|5cd26606c5a53c9f403ff7a92a6917c19cf440a23ce03e2b90e8c493312ef8cd"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".well-known/security.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "JRN003", "level": "warning", "message": {"text": "Frontend API reference is not matched by discovered backend routes"}, "properties": {"repobilityId": 12747, "scanner": "repobility-journey-contract", "fingerprint": "0cacd1eab282922367c29357d1bc1f3e9ae494bc025e1e5bc5c2a758d2b321fc", "category": "quality", "severity": "medium", "confidence": 0.74, "triageState": "open", "verdict": "likely", "isResolved": false, "reason": "Same-origin /api path appears in frontend code but no discovered backend endpoint has the same route shape.", "evidence": {"rule_id": "JRN003", "scanner": "repobility-journey-contract", "references": ["https://repobility.com/library/authorization/"], "route_shape": "/api/v1/sensor/drift/status", "correlation_key": "fp|0cacd1eab282922367c29357d1bc1f3e9ae494bc025e1e5bc5c2a758d2b321fc", "backend_endpoint_count": 34}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/train-camera-free.js"}, "region": {"startLine": 256}}}]}, {"ruleId": "JRN003", "level": "warning", "message": {"text": "Frontend API reference is not matched by discovered backend routes"}, "properties": {"repobilityId": 12746, "scanner": "repobility-journey-contract", "fingerprint": "e1282ab7c9c0ed7c6fa67f630b9576717390eb66b5c6a82f4719dd6fca77d40c", "category": "quality", "severity": "medium", "confidence": 0.74, "triageState": "open", "verdict": "likely", "isResolved": false, "reason": "Same-origin /api path appears in frontend code but no discovered backend endpoint has the same route shape.", "evidence": {"rule_id": "JRN003", "scanner": "repobility-journey-contract", "references": ["https://repobility.com/library/authorization/"], "route_shape": "/api/v1/coherence/profile", "correlation_key": "fp|e1282ab7c9c0ed7c6fa67f630b9576717390eb66b5c6a82f4719dd6fca77d40c", "backend_endpoint_count": 34}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/train-camera-free.js"}, "region": {"startLine": 251}}}]}, {"ruleId": "JRN003", "level": "warning", "message": {"text": "Frontend API reference is not matched by discovered backend routes"}, "properties": {"repobilityId": 12745, "scanner": "repobility-journey-contract", "fingerprint": "7d56abc89bddba9ce191ccb04c6c59d7a67276ce175d5844328f13bd1eaa8643", "category": "quality", "severity": "medium", "confidence": 0.74, "triageState": "open", "verdict": "likely", "isResolved": false, "reason": "Same-origin /api path appears in frontend code but no discovered backend endpoint has the same route shape.", "evidence": {"rule_id": "JRN003", "scanner": "repobility-journey-contract", "references": ["https://repobility.com/library/authorization/"], "route_shape": "/api/v1/boundary", "correlation_key": "fp|7d56abc89bddba9ce191ccb04c6c59d7a67276ce175d5844328f13bd1eaa8643", "backend_endpoint_count": 34}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/train-camera-free.js"}, "region": {"startLine": 246}}}]}, {"ruleId": "JRN003", "level": "warning", "message": {"text": "Frontend API reference is not matched by discovered backend routes"}, "properties": {"repobilityId": 12744, "scanner": "repobility-journey-contract", "fingerprint": "a456af1ff4362b343d17a496864d8d4c781e438075ac304757ed8692a051ef84", "category": "quality", "severity": "medium", "confidence": 0.74, "triageState": "open", "verdict": "likely", "isResolved": false, "reason": "Same-origin /api path appears in frontend code but no discovered backend endpoint has the same route shape.", "evidence": {"rule_id": "JRN003", "scanner": "repobility-journey-contract", "references": ["https://repobility.com/library/authorization/"], "route_shape": "/api/v1/sensor/list", "correlation_key": "fp|a456af1ff4362b343d17a496864d8d4c781e438075ac304757ed8692a051ef84", "backend_endpoint_count": 34}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/train-camera-free.js"}, "region": {"startLine": 241}}}]}, {"ruleId": "JRN003", "level": "warning", "message": {"text": "Frontend API reference is not matched by discovered backend routes"}, "properties": {"repobilityId": 12743, "scanner": "repobility-journey-contract", "fingerprint": "d78c230c94a4ed52c61dcec25b8396f7edd365c4f9852c97d907e99a9c559b22", "category": "quality", "severity": "medium", "confidence": 0.74, "triageState": "open", "verdict": "likely", "isResolved": false, "reason": "Same-origin /api path appears in frontend code but no discovered backend endpoint has the same route shape.", "evidence": {"rule_id": "JRN003", "scanner": "repobility-journey-contract", "references": ["https://repobility.com/library/authorization/"], "route_shape": "/api/v1/sensor/embedding/latest", "correlation_key": "fp|d78c230c94a4ed52c61dcec25b8396f7edd365c4f9852c97d907e99a9c559b22", "backend_endpoint_count": 34}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/train-camera-free.js"}, "region": {"startLine": 236}}}]}, {"ruleId": "JRN003", "level": "warning", "message": {"text": "Frontend API reference is not matched by discovered backend routes"}, "properties": {"repobilityId": 12742, "scanner": "repobility-journey-contract", "fingerprint": "360d51280bff752e6f30921f0d1005d00fd1615093749f70aee9558a8780aef7", "category": "quality", "severity": "medium", "confidence": 0.74, "triageState": "open", "verdict": "likely", "isResolved": false, "reason": "Same-origin /api path appears in frontend code but no discovered backend endpoint has the same route shape.", "evidence": {"rule_id": "JRN003", "scanner": "repobility-journey-contract", "references": ["https://repobility.com/library/authorization/"], "route_shape": "/api/v1/sensor/list", "correlation_key": "fp|360d51280bff752e6f30921f0d1005d00fd1615093749f70aee9558a8780aef7", "backend_endpoint_count": 34}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/train-camera-free.js"}, "region": {"startLine": 229}}}]}, {"ruleId": "JRN003", "level": "warning", "message": {"text": "Frontend API reference is not matched by discovered backend routes"}, "properties": {"repobilityId": 12741, "scanner": "repobility-journey-contract", "fingerprint": "2f9fbb1fb9e74076ddd24c28b255e724732d176f67abd4f2ef0755bfb7c0d261", "category": "quality", "severity": "medium", "confidence": 0.74, "triageState": "open", "verdict": "likely", "isResolved": false, "reason": "Same-origin /api path appears in frontend code but no discovered backend endpoint has the same route shape.", "evidence": {"rule_id": "JRN003", "scanner": "repobility-journey-contract", "references": ["https://repobility.com/library/authorization/"], "route_shape": "/api/witness/verify", "correlation_key": "fp|2f9fbb1fb9e74076ddd24c28b255e724732d176f67abd4f2ef0755bfb7c0d261", "backend_endpoint_count": 34}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "dashboard/src/transport/WsClient.ts"}, "region": {"startLine": 183}}}]}, {"ruleId": "JRN003", "level": "warning", "message": {"text": "Frontend API reference is not matched by discovered backend routes"}, "properties": {"repobilityId": 12740, "scanner": "repobility-journey-contract", "fingerprint": "c457993e27d4a5a4f9e2bc436e460cceaab7570fc46bd6fdbd5c0ecc6d494364", "category": "quality", "severity": "medium", "confidence": 0.74, "triageState": "open", "verdict": "likely", "isResolved": false, "reason": "Same-origin /api path appears in frontend code but no discovered backend endpoint has the same route shape.", "evidence": {"rule_id": "JRN003", "scanner": "repobility-journey-contract", "references": ["https://repobility.com/library/authorization/"], "route_shape": "/api/witness/generate", "correlation_key": "fp|c457993e27d4a5a4f9e2bc436e460cceaab7570fc46bd6fdbd5c0ecc6d494364", "backend_endpoint_count": 34}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "dashboard/src/transport/WsClient.ts"}, "region": {"startLine": 172}}}]}, {"ruleId": "JRN003", "level": "warning", "message": {"text": "Frontend API reference is not matched by discovered backend routes"}, "properties": {"repobilityId": 12739, "scanner": "repobility-journey-contract", "fingerprint": "c89b214104692959f1339a78097fcd13d8a09720f9d70ebbf2cce592a76295a3", "category": "quality", "severity": "medium", "confidence": 0.74, "triageState": "open", "verdict": "likely", "isResolved": false, "reason": "Same-origin /api path appears in frontend code but no discovered backend endpoint has the same route shape.", "evidence": {"rule_id": "JRN003", "scanner": "repobility-journey-contract", "references": ["https://repobility.com/library/authorization/"], "route_shape": "/api/step", "correlation_key": "fp|c89b214104692959f1339a78097fcd13d8a09720f9d70ebbf2cce592a76295a3", "backend_endpoint_count": 34}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "dashboard/src/transport/WsClient.ts"}, "region": {"startLine": 165}}}]}, {"ruleId": "JRN003", "level": "warning", "message": {"text": "Frontend API reference is not matched by discovered backend routes"}, "properties": {"repobilityId": 12738, "scanner": "repobility-journey-contract", "fingerprint": "725e7573f8ae14abfa3bfd84175ba41b50c6800de105f942f5148510a839c635", "category": "quality", "severity": "medium", "confidence": 0.74, "triageState": "open", "verdict": "likely", "isResolved": false, "reason": "Same-origin /api path appears in frontend code but no discovered backend endpoint has the same route shape.", "evidence": {"rule_id": "JRN003", "scanner": "repobility-journey-contract", "references": ["https://repobility.com/library/authorization/"], "route_shape": "/api/pause", "correlation_key": "fp|725e7573f8ae14abfa3bfd84175ba41b50c6800de105f942f5148510a839c635", "backend_endpoint_count": 34}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "dashboard/src/transport/WsClient.ts"}, "region": {"startLine": 158}}}]}, {"ruleId": "JRN003", "level": "warning", "message": {"text": "Frontend API reference is not matched by discovered backend routes"}, "properties": {"repobilityId": 12737, "scanner": "repobility-journey-contract", "fingerprint": "5e3cb5cf99fa3f890e7539d238907e598625ad10ab9d1246c8fbc97a7104bc8d", "category": "quality", "severity": "medium", "confidence": 0.74, "triageState": "open", "verdict": "likely", "isResolved": false, "reason": "Same-origin /api path appears in frontend code but no discovered backend endpoint has the same route shape.", "evidence": {"rule_id": "JRN003", "scanner": "repobility-journey-contract", "references": ["https://repobility.com/library/authorization/"], "route_shape": "/api/run", "correlation_key": "fp|5e3cb5cf99fa3f890e7539d238907e598625ad10ab9d1246c8fbc97a7104bc8d", "backend_endpoint_count": 34}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "dashboard/src/transport/WsClient.ts"}, "region": {"startLine": 151}}}]}, {"ruleId": "JRN003", "level": "warning", "message": {"text": "Frontend API reference is not matched by discovered backend routes"}, "properties": {"repobilityId": 12736, "scanner": "repobility-journey-contract", "fingerprint": "f8079123fb6ec824b6300d44d027b63e6f193aa50f044b9d5abded75b62942e5", "category": "quality", "severity": "medium", "confidence": 0.74, "triageState": "open", "verdict": "likely", "isResolved": false, "reason": "Same-origin /api path appears in frontend code but no discovered backend endpoint has the same route shape.", "evidence": {"rule_id": "JRN003", "scanner": "repobility-journey-contract", "references": ["https://repobility.com/library/authorization/"], "route_shape": "/api/reset", "correlation_key": "fp|f8079123fb6ec824b6300d44d027b63e6f193aa50f044b9d5abded75b62942e5", "backend_endpoint_count": 34}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "dashboard/src/transport/WsClient.ts"}, "region": {"startLine": 145}}}]}, {"ruleId": "JRN003", "level": "warning", "message": {"text": "Frontend API reference is not matched by discovered backend routes"}, "properties": {"repobilityId": 12735, "scanner": "repobility-journey-contract", "fingerprint": "f4450800c5162db902f45fe5a143f08675a8d19f39679d1b02fb10c00cf05b34", "category": "quality", "severity": "medium", "confidence": 0.74, "triageState": "open", "verdict": "likely", "isResolved": false, "reason": "Same-origin /api path appears in frontend code but no discovered backend endpoint has the same route shape.", "evidence": {"rule_id": "JRN003", "scanner": "repobility-journey-contract", "references": ["https://repobility.com/library/authorization/"], "route_shape": "/api/seed", "correlation_key": "fp|f4450800c5162db902f45fe5a143f08675a8d19f39679d1b02fb10c00cf05b34", "backend_endpoint_count": 34}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "dashboard/src/transport/WsClient.ts"}, "region": {"startLine": 139}}}]}, {"ruleId": "JRN003", "level": "warning", "message": {"text": "Frontend API reference is not matched by discovered backend routes"}, "properties": {"repobilityId": 12734, "scanner": "repobility-journey-contract", "fingerprint": "837d94548ed6081545e53fb05ebb2617c0410e94e094bc8f48fe56dd0b99aca4", "category": "quality", "severity": "medium", "confidence": 0.74, "triageState": "open", "verdict": "likely", "isResolved": false, "reason": "Same-origin /api path appears in frontend code but no discovered backend endpoint has the same route shape.", "evidence": {"rule_id": "JRN003", "scanner": "repobility-journey-contract", "references": ["https://repobility.com/library/authorization/"], "route_shape": "/api/config", "correlation_key": "fp|837d94548ed6081545e53fb05ebb2617c0410e94e094bc8f48fe56dd0b99aca4", "backend_endpoint_count": 34}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "dashboard/src/transport/WsClient.ts"}, "region": {"startLine": 136}}}]}, {"ruleId": "JRN003", "level": "warning", "message": {"text": "Frontend API reference is not matched by discovered backend routes"}, "properties": {"repobilityId": 12733, "scanner": "repobility-journey-contract", "fingerprint": "d156e7a281fc9742bd2f0159b8ca6bec707f4c738d4f0ed960473061ab54e204", "category": "quality", "severity": "medium", "confidence": 0.74, "triageState": "open", "verdict": "likely", "isResolved": false, "reason": "Same-origin /api path appears in frontend code but no discovered backend endpoint has the same route shape.", "evidence": {"rule_id": "JRN003", "scanner": "repobility-journey-contract", "references": ["https://repobility.com/library/authorization/"], "route_shape": "/api/scene", "correlation_key": "fp|d156e7a281fc9742bd2f0159b8ca6bec707f4c738d4f0ed960473061ab54e204", "backend_endpoint_count": 34}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "dashboard/src/transport/WsClient.ts"}, "region": {"startLine": 133}}}]}, {"ruleId": "AUC012", "level": "warning", "message": {"text": "[AUC012] FastAPI interactive docs may be exposed by framework defaults: FastAPI exposes /docs, /redoc, and /openapi.json by default. Public production APIs should explicitly disable those defaults, protect them behind admin authentication, or publish a reviewed OpenAPI spec with declared security requirements."}, "properties": {"repobilityId": 12732, "scanner": "repobility-access-control", "fingerprint": "27f8c50db94c1d5138790446654bd4d0b5823ce185d040059e5a7502358b5899", "category": "auth", "severity": "medium", "confidence": 0.72, "triageState": "open", "verdict": "needs_review", "isResolved": false, "reason": "Static route and framework evidence require project-owner confirmation.", "evidence": {"apps": [{"line": 65, "file_path": "archive/v1/src/app.py", "docs_url_disabled": false, "redoc_url_disabled": false, "openapi_url_disabled": false}, {"line": 34, "file_path": "archive/v1/tests/integration/test_api_endpoints.py", "docs_url_disabled": false, "redoc_url_disabled": false, "openapi_url_disabled": false}, {"line": 243, "file_path": "archive/v1/tests/integration/test_api_endpoints.py", "docs_url_disabled": false, "redoc_url_disabled": false, "openapi_url_disabled": false}, {"line": 274, "file_path": "archive/v1/tests/integration/test_api_endpoints.py", "docs_url_disabled": false, "redoc_url_disabled": false, "openapi_url_disabled": false}, {"line": 308, "file_path": "archive/v1/tests/integration/test_api_endpoints.py", "docs_url_disabled": false, "redoc_url_disabled": false, "openapi_url_disabled": false}], "scanner": "repobility-access-control", "correlation_key": "fp|27f8c50db94c1d5138790446654bd4d0b5823ce185d040059e5a7502358b5899"}}}, {"ruleId": "AUC009", "level": "warning", "message": {"text": "[AUC009] Sensitive function route lacks elevated authorization evidence: A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: DELETE /clients/{client_id}."}, "properties": {"repobilityId": 12731, "scanner": "repobility-access-control", "fingerprint": "a4eeb2b88afab87ecda98d7e8a62b86f8570acdcf5e2ef8a2476d616efc72f44", "category": "auth", "severity": "medium", "confidence": 0.68, "triageState": "open", "verdict": "needs_review", "isResolved": false, "reason": "Static route and framework evidence require project-owner confirmation.", "evidence": {"path": "/clients/{client_id}", "method": "DELETE", "scanner": "repobility-access-control", "framework": "FastAPI", "correlation_key": "code|auth|token|436|cwe-285", "identity_targets": ["authenticated", "owner"]}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "archive/v1/src/api/routers/stream.py"}, "region": {"startLine": 436}}}]}, {"ruleId": "AUC004", "level": "warning", "message": {"text": "[AUC004] Admin route does not show super_admin separation: An administrative route was detected without nearby evidence that platform super_admin access is separated from tenant/application admin access. Endpoint: POST /{settings.api_prefix}/dev/reset."}, "properties": {"repobilityId": 12730, "scanner": "repobility-access-control", "fingerprint": "9c121c5b1c59d5e5bc9fa8cd87b82f94cd1d658c22ddfc7a602495c298dfadac", "category": "auth", "severity": "medium", "confidence": 0.66, "triageState": "open", "verdict": "needs_review", "isResolved": false, "reason": "Static route and framework evidence require project-owner confirmation.", "evidence": {"path": "/{settings.api_prefix}/dev/reset", "method": "POST", "scanner": "repobility-access-control", "framework": "FastAPI", "correlation_key": "code|auth|archive/v1/src/api/main.py|405|cwe-285", "identity_targets": ["unknown", "admin"]}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "archive/v1/src/api/main.py"}, "region": {"startLine": 405}}}]}, {"ruleId": "AUC004", "level": "warning", "message": {"text": "[AUC004] Admin route does not show super_admin separation: An administrative route was detected without nearby evidence that platform super_admin access is separated from tenant/application admin access. Endpoint: GET /{settings.api_prefix}/dev/config."}, "properties": {"repobilityId": 12729, "scanner": "repobility-access-control", "fingerprint": "0b53babfee9a0a858861e6b606da5942ecf0074107ba8c7b82a553bce0445845", "category": "auth", "severity": "medium", "confidence": 0.66, "triageState": "open", "verdict": "needs_review", "isResolved": false, "reason": "Static route and framework evidence require project-owner confirmation.", "evidence": {"path": "/{settings.api_prefix}/dev/config", "method": "GET", "scanner": "repobility-access-control", "framework": "FastAPI", "correlation_key": "code|auth|archive/v1/src/api/main.py|387|cwe-285", "identity_targets": ["unknown", "admin"]}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "archive/v1/src/api/main.py"}, "region": {"startLine": 387}}}]}, {"ruleId": "AUC004", "level": "warning", "message": {"text": "[AUC004] Admin route does not show super_admin separation: An administrative route was detected without nearby evidence that platform super_admin access is separated from tenant/application admin access. Endpoint: GET /{settings.api_prefix}/metrics."}, "properties": {"repobilityId": 12728, "scanner": "repobility-access-control", "fingerprint": "9ce60f1ff5effb41f0753a52bab807202c5fc5221ce59cfe07354d8d61e90335", "category": "auth", "severity": "medium", "confidence": 0.66, "triageState": "open", "verdict": "needs_review", "isResolved": false, "reason": "Static route and framework evidence require project-owner confirmation.", "evidence": {"path": "/{settings.api_prefix}/metrics", "method": "GET", "scanner": "repobility-access-control", "framework": "FastAPI", "correlation_key": "code|auth|archive/v1/src/api/main.py|366|cwe-285", "identity_targets": ["anonymous", "authenticated"]}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "archive/v1/src/api/main.py"}, "region": {"startLine": 366}}}]}, {"ruleId": "AUC004", "level": "warning", "message": {"text": "[AUC004] Admin route does not show super_admin separation: An administrative route was detected without nearby evidence that platform super_admin access is separated from tenant/application admin access. Endpoint: GET /{settings.api_prefix}/status."}, "properties": {"repobilityId": 12727, "scanner": "repobility-access-control", "fingerprint": "6dc410b7fa22bffdeb998c53112dad9351ce41261667f4fd7bf0db9f7bea7a2d", "category": "auth", "severity": "medium", "confidence": 0.66, "triageState": "open", "verdict": "needs_review", "isResolved": false, "reason": "Static route and framework evidence require project-owner confirmation.", "evidence": {"path": "/{settings.api_prefix}/status", "method": "GET", "scanner": "repobility-access-control", "framework": "FastAPI", "correlation_key": "code|auth|archive/v1/src/api/main.py|326|cwe-285", "identity_targets": ["anonymous", "authenticated"]}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "archive/v1/src/api/main.py"}, "region": {"startLine": 326}}}]}, {"ruleId": "AUC004", "level": "warning", "message": {"text": "[AUC004] Admin route does not show super_admin separation: An administrative route was detected without nearby evidence that platform super_admin access is separated from tenant/application admin access. Endpoint: GET /{settings.api_prefix}/info."}, "properties": {"repobilityId": 12726, "scanner": "repobility-access-control", "fingerprint": "00b1cd616674f0e2f7533ae1032be8728872da1b3d670d2bf29e05626a46fa1e", "category": "auth", "severity": "medium", "confidence": 0.66, "triageState": "open", "verdict": "needs_review", "isResolved": false, "reason": "Static route and framework evidence require project-owner confirmation.", "evidence": {"path": "/{settings.api_prefix}/info", "method": "GET", "scanner": "repobility-access-control", "framework": "FastAPI", "correlation_key": "code|auth|archive/v1/src/api/main.py|293|cwe-285", "identity_targets": ["unknown", "admin"]}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "archive/v1/src/api/main.py"}, "region": {"startLine": 293}}}]}, {"ruleId": "AUC004", "level": "warning", "message": {"text": "[AUC004] Admin route does not show super_admin separation: An administrative route was detected without nearby evidence that platform super_admin access is separated from tenant/application admin access. Endpoint: POST /{settings.api_prefix}/dev/reset."}, "properties": {"repobilityId": 12725, "scanner": "repobility-access-control", "fingerprint": "3d76e87bead2ddf8571e074c22629fe29dff4ed906f8ccb1ee46c05fad825d38", "category": "auth", "severity": "medium", "confidence": 0.66, "triageState": "open", "verdict": "needs_review", "isResolved": false, "reason": "Static route and framework evidence require project-owner confirmation.", "evidence": {"path": "/{settings.api_prefix}/dev/reset", "method": "POST", "scanner": "repobility-access-control", "framework": "FastAPI", "correlation_key": "code|auth|archive/v1/src/app.py|312|cwe-285", "identity_targets": ["unknown", "admin"]}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "archive/v1/src/app.py"}, "region": {"startLine": 312}}}]}, {"ruleId": "AUC004", "level": "warning", "message": {"text": "[AUC004] Admin route does not show super_admin separation: An administrative route was detected without nearby evidence that platform super_admin access is separated from tenant/application admin access. Endpoint: GET /{settings.api_prefix}/dev/config."}, "properties": {"repobilityId": 12724, "scanner": "repobility-access-control", "fingerprint": "f8f0d33406fc560275524677c91e0cbd055032a1d2f29aca282a4818f607002e", "category": "auth", "severity": "medium", "confidence": 0.66, "triageState": "open", "verdict": "needs_review", "isResolved": false, "reason": "Static route and framework evidence require project-owner confirmation.", "evidence": {"path": "/{settings.api_prefix}/dev/config", "method": "GET", "scanner": "repobility-access-control", "framework": "FastAPI", "correlation_key": "code|auth|archive/v1/src/app.py|293|cwe-285", "identity_targets": ["unknown", "admin"]}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "archive/v1/src/app.py"}, "region": {"startLine": 293}}}]}, {"ruleId": "AUC004", "level": "warning", "message": {"text": "[AUC004] Admin route does not show super_admin separation: An administrative route was detected without nearby evidence that platform super_admin access is separated from tenant/application admin access. Endpoint: GET /{settings.api_prefix}/metrics."}, "properties": {"repobilityId": 12723, "scanner": "repobility-access-control", "fingerprint": "fe157da9d9026f20b50dfbe2b3fead839b7211333da461d3e660bf8ab73f81cb", "category": "auth", "severity": "medium", "confidence": 0.66, "triageState": "open", "verdict": "needs_review", "isResolved": false, "reason": "Static route and framework evidence require project-owner confirmation.", "evidence": {"path": "/{settings.api_prefix}/metrics", "method": "GET", "scanner": "repobility-access-control", "framework": "FastAPI", "correlation_key": "code|auth|archive/v1/src/app.py|274|cwe-285", "identity_targets": ["anonymous", "authenticated"]}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "archive/v1/src/app.py"}, "region": {"startLine": 274}}}]}, {"ruleId": "AUC004", "level": "warning", "message": {"text": "[AUC004] Admin route does not show super_admin separation: An administrative route was detected without nearby evidence that platform super_admin access is separated from tenant/application admin access. Endpoint: GET /{settings.api_prefix}/status."}, "properties": {"repobilityId": 12722, "scanner": "repobility-access-control", "fingerprint": "e275d4e5a43dace2412ef58be4f9dfdb45901c3b2ca7eed63a157cc9bdf424b6", "category": "auth", "severity": "medium", "confidence": 0.66, "triageState": "open", "verdict": "needs_review", "isResolved": false, "reason": "Static route and framework evidence require project-owner confirmation.", "evidence": {"path": "/{settings.api_prefix}/status", "method": "GET", "scanner": "repobility-access-control", "framework": "FastAPI", "correlation_key": "code|auth|archive/v1/src/app.py|245|cwe-285", "identity_targets": ["anonymous", "authenticated"]}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "archive/v1/src/app.py"}, "region": {"startLine": 245}}}]}, {"ruleId": "AUC004", "level": "warning", "message": {"text": "[AUC004] Admin route does not show super_admin separation: An administrative route was detected without nearby evidence that platform super_admin access is separated from tenant/application admin access. Endpoint: GET /{settings.api_prefix}/info."}, "properties": {"repobilityId": 12721, "scanner": "repobility-access-control", "fingerprint": "626f7b3ab1af07453f2604c26928a3b0fd5cdea0df7b0f0f34ef7f0414619fdd", "category": "auth", "severity": "medium", "confidence": 0.66, "triageState": "open", "verdict": "needs_review", "isResolved": false, "reason": "Static route and framework evidence require project-owner confirmation.", "evidence": {"path": "/{settings.api_prefix}/info", "method": "GET", "scanner": "repobility-access-control", "framework": "FastAPI", "correlation_key": "code|auth|archive/v1/src/app.py|219|cwe-285", "identity_targets": ["unknown", "admin"]}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "archive/v1/src/app.py"}, "region": {"startLine": 219}}}]}, {"ruleId": "AUC001", "level": "warning", "message": {"text": "[AUC001] No Repobility access matrix policy found: The repository uses web/API frameworks but does not define .repobility/access.yml or equivalent authorization documentation."}, "properties": {"repobilityId": 12720, "scanner": "repobility-access-control", "fingerprint": "f1305052c3ba1e6c1cdb5dccc19e58a8168cf78b176658f32b1fc823df3e9d10", "category": "auth", "severity": "medium", "confidence": 0.92, "triageState": "open", "verdict": "likely", "isResolved": false, "reason": "Static route and framework evidence require project-owner confirmation.", "evidence": {"scanner": "repobility-access-control", "frameworks": ["FastAPI"], "expected_files": [".repobility/access.yml", ".repobility/access.yaml", ".repobility/access.json", ".repobility/authorization.yml"], "correlation_key": "fp|f1305052c3ba1e6c1cdb5dccc19e58a8168cf78b176658f32b1fc823df3e9d10"}}}, {"ruleId": "DKR003", "level": "warning", "message": {"text": "Compose service `sensing-server` image uses the latest tag"}, "properties": {"repobilityId": 12715, "scanner": "repobility-docker", "fingerprint": "c91c11eac33044662f5063393af45ec8b1a02d17ea79fb6f1007d9b306e16758", "category": "docker", "severity": "medium", "confidence": 0.94, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Image tag is latest.", "evidence": {"image": "ruvnet/wifi-densepose:latest", "rule_id": "DKR003", "scanner": "repobility-docker", "references": ["https://docs.docker.com/develop/develop-images/dockerfile_best-practices/", "https://docs.docker.com/scout/policy/", "https://github.com/hadolint/hadolint"], "correlation_key": "fp|c91c11eac33044662f5063393af45ec8b1a02d17ea79fb6f1007d9b306e16758"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docker/docker-compose.yml"}, "region": {"startLine": 3}}}]}, {"ruleId": "DKR001", "level": "warning", "message": {"text": "Docker final stage has no non-root USER"}, "properties": {"repobilityId": 12714, "scanner": "repobility-docker", "fingerprint": "837a51a1298f78dd73d8f0c1914ced69a243d2b292b01e08e0b0d98175370ac1", "category": "docker", "severity": "medium", "confidence": 0.82, "triageState": "open", "verdict": "likely", "isResolved": false, "reason": "No USER directive was found in the final runtime stage.", "evidence": {"rule_id": "DKR001", "scanner": "repobility-docker", "final_base": "debian:bookworm-slim", "references": ["https://docs.docker.com/develop/develop-images/dockerfile_best-practices/", "https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html", "https://github.com/hadolint/hadolint"], "correlation_key": "fp|837a51a1298f78dd73d8f0c1914ced69a243d2b292b01e08e0b0d98175370ac1"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docker/Dockerfile.rust"}, "region": {"startLine": 22}}}]}, {"ruleId": "DKR001", "level": "warning", "message": {"text": "Docker final stage has no non-root USER"}, "properties": {"repobilityId": 12712, "scanner": "repobility-docker", "fingerprint": "82f9672db7d1e14357e3b144cf8b1e1e101fd0fb6c254b8c3db31eb0030ef6c5", "category": "docker", "severity": "medium", "confidence": 0.82, "triageState": "open", "verdict": "likely", "isResolved": false, "reason": "No USER directive was found in the final runtime stage.", "evidence": {"rule_id": "DKR001", "scanner": "repobility-docker", "final_base": "python:3.11-slim-bookworm", "references": ["https://docs.docker.com/develop/develop-images/dockerfile_best-practices/", "https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html", "https://github.com/hadolint/hadolint"], "correlation_key": "fp|82f9672db7d1e14357e3b144cf8b1e1e101fd0fb6c254b8c3db31eb0030ef6c5"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docker/Dockerfile.python"}, "region": {"startLine": 4}}}]}, {"ruleId": "DKR018", "level": "warning", "message": {"text": "Database dump or local database file is included in Docker build context"}, "properties": {"repobilityId": 12711, "scanner": "repobility-docker", "fingerprint": "655485f8d8d660f19955b099504360fbf5ff0f88b2be2fc7d9501b5ab7e7369f", "category": "docker", "severity": "medium", "confidence": 0.86, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Database-like artifacts are reachable from the Docker build context and are not ignored.", "evidence": {"rule_id": "DKR018", "scanner": "repobility-docker", "references": ["https://docs.docker.com/develop/develop-images/dockerfile_best-practices/", "https://docs.docker.com/engine/storage/volumes/"], "correlation_key": "fp|655485f8d8d660f19955b099504360fbf5ff0f88b2be2fc7d9501b5ab7e7369f", "database_artifacts": [{"path": "archive/v1/data/wifi_densepose_fallback.db", "size_mb": 0.2}, {"path": "archive/v1/data/test_wifi_densepose.db", "size_mb": 0.0}]}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".dockerignore"}, "region": {"startLine": 1}}}]}, {"ruleId": "ERR002", "level": "warning", "message": {"text": "[ERR002] Empty Catch Block: Empty catch blocks hide errors."}, "properties": {"repobilityId": 12709, "scanner": "repobility-threat-engine", "fingerprint": "fdba4479301a60f22e1ab1d4faba877553a617e130aea81aad1d598aa56f5995", "category": "error_handling", "severity": "medium", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": "catch (x) {\n                }", "reason": "Pattern matched with no mitigating context found", "rule_id": "ERR002", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "fp|fdba4479301a60f22e1ab1d4faba877553a617e130aea81aad1d598aa56f5995"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "v2/crates/wifi-densepose-desktop/ui/.vite/deps/chunk-JCH2SJW3.js"}, "region": {"startLine": 1363}}}]}, {"ruleId": "ERR002", "level": "warning", "message": {"text": "[ERR002] Empty Catch Block: Empty catch blocks hide errors."}, "properties": {"repobilityId": 12708, "scanner": "repobility-threat-engine", "fingerprint": "82df438e9f550ba22f7231dfb7dbcac4bfd0d02f7a30fd095eb7fb2c991b2067", "category": "error_handling", "severity": "medium", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": "catch (_) {}", "reason": "Pattern matched with no mitigating context found", "rule_id": "ERR002", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "fp|82df438e9f550ba22f7231dfb7dbcac4bfd0d02f7a30fd095eb7fb2c991b2067"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/train-ruvllm.js"}, "region": {"startLine": 979}}}]}, {"ruleId": "ERR002", "level": "warning", "message": {"text": "[ERR002] Empty Catch Block: Empty catch blocks hide errors."}, "properties": {"repobilityId": 12707, "scanner": "repobility-threat-engine", "fingerprint": "aa4b1db1a14052378b1bb1ea05e6849d9d61687562de31748d74926e118236a3", "category": "error_handling", "severity": "medium", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": "catch (_) {}", "reason": "Pattern matched with no mitigating context found", "rule_id": "ERR002", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "fp|aa4b1db1a14052378b1bb1ea05e6849d9d61687562de31748d74926e118236a3"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/train-camera-free.js"}, "region": {"startLine": 299}}}]}, {"ruleId": "SEC014", "level": "warning", "message": {"text": "[SEC014] SSL Verification Disabled: SSL certificate verification is disabled, allowing man-in-the-middle attacks."}, "properties": {"repobilityId": 12706, "scanner": "repobility-threat-engine", "fingerprint": "38b2312022895fd85150456ddded724f060a2c8ce1ec5921900d10c638aa4253", "category": "crypto", "severity": "medium", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": "CERT_NONE", "reason": "Pattern matched with no mitigating context found", "rule_id": "SEC014", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "code|crypto|scripts/seed_csi_bridge.py|219|sec014"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/seed_csi_bridge.py"}, "region": {"startLine": 219}}}]}, {"ruleId": "ERR001", "level": "warning", "message": {"text": "[ERR001] Silent Exception Swallowing: Silently swallowing all exceptions hides bugs. Even in cleanup code, log at DEBUG level."}, "properties": {"repobilityId": 12695, "scanner": "repobility-threat-engine", "fingerprint": "2f4862865daa9175432ee16775f17c8e6c2f43b930156d7ba93610a12d3ceeba", "category": "error_handling", "severity": "medium", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": "except Exception:\n            pass", "reason": "Pattern matched with no mitigating context found", "rule_id": "ERR001", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "fp|2f4862865daa9175432ee16775f17c8e6c2f43b930156d7ba93610a12d3ceeba"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/mmwave_fusion_bridge.py"}, "region": {"startLine": 104}}}]}, {"ruleId": "ERR001", "level": "warning", "message": {"text": "[ERR001] Silent Exception Swallowing: Silently swallowing all exceptions hides bugs. Even in cleanup code, log at DEBUG level."}, "properties": {"repobilityId": 12694, "scanner": "repobility-threat-engine", "fingerprint": "ebeb53457a6147d1549802a1d0f8d353291e251895f7d2cdcdea5328bc21d8e3", "category": "error_handling", "severity": "medium", "confidence": 0.45, "triageState": "open", "verdict": "likely_fp", "isResolved": false, "reason": "Pattern matched with no mitigating context found | [R34-retro auto-suppress: documentation/example path]", "evidence": {"match": "except Exception:\n                pass", "reason": "Pattern matched with no mitigating context found", "rule_id": "ERR001", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "fp|ebeb53457a6147d1549802a1d0f8d353291e251895f7d2cdcdea5328bc21d8e3"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "examples/ruview_live.py"}, "region": {"startLine": 345}}}]}, {"ruleId": "ERR001", "level": "warning", "message": {"text": "[ERR001] Silent Exception Swallowing: Silently swallowing all exceptions hides bugs. Even in cleanup code, log at DEBUG level."}, "properties": {"repobilityId": 12693, "scanner": "repobility-threat-engine", "fingerprint": "ad98e627cd88ef8a43fba5d2386c6a5f9cc7b934d8a5de5d28c8a2613efad7ce", "category": "error_handling", "severity": "medium", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": "except Exception:\n            pass", "reason": "Pattern matched with no mitigating context found", "rule_id": "ERR001", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "fp|ad98e627cd88ef8a43fba5d2386c6a5f9cc7b934d8a5de5d28c8a2613efad7ce"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "wifi_densepose/__init__.py"}, "region": {"startLine": 102}}}]}, {"ruleId": "AGT012", "level": "warning", "message": {"text": "Agent control bridge may listen on a network interface without visible auth"}, "properties": {"repobilityId": 12692, "scanner": "repobility-agent-runtime", "fingerprint": "0a44db1773a98e851495a823fe33137efb2d24d6dcf3bb537f005a07779d58cc", "category": "quality", "severity": "medium", "confidence": 0.72, "triageState": "open", "verdict": "likely", "isResolved": false, "reason": "File combines agent-control wording with an HTTP/SSE/WebSocket listener on an all-interface host and no visible auth guard.", "evidence": {"rule_id": "AGT012", "scanner": "repobility-agent-runtime", "references": [], "correlation_key": "fp|0a44db1773a98e851495a823fe33137efb2d24d6dcf3bb537f005a07779d58cc"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/qemu_swarm.py"}, "region": {"startLine": 7}}}]}, {"ruleId": "AGT012", "level": "warning", "message": {"text": "Agent control bridge may listen on a network interface without visible auth"}, "properties": {"repobilityId": 12691, "scanner": "repobility-agent-runtime", "fingerprint": "43b0ea40cb94e9b263daac5c44c62dcfd6d637f04f29f6d35697ab7d207b5a7e", "category": "quality", "severity": "medium", "confidence": 0.72, "triageState": "open", "verdict": "likely", "isResolved": false, "reason": "File combines agent-control wording with an HTTP/SSE/WebSocket listener on an all-interface host and no visible auth guard.", "evidence": {"rule_id": "AGT012", "scanner": "repobility-agent-runtime", "references": [], "correlation_key": "fp|43b0ea40cb94e9b263daac5c44c62dcfd6d637f04f29f6d35697ab7d207b5a7e"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/qemu-mesh-test.sh"}, "region": {"startLine": 28}}}]}, {"ruleId": "AGT012", "level": "warning", "message": {"text": "Agent control bridge may listen on a network interface without visible auth"}, "properties": {"repobilityId": 12690, "scanner": "repobility-agent-runtime", "fingerprint": "244696ae08dc70e1daa22c39a20c318ab381ee77c291b98652bb9dbaed216165", "category": "quality", "severity": "medium", "confidence": 0.72, "triageState": "open", "verdict": "likely", "isResolved": false, "reason": "File combines agent-control wording with an HTTP/SSE/WebSocket listener on an all-interface host and no visible auth guard.", "evidence": {"rule_id": "AGT012", "scanner": "repobility-agent-runtime", "references": [], "correlation_key": "fp|244696ae08dc70e1daa22c39a20c318ab381ee77c291b98652bb9dbaed216165"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "install.sh"}, "region": {"startLine": 229}}}]}, {"ruleId": "AGT012", "level": "warning", "message": {"text": "Agent control bridge may listen on a network interface without visible auth"}, "properties": {"repobilityId": 12689, "scanner": "repobility-agent-runtime", "fingerprint": "d8efddefff2a8994de9f57dcda37df2a76e798fd02e94cb5e2cc441adf6f3ce6", "category": "quality", "severity": "medium", "confidence": 0.72, "triageState": "open", "verdict": "likely", "isResolved": false, "reason": "File combines agent-control wording with an HTTP/SSE/WebSocket listener on an all-interface host and no visible auth guard.", "evidence": {"rule_id": "AGT012", "scanner": "repobility-agent-runtime", "references": [], "correlation_key": "fp|d8efddefff2a8994de9f57dcda37df2a76e798fd02e94cb5e2cc441adf6f3ce6"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "archive/v1/src/sensing/ws_server.py"}, "region": {"startLine": 2}}}]}, {"ruleId": "AGT015", "level": "warning", "message": {"text": "Remote install command pipes network code directly to a shell"}, "properties": {"repobilityId": 12688, "scanner": "repobility-agent-runtime", "fingerprint": "9e27be744f4dc861749b9f61a4ca1cee2512ad036ade9052cab254a943637d7d", "category": "dependency", "severity": "medium", "confidence": 0.7, "triageState": "open", "verdict": "likely", "isResolved": false, "reason": "File contains a remote download piped directly to a shell without visible checksum or signature verification.", "evidence": {"rule_id": "AGT015", "scanner": "repobility-agent-runtime", "references": [], "correlation_key": "fp|9e27be744f4dc861749b9f61a4ca1cee2512ad036ade9052cab254a943637d7d"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/dashboard-pages.yml"}, "region": {"startLine": 47}}}]}, {"ruleId": "AGT015", "level": "warning", "message": {"text": "Remote install command pipes network code directly to a shell"}, "properties": {"repobilityId": 12687, "scanner": "repobility-agent-runtime", "fingerprint": "4ddbd3c06dbdda5c7207446092d9175046415a28b352db32d3f773019dce5f59", "category": "dependency", "severity": "medium", "confidence": 0.7, "triageState": "open", "verdict": "likely", "isResolved": false, "reason": "File contains a remote download piped directly to a shell without visible checksum or signature verification.", "evidence": {"rule_id": "AGT015", "scanner": "repobility-agent-runtime", "references": [], "correlation_key": "fp|4ddbd3c06dbdda5c7207446092d9175046415a28b352db32d3f773019dce5f59"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/dashboard-a11y.yml"}, "region": {"startLine": 28}}}]}, {"ruleId": "AIC003", "level": "warning", "message": {"text": "Duplicated implementation block across source files"}, "properties": {"repobilityId": 12686, "scanner": "repobility-ai-code-hygiene", "fingerprint": "4c55315199e414c112f8e30afe925eb8f5a49b36c437aa0120f662a1595c25e8", "category": "quality", "severity": "medium", "confidence": 0.86, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "A normalized source-code window appears in two different non-test files.", "evidence": {"lines": 12, "rule_id": "AIC003", "scanner": "repobility-ai-code-hygiene", "references": ["https://jscpd.dev/"], "duplicate_file": "scripts/material-classifier.js", "duplicate_line": 380, "correlation_key": "fp|4c55315199e414c112f8e30afe925eb8f5a49b36c437aa0120f662a1595c25e8"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/passive-radar.js"}, "region": {"startLine": 404}}}]}, {"ruleId": "AIC003", "level": "warning", "message": {"text": "Duplicated implementation block across source files"}, "properties": {"repobilityId": 12685, "scanner": "repobility-ai-code-hygiene", "fingerprint": "2537305122100664a9e5caa0cef383b783cb0e24bb7aeea5ec248f9761bdc88e", "category": "quality", "severity": "medium", "confidence": 0.86, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "A normalized source-code window appears in two different non-test files.", "evidence": {"lines": 12, "rule_id": "AIC003", "scanner": "repobility-ai-code-hygiene", "references": ["https://jscpd.dev/"], "duplicate_file": "scripts/device-fingerprint.js", "duplicate_line": 435, "correlation_key": "fp|2537305122100664a9e5caa0cef383b783cb0e24bb7aeea5ec248f9761bdc88e"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/passive-radar.js"}, "region": {"startLine": 398}}}]}, {"ruleId": "AIC003", "level": "warning", "message": {"text": "Duplicated implementation block across source files"}, "properties": {"repobilityId": 12684, "scanner": "repobility-ai-code-hygiene", "fingerprint": "a1684efa99493916c9cd5e2e76c42c491016cbc32b0c66522eae4ae9627652df", "category": "quality", "severity": "medium", "confidence": 0.86, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "A normalized source-code window appears in two different non-test files.", "evidence": {"lines": 12, "rule_id": "AIC003", "scanner": "repobility-ai-code-hygiene", "references": ["https://jscpd.dev/"], "duplicate_file": "scripts/csi-graph-visualizer.js", "duplicate_line": 57, "correlation_key": "fp|a1684efa99493916c9cd5e2e76c42c491016cbc32b0c66522eae4ae9627652df"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/mincut-person-counter.js"}, "region": {"startLine": 45}}}]}, {"ruleId": "AIC003", "level": "warning", "message": {"text": "Duplicated implementation block across source files"}, "properties": {"repobilityId": 12683, "scanner": "repobility-ai-code-hygiene", "fingerprint": "cd17a64bc1024f4260a5e0bf163340a39f285d927f0568818de4fb89e660e090", "category": "quality", "severity": "medium", "confidence": 0.86, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "A normalized source-code window appears in two different non-test files.", "evidence": {"lines": 12, "rule_id": "AIC003", "scanner": "repobility-ai-code-hygiene", "references": ["https://jscpd.dev/"], "duplicate_file": "scripts/csi-spectrogram.js", "duplicate_line": 276, "correlation_key": "fp|cd17a64bc1024f4260a5e0bf163340a39f285d927f0568818de4fb89e660e090"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/mesh-graph-transformer.js"}, "region": {"startLine": 282}}}]}, {"ruleId": "AIC003", "level": "warning", "message": {"text": "Duplicated implementation block across source files"}, "properties": {"repobilityId": 12682, "scanner": "repobility-ai-code-hygiene", "fingerprint": "1e42803c42396dd728af0ea632b169b3c49d3f59595bdc12f9a21f1e5bbd79b3", "category": "quality", "severity": "medium", "confidence": 0.86, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "A normalized source-code window appears in two different non-test files.", "evidence": {"lines": 12, "rule_id": "AIC003", "scanner": "repobility-ai-code-hygiene", "references": ["https://jscpd.dev/"], "duplicate_file": "scripts/device-fingerprint.js", "duplicate_line": 256, "correlation_key": "fp|1e42803c42396dd728af0ea632b169b3c49d3f59595bdc12f9a21f1e5bbd79b3"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/material-classifier.js"}, "region": {"startLine": 179}}}]}, {"ruleId": "AIC003", "level": "warning", "message": {"text": "Duplicated implementation block across source files"}, "properties": {"repobilityId": 12681, "scanner": "repobility-ai-code-hygiene", "fingerprint": "b23ae9269f4f10edc2fb22e4d041db93d930bbe6f683d097dd266c7ca4a9b3c8", "category": "quality", "severity": "medium", "confidence": 0.86, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "A normalized source-code window appears in two different non-test files.", "evidence": {"lines": 12, "rule_id": "AIC003", "scanner": "repobility-ai-code-hygiene", "references": ["https://jscpd.dev/"], "duplicate_file": "firmware/esp32-csi-node/provision.py", "duplicate_line": 81, "correlation_key": "fp|b23ae9269f4f10edc2fb22e4d041db93d930bbe6f683d097dd266c7ca4a9b3c8"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/generate_nvs_matrix.py"}, "region": {"startLine": 224}}}]}, {"ruleId": "AIC003", "level": "warning", "message": {"text": "Duplicated implementation block across source files"}, "properties": {"repobilityId": 12680, "scanner": "repobility-ai-code-hygiene", "fingerprint": "7b4da86facd8dd4d1d6f1cd5416bcafdd1db1e44c4d9ab1331b6317324b9a9a9", "category": "quality", "severity": "medium", "confidence": 0.86, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "A normalized source-code window appears in two different non-test files.", "evidence": {"lines": 12, "rule_id": "AIC003", "scanner": "repobility-ai-code-hygiene", "references": ["https://jscpd.dev/"], "duplicate_file": "references/script_2.py", "duplicate_line": 60, "correlation_key": "fp|7b4da86facd8dd4d1d6f1cd5416bcafdd1db1e44c4d9ab1331b6317324b9a9a9"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "references/wifi_densepose_pytorch.py"}, "region": {"startLine": 65}}}]}, {"ruleId": "AIC003", "level": "warning", "message": {"text": "Duplicated implementation block across source files"}, "properties": {"repobilityId": 12679, "scanner": "repobility-ai-code-hygiene", "fingerprint": "d6ec50d1af9967782004dcae7169d066b883b2ba17e5843d5948be84b03514e5", "category": "quality", "severity": "medium", "confidence": 0.86, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "A normalized source-code window appears in two different non-test files.", "evidence": {"lines": 12, "rule_id": "AIC003", "scanner": "repobility-ai-code-hygiene", "references": ["https://jscpd.dev/"], "duplicate_file": "references/script.py", "duplicate_line": 3, "correlation_key": "fp|d6ec50d1af9967782004dcae7169d066b883b2ba17e5843d5948be84b03514e5"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "references/wifi_densepose_pytorch.py"}, "region": {"startLine": 3}}}]}, {"ruleId": "AIC003", "level": "warning", "message": {"text": "Duplicated implementation block across source files"}, "properties": {"repobilityId": 12678, "scanner": "repobility-ai-code-hygiene", "fingerprint": "22bd3c428048851878e5cf258315969c19f05b91129b8e7eca4d686dd817ff2b", "category": "quality", "severity": "medium", "confidence": 0.86, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "A normalized source-code window appears in two different non-test files.", "evidence": {"lines": 12, "rule_id": "AIC003", "scanner": "repobility-ai-code-hygiene", "references": ["https://jscpd.dev/"], "duplicate_file": "references/script_4.py", "duplicate_line": 1, "correlation_key": "fp|22bd3c428048851878e5cf258315969c19f05b91129b8e7eca4d686dd817ff2b"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "references/script_5.py"}, "region": {"startLine": 1}}}]}, {"ruleId": "AIC003", "level": "warning", "message": {"text": "Duplicated implementation block across source files"}, "properties": {"repobilityId": 12677, "scanner": "repobility-ai-code-hygiene", "fingerprint": "c3027f4f5d7dc3dd0bb0dd7bec439a795c3e852eeaec2c415f3015bc8dbd9d41", "category": "quality", "severity": "medium", "confidence": 0.86, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "A normalized source-code window appears in two different non-test files.", "evidence": {"lines": 12, "rule_id": "AIC003", "scanner": "repobility-ai-code-hygiene", "references": ["https://jscpd.dev/"], "duplicate_file": "references/script_2.py", "duplicate_line": 26, "correlation_key": "fp|c3027f4f5d7dc3dd0bb0dd7bec439a795c3e852eeaec2c415f3015bc8dbd9d41"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "references/script_4.py"}, "region": {"startLine": 21}}}]}, {"ruleId": "AIC003", "level": "warning", "message": {"text": "Duplicated implementation block across source files"}, "properties": {"repobilityId": 12676, "scanner": "repobility-ai-code-hygiene", "fingerprint": "899e26d42d9d6d0905bbed13b7bad19b0be1d0050b6a5be1ab48fa740dc43b60", "category": "quality", "severity": "medium", "confidence": 0.86, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "A normalized source-code window appears in two different non-test files.", "evidence": {"lines": 12, "rule_id": "AIC003", "scanner": "repobility-ai-code-hygiene", "references": ["https://jscpd.dev/"], "duplicate_file": "references/script.py", "duplicate_line": 22, "correlation_key": "fp|899e26d42d9d6d0905bbed13b7bad19b0be1d0050b6a5be1ab48fa740dc43b60"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "references/script_4.py"}, "region": {"startLine": 17}}}]}, {"ruleId": "AIC003", "level": "warning", "message": {"text": "Duplicated implementation block across source files"}, "properties": {"repobilityId": 12675, "scanner": "repobility-ai-code-hygiene", "fingerprint": "22964dabe557c27f19cee90ee5d3d6e0c91429657eee5668cbf32c1825820b7c", "category": "quality", "severity": "medium", "confidence": 0.86, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "A normalized source-code window appears in two different non-test files.", "evidence": {"lines": 12, "rule_id": "AIC003", "scanner": "repobility-ai-code-hygiene", "references": ["https://jscpd.dev/"], "duplicate_file": "references/script.py", "duplicate_line": 3, "correlation_key": "fp|22964dabe557c27f19cee90ee5d3d6e0c91429657eee5668cbf32c1825820b7c"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "references/script_2.py"}, "region": {"startLine": 3}}}]}, {"ruleId": "DKC010", "level": "note", "message": {"text": "Compose service lacks no-new-privileges hardening"}, "properties": {"repobilityId": 12719, "scanner": "repobility-docker", "fingerprint": "2d080414528d7d03d1c6b7e66957f6b018b56426a8c151e2e4a7f5061881bc10", "category": "docker", "severity": "low", "confidence": 0.62, "triageState": "open", "verdict": "needs_review", "isResolved": false, "reason": "App-like service has no security_opt no-new-privileges setting.", "evidence": {"rule_id": "DKC010", "scanner": "repobility-docker", "service": "python-sensing", "references": ["https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html"], "correlation_key": "fp|2d080414528d7d03d1c6b7e66957f6b018b56426a8c151e2e4a7f5061881bc10"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docker/docker-compose.yml"}, "region": {"startLine": 28}}}]}, {"ruleId": "DKC006", "level": "note", "message": {"text": "Compose service does not declare a runtime user"}, "properties": {"repobilityId": 12718, "scanner": "repobility-docker", "fingerprint": "a6e6c4d0d8e1af9ba5c9911459700287ee433b41669702d1424b62a2f25f5c00", "category": "docker", "severity": "low", "confidence": 0.56, "triageState": "open", "verdict": "needs_review", "isResolved": false, "reason": "Service has no user setting and Repobility could not prove the image runs non-root.", "evidence": {"rule_id": "DKC006", "scanner": "repobility-docker", "service": "python-sensing", "references": ["https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html"], "correlation_key": "fp|a6e6c4d0d8e1af9ba5c9911459700287ee433b41669702d1424b62a2f25f5c00"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docker/docker-compose.yml"}, "region": {"startLine": 28}}}]}, {"ruleId": "DKC010", "level": "note", "message": {"text": "Compose service lacks no-new-privileges hardening"}, "properties": {"repobilityId": 12717, "scanner": "repobility-docker", "fingerprint": "39c60937c9064aa489177f79699a375a184d910aa67c3b80f55f813095589915", "category": "docker", "severity": "low", "confidence": 0.62, "triageState": "open", "verdict": "needs_review", "isResolved": false, "reason": "App-like service has no security_opt no-new-privileges setting.", "evidence": {"rule_id": "DKC010", "scanner": "repobility-docker", "service": "sensing-server", "references": ["https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html"], "correlation_key": "fp|39c60937c9064aa489177f79699a375a184d910aa67c3b80f55f813095589915"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docker/docker-compose.yml"}, "region": {"startLine": 3}}}]}, {"ruleId": "DKC006", "level": "note", "message": {"text": "Compose service does not declare a runtime user"}, "properties": {"repobilityId": 12716, "scanner": "repobility-docker", "fingerprint": "ee646f028bff7763799631f59cff3e142814659a42399622d47ae7c2dc0f5ac0", "category": "docker", "severity": "low", "confidence": 0.56, "triageState": "open", "verdict": "needs_review", "isResolved": false, "reason": "Service has no user setting and Repobility could not prove the image runs non-root.", "evidence": {"rule_id": "DKC006", "scanner": "repobility-docker", "service": "sensing-server", "references": ["https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html"], "correlation_key": "fp|ee646f028bff7763799631f59cff3e142814659a42399622d47ae7c2dc0f5ac0"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docker/docker-compose.yml"}, "region": {"startLine": 3}}}]}, {"ruleId": "DKR008", "level": "note", "message": {"text": ".dockerignore misses sensitive defaults"}, "properties": {"repobilityId": 12713, "scanner": "repobility-docker", "fingerprint": "aea2ad92c68c4ee1f8432bb1ec25e7d45ac12c9e1790ac2d3fffe638b1acce12", "category": "docker", "severity": "low", "confidence": 0.72, "triageState": "open", "verdict": "likely", "isResolved": false, "reason": "A Docker build context should exclude secrets and repository metadata.", "evidence": {"rule_id": "DKR008", "scanner": "repobility-docker", "references": ["https://docs.docker.com/develop/develop-images/dockerfile_best-practices/"], "correlation_key": "fp|aea2ad92c68c4ee1f8432bb1ec25e7d45ac12c9e1790ac2d3fffe638b1acce12", "missing_patterns": ["id_rsa", "*.pem", "*.key"]}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".dockerignore"}, "region": {"startLine": 1}}}]}, {"ruleId": "AIC002", "level": "note", "message": {"text": "Source file name looks like an AI patch artifact"}, "properties": {"repobilityId": 12674, "scanner": "repobility-ai-code-hygiene", "fingerprint": "b9c7e73fbdad05e0d3489f92220f1106ffae4523114b35ab9217f2b3d50adf8a", "category": "quality", "severity": "low", "confidence": 0.62, "triageState": "open", "verdict": "needs_review", "isResolved": false, "reason": "Source filename contains a temporary or patch-style suffix.", "evidence": {"suffix": "update", "rule_id": "AIC002", "scanner": "repobility-ai-code-hygiene", "references": ["https://arxiv.org/abs/2601.15195"], "correlation_key": "fp|b9c7e73fbdad05e0d3489f92220f1106ffae4523114b35ab9217f2b3d50adf8a"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "firmware/esp32-csi-node/main/ota_update.h"}, "region": {"startLine": 1}}}]}, {"ruleId": "AIC002", "level": "note", "message": {"text": "Source file name looks like an AI patch artifact"}, "properties": {"repobilityId": 12673, "scanner": "repobility-ai-code-hygiene", "fingerprint": "a1baefc3044aa0ee99288a9d3947e7a3df5b40e17510461a03f8d14a52872a89", "category": "quality", "severity": "low", "confidence": 0.62, "triageState": "open", "verdict": "needs_review", "isResolved": false, "reason": "Source filename contains a temporary or patch-style suffix.", "evidence": {"suffix": "update", "rule_id": "AIC002", "scanner": "repobility-ai-code-hygiene", "references": ["https://arxiv.org/abs/2601.15195"], "correlation_key": "fp|a1baefc3044aa0ee99288a9d3947e7a3df5b40e17510461a03f8d14a52872a89"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "firmware/esp32-csi-node/main/ota_update.c"}, "region": {"startLine": 1}}}]}, {"ruleId": "AIC006", "level": "note", "message": {"text": "Archive or legacy directory is mixed into the active repository root"}, "properties": {"repobilityId": 12672, "scanner": "repobility-ai-code-hygiene", "fingerprint": "0a7d2f4e50dd6f0a3ca0adfbcb9cb1f442d6b4ebfb1b14f4466301798c4f394e", "category": "quality", "severity": "low", "confidence": 0.68, "triageState": "open", "verdict": "likely", "isResolved": false, "reason": "Repository root contains an archive/legacy directory name.", "evidence": {"rule_id": "AIC006", "scanner": "repobility-ai-code-hygiene", "directory": "archive", "references": ["https://arxiv.org/abs/2601.15195"], "correlation_key": "fp|0a7d2f4e50dd6f0a3ca0adfbcb9cb1f442d6b4ebfb1b14f4466301798c4f394e"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "archive"}, "region": {"startLine": 1}}}]}, {"ruleId": "ERR002", "level": "none", "message": {"text": "[ERR002] Empty Catch Block (and 1 more): Same pattern found in 1 additional files. Review if needed."}, "properties": {"repobilityId": 12710, "scanner": "repobility-threat-engine", "fingerprint": "e7174d71aa23c14419f9144792a6ba116afcec3004f64b82de4dbf54fc9e1921", "category": "error_handling", "severity": "info", "confidence": 0.2, "triageState": "false_positive", "verdict": "likely_fp", "isResolved": true, "reason": "Deduplicated summary only: 1 additional occurrences found. The top occurrences remain visible as actionable findings.", "evidence": {"reason": "Deduplicated summary only: 1 additional occurrences found. The top occurrences remain visible as actionable findings.", "rule_id": "ERR002", "scanner": "repobility-threat-engine", "confidence": 0.2, "correlation_key": "fp|e7174d71aa23c14419f9144792a6ba116afcec3004f64b82de4dbf54fc9e1921"}}}, {"ruleId": "SEC015", "level": "none", "message": {"text": "[SEC015] Insecure Randomness for Security (and 3 more): Same pattern found in 3 additional files. Review if needed."}, "properties": {"repobilityId": 12705, "scanner": "repobility-threat-engine", "fingerprint": "ed3769a4ea3a3aeb3b1fd74c33a316d9452004c8aff6770390b3265ad0543e09", "category": "crypto", "severity": "info", "confidence": 0.2, "triageState": "false_positive", "verdict": "likely_fp", "isResolved": true, "reason": "Deduplicated summary only: 3 additional occurrences found. The top occurrences remain visible as actionable findings.", "evidence": {"reason": "Deduplicated summary only: 3 additional occurrences found. The top occurrences remain visible as actionable findings.", "rule_id": "SEC015", "scanner": "repobility-threat-engine", "confidence": 0.2, "correlation_key": "fp|ed3769a4ea3a3aeb3b1fd74c33a316d9452004c8aff6770390b3265ad0543e09"}}}, {"ruleId": "SEC015", "level": "none", "message": {"text": "[SEC015] Insecure Randomness for Security: Weak PRNG used in security-sensitive context. Output is predictable."}, "properties": {"repobilityId": 12704, "scanner": "repobility-threat-engine", "fingerprint": "a6c27420e22b2575520bdf7d528936487d1322cfb1140b3297920d3573649a26", "category": "crypto", "severity": "info", "confidence": 0.15, "triageState": "false_positive", "verdict": "likely_fp", "isResolved": true, "reason": "Weak PRNG appears to be used for non-security behavior (UI, sampling, demos, shuffling, or backoff), not for secrets", "evidence": {"match": "Math.random()", "reason": "Weak PRNG appears to be used for non-security behavior (UI, sampling, demos, shuffling, or backoff), not for secrets", "rule_id": "SEC015", "scanner": "repobility-threat-engine", "confidence": 0.15, "correlation_key": "code|crypto|token|173|sec015"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/mesh-graph-transformer.js"}, "region": {"startLine": 173}}}]}, {"ruleId": "SEC015", "level": "none", "message": {"text": "[SEC015] Insecure Randomness for Security: Weak PRNG used in security-sensitive context. Output is predictable."}, "properties": {"repobilityId": 12703, "scanner": "repobility-threat-engine", "fingerprint": "a9f71eb25c2690492d9304105b9ba6545de89fd4b00784a06eb065c3671165eb", "category": "crypto", "severity": "info", "confidence": 0.25, "triageState": "false_positive", "verdict": "likely_fp", "isResolved": true, "reason": "Weak PRNG appears to be used for non-security behavior (UI, sampling, demos, shuffling, or backoff), not for secrets", "evidence": {"match": "Math.random()", "reason": "Weak PRNG appears to be used for non-security behavior (UI, sampling, demos, shuffling, or backoff), not for secrets", "rule_id": "SEC015", "scanner": "repobility-threat-engine", "confidence": 0.25, "correlation_key": "code|crypto|references/app.js|68|sec015"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "references/app.js"}, "region": {"startLine": 68}}}]}, {"ruleId": "SEC015", "level": "none", "message": {"text": "[SEC015] Insecure Randomness for Security: Weak PRNG used in security-sensitive context. Output is predictable."}, "properties": {"repobilityId": 12702, "scanner": "repobility-threat-engine", "fingerprint": "dc16257e9f2b6a34083c0e3ac4fa1b896fade4e7119e8a00cdb82f0a9aec8faf", "category": "crypto", "severity": "info", "confidence": 0.25, "triageState": "false_positive", "verdict": "likely_fp", "isResolved": true, "reason": "Weak PRNG appears to be used for non-security behavior (UI, sampling, demos, shuffling, or backoff), not for secrets", "evidence": {"match": "random.randint(", "reason": "Weak PRNG appears to be used for non-security behavior (UI, sampling, demos, shuffling, or backoff), not for secrets", "rule_id": "SEC015", "scanner": "repobility-threat-engine", "confidence": 0.25, "correlation_key": "code|crypto|references/script_5.py|212|sec015"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "references/script_5.py"}, "region": {"startLine": 212}}}]}, {"ruleId": "SEC020", "level": "none", "message": {"text": "[SEC020] Secret Printed to Logs (and 7 more): Same pattern found in 7 additional files. Review if needed."}, "properties": {"repobilityId": 12701, "scanner": "repobility-threat-engine", "fingerprint": "3c1512ec1e531167a3aa928d567398e9cb8cbf7ff40fccf993810ebf40229e88", "category": "credential_exposure", "severity": "info", "confidence": 0.2, "triageState": "false_positive", "verdict": "likely_fp", "isResolved": true, "reason": "Deduplicated summary only: 7 additional occurrences found. The top occurrences remain visible as actionable findings.", "evidence": {"reason": "Deduplicated summary only: 7 additional occurrences found. The top occurrences remain visible as actionable findings.", "rule_id": "SEC020", "scanner": "repobility-threat-engine", "confidence": 0.2, "correlation_key": "fp|3c1512ec1e531167a3aa928d567398e9cb8cbf7ff40fccf993810ebf40229e88"}}}, {"ruleId": "SEC020", "level": "none", "message": {"text": "[SEC020] Secret Printed to Logs: Debug or diagnostic code appears to print a credential-bearing value. This is a frequent AI-assisted coding failure: the helper exposes the exact value needed for troubleshooting."}, "properties": {"repobilityId": 12700, "scanner": "repobility-threat-engine", "fingerprint": "feb1f053acdd24fc874044f7e316c18d490ca33ba36c4daed58575c980cd7ae1", "category": "credential_exposure", "severity": "info", "confidence": 0.15, "triageState": "false_positive", "verdict": "likely_fp", "isResolved": true, "reason": "Log message mentions credential-related metadata but does not print a credential-bearing value", "evidence": {"match": "print(\"Install: pip install google-cloud-secret-manager\", file=sys.stderr)", "reason": "Log message mentions credential-related metadata but does not print a credential-bearing value", "rule_id": "SEC020", "scanner": "repobility-threat-engine", "confidence": 0.15, "correlation_key": "secret|token|7|print install: pip install google-cloud-secret-manager file sys.stderr"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/publish-huggingface.py"}, "region": {"startLine": 73}}}]}, {"ruleId": "SEC020", "level": "none", "message": {"text": "[SEC020] Secret Printed to Logs: Debug or diagnostic code appears to print a credential-bearing value. This is a frequent AI-assisted coding failure: the helper exposes the exact value needed for troubleshooting."}, "properties": {"repobilityId": 12699, "scanner": "repobility-threat-engine", "fingerprint": "03f9aa7f90612b607a557be1c694dfa72fe1400e59d566e1c9c5d5eaa24ff168", "category": "credential_exposure", "severity": "info", "confidence": 0.15, "triageState": "false_positive", "verdict": "likely_fp", "isResolved": true, "reason": "Log message mentions credential-related metadata but does not print a credential-bearing value", "evidence": {"match": "console.error('[seed] No token provided (--seed-token or $SEED_TOKEN)", "reason": "Log message mentions credential-related metadata but does not print a credential-bearing value", "rule_id": "SEC020", "scanner": "repobility-threat-engine", "confidence": 0.15, "correlation_key": "secret|scripts/csi-spectrogram.js|37|console.error seed no token provided --seed-token or seed_token"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/csi-spectrogram.js"}, "region": {"startLine": 376}}}]}, {"ruleId": "SEC011", "level": "none", "message": {"text": "[SEC011] Unsafe PyTorch Model Loading: torch.load() uses pickle internally and can execute arbitrary code from untrusted model files."}, "properties": {"repobilityId": 12697, "scanner": "repobility-threat-engine", "fingerprint": "30070e95ee06a083366663e312e8ef795a90283edf78bb5ddbc95aa24576bffc", "category": "deserialization", "severity": "info", "confidence": 0.1, "triageState": "false_positive", "verdict": "likely_fp", "isResolved": true, "reason": "Safe pattern 'weights_only\\s*=\\s*True' detected on same line", "evidence": {"match": "torch.load(", "reason": "Safe pattern 'weights_only\\s*=\\s*True' detected on same line", "rule_id": "SEC011", "scanner": "repobility-threat-engine", "confidence": 0.1, "correlation_key": "code|deserialization|token|444|sec011"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "references/wifi_densepose_pytorch.py"}, "region": {"startLine": 444}}}]}, {"ruleId": "ERR001", "level": "none", "message": {"text": "[ERR001] Silent Exception Swallowing (and 2 more): Same pattern found in 2 additional files. Review if needed."}, "properties": {"repobilityId": 12696, "scanner": "repobility-threat-engine", "fingerprint": "4ffea2800599adb663df46ab31003467b0a25ff84f83dd40a996e94f4d40f164", "category": "error_handling", "severity": "info", "confidence": 0.2, "triageState": "false_positive", "verdict": "likely_fp", "isResolved": true, "reason": "Deduplicated summary only: 2 additional occurrences found. The top occurrences remain visible as actionable findings.", "evidence": {"reason": "Deduplicated summary only: 2 additional occurrences found. The top occurrences remain visible as actionable findings.", "rule_id": "ERR001", "scanner": "repobility-threat-engine", "confidence": 0.2, "correlation_key": "fp|4ffea2800599adb663df46ab31003467b0a25ff84f83dd40a996e94f4d40f164"}}}, {"ruleId": "SEC020", "level": "error", "message": {"text": "[SEC020] Secret Printed to Logs: Debug or diagnostic code appears to print a credential-bearing value. This is a frequent AI-assisted coding failure: the helper exposes the exact value needed for troubleshooting."}, "properties": {"repobilityId": 12698, "scanner": "repobility-threat-engine", "fingerprint": "6aa1920296d2fee6005ff3a63f70e02b1066e0dd1aab0848593af4c97ece9f26", "category": "credential_exposure", "severity": "high", "confidence": 0.92, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Formatted expression outputs a credential-bearing value directly.", "evidence": {"match": "print(f\"  WiFi Password: <redacted>'*' * len(args.password)", "reason": "Formatted expression outputs a credential-bearing value directly.", "rule_id": "SEC020", "scanner": "repobility-threat-engine", "confidence": 0.92, "correlation_key": "secret|scripts/provision.py|21|print f wifi password: redacted len args.password"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/provision.py"}, "region": {"startLine": 216}}}]}, {"ruleId": "scanner-8ff4558134dce223", "level": "note", "message": {"text": "Possibly dead Python function: filter"}, "properties": {"repobilityId": "7da968b6f6ed2422", "scanner": "scanner-primary", "fingerprint": "8ff4558134dce223", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "archive/v1/src/logger.py:75"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-5b78d3804f38e405", "level": "note", "message": {"text": "Possibly dead Python function: configure_third_party_loggers"}, "properties": {"repobilityId": "563d0d86404bc212", "scanner": "scanner-primary", "fingerprint": "5b78d3804f38e405", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "archive/v1/src/logger.py:225"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3cbf31ecf2cb6e44", "level": "note", "message": {"text": "Possibly dead Python function: log_function_call"}, "properties": {"repobilityId": "f10aa96dc50a434e", "scanner": "scanner-primary", "fingerprint": "3cbf31ecf2cb6e44", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "archive/v1/src/logger.py:258"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-391ac23a62a71709", "level": "note", "message": {"text": "Possibly dead Python function: log_async_function_call"}, "properties": {"repobilityId": "31e4bec85d37560c", "scanner": "scanner-primary", "fingerprint": "391ac23a62a71709", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "archive/v1/src/logger.py:278"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-44855c5b63883b17", "level": "note", "message": {"text": "Possibly dead Python function: set_environment_override"}, "properties": {"repobilityId": "f2e9997d886a7f5f", "scanner": "scanner-primary", "fingerprint": "44855c5b63883b17", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "archive/v1/src/config.py:49"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-9b116984e61aa6c2", "level": "note", "message": {"text": "Possibly dead Python function: clear_environment_overrides"}, "properties": {"repobilityId": "c005c3d11abdde10", "scanner": "scanner-primary", "fingerprint": "9b116984e61aa6c2", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "archive/v1/src/config.py:58"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-0efb740b0c61bdf0", "level": "note", "message": {"text": "Possibly dead Python function: validate_app_configuration"}, "properties": {"repobilityId": "a4c586a26ee5af6f", "scanner": "scanner-primary", "fingerprint": "0efb740b0c61bdf0", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "archive/v1/src/config.py:300"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3c1c4b45c4b34dbf", "level": "note", "message": {"text": "Possibly dead Python function: reload_configuration"}, "properties": {"repobilityId": "ff15702d162e4b6b", "scanner": "scanner-primary", "fingerprint": "3c1c4b45c4b34dbf", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "archive/v1/src/config.py:305"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-4fdac0cffa37e41a", "level": "note", "message": {"text": "Possibly dead Python function: load_domain_config_from_file"}, "properties": {"repobilityId": "e8fb0f18dc34136c", "scanner": "scanner-primary", "fingerprint": "4fdac0cffa37e41a", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "archive/v1/src/config/domains.py:434"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-65d62fb0785896fc", "level": "note", "message": {"text": "Possibly dead Python function: save_domain_config_to_file"}, "properties": {"repobilityId": "c413e24d19f46cc5", "scanner": "scanner-primary", "fingerprint": "65d62fb0785896fc", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "archive/v1/src/config/domains.py:473"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-79b3e82b67a9d3ad", "level": "note", "message": {"text": "Possibly dead Python function: check_token_bucket"}, "properties": {"repobilityId": "cc539965a3424d93", "scanner": "scanner-primary", "fingerprint": "79b3e82b67a9d3ad", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "archive/v1/src/middleware/rate_limit.py:265"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-2b92a977fe4b4b13", "level": "note", "message": {"text": "Possibly dead Python function: setup_rate_limiting"}, "properties": {"repobilityId": "2e974896d07ac4a1", "scanner": "scanner-primary", "fingerprint": "2b92a977fe4b4b13", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "archive/v1/src/middleware/rate_limit.py:395"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-9363ac046e4a7ac8", "level": "note", "message": {"text": "Possibly dead Python function: validate_rate_limit_config"}, "properties": {"repobilityId": "bb63d955621f8069", "scanner": "scanner-primary", "fingerprint": "9363ac046e4a7ac8", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "archive/v1/src/middleware/rate_limit.py:462"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-2fdef7dc77bdbdb3", "level": "note", "message": {"text": "Possibly dead Python function: send_wrapper"}, "properties": {"repobilityId": "f34ba48c1fd7571b", "scanner": "scanner-primary", "fingerprint": "2fdef7dc77bdbdb3", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "archive/v1/src/middleware/cors.py:74"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-507fff714bf258d9", "level": "note", "message": {"text": "Possibly dead Python function: setup_cors_middleware"}, "properties": {"repobilityId": "f83f61b1fe7c71a2", "scanner": "scanner-primary", "fingerprint": "507fff714bf258d9", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "archive/v1/src/middleware/cors.py:210"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-67dc7cd6d50b9fb0", "level": "note", "message": {"text": "Possibly dead Python function: validate_cors_config"}, "properties": {"repobilityId": "e6d1c724e334502a", "scanner": "scanner-primary", "fingerprint": "67dc7cd6d50b9fb0", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "archive/v1/src/middleware/cors.py:333"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-1438cd16162c16c0", "level": "note", "message": {"text": "Possibly dead Python function: update_user"}, "properties": {"repobilityId": "dcc7f0ee1c0775f1", "scanner": "scanner-primary", "fingerprint": "1438cd16162c16c0", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "archive/v1/src/middleware/auth.py:137"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-9999e52113d31cb8", "level": "note", "message": {"text": "Debug `console.log` remains in browser-facing code \u2014 v2/crates/homecore-server/ui/js/panels/seed-detail.js:82"}, "properties": {"repobilityId": "7b2da56576a09f22", "scanner": "scanner-primary", "fingerprint": "9999e52113d31cb8", "layer": "frontend", "severity": "low", "confidence": 0.85, "tags": ["frontend-quality", "fq.console-leak"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "v2/crates/homecore-server/ui/js/panels/seed-detail.js"}, "region": {"startLine": 82}}}]}, {"ruleId": "scanner-a72ee9d7cff73730", "level": "note", "message": {"text": "Icon-only button without accessible name \u2014 v2/crates/wifi-densepose-desktop/ui/src/pages/NetworkDiscovery.tsx:1113"}, "properties": {"repobilityId": "f5de4545cf362af0", "scanner": "scanner-primary", "fingerprint": "a72ee9d7cff73730", "layer": "frontend", "severity": "low", "confidence": 0.85, "tags": ["frontend-quality", "fq.button.no-label"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "v2/crates/wifi-densepose-desktop/ui/src/pages/NetworkDiscovery.tsx"}, "region": {"startLine": 1113}}}]}, {"ruleId": "scanner-38b70e83f638354f", "level": "note", "message": {"text": "Debug `console.log` remains in browser-facing code \u2014 ui/app.js:41"}, "properties": {"repobilityId": "07aee060a6b931c4", "scanner": "scanner-primary", "fingerprint": "38b70e83f638354f", "layer": "frontend", "severity": "low", "confidence": 0.85, "tags": ["frontend-quality", "fq.console-leak"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "ui/app.js"}, "region": {"startLine": 41}}}]}, {"ruleId": "scanner-d233eb7d9e44b6f6", "level": "note", "message": {"text": "Debug `console.log` remains in browser-facing code \u2014 ui/pose-fusion/js/cnn-embedder.js:97"}, "properties": {"repobilityId": "915fcdddc4c7fda6", "scanner": "scanner-primary", "fingerprint": "d233eb7d9e44b6f6", "layer": "frontend", "severity": "low", "confidence": 0.85, "tags": ["frontend-quality", "fq.console-leak"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "ui/pose-fusion/js/cnn-embedder.js"}, "region": {"startLine": 97}}}]}, {"ruleId": "scanner-439c7c7583421ab6", "level": "note", "message": {"text": "Debug `console.log` remains in browser-facing code \u2014 ui/pose-fusion/js/main.js:85"}, "properties": {"repobilityId": "6d92118fb5c5f9bc", "scanner": "scanner-primary", "fingerprint": "439c7c7583421ab6", "layer": "frontend", "severity": "low", "confidence": 0.85, "tags": ["frontend-quality", "fq.console-leak"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "ui/pose-fusion/js/main.js"}, "region": {"startLine": 85}}}]}, {"ruleId": "scanner-57c1f4d2d7cc8907", "level": "none", "message": {"text": "TODO/FIXME marker in shipping code \u2014 ui/pose-fusion/pkg/ruvector-attention/ruvector_attention_wasm.js:1274"}, "properties": {"repobilityId": "fe477a9043305d08", "scanner": "scanner-primary", "fingerprint": "57c1f4d2d7cc8907", "layer": "frontend", "severity": "info", "confidence": 0.7, "tags": ["frontend-quality", "fq.todo-marker"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "ui/pose-fusion/pkg/ruvector-attention/ruvector_attention_wasm.js"}, "region": {"startLine": 1274}}}]}, {"ruleId": "scanner-a83089012223a688", "level": "note", "message": {"text": "Debug `console.log` remains in browser-facing code \u2014 ui/pose-fusion/pkg/ruvector-attention/ruvector_attention_wasm.js:1112"}, "properties": {"repobilityId": "c4e61b004c9e8738", "scanner": "scanner-primary", "fingerprint": "a83089012223a688", "layer": "frontend", "severity": "low", "confidence": 0.85, "tags": ["frontend-quality", "fq.console-leak"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "ui/pose-fusion/pkg/ruvector-attention/ruvector_attention_wasm.js"}, "region": {"startLine": 1112}}}]}, {"ruleId": "scanner-fed598a8630f513f", "level": "note", "message": {"text": "Debug `console.log` remains in browser-facing code \u2014 ui/pose-fusion/pkg/ruvector-attention/ruvector_attention_browser.js:567"}, "properties": {"repobilityId": "7f1991ee49f721bc", "scanner": "scanner-primary", "fingerprint": "fed598a8630f513f", "layer": "frontend", "severity": "low", "confidence": 0.85, "tags": ["frontend-quality", "fq.console-leak"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "ui/pose-fusion/pkg/ruvector-attention/ruvector_attention_browser.js"}, "region": {"startLine": 567}}}]}, {"ruleId": "scanner-35da4dd414799a9b", "level": "note", "message": {"text": "Debug `console.log` remains in browser-facing code \u2014 ui/observatory/js/main.js:451"}, "properties": {"repobilityId": "9e5e0818c9271d17", "scanner": "scanner-primary", "fingerprint": "35da4dd414799a9b", "layer": "frontend", "severity": "low", "confidence": 0.85, "tags": ["frontend-quality", "fq.console-leak"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "ui/observatory/js/main.js"}, "region": {"startLine": 451}}}]}, {"ruleId": "scanner-ba86de30696df3f8", "level": "note", "message": {"text": "Debug `console.log` remains in browser-facing code \u2014 ui/utils/pose-renderer.js:124"}, "properties": {"repobilityId": "231309d1a57dc978", "scanner": "scanner-primary", "fingerprint": "ba86de30696df3f8", "layer": "frontend", "severity": "low", "confidence": 0.85, "tags": ["frontend-quality", "fq.console-leak"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "ui/utils/pose-renderer.js"}, "region": {"startLine": 124}}}]}, {"ruleId": "scanner-1f5492abcf306fcb", "level": "note", "message": {"text": "Debug `console.log` remains in browser-facing code \u2014 ui/utils/backend-detector.js:23"}, "properties": {"repobilityId": "11793759fa607e39", "scanner": "scanner-primary", "fingerprint": "1f5492abcf306fcb", "layer": "frontend", "severity": "low", "confidence": 0.85, "tags": ["frontend-quality", "fq.console-leak"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "ui/utils/backend-detector.js"}, "region": {"startLine": 23}}}]}, {"ruleId": "scanner-bcc0a629bd3e3504", "level": "note", "message": {"text": "Debug `console.log` remains in browser-facing code \u2014 ui/utils/mock-server.js:221"}, "properties": {"repobilityId": "16bde32d1521b9af", "scanner": "scanner-primary", "fingerprint": "bcc0a629bd3e3504", "layer": "frontend", "severity": "low", "confidence": 0.85, "tags": ["frontend-quality", "fq.console-leak"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "ui/utils/mock-server.js"}, "region": {"startLine": 221}}}]}, {"ruleId": "scanner-f7628a3bd68458fa", "level": "note", "message": {"text": "Icon-only button without accessible name \u2014 ui/components/PoseDetectionCanvas.js:1240"}, "properties": {"repobilityId": "02fa54ae2b4b8ba6", "scanner": "scanner-primary", "fingerprint": "f7628a3bd68458fa", "layer": "frontend", "severity": "low", "confidence": 0.85, "tags": ["frontend-quality", "fq.button.no-label"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "ui/components/PoseDetectionCanvas.js"}, "region": {"startLine": 1240}}}]}, {"ruleId": "scanner-78a5dbea1b244639", "level": "note", "message": {"text": "Debug `console.log` remains in browser-facing code \u2014 ui/components/DashboardTab.js:56"}, "properties": {"repobilityId": "9d52d62f8ce86c1f", "scanner": "scanner-primary", "fingerprint": "78a5dbea1b244639", "layer": "frontend", "severity": "low", "confidence": 0.85, "tags": ["frontend-quality", "fq.console-leak"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "ui/components/DashboardTab.js"}, "region": {"startLine": 56}}}]}, {"ruleId": "scanner-863f989cc1bd6e61", "level": "note", "message": {"text": "Debug `console.log` remains in browser-facing code \u2014 ui/services/websocket.service.js:271"}, "properties": {"repobilityId": "9513074a2f70e2f8", "scanner": "scanner-primary", "fingerprint": "863f989cc1bd6e61", "layer": "frontend", "severity": "low", "confidence": 0.85, "tags": ["frontend-quality", "fq.console-leak"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "ui/services/websocket.service.js"}, "region": {"startLine": 271}}}]}, {"ruleId": "scanner-661dbd90edcf77d7", "level": "note", "message": {"text": "Debug `console.log` remains in browser-facing code \u2014 ui/services/pose.service.js:492"}, "properties": {"repobilityId": "070f33025aab20b2", "scanner": "scanner-primary", "fingerprint": "661dbd90edcf77d7", "layer": "frontend", "severity": "low", "confidence": 0.85, "tags": ["frontend-quality", "fq.console-leak"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "ui/services/pose.service.js"}, "region": {"startLine": 492}}}]}, {"ruleId": "scanner-80a0146b9d7c52ca", "level": "note", "message": {"text": "Debug `console.log` remains in browser-facing code \u2014 ui/services/websocket-client.js:57"}, "properties": {"repobilityId": "d31ddc08ab2ac17a", "scanner": "scanner-primary", "fingerprint": "80a0146b9d7c52ca", "layer": "frontend", "severity": "low", "confidence": 0.85, "tags": ["frontend-quality", "fq.console-leak"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "ui/services/websocket-client.js"}, "region": {"startLine": 57}}}]}, {"ruleId": "scanner-9c011dcfc07a1802", "level": "warning", "message": {"text": "detect child process \u2014 .claude/helpers/statusline.cjs:71"}, "properties": {"repobilityId": "3fef77ce7b498ff7", "scanner": "scanner-primary", "fingerprint": "9c011dcfc07a1802", "layer": "security", "severity": "medium", "confidence": 0.55, "tags": ["semgrep", "security", "javascript"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/helpers/statusline.cjs"}, "region": {"startLine": 71}}}]}, {"ruleId": "scanner-d2067b1b786592f8", "level": "note", "message": {"text": "avoid bind to all interfaces \u2014 archive/v1/src/sensing/ws_server.py:216"}, "properties": {"repobilityId": "b92c691c0e77a74e", "scanner": "scanner-primary", "fingerprint": "d2067b1b786592f8", "layer": "security", "severity": "low", "confidence": 0.55, "tags": ["semgrep", "security", "python", "non-production-context"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "archive/v1/src/sensing/ws_server.py"}, "region": {"startLine": 216}}}]}, {"ruleId": "scanner-db841f3aed038eed", "level": "warning", "message": {"text": "dynamic urllib use detected \u2014 examples/happiness-vector/seed_query.py:33"}, "properties": {"repobilityId": "96845027ad2fd9ba", "scanner": "scanner-primary", "fingerprint": "db841f3aed038eed", "layer": "security", "severity": "medium", "confidence": 0.55, "tags": ["semgrep", "security", "python", "non-production-context"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "examples/happiness-vector/seed_query.py"}, "region": {"startLine": 33}}}]}, {"ruleId": "scanner-39d76fc576fe5c0f", "level": "warning", "message": {"text": "dynamic urllib use detected \u2014 examples/ruview_live.py:344"}, "properties": {"repobilityId": "0a88afe5a395f0e8", "scanner": "scanner-primary", "fingerprint": "39d76fc576fe5c0f", "layer": "security", "severity": "medium", "confidence": 0.55, "tags": ["semgrep", "security", "python", "non-production-context"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "examples/ruview_live.py"}, "region": {"startLine": 344}}}]}, {"ruleId": "scanner-e85e42ee72bf5fa7", "level": "warning", "message": {"text": "dynamic urllib use detected \u2014 examples/through-wall/wiflow_capture.py:38"}, "properties": {"repobilityId": "edaaea6e28f8951d", "scanner": "scanner-primary", "fingerprint": "e85e42ee72bf5fa7", "layer": "security", "severity": "medium", "confidence": 0.55, "tags": ["semgrep", "security", "python", "non-production-context"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "examples/through-wall/wiflow_capture.py"}, "region": {"startLine": 38}}}]}, {"ruleId": "scanner-d6b79c612369671a", "level": "warning", "message": {"text": "insecure use string copy fn \u2014 firmware/esp32-csi-node/main/c6_softap_he.c:126"}, "properties": {"repobilityId": "ad874c39712a20a0", "scanner": "scanner-primary", "fingerprint": "d6b79c612369671a", "layer": "security", "severity": "medium", "confidence": 0.55, "tags": ["semgrep", "security", "c"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "firmware/esp32-csi-node/main/c6_softap_he.c"}, "region": {"startLine": 126}}}]}, {"ruleId": "scanner-e2cc311b337f09f9", "level": "warning", "message": {"text": "insecure use string copy fn \u2014 firmware/esp32-csi-node/main/main.c:115"}, "properties": {"repobilityId": "a76e915426ced77f", "scanner": "scanner-primary", "fingerprint": "e2cc311b337f09f9", "layer": "security", "severity": "medium", "confidence": 0.55, "tags": ["semgrep", "security", "c"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "firmware/esp32-csi-node/main/main.c"}, "region": {"startLine": 115}}}]}, {"ruleId": "scanner-ae24c574dc0cebc5", "level": "warning", "message": {"text": "insecure use string copy fn \u2014 firmware/esp32-csi-node/main/nvs_config.c:27"}, "properties": {"repobilityId": "03fa2b9865a1cf39", "scanner": "scanner-primary", "fingerprint": "ae24c574dc0cebc5", "layer": "security", "severity": "medium", "confidence": 0.55, "tags": ["semgrep", "security", "c"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "firmware/esp32-csi-node/main/nvs_config.c"}, "region": {"startLine": 27}}}]}, {"ruleId": "scanner-2fe39e68f6e18857", "level": "warning", "message": {"text": "insecure use string copy fn \u2014 firmware/esp32-csi-node/main/wasm_runtime.c:789"}, "properties": {"repobilityId": "454d5034e86ab2ec", "scanner": "scanner-primary", "fingerprint": "2fe39e68f6e18857", "layer": "security", "severity": "medium", "confidence": 0.55, "tags": ["semgrep", "security", "c"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "firmware/esp32-csi-node/main/wasm_runtime.c"}, "region": {"startLine": 789}}}]}, {"ruleId": "scanner-3a880eeea7ef31f8", "level": "error", "message": {"text": "double free \u2014 firmware/esp32-csi-node/main/wasm_upload.c:186"}, "properties": {"repobilityId": "879a02ff21ceb494", "scanner": "scanner-primary", "fingerprint": "3a880eeea7ef31f8", "layer": "security", "severity": "high", "confidence": 0.55, "tags": ["semgrep", "security", "c"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "firmware/esp32-csi-node/main/wasm_upload.c"}, "region": {"startLine": 186}}}]}, {"ruleId": "scanner-89f8044d4feeb990", "level": "warning", "message": {"text": "dynamic urllib use detected \u2014 scripts/collect-ground-truth.py:102"}, "properties": {"repobilityId": "b85b9b7903d86d25", "scanner": "scanner-primary", "fingerprint": "89f8044d4feeb990", "layer": "security", "severity": "medium", "confidence": 0.55, "tags": ["semgrep", "security", "python"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/collect-ground-truth.py"}, "region": {"startLine": 102}}}]}, {"ruleId": "scanner-3a769f32fc6ff528", "level": "note", "message": {"text": "avoid bind to all interfaces \u2014 scripts/collect-training-data.py:294"}, "properties": {"repobilityId": "79cabf2fcfb89ad2", "scanner": "scanner-primary", "fingerprint": "3a769f32fc6ff528", "layer": "security", "severity": "low", "confidence": 0.7, "tags": ["semgrep", "security", "python"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/collect-training-data.py"}, "region": {"startLine": 294}}}]}, {"ruleId": "scanner-7235c1d7fa0b706c", "level": "warning", "message": {"text": "dynamic urllib use detected \u2014 scripts/esp32_wasm_test.py:303"}, "properties": {"repobilityId": "22eb6905a5883696", "scanner": "scanner-primary", "fingerprint": "7235c1d7fa0b706c", "layer": "security", "severity": "medium", "confidence": 0.55, "tags": ["semgrep", "security", "python", "non-production-context"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/esp32_wasm_test.py"}, "region": {"startLine": 303}}}]}, {"ruleId": "scanner-52ae1e3ff733d93a", "level": "warning", "message": {"text": "dynamic urllib use detected \u2014 scripts/occworld_retrain.py:64"}, "properties": {"repobilityId": "fdc5d99b96294ed4", "scanner": "scanner-primary", "fingerprint": "52ae1e3ff733d93a", "layer": "security", "severity": "medium", "confidence": 0.55, "tags": ["semgrep", "security", "python"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/occworld_retrain.py"}, "region": {"startLine": 64}}}]}, {"ruleId": "scanner-490de8fae193e99e", "level": "note", "message": {"text": "avoid bind to all interfaces \u2014 scripts/overnight-empty-capture.py:54"}, "properties": {"repobilityId": "d6a17a37f58a26e6", "scanner": "scanner-primary", "fingerprint": "490de8fae193e99e", "layer": "security", "severity": "low", "confidence": 0.7, "tags": ["semgrep", "security", "python"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/overnight-empty-capture.py"}, "region": {"startLine": 54}}}]}, {"ruleId": "scanner-7d431d35141017af", "level": "note", "message": {"text": "avoid bind to all interfaces \u2014 scripts/record-csi-udp.py:68"}, "properties": {"repobilityId": "2f67f2b7041d3acf", "scanner": "scanner-primary", "fingerprint": "7d431d35141017af", "layer": "security", "severity": "low", "confidence": 0.7, "tags": ["semgrep", "security", "python"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/record-csi-udp.py"}, "region": {"startLine": 68}}}]}, {"ruleId": "scanner-e310457f06521717", "level": "warning", "message": {"text": "dynamic urllib use detected \u2014 scripts/seed_csi_bridge.py:235"}, "properties": {"repobilityId": "9e999b7628a8b54b", "scanner": "scanner-primary", "fingerprint": "e310457f06521717", "layer": "security", "severity": "medium", "confidence": 0.55, "tags": ["semgrep", "security", "python"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/seed_csi_bridge.py"}, "region": {"startLine": 235}}}]}, {"ruleId": "scanner-f4e01324d3260418", "level": "error", "message": {"text": "CVE-2025-23042: gradio 5.9.1 \u2014 aether-arena/space/requirements.txt"}, "properties": {"repobilityId": "c5afc6342949c80a", "scanner": "scanner-primary", "fingerprint": "f4e01324d3260418", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-23042"]}}, {"ruleId": "scanner-a9e9cd1bf1dd4ae3", "level": "error", "message": {"text": "CVE-2024-8966: gradio 5.9.1 \u2014 aether-arena/space/requirements.txt"}, "properties": {"repobilityId": "ebe4b058ad3a4f0a", "scanner": "scanner-primary", "fingerprint": "a9e9cd1bf1dd4ae3", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2024-8966"]}}, {"ruleId": "scanner-484227947e68e5a4", "level": "error", "message": {"text": "CVE-2026-28414: gradio 5.9.1 \u2014 aether-arena/space/requirements.txt"}, "properties": {"repobilityId": "af66c8b9ebc041cb", "scanner": "scanner-primary", "fingerprint": "484227947e68e5a4", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-28414"]}}, {"ruleId": "scanner-1fcce4e3388fcc0a", "level": "error", "message": {"text": "CVE-2026-28416: gradio 5.9.1 \u2014 aether-arena/space/requirements.txt"}, "properties": {"repobilityId": "797251c2b6c6eb07", "scanner": "scanner-primary", "fingerprint": "1fcce4e3388fcc0a", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-28416"]}}, {"ruleId": "scanner-c834a030d84cafab", "level": "error", "message": {"text": "CVE-2026-48545: gradio 5.9.1 \u2014 aether-arena/space/requirements.txt"}, "properties": {"repobilityId": "85d36348364dd2e1", "scanner": "scanner-primary", "fingerprint": "c834a030d84cafab", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-48545"]}}, {"ruleId": "scanner-7adde57eee598a0c", "level": "warning", "message": {"text": "CVE-2025-48889: gradio 5.9.1 \u2014 aether-arena/space/requirements.txt"}, "properties": {"repobilityId": "8100c529597ad14c", "scanner": "scanner-primary", "fingerprint": "7adde57eee598a0c", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-48889"]}}, {"ruleId": "scanner-cac348b5ce558978", "level": "warning", "message": {"text": "CVE-2026-28415: gradio 5.9.1 \u2014 aether-arena/space/requirements.txt"}, "properties": {"repobilityId": "19d1fac4fa6a41b3", "scanner": "scanner-primary", "fingerprint": "cac348b5ce558978", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-28415"]}}, {"ruleId": "scanner-d49225f5fcbc2224", "level": "note", "message": {"text": "CVE-2025-5320: gradio 5.9.1 \u2014 aether-arena/space/requirements.txt"}, "properties": {"repobilityId": "35d7dcb3b47ab1a1", "scanner": "scanner-primary", "fingerprint": "d49225f5fcbc2224", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-5320"]}}, {"ruleId": "scanner-c770d091d643e3df", "level": "note", "message": {"text": "CVE-2026-10783: gradio 5.9.1 \u2014 aether-arena/space/requirements.txt"}, "properties": {"repobilityId": "e60bab13755844b7", "scanner": "scanner-primary", "fingerprint": "c770d091d643e3df", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-10783"]}}, {"ruleId": "scanner-653ec223ae029bc1", "level": "note", "message": {"text": "CVE-2026-27167: gradio 5.9.1 \u2014 aether-arena/space/requirements.txt"}, "properties": {"repobilityId": "7017ef452b691ba6", "scanner": "scanner-primary", "fingerprint": "653ec223ae029bc1", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-27167"]}}, {"ruleId": "scanner-7eb0587d33dc7732", "level": "error", "message": {"text": "GHSA-36hh-v3qg-5jq4: pyo3 0.22.6 \u2014 python/Cargo.lock"}, "properties": {"repobilityId": "9846fadcd37ad112", "scanner": "scanner-primary", "fingerprint": "7eb0587d33dc7732", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-36hh-v3qg-5jq4"]}}, {"ruleId": "scanner-da7c66a3e5c8ffe1", "level": "warning", "message": {"text": "GHSA-chgr-c6px-7xpp: pyo3 0.22.6 \u2014 python/Cargo.lock"}, "properties": {"repobilityId": "d27427a15d356c1c", "scanner": "scanner-primary", "fingerprint": "da7c66a3e5c8ffe1", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-chgr-c6px-7xpp"]}}, {"ruleId": "scanner-a336ac1c886fca81", "level": "note", "message": {"text": "GHSA-pph8-gcv7-4qj5: pyo3 0.22.6 \u2014 python/Cargo.lock"}, "properties": {"repobilityId": "d1c02dedcf66cad0", "scanner": "scanner-primary", "fingerprint": "a336ac1c886fca81", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-pph8-gcv7-4qj5"]}}, {"ruleId": "scanner-410cf64286c7317a", "level": "warning", "message": {"text": "GHSA-frvp-7c67-39w9: @hono/node-server 1.19.14 \u2014 tools/ruview-mcp/package-lock.json"}, "properties": {"repobilityId": "ec12545f1a039d80", "scanner": "scanner-primary", "fingerprint": "410cf64286c7317a", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-frvp-7c67-39w9"]}}, {"ruleId": "scanner-7b93c6f207aeb97a", "level": "note", "message": {"text": "CVE-2026-12590: body-parser 2.2.2 \u2014 tools/ruview-mcp/package-lock.json"}, "properties": {"repobilityId": "ea45f24052441a57", "scanner": "scanner-primary", "fingerprint": "7b93c6f207aeb97a", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-12590"]}}, {"ruleId": "scanner-357c5cd09011724e", "level": "error", "message": {"text": "CVE-2026-13676: fast-uri 3.1.2 \u2014 tools/ruview-mcp/package-lock.json"}, "properties": {"repobilityId": "012f287da3e0d5a6", "scanner": "scanner-primary", "fingerprint": "357c5cd09011724e", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-13676"]}}, {"ruleId": "scanner-2347fdfc0a1a5aaf", "level": "error", "message": {"text": "CVE-2026-16221: fast-uri 3.1.2 \u2014 tools/ruview-mcp/package-lock.json"}, "properties": {"repobilityId": "c1947f734a228187", "scanner": "scanner-primary", "fingerprint": "2347fdfc0a1a5aaf", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-16221"]}}, {"ruleId": "scanner-90d852456d13e472", "level": "error", "message": {"text": "CVE-2026-54290: hono 4.12.21 \u2014 tools/ruview-mcp/package-lock.json"}, "properties": {"repobilityId": "b9981fe1210624dc", "scanner": "scanner-primary", "fingerprint": "90d852456d13e472", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-54290"]}}, {"ruleId": "scanner-10de9d905fa99bf3", "level": "warning", "message": {"text": "CVE-2026-54286: hono 4.12.21 \u2014 tools/ruview-mcp/package-lock.json"}, "properties": {"repobilityId": "3528d465039cc2b9", "scanner": "scanner-primary", "fingerprint": "10de9d905fa99bf3", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-54286"]}}, {"ruleId": "scanner-7de109c2876a6b2f", "level": "warning", "message": {"text": "CVE-2026-54287: hono 4.12.21 \u2014 tools/ruview-mcp/package-lock.json"}, "properties": {"repobilityId": "a0c74add7e1ef40c", "scanner": "scanner-primary", "fingerprint": "7de109c2876a6b2f", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-54287"]}}, {"ruleId": "scanner-1771116af149637d", "level": "warning", "message": {"text": "CVE-2026-54288: hono 4.12.21 \u2014 tools/ruview-mcp/package-lock.json"}, "properties": {"repobilityId": "2c9042db21623083", "scanner": "scanner-primary", "fingerprint": "1771116af149637d", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-54288"]}}, {"ruleId": "scanner-cd6dc4de7e043c9e", "level": "warning", "message": {"text": "CVE-2026-54289: hono 4.12.21 \u2014 tools/ruview-mcp/package-lock.json"}, "properties": {"repobilityId": "acb42704b41a0700", "scanner": "scanner-primary", "fingerprint": "cd6dc4de7e043c9e", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-54289"]}}, {"ruleId": "scanner-d45a296cfde0a436", "level": "warning", "message": {"text": "CVE-2026-59895: hono 4.12.21 \u2014 tools/ruview-mcp/package-lock.json"}, "properties": {"repobilityId": "967875893125ef33", "scanner": "scanner-primary", "fingerprint": "d45a296cfde0a436", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-59895"]}}, {"ruleId": "scanner-3f8356552eefbf72", "level": "warning", "message": {"text": "CVE-2026-59896: hono 4.12.21 \u2014 tools/ruview-mcp/package-lock.json"}, "properties": {"repobilityId": "a09668fdefaf78b4", "scanner": "scanner-primary", "fingerprint": "3f8356552eefbf72", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-59896"]}}, {"ruleId": "scanner-4fcf8aeb45bd85a4", "level": "warning", "message": {"text": "CVE-2026-59897: hono 4.12.21 \u2014 tools/ruview-mcp/package-lock.json"}, "properties": {"repobilityId": "8f02e840cdf9ffa1", "scanner": "scanner-primary", "fingerprint": "4fcf8aeb45bd85a4", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-59897"]}}, {"ruleId": "scanner-32c91dcdf7a3059d", "level": "note", "message": {"text": "CVE-2026-49356: @babel/core 7.29.0 \u2014 ui/mobile/package-lock.json"}, "properties": {"repobilityId": "13ab2509459372f0", "scanner": "scanner-primary", "fingerprint": "32c91dcdf7a3059d", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-49356"]}}, {"ruleId": "scanner-bfc18f6e1b61dc78", "level": "error", "message": {"text": "CVE-2026-44486: axios 1.15.2 \u2014 ui/mobile/package-lock.json"}, "properties": {"repobilityId": "9f346c82e724f91b", "scanner": "scanner-primary", "fingerprint": "bfc18f6e1b61dc78", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-44486"]}}, {"ruleId": "scanner-41d0cd8ca362ad8e", "level": "error", "message": {"text": "CVE-2026-44487: axios 1.15.2 \u2014 ui/mobile/package-lock.json"}, "properties": {"repobilityId": "16e901def241bb7e", "scanner": "scanner-primary", "fingerprint": "41d0cd8ca362ad8e", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-44487"]}}, {"ruleId": "scanner-4f76862949130970", "level": "error", "message": {"text": "CVE-2026-44488: axios 1.15.2 \u2014 ui/mobile/package-lock.json"}, "properties": {"repobilityId": "e7c25175e6f01fe6", "scanner": "scanner-primary", "fingerprint": "4f76862949130970", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-44488"]}}, {"ruleId": "scanner-1cd5c11821bf8d94", "level": "error", "message": {"text": "CVE-2026-44492: axios 1.15.2 \u2014 ui/mobile/package-lock.json"}, "properties": {"repobilityId": "1b1336e652f3cdc3", "scanner": "scanner-primary", "fingerprint": "1cd5c11821bf8d94", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-44492"]}}, {"ruleId": "scanner-1fd7ed54d518700c", "level": "error", "message": {"text": "CVE-2026-44494: axios 1.15.2 \u2014 ui/mobile/package-lock.json"}, "properties": {"repobilityId": "6a9c921843e1f764", "scanner": "scanner-primary", "fingerprint": "1fd7ed54d518700c", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-44494"]}}, {"ruleId": "scanner-4f2507865c2b1c32", "level": "error", "message": {"text": "CVE-2026-44496: axios 1.15.2 \u2014 ui/mobile/package-lock.json"}, "properties": {"repobilityId": "660711b6a8b2a022", "scanner": "scanner-primary", "fingerprint": "4f2507865c2b1c32", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-44496"]}}, {"ruleId": "scanner-8f61e4424b5ef3f4", "level": "error", "message": {"text": "GHSA-gcfj-64vw-6mp9: axios 1.15.2 \u2014 ui/mobile/package-lock.json"}, "properties": {"repobilityId": "e969116389dd440c", "scanner": "scanner-primary", "fingerprint": "8f61e4424b5ef3f4", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-gcfj-64vw-6mp9"]}}, {"ruleId": "scanner-e571e4307a21bdcb", "level": "warning", "message": {"text": "CVE-2026-44490: axios 1.15.2 \u2014 ui/mobile/package-lock.json"}, "properties": {"repobilityId": "2d6f2a51ab3833f3", "scanner": "scanner-primary", "fingerprint": "e571e4307a21bdcb", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-44490"]}}, {"ruleId": "scanner-570e319244c838d2", "level": "warning", "message": {"text": "GHSA-42h9-826w-cgv3: axios 1.15.2 \u2014 ui/mobile/package-lock.json"}, "properties": {"repobilityId": "33ede06f59b979a2", "scanner": "scanner-primary", "fingerprint": "570e319244c838d2", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-42h9-826w-cgv3"]}}, {"ruleId": "scanner-fa22a3bfc6ea9e0d", "level": "warning", "message": {"text": "GHSA-7q8q-rj6j-mhjq: axios 1.15.2 \u2014 ui/mobile/package-lock.json"}, "properties": {"repobilityId": "b2dcaed8d283e359", "scanner": "scanner-primary", "fingerprint": "fa22a3bfc6ea9e0d", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-7q8q-rj6j-mhjq"]}}, {"ruleId": "scanner-b4181efc23005404", "level": "warning", "message": {"text": "GHSA-f4gw-2p7v-4548: axios 1.15.2 \u2014 ui/mobile/package-lock.json"}, "properties": {"repobilityId": "b8b08a9e035a0fef", "scanner": "scanner-primary", "fingerprint": "b4181efc23005404", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-f4gw-2p7v-4548"]}}, {"ruleId": "scanner-17995062a6d383d2", "level": "warning", "message": {"text": "GHSA-hcpx-6fm6-wx23: axios 1.15.2 \u2014 ui/mobile/package-lock.json"}, "properties": {"repobilityId": "1d3ef0e91ceecaa3", "scanner": "scanner-primary", "fingerprint": "17995062a6d383d2", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-hcpx-6fm6-wx23"]}}, {"ruleId": "scanner-88a481fc6035d7c0", "level": "warning", "message": {"text": "GHSA-jqh4-m9w3-8hp9: axios 1.15.2 \u2014 ui/mobile/package-lock.json"}, "properties": {"repobilityId": "6864e459a9e42b4a", "scanner": "scanner-primary", "fingerprint": "88a481fc6035d7c0", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-jqh4-m9w3-8hp9"]}}, {"ruleId": "scanner-78da87c6f801f5b8", "level": "warning", "message": {"text": "GHSA-mmx7-hfxf-jppx: axios 1.15.2 \u2014 ui/mobile/package-lock.json"}, "properties": {"repobilityId": "3a392e16af1df9b1", "scanner": "scanner-primary", "fingerprint": "78da87c6f801f5b8", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-mmx7-hfxf-jppx"]}}, {"ruleId": "scanner-e45630fb571597e5", "level": "warning", "message": {"text": "GHSA-mwf2-3pr3-8698: axios 1.15.2 \u2014 ui/mobile/package-lock.json"}, "properties": {"repobilityId": "6ed08881ac92a2b6", "scanner": "scanner-primary", "fingerprint": "e45630fb571597e5", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-mwf2-3pr3-8698"]}}, {"ruleId": "scanner-f54ebf6bc8395d74", "level": "warning", "message": {"text": "GHSA-pmv8-rq9r-6j72: axios 1.15.2 \u2014 ui/mobile/package-lock.json"}, "properties": {"repobilityId": "e8215250c49e9c63", "scanner": "scanner-primary", "fingerprint": "f54ebf6bc8395d74", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-pmv8-rq9r-6j72"]}}, {"ruleId": "scanner-b4921970d90d6931", "level": "warning", "message": {"text": "GHSA-xj6q-8x83-jv6g: axios 1.15.2 \u2014 ui/mobile/package-lock.json"}, "properties": {"repobilityId": "bc3383fcb180ed8e", "scanner": "scanner-primary", "fingerprint": "b4921970d90d6931", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-xj6q-8x83-jv6g"]}}, {"ruleId": "scanner-75d0413ae8fe9fdd", "level": "note", "message": {"text": "CVE-2026-44489: axios 1.15.2 \u2014 ui/mobile/package-lock.json"}, "properties": {"repobilityId": "34f8af61ce7b3bbe", "scanner": "scanner-primary", "fingerprint": "75d0413ae8fe9fdd", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-44489"]}}, {"ruleId": "scanner-572725fca9e08098", "level": "error", "message": {"text": "CVE-2026-13149: brace-expansion 1.1.12 \u2014 ui/mobile/package-lock.json"}, "properties": {"repobilityId": "53e2fff5c76aeac4", "scanner": "scanner-primary", "fingerprint": "572725fca9e08098", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-13149"]}}, {"ruleId": "scanner-3c186b53b4e13032", "level": "warning", "message": {"text": "CVE-2026-33750: brace-expansion 1.1.12 \u2014 ui/mobile/package-lock.json"}, "properties": {"repobilityId": "b0c882ac2f5ba6f3", "scanner": "scanner-primary", "fingerprint": "3c186b53b4e13032", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-33750"]}}, {"ruleId": "scanner-93de580ca1210ad4", "level": "error", "message": {"text": "CVE-2026-13149: brace-expansion 5.0.4 \u2014 ui/mobile/package-lock.json"}, "properties": {"repobilityId": "53e2fff5c76aeac4", "scanner": "scanner-primary", "fingerprint": "93de580ca1210ad4", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-13149"]}}, {"ruleId": "scanner-6d49fd052be6b7ac", "level": "warning", "message": {"text": "CVE-2026-33750: brace-expansion 5.0.4 \u2014 ui/mobile/package-lock.json"}, "properties": {"repobilityId": "b0c882ac2f5ba6f3", "scanner": "scanner-primary", "fingerprint": "6d49fd052be6b7ac", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-33750"]}}, {"ruleId": "scanner-9874fe5189adbaad", "level": "warning", "message": {"text": "CVE-2026-45149: brace-expansion 5.0.4 \u2014 ui/mobile/package-lock.json"}, "properties": {"repobilityId": "b2173fe3611a6ef9", "scanner": "scanner-primary", "fingerprint": "9874fe5189adbaad", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-45149"]}}, {"ruleId": "scanner-2d504ec00baa3419", "level": "warning", "message": {"text": "GHSA-r4q5-vmmm-2653: follow-redirects 1.15.11 \u2014 ui/mobile/package-lock.json"}, "properties": {"repobilityId": "99fc2ab34de76c69", "scanner": "scanner-primary", "fingerprint": "2d504ec00baa3419", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-r4q5-vmmm-2653"]}}, {"ruleId": "scanner-23f50bd5c9fb77ab", "level": "error", "message": {"text": "CVE-2026-12143: form-data 4.0.5 \u2014 ui/mobile/package-lock.json"}, "properties": {"repobilityId": "0a39dd3ba3a393c4", "scanner": "scanner-primary", "fingerprint": "23f50bd5c9fb77ab", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-12143"]}}, {"ruleId": "scanner-d594b65c9a3d7aaf", "level": "error", "message": {"text": "CVE-2026-59869: js-yaml 4.1.1 \u2014 ui/mobile/package-lock.json"}, "properties": {"repobilityId": "a3b2f13e8ce64eeb", "scanner": "scanner-primary", "fingerprint": "d594b65c9a3d7aaf", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-59869"]}}, {"ruleId": "scanner-f1bbc3b1a5e227cf", "level": "warning", "message": {"text": "CVE-2026-53550: js-yaml 4.1.1 \u2014 ui/mobile/package-lock.json"}, "properties": {"repobilityId": "63b0882d1e92f35d", "scanner": "scanner-primary", "fingerprint": "f1bbc3b1a5e227cf", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-53550"]}}, {"ruleId": "scanner-f1b4176e41c8f9b0", "level": "warning", "message": {"text": "CVE-2026-41305: postcss 8.4.49 \u2014 ui/mobile/package-lock.json"}, "properties": {"repobilityId": "04a99d86b45c83c2", "scanner": "scanner-primary", "fingerprint": "f1b4176e41c8f9b0", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-41305"]}}, {"ruleId": "scanner-e5065b865f163197", "level": "error", "message": {"text": "CVE-2026-9277: shell-quote 1.8.3 \u2014 ui/mobile/package-lock.json"}, "properties": {"repobilityId": "48c0fc4aac57b4e4", "scanner": "scanner-primary", "fingerprint": "e5065b865f163197", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-9277"]}}, {"ruleId": "scanner-a9e796ddfd2e86df", "level": "error", "message": {"text": "CVE-2026-13311: shell-quote 1.8.3 \u2014 ui/mobile/package-lock.json"}, "properties": {"repobilityId": "8b5b53d7cbdac679", "scanner": "scanner-primary", "fingerprint": "a9e796ddfd2e86df", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-13311"]}}, {"ruleId": "scanner-4e8ffef7ffec545d", "level": "warning", "message": {"text": "CVE-2026-41907: uuid 7.0.3 \u2014 ui/mobile/package-lock.json"}, "properties": {"repobilityId": "278251a30fbc3ecf", "scanner": "scanner-primary", "fingerprint": "4e8ffef7ffec545d", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-41907"]}}, {"ruleId": "scanner-59b8bcd3f7036b1c", "level": "error", "message": {"text": "CVE-2026-48779: ws 7.5.10 \u2014 ui/mobile/package-lock.json"}, "properties": {"repobilityId": "b698eabb7940ac37", "scanner": "scanner-primary", "fingerprint": "59b8bcd3f7036b1c", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-48779"]}}, {"ruleId": "scanner-79caab45063d4fc3", "level": "error", "message": {"text": "CVE-2026-48779: ws 8.19.0 \u2014 ui/mobile/package-lock.json"}, "properties": {"repobilityId": "b698eabb7940ac37", "scanner": "scanner-primary", "fingerprint": "79caab45063d4fc3", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-48779"]}}, {"ruleId": "scanner-25e960b140185a89", "level": "warning", "message": {"text": "CVE-2026-45736: ws 8.19.0 \u2014 ui/mobile/package-lock.json"}, "properties": {"repobilityId": "89e0a7b30ddb0a4b", "scanner": "scanner-primary", "fingerprint": "25e960b140185a89", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-45736"]}}, {"ruleId": "scanner-aaeb6ee67d225d7e", "level": "warning", "message": {"text": "CVE-2026-33532: yaml 2.8.2 \u2014 ui/mobile/package-lock.json"}, "properties": {"repobilityId": "31e28b7a9f0bd54f", "scanner": "scanner-primary", "fingerprint": "aaeb6ee67d225d7e", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-33532"]}}, {"ruleId": "scanner-c9bcf62777f61505", "level": "warning", "message": {"text": "GHSA-wrw7-89jp-8q8g: glib 0.18.5 \u2014 v2/Cargo.lock"}, "properties": {"repobilityId": "0efe3e08c7d75bf4", "scanner": "scanner-primary", "fingerprint": "c9bcf62777f61505", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-wrw7-89jp-8q8g"]}}, {"ruleId": "scanner-3a086debfbb6af0b", "level": "note", "message": {"text": "GHSA-rhfx-m35p-ff5j: lru 0.12.5 \u2014 v2/Cargo.lock"}, "properties": {"repobilityId": "d79a8932f0161b0b", "scanner": "scanner-primary", "fingerprint": "3a086debfbb6af0b", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-rhfx-m35p-ff5j"]}}, {"ruleId": "scanner-bd08c3d70cbe69dd", "level": "error", "message": {"text": "CVE-2026-31812: quinn-proto 0.11.13 \u2014 v2/Cargo.lock"}, "properties": {"repobilityId": "af980b811f58e2b7", "scanner": "scanner-primary", "fingerprint": "bd08c3d70cbe69dd", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-31812"]}}, {"ruleId": "scanner-4608de8edf5c0606", "level": "note", "message": {"text": "GHSA-cq8v-f236-94qc: rand 0.7.3 \u2014 v2/Cargo.lock"}, "properties": {"repobilityId": "79ed665f347628bf", "scanner": "scanner-primary", "fingerprint": "4608de8edf5c0606", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-cq8v-f236-94qc"]}}, {"ruleId": "scanner-2f5d57ed470314bc", "level": "note", "message": {"text": "GHSA-cq8v-f236-94qc: rand 0.8.5 \u2014 v2/Cargo.lock"}, "properties": {"repobilityId": "79ed665f347628bf", "scanner": "scanner-primary", "fingerprint": "2f5d57ed470314bc", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-cq8v-f236-94qc"]}}, {"ruleId": "scanner-287d16650f63ce0d", "level": "note", "message": {"text": "GHSA-cq8v-f236-94qc: rand 0.9.2 \u2014 v2/Cargo.lock"}, "properties": {"repobilityId": "79ed665f347628bf", "scanner": "scanner-primary", "fingerprint": "287d16650f63ce0d", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-cq8v-f236-94qc"]}}, {"ruleId": "scanner-645ac750b169c31d", "level": "warning", "message": {"text": "GHSA-vfvv-c25p-m7mm: rkyv 0.8.15 \u2014 v2/Cargo.lock"}, "properties": {"repobilityId": "c344ee576993fdaa", "scanner": "scanner-primary", "fingerprint": "645ac750b169c31d", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-vfvv-c25p-m7mm"]}}, {"ruleId": "scanner-b8d94b3d56abe930", "level": "error", "message": {"text": "GHSA-82j2-j2ch-gfr8: rustls-webpki 0.101.7 \u2014 v2/Cargo.lock"}, "properties": {"repobilityId": "3ed0feef08aa4847", "scanner": "scanner-primary", "fingerprint": "b8d94b3d56abe930", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-82j2-j2ch-gfr8"]}}, {"ruleId": "scanner-1c0dba1ea026708d", "level": "note", "message": {"text": "GHSA-965h-392x-2mh5: rustls-webpki 0.101.7 \u2014 v2/Cargo.lock"}, "properties": {"repobilityId": "3be940ebe300c6e1", "scanner": "scanner-primary", "fingerprint": "1c0dba1ea026708d", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-965h-392x-2mh5"]}}, {"ruleId": "scanner-0c827a90da12221b", "level": "note", "message": {"text": "GHSA-xgp8-3hg3-c2mh: rustls-webpki 0.101.7 \u2014 v2/Cargo.lock"}, "properties": {"repobilityId": "2af16c8e695ac6f9", "scanner": "scanner-primary", "fingerprint": "0c827a90da12221b", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-xgp8-3hg3-c2mh"]}}, {"ruleId": "scanner-132e297703cc1b09", "level": "error", "message": {"text": "GHSA-82j2-j2ch-gfr8: rustls-webpki 0.102.8 \u2014 v2/Cargo.lock"}, "properties": {"repobilityId": "3ed0feef08aa4847", "scanner": "scanner-primary", "fingerprint": "132e297703cc1b09", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-82j2-j2ch-gfr8"]}}, {"ruleId": "scanner-4f858743aa984d6a", "level": "warning", "message": {"text": "GHSA-pwjx-qhcg-rvj4: rustls-webpki 0.102.8 \u2014 v2/Cargo.lock"}, "properties": {"repobilityId": "8d4bfc457ad603de", "scanner": "scanner-primary", "fingerprint": "4f858743aa984d6a", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-pwjx-qhcg-rvj4"]}}, {"ruleId": "scanner-165c0a13967b3ecf", "level": "note", "message": {"text": "GHSA-965h-392x-2mh5: rustls-webpki 0.102.8 \u2014 v2/Cargo.lock"}, "properties": {"repobilityId": "3be940ebe300c6e1", "scanner": "scanner-primary", "fingerprint": "165c0a13967b3ecf", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-965h-392x-2mh5"]}}, {"ruleId": "scanner-275d0eb07e28d915", "level": "note", "message": {"text": "GHSA-xgp8-3hg3-c2mh: rustls-webpki 0.102.8 \u2014 v2/Cargo.lock"}, "properties": {"repobilityId": "2af16c8e695ac6f9", "scanner": "scanner-primary", "fingerprint": "275d0eb07e28d915", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-xgp8-3hg3-c2mh"]}}, {"ruleId": "scanner-448bb5df44dc09b3", "level": "warning", "message": {"text": "GHSA-7gcf-g7xr-8hxj: serde_with 3.17.0 \u2014 v2/Cargo.lock"}, "properties": {"repobilityId": "b13122aea5c0bfc6", "scanner": "scanner-primary", "fingerprint": "448bb5df44dc09b3", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-7gcf-g7xr-8hxj"]}}, {"ruleId": "scanner-28455b4bc8f7bd71", "level": "note", "message": {"text": "CVE-2024-58266: shlex 0.1.1 \u2014 v2/Cargo.lock"}, "properties": {"repobilityId": "50f45d8579aeec43", "scanner": "scanner-primary", "fingerprint": "28455b4bc8f7bd71", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2024-58266"]}}, {"ruleId": "scanner-315735c1dcce390d", "level": "warning", "message": {"text": "GHSA-3pv8-6f4r-ffg2: tar 0.4.45 \u2014 v2/Cargo.lock"}, "properties": {"repobilityId": "ac77a2849f015564", "scanner": "scanner-primary", "fingerprint": "315735c1dcce390d", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-3pv8-6f4r-ffg2"]}}, {"ruleId": "scanner-98add9fd63cbe1cd", "level": "warning", "message": {"text": "CVE-2026-42184: tauri 2.10.3 \u2014 v2/Cargo.lock"}, "properties": {"repobilityId": "a56290c541d055ad", "scanner": "scanner-primary", "fingerprint": "98add9fd63cbe1cd", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-42184"]}}, {"ruleId": "scanner-9f841459602c9b33", "level": "error", "message": {"text": "CVE-2022-39974: wasm3 0.3.1 \u2014 v2/Cargo.lock"}, "properties": {"repobilityId": "dc3f0c3889571405", "scanner": "scanner-primary", "fingerprint": "9f841459602c9b33", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2022-39974"]}}, {"ruleId": "scanner-92838106c5b834fe", "level": "warning", "message": {"text": "CVE-2022-34529: wasm3 0.3.1 \u2014 v2/Cargo.lock"}, "properties": {"repobilityId": "b50a77eb78fc419a", "scanner": "scanner-primary", "fingerprint": "92838106c5b834fe", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2022-34529"]}}, {"ruleId": "scanner-74ac613e7e120928", "level": "warning", "message": {"text": "CVE-2024-27529: wasm3 0.3.1 \u2014 v2/Cargo.lock"}, "properties": {"repobilityId": "c9284abea0dc06f6", "scanner": "scanner-primary", "fingerprint": "74ac613e7e120928", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2024-27529"]}}, {"ruleId": "scanner-4a3c26043925246a", "level": "warning", "message": {"text": "CVE-2026-44216: wasmtime 42.0.2 \u2014 v2/Cargo.lock"}, "properties": {"repobilityId": "c7d318ad71771646", "scanner": "scanner-primary", "fingerprint": "4a3c26043925246a", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-44216"]}}, {"ruleId": "scanner-07ded30f5ea99bc8", "level": "warning", "message": {"text": "CVE-2026-25541: bytes 1.11.0 \u2014 v2/patches/ruvector-crv/Cargo.lock"}, "properties": {"repobilityId": "9b79e4c9c7766940", "scanner": "scanner-primary", "fingerprint": "07ded30f5ea99bc8", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-25541"]}}, {"ruleId": "scanner-60b25026c88a595b", "level": "note", "message": {"text": "GHSA-cq8v-f236-94qc: rand 0.8.5 \u2014 v2/patches/ruvector-crv/Cargo.lock"}, "properties": {"repobilityId": "29660e8409d5d119", "scanner": "scanner-primary", "fingerprint": "60b25026c88a595b", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-cq8v-f236-94qc"]}}, {"ruleId": "scanner-7d6d199d2d727225", "level": "warning", "message": {"text": "GHSA-vfvv-c25p-m7mm: rkyv 0.8.12 \u2014 v2/patches/ruvector-crv/Cargo.lock"}, "properties": {"repobilityId": "c4496886f3a69806", "scanner": "scanner-primary", "fingerprint": "7d6d199d2d727225", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-vfvv-c25p-m7mm"]}}, {"ruleId": "scanner-8a97d8d1d649617e", "level": "error", "message": {"text": "DS-0002: Image user should not be 'root' \u2014 docker/Dockerfile.python"}, "properties": {"repobilityId": "6c16a34488e0ade9", "scanner": "scanner-primary", "fingerprint": "8a97d8d1d649617e", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "misconfig"]}}, {"ruleId": "scanner-18fdfdc8a4eb56ed", "level": "note", "message": {"text": "DS-0026: No HEALTHCHECK defined \u2014 docker/Dockerfile.python"}, "properties": {"repobilityId": "3a792dbd29870f6c", "scanner": "scanner-primary", "fingerprint": "18fdfdc8a4eb56ed", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "misconfig"]}}, {"ruleId": "scanner-002a58f53a03ede1", "level": "error", "message": {"text": "DS-0002: Image user should not be 'root' \u2014 docker/Dockerfile.rust"}, "properties": {"repobilityId": "c08f145645885bed", "scanner": "scanner-primary", "fingerprint": "002a58f53a03ede1", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "misconfig"]}}, {"ruleId": "scanner-8e1556b9e68c13a4", "level": "note", "message": {"text": "DS-0026: No HEALTHCHECK defined \u2014 docker/Dockerfile.rust"}, "properties": {"repobilityId": "8b403905d4fa9bb5", "scanner": "scanner-primary", "fingerprint": "8e1556b9e68c13a4", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "misconfig"]}}, {"ruleId": "scanner-49ffd3aff8b8a921", "level": "error", "message": {"text": "DS-0031: Secrets passed via `build-args` or envs or copied secret files \u2014 docker/Dockerfile.rust"}, "properties": {"repobilityId": "c5e89ca6b1daaa99", "scanner": "scanner-primary", "fingerprint": "49ffd3aff8b8a921", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["trivy", "misconfig"]}}, {"ruleId": "scanner-6f6e99adfe23e933", "level": "warning", "message": {"text": "KSV-0001: Can elevate its own privileges \u2014 logging/fluentd-config.yml"}, "properties": {"repobilityId": "da261af7a6a68a38", "scanner": "scanner-primary", "fingerprint": "6f6e99adfe23e933", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "misconfig"]}}, {"ruleId": "scanner-9d4e60ff2d70ff01", "level": "note", "message": {"text": "KSV-0003: Default capabilities: some containers do not drop all \u2014 logging/fluentd-config.yml"}, "properties": {"repobilityId": "f919c19da796d063", "scanner": "scanner-primary", "fingerprint": "9d4e60ff2d70ff01", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "misconfig"]}}, {"ruleId": "scanner-c5e6ba9da3028453", "level": "note", "message": {"text": "KSV-0004: Default capabilities: some containers do not drop any \u2014 logging/fluentd-config.yml"}, "properties": {"repobilityId": "bdd2b36e3d831713", "scanner": "scanner-primary", "fingerprint": "c5e6ba9da3028453", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "misconfig"]}}, {"ruleId": "scanner-9826465df4ac34b3", "level": "warning", "message": {"text": "KSV-0012: Runs as root user \u2014 logging/fluentd-config.yml"}, "properties": {"repobilityId": "eb2575bac9c6527d", "scanner": "scanner-primary", "fingerprint": "9826465df4ac34b3", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "misconfig"]}}, {"ruleId": "scanner-42127da9f745774b", "level": "error", "message": {"text": "KSV-0014: Root file system is not read-only \u2014 logging/fluentd-config.yml"}, "properties": {"repobilityId": "074bb51cd9b3b96b", "scanner": "scanner-primary", "fingerprint": "42127da9f745774b", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "misconfig"]}}, {"ruleId": "scanner-fcd951ec11cef8b8", "level": "note", "message": {"text": "KSV-0020: Runs with UID <= 10000 \u2014 logging/fluentd-config.yml"}, "properties": {"repobilityId": "a07d1b2db651408d", "scanner": "scanner-primary", "fingerprint": "fcd951ec11cef8b8", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "misconfig"]}}, {"ruleId": "scanner-58a0c3cdda191e36", "level": "note", "message": {"text": "KSV-0021: Runs with GID <= 10000 \u2014 logging/fluentd-config.yml"}, "properties": {"repobilityId": "c964eee7824c8fca", "scanner": "scanner-primary", "fingerprint": "58a0c3cdda191e36", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "misconfig"]}}, {"ruleId": "scanner-dd0ecc43a914742b", "level": "warning", "message": {"text": "KSV-0023: hostPath volumes mounted \u2014 logging/fluentd-config.yml"}, "properties": {"repobilityId": "e7b6d6f74c52ed86", "scanner": "scanner-primary", "fingerprint": "dd0ecc43a914742b", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "misconfig"]}}, {"ruleId": "scanner-44f4bf69a36d0991", "level": "note", "message": {"text": "KSV-0030: Runtime/Default Seccomp profile not set \u2014 logging/fluentd-config.yml"}, "properties": {"repobilityId": "1d02f2e7078aeec9", "scanner": "scanner-primary", "fingerprint": "44f4bf69a36d0991", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "misconfig"]}}, {"ruleId": "scanner-0847940ec5498e75", "level": "warning", "message": {"text": "KSV-0037: User resources should not be placed in kube-system namespace \u2014 logging/fluentd-config.yml"}, "properties": {"repobilityId": "92b57f973f67b31c", "scanner": "scanner-primary", "fingerprint": "0847940ec5498e75", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "misconfig"]}}, {"ruleId": "scanner-1cb0309121f5a5ff", "level": "warning", "message": {"text": "KSV-0104: Seccomp policies disabled \u2014 logging/fluentd-config.yml"}, "properties": {"repobilityId": "f8ea3fcbff8eb148", "scanner": "scanner-primary", "fingerprint": "1cb0309121f5a5ff", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "misconfig"]}}, {"ruleId": "scanner-b1b21e8a99340b75", "level": "note", "message": {"text": "KSV-0106: Container capabilities must only include NET_BIND_SERVICE \u2014 logging/fluentd-config.yml"}, "properties": {"repobilityId": "1d1d48f4fdbc8d5c", "scanner": "scanner-primary", "fingerprint": "b1b21e8a99340b75", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "misconfig"]}}, {"ruleId": "scanner-d66029db5848aac9", "level": "error", "message": {"text": "KSV-0118: Default security context configured \u2014 logging/fluentd-config.yml"}, "properties": {"repobilityId": "818fccb5fd91cfd4", "scanner": "scanner-primary", "fingerprint": "d66029db5848aac9", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "misconfig"]}}, {"ruleId": "scanner-7619548f4fa51cdc", "level": "warning", "message": {"text": "KSV-0125: Restrict container images to trusted registries \u2014 logging/fluentd-config.yml"}, "properties": {"repobilityId": "e6bbc73c22dc20a8", "scanner": "scanner-primary", "fingerprint": "7619548f4fa51cdc", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "misconfig"]}}, {"ruleId": "scanner-cc55229a7a3c078d", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .mcp.json"}, "properties": {"repobilityId": "51942fb3d5b8b5b4", "scanner": "scanner-primary", "fingerprint": "cc55229a7a3c078d", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "mcp_config"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".mcp.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-bea357a6497a2d5d", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: CLAUDE.md"}, "properties": {"repobilityId": "aae72df3934829ac", "scanner": "scanner-primary", "fingerprint": "bea357a6497a2d5d", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "CLAUDE.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-24f2ea4bd14badc1", "level": "warning", "message": {"text": "Agent instruction contains unpinned remote install: CLAUDE.md"}, "properties": {"repobilityId": "0f6049734704e537", "scanner": "scanner-primary", "fingerprint": "24f2ea4bd14badc1", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "supply-chain", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "CLAUDE.md"}, "region": {"startLine": 402}}}]}, {"ruleId": "scanner-122f91b7f2906dc4", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/settings.json"}, "properties": {"repobilityId": "a2967269048b6a9d", "scanner": "scanner-primary", "fingerprint": "122f91b7f2906dc4", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/settings.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e2d5ba504ad8cc73", "level": "warning", "message": {"text": "Agent instruction contains unpinned remote install: .claude/commands/claude-flow-help.md"}, "properties": {"repobilityId": "fd7fbbcda7215758", "scanner": "scanner-primary", "fingerprint": "e2d5ba504ad8cc73", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "supply-chain", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/commands/claude-flow-help.md"}, "region": {"startLine": 69}}}]}, {"ruleId": "scanner-133522674206264c", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/commands/automation/smart-spawn.md"}, "properties": {"repobilityId": "536df4c8df0c04b7", "scanner": "scanner-primary", "fingerprint": "133522674206264c", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/commands/automation/smart-spawn.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-943b1b5c941fc9b4", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/commands/automation/workflow-select.md"}, "properties": {"repobilityId": "8d3698e3d562e6d8", "scanner": "scanner-primary", "fingerprint": "943b1b5c941fc9b4", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/commands/automation/workflow-select.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-2e5cf38d9fb6f954", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/commands/automation/smart-agents.md"}, "properties": {"repobilityId": "87cef96ea8c3e79a", "scanner": "scanner-primary", "fingerprint": "2e5cf38d9fb6f954", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/commands/automation/smart-agents.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-fd95ed8feae32ca7", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/commands/monitoring/status.md"}, "properties": {"repobilityId": "e3a5e1a05eedaefe", "scanner": "scanner-primary", "fingerprint": "fd95ed8feae32ca7", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/commands/monitoring/status.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-197f2e1f333a466e", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/commands/monitoring/agent-metrics.md"}, "properties": {"repobilityId": "a86e7930bf529d54", "scanner": "scanner-primary", "fingerprint": "197f2e1f333a466e", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/commands/monitoring/agent-metrics.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e836aeb64cdfe6d5", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/commands/monitoring/swarm-monitor.md"}, "properties": {"repobilityId": "034bb836588a8350", "scanner": "scanner-primary", "fingerprint": "e836aeb64cdfe6d5", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/commands/monitoring/swarm-monitor.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-0e99365509cea0e5", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/commands/monitoring/real-time-view.md"}, "properties": {"repobilityId": "7336d68161594ed4", "scanner": "scanner-primary", "fingerprint": "0e99365509cea0e5", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/commands/monitoring/real-time-view.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-17bf2bdb3e215bda", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/commands/monitoring/agents.md"}, "properties": {"repobilityId": "82702ce0693735a5", "scanner": "scanner-primary", "fingerprint": "17bf2bdb3e215bda", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/commands/monitoring/agents.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-4d71cd6e47c02529", "level": "error", "message": {"text": "Agent instruction/config may expose a secret: .claude/commands/github/issue-tracker.md"}, "properties": {"repobilityId": "4866e12709384ba2", "scanner": "scanner-primary", "fingerprint": "4d71cd6e47c02529", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["agent-instructions", "secrets", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/commands/github/issue-tracker.md"}, "region": {"startLine": 68}}}]}, {"ruleId": "scanner-a48f0a7a322b4fc3", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/commands/github/repo-analyze.md"}, "properties": {"repobilityId": "ca07a5806f63bd5a", "scanner": "scanner-primary", "fingerprint": "a48f0a7a322b4fc3", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/commands/github/repo-analyze.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-46e699e02194410f", "level": "error", "message": {"text": "Agent instruction/config may expose a secret: .claude/commands/github/sync-coordinator.md"}, "properties": {"repobilityId": "81be617de2cb32a0", "scanner": "scanner-primary", "fingerprint": "46e699e02194410f", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["agent-instructions", "secrets", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/commands/github/sync-coordinator.md"}, "region": {"startLine": 78}}}]}, {"ruleId": "scanner-74dbb6bacaa064ee", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/commands/github/pr-enhance.md"}, "properties": {"repobilityId": "2f137dc91f714ad8", "scanner": "scanner-primary", "fingerprint": "74dbb6bacaa064ee", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/commands/github/pr-enhance.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-be6f6fc1affd2640", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/commands/github/issue-triage.md"}, "properties": {"repobilityId": "ed805952ecf99404", "scanner": "scanner-primary", "fingerprint": "be6f6fc1affd2640", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/commands/github/issue-triage.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f7e4ace6dab989c8", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/commands/github/code-review.md"}, "properties": {"repobilityId": "cedbfb38c6cf00e5", "scanner": "scanner-primary", "fingerprint": "f7e4ace6dab989c8", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/commands/github/code-review.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-9d5c01a7a814dd1f", "level": "error", "message": {"text": "Agent instruction/config may expose a secret: .claude/commands/github/release-manager.md"}, "properties": {"repobilityId": "f174d24994a3ca72", "scanner": "scanner-primary", "fingerprint": "9d5c01a7a814dd1f", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["agent-instructions", "secrets", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/commands/github/release-manager.md"}, "region": {"startLine": 227}}}]}, {"ruleId": "scanner-96e852ec787b8741", "level": "error", "message": {"text": "Agent instruction/config may expose a secret: .claude/commands/github/repo-architect.md"}, "properties": {"repobilityId": "683670a6002db808", "scanner": "scanner-primary", "fingerprint": "96e852ec787b8741", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["agent-instructions", "secrets", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/commands/github/repo-architect.md"}, "region": {"startLine": 228}}}]}, {"ruleId": "scanner-a38504332b02e084", "level": "error", "message": {"text": "Agent instruction/config may expose a secret: .claude/commands/github/pr-manager.md"}, "properties": {"repobilityId": "53b1ab1acf87a7f0", "scanner": "scanner-primary", "fingerprint": "a38504332b02e084", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["agent-instructions", "secrets", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/commands/github/pr-manager.md"}, "region": {"startLine": 92}}}]}, {"ruleId": "scanner-fadb96a708125716", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/commands/github/swarm-issue.md"}, "properties": {"repobilityId": "7e2d9ee6e9b92df1", "scanner": "scanner-primary", "fingerprint": "fadb96a708125716", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/commands/github/swarm-issue.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-54f30e6a9ab71fa5", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/commands/github/project-board-sync.md"}, "properties": {"repobilityId": "3bf19fd9bb552b09", "scanner": "scanner-primary", "fingerprint": "54f30e6a9ab71fa5", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/commands/github/project-board-sync.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d778eb83136e55c5", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/commands/analysis/token-efficiency.md"}, "properties": {"repobilityId": "66a08b1adf6ee0e0", "scanner": "scanner-primary", "fingerprint": "d778eb83136e55c5", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/commands/analysis/token-efficiency.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3f96df1e6af32a81", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/commands/analysis/performance-report.md"}, "properties": {"repobilityId": "11fd6830d1e1403e", "scanner": "scanner-primary", "fingerprint": "3f96df1e6af32a81", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/commands/analysis/performance-report.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-62f9d659cb6b42aa", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/commands/analysis/COMMAND_COMPLIANCE_REPORT.md"}, "properties": {"repobilityId": "1a33067f5519c2a0", "scanner": "scanner-primary", "fingerprint": "62f9d659cb6b42aa", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/commands/analysis/COMMAND_COMPLIANCE_REPORT.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-cd5713fd6351dd24", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/commands/analysis/token-usage.md"}, "properties": {"repobilityId": "94449dd1636cbc86", "scanner": "scanner-primary", "fingerprint": "cd5713fd6351dd24", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/commands/analysis/token-usage.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-18fb49cea8f73784", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/commands/analysis/bottleneck-detect.md"}, "properties": {"repobilityId": "ae7532f911dc1185", "scanner": "scanner-primary", "fingerprint": "18fb49cea8f73784", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/commands/analysis/bottleneck-detect.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-678f0006e3f742bd", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/commands/optimization/auto-topology.md"}, "properties": {"repobilityId": "94c10e342dacaf74", "scanner": "scanner-primary", "fingerprint": "678f0006e3f742bd", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/commands/optimization/auto-topology.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-7b91db97d1267c82", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/commands/optimization/README.md"}, "properties": {"repobilityId": "fced2458fbe38795", "scanner": "scanner-primary", "fingerprint": "7b91db97d1267c82", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/commands/optimization/README.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-984755b4953bba20", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/commands/optimization/topology-optimize.md"}, "properties": {"repobilityId": "177d7abb2467b687", "scanner": "scanner-primary", "fingerprint": "984755b4953bba20", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/commands/optimization/topology-optimize.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-2b5a994140b678e1", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/commands/optimization/parallel-execute.md"}, "properties": {"repobilityId": "0d12a2b1fe85834e", "scanner": "scanner-primary", "fingerprint": "2b5a994140b678e1", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/commands/optimization/parallel-execute.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-5ecd9dbc8e691615", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/commands/optimization/cache-manage.md"}, "properties": {"repobilityId": "639f089d6dff5df9", "scanner": "scanner-primary", "fingerprint": "5ecd9dbc8e691615", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/commands/optimization/cache-manage.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-58e1f00dd6a50d82", "level": "error", "message": {"text": "Agent instruction/config may expose a secret: .claude/commands/hooks/post-task.md"}, "properties": {"repobilityId": "68700d5afea7bc6d", "scanner": "scanner-primary", "fingerprint": "58e1f00dd6a50d82", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["agent-instructions", "secrets", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/commands/hooks/post-task.md"}, "region": {"startLine": 103}}}]}, {"ruleId": "scanner-786493ca2daa6c83", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/commands/hooks/post-task.md"}, "properties": {"repobilityId": "125cae6b6e0abbca", "scanner": "scanner-primary", "fingerprint": "786493ca2daa6c83", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/commands/hooks/post-task.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d17cebdb2d322e78", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/commands/hooks/pre-task.md"}, "properties": {"repobilityId": "992eb04e79519370", "scanner": "scanner-primary", "fingerprint": "d17cebdb2d322e78", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/commands/hooks/pre-task.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-8b5937b7ffe10288", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/commands/hooks/session-end.md"}, "properties": {"repobilityId": "952dd41c46d0f1b0", "scanner": "scanner-primary", "fingerprint": "8b5937b7ffe10288", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/commands/hooks/session-end.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-cf983c6eea41bf76", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/commands/hooks/post-edit.md"}, "properties": {"repobilityId": "59a4f997a5ec73fd", "scanner": "scanner-primary", "fingerprint": "cf983c6eea41bf76", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/commands/hooks/post-edit.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-9b55f692e2f5a4b2", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/commands/sparc/innovator.md"}, "properties": {"repobilityId": "8187913755745611", "scanner": "scanner-primary", "fingerprint": "9b55f692e2f5a4b2", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/commands/sparc/innovator.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-145b25e83dfae7c1", "level": "error", "message": {"text": "Agent instruction/config may expose a secret: .claude/commands/sparc/tutorial.md"}, "properties": {"repobilityId": "dab740b8b5bdf7da", "scanner": "scanner-primary", "fingerprint": "145b25e83dfae7c1", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["agent-instructions", "secrets", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/commands/sparc/tutorial.md"}, "region": {"startLine": 59}}}]}, {"ruleId": "scanner-aea9ce8500651411", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/commands/sparc/tutorial.md"}, "properties": {"repobilityId": "7145f5a8f436528d", "scanner": "scanner-primary", "fingerprint": "aea9ce8500651411", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/commands/sparc/tutorial.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-56e25ec61fbe48c6", "level": "error", "message": {"text": "Agent instruction/config may expose a secret: .claude/commands/sparc/code.md"}, "properties": {"repobilityId": "93e6bd13a54c6bc3", "scanner": "scanner-primary", "fingerprint": "56e25ec61fbe48c6", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["agent-instructions", "secrets", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/commands/sparc/code.md"}, "region": {"startLine": 69}}}]}, {"ruleId": "scanner-9a1e2a0d2f2fee34", "level": "error", "message": {"text": "Agent instruction/config may expose a secret: .claude/commands/sparc/sparc.md"}, "properties": {"repobilityId": "6772e9e1210253e3", "scanner": "scanner-primary", "fingerprint": "9a1e2a0d2f2fee34", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["agent-instructions", "secrets", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/commands/sparc/sparc.md"}, "region": {"startLine": 91}}}]}, {"ruleId": "scanner-03086e0a7e44b2e6", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/commands/sparc/batch-executor.md"}, "properties": {"repobilityId": "353b7ca679f77b71", "scanner": "scanner-primary", "fingerprint": "03086e0a7e44b2e6", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/commands/sparc/batch-executor.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ffea67f8ea442865", "level": "error", "message": {"text": "Agent instruction/config may expose a secret: .claude/commands/sparc/post-deployment-monitoring-mode.md"}, "properties": {"repobilityId": "9b68977eaeeea953", "scanner": "scanner-primary", "fingerprint": "ffea67f8ea442865", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["agent-instructions", "secrets", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/commands/sparc/post-deployment-monitoring-mode.md"}, "region": {"startLine": 63}}}]}, {"ruleId": "scanner-62660382aa28e045", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/commands/sparc/post-deployment-monitoring-mode.md"}, "properties": {"repobilityId": "df0ad84f24f8a6f0", "scanner": "scanner-primary", "fingerprint": "62660382aa28e045", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/commands/sparc/post-deployment-monitoring-mode.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-9f238695ce7739da", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/commands/sparc/documenter.md"}, "properties": {"repobilityId": "7308e296c6c34587", "scanner": "scanner-primary", "fingerprint": "9f238695ce7739da", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/commands/sparc/documenter.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-fc86c8b7b9fe2245", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/commands/sparc/designer.md"}, "properties": {"repobilityId": "21e19a9b7eb34fc9", "scanner": "scanner-primary", "fingerprint": "fc86c8b7b9fe2245", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/commands/sparc/designer.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-880c8be4effa2bda", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/commands/sparc/architect.md"}, "properties": {"repobilityId": "cc93d4627e5dfea9", "scanner": "scanner-primary", "fingerprint": "880c8be4effa2bda", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/commands/sparc/architect.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-1b2f2449b22375e8", "level": "error", "message": {"text": "Agent instruction/config may expose a secret: .claude/commands/sparc/refinement-optimization-mode.md"}, "properties": {"repobilityId": "9b49de95cd2ab92c", "scanner": "scanner-primary", "fingerprint": "1b2f2449b22375e8", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["agent-instructions", "secrets", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/commands/sparc/refinement-optimization-mode.md"}, "region": {"startLine": 63}}}]}, {"ruleId": "scanner-f14bb75e6f4acd31", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/commands/sparc/refinement-optimization-mode.md"}, "properties": {"repobilityId": "7d4978d255f6566d", "scanner": "scanner-primary", "fingerprint": "f14bb75e6f4acd31", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/commands/sparc/refinement-optimization-mode.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-811fd948456e9b41", "level": "error", "message": {"text": "Agent instruction/config may expose a secret: .claude/commands/sparc/docs-writer.md"}, "properties": {"repobilityId": "15afc8914caa4af0", "scanner": "scanner-primary", "fingerprint": "811fd948456e9b41", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["agent-instructions", "secrets", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/commands/sparc/docs-writer.md"}, "region": {"startLine": 60}}}]}, {"ruleId": "scanner-c55825c879d8d930", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/commands/sparc/docs-writer.md"}, "properties": {"repobilityId": "f5947a7f835fc12f", "scanner": "scanner-primary", "fingerprint": "c55825c879d8d930", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/commands/sparc/docs-writer.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-34a932f2da704d40", "level": "error", "message": {"text": "Agent instruction/config may expose a secret: .claude/commands/sparc/integration.md"}, "properties": {"repobilityId": "d1ca253e3ad2c799", "scanner": "scanner-primary", "fingerprint": "34a932f2da704d40", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["agent-instructions", "secrets", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/commands/sparc/integration.md"}, "region": {"startLine": 63}}}]}, {"ruleId": "scanner-06a970c127cfbcb5", "level": "error", "message": {"text": "Agent instruction/config may expose a secret: .claude/commands/sparc/supabase-admin.md"}, "properties": {"repobilityId": "b5f2f8351e1d84e4", "scanner": "scanner-primary", "fingerprint": "06a970c127cfbcb5", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["agent-instructions", "secrets", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/commands/sparc/supabase-admin.md"}, "region": {"startLine": 328}}}]}, {"ruleId": "scanner-685aa2132bda1aff", "level": "error", "message": {"text": "Agent instruction/config may expose a secret: .claude/commands/sparc/security-review.md"}, "properties": {"repobilityId": "6d168b774f02b9ec", "scanner": "scanner-primary", "fingerprint": "685aa2132bda1aff", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["agent-instructions", "secrets", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/commands/sparc/security-review.md"}, "region": {"startLine": 60}}}]}, {"ruleId": "scanner-afb3800368c145df", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/commands/sparc/security-review.md"}, "properties": {"repobilityId": "0afcff889c37b7fe", "scanner": "scanner-primary", "fingerprint": "afb3800368c145df", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/commands/sparc/security-review.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-013ed90594cd468d", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/commands/sparc/swarm-coordinator.md"}, "properties": {"repobilityId": "9afc70ceebc1e48a", "scanner": "scanner-primary", "fingerprint": "013ed90594cd468d", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/commands/sparc/swarm-coordinator.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b8b3058f1936119c", "level": "error", "message": {"text": "Agent instruction/config may expose a secret: .claude/commands/sparc/spec-pseudocode.md"}, "properties": {"repobilityId": "fea3a0becf334964", "scanner": "scanner-primary", "fingerprint": "b8b3058f1936119c", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["agent-instructions", "secrets", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/commands/sparc/spec-pseudocode.md"}, "region": {"startLine": 60}}}]}, {"ruleId": "scanner-4431dc38d13dcfe5", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/commands/sparc/spec-pseudocode.md"}, "properties": {"repobilityId": "4fd2abd5f81526ad", "scanner": "scanner-primary", "fingerprint": "4431dc38d13dcfe5", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/commands/sparc/spec-pseudocode.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-dacd3f2e07bb2e45", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/commands/sparc/analyzer.md"}, "properties": {"repobilityId": "0fd01f1ac1ac6b39", "scanner": "scanner-primary", "fingerprint": "dacd3f2e07bb2e45", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/commands/sparc/analyzer.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3e9d1fae51a22527", "level": "error", "message": {"text": "Agent instruction/config may expose a secret: .claude/commands/sparc/devops.md"}, "properties": {"repobilityId": "f929faff13634bb4", "scanner": "scanner-primary", "fingerprint": "3e9d1fae51a22527", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["agent-instructions", "secrets", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/commands/sparc/devops.md"}, "region": {"startLine": 89}}}]}, {"ruleId": "scanner-ebd1ad4ddfd06917", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/commands/sparc/workflow-manager.md"}, "properties": {"repobilityId": "2406f8b6d768e21a", "scanner": "scanner-primary", "fingerprint": "ebd1ad4ddfd06917", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/commands/sparc/workflow-manager.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a2dfbcd5e1a10cb2", "level": "error", "message": {"text": "Agent instruction/config may expose a secret: .claude/commands/sparc/debug.md"}, "properties": {"repobilityId": "e1adc1a214a1b714", "scanner": "scanner-primary", "fingerprint": "a2dfbcd5e1a10cb2", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["agent-instructions", "secrets", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/commands/sparc/debug.md"}, "region": {"startLine": 63}}}]}, {"ruleId": "scanner-6d2db4e8dba14dfc", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/commands/sparc/debug.md"}, "properties": {"repobilityId": "f4b2b57c89315bff", "scanner": "scanner-primary", "fingerprint": "6d2db4e8dba14dfc", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/commands/sparc/debug.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a35e881035e8730c", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/commands/sparc/memory-manager.md"}, "properties": {"repobilityId": "49c25c2f5070aa7e", "scanner": "scanner-primary", "fingerprint": "a35e881035e8730c", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/commands/sparc/memory-manager.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-dd5eb8d74e9c847c", "level": "error", "message": {"text": "Agent instruction/config may expose a secret: .claude/agents/swarm/hierarchical-coordinator.md"}, "properties": {"repobilityId": "3350d96ac568ba9b", "scanner": "scanner-primary", "fingerprint": "dd5eb8d74e9c847c", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["agent-instructions", "secrets", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/agents/swarm/hierarchical-coordinator.md"}, "region": {"startLine": 560}}}]}, {"ruleId": "scanner-b2e07a98e586d672", "level": "error", "message": {"text": "Agent instruction/config may expose a secret: .claude/agents/swarm/adaptive-coordinator.md"}, "properties": {"repobilityId": "2ed8cc1bc78d8c57", "scanner": "scanner-primary", "fingerprint": "b2e07a98e586d672", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["agent-instructions", "secrets", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/agents/swarm/adaptive-coordinator.md"}, "region": {"startLine": 810}}}]}, {"ruleId": "scanner-5fae87c2ae599549", "level": "error", "message": {"text": "Agent instruction/config may expose a secret: .claude/agents/swarm/mesh-coordinator.md"}, "properties": {"repobilityId": "4964fb365aecee08", "scanner": "scanner-primary", "fingerprint": "5fae87c2ae599549", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["agent-instructions", "secrets", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/agents/swarm/mesh-coordinator.md"}, "region": {"startLine": 732}}}]}, {"ruleId": "scanner-36fb71af44f9d256", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/agents/testing/production-validator.md"}, "properties": {"repobilityId": "785b54b0030e85e8", "scanner": "scanner-primary", "fingerprint": "36fb71af44f9d256", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/agents/testing/production-validator.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-579763e824e0bbbc", "level": "error", "message": {"text": "Agent instruction/config may expose a secret: .claude/agents/github/swarm-pr.md"}, "properties": {"repobilityId": "1162c9b032f3c15b", "scanner": "scanner-primary", "fingerprint": "579763e824e0bbbc", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["agent-instructions", "secrets", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/agents/github/swarm-pr.md"}, "region": {"startLine": 418}}}]}, {"ruleId": "scanner-7eee98f79923c490", "level": "error", "message": {"text": "Agent instruction/config may expose a secret: .claude/agents/github/issue-tracker.md"}, "properties": {"repobilityId": "ba787d31410e5e66", "scanner": "scanner-primary", "fingerprint": "7eee98f79923c490", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["agent-instructions", "secrets", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/agents/github/issue-tracker.md"}, "region": {"startLine": 352}}}]}, {"ruleId": "scanner-7edfb78773ba0b09", "level": "error", "message": {"text": "Agent instruction/config may expose a secret: .claude/agents/github/workflow-automation.md"}, "properties": {"repobilityId": "0da99a62694090d2", "scanner": "scanner-primary", "fingerprint": "7edfb78773ba0b09", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["agent-instructions", "secrets", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/agents/github/workflow-automation.md"}, "region": {"startLine": 803}}}]}, {"ruleId": "scanner-dd6b9d8c7a5f1f6d", "level": "error", "message": {"text": "Agent instruction/config may expose a secret: .claude/agents/github/sync-coordinator.md"}, "properties": {"repobilityId": "3b45d27d8e6ad77f", "scanner": "scanner-primary", "fingerprint": "dd6b9d8c7a5f1f6d", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["agent-instructions", "secrets", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/agents/github/sync-coordinator.md"}, "region": {"startLine": 114}}}]}, {"ruleId": "scanner-2586ecab8d9e229d", "level": "error", "message": {"text": "Agent instruction/config may expose a secret: .claude/agents/github/release-manager.md"}, "properties": {"repobilityId": "3fa0e962ee772696", "scanner": "scanner-primary", "fingerprint": "2586ecab8d9e229d", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["agent-instructions", "secrets", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/agents/github/release-manager.md"}, "region": {"startLine": 494}}}]}, {"ruleId": "scanner-83ff40bc16f3a11f", "level": "error", "message": {"text": "Agent instruction/config may expose a secret: .claude/agents/github/repo-architect.md"}, "properties": {"repobilityId": "eefc6aca37cd960d", "scanner": "scanner-primary", "fingerprint": "83ff40bc16f3a11f", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["agent-instructions", "secrets", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/agents/github/repo-architect.md"}, "region": {"startLine": 259}}}]}, {"ruleId": "scanner-6e4a8da633786e2b", "level": "error", "message": {"text": "Agent instruction/config may expose a secret: .claude/agents/github/pr-manager.md"}, "properties": {"repobilityId": "f4c268cc020c9760", "scanner": "scanner-primary", "fingerprint": "6e4a8da633786e2b", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["agent-instructions", "secrets", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/agents/github/pr-manager.md"}, "region": {"startLine": 360}}}]}, {"ruleId": "scanner-c8dc8b686f0691cd", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/agents/github/swarm-issue.md"}, "properties": {"repobilityId": "ce807a523e6c0362", "scanner": "scanner-primary", "fingerprint": "c8dc8b686f0691cd", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/agents/github/swarm-issue.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b194af1a6233fd05", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/agents/github/project-board-sync.md"}, "properties": {"repobilityId": "d3e4cc512a31633a", "scanner": "scanner-primary", "fingerprint": "b194af1a6233fd05", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/agents/github/project-board-sync.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b7a96fbdae4f2347", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/agents/architecture/arch-system-design.md"}, "properties": {"repobilityId": "718286368c0399ff", "scanner": "scanner-primary", "fingerprint": "b7a96fbdae4f2347", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/agents/architecture/arch-system-design.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3c5ccc0ad99d0714", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/agents/architecture/system-design/arch-system-design.md"}, "properties": {"repobilityId": "f03ddedf19291712", "scanner": "scanner-primary", "fingerprint": "3c5ccc0ad99d0714", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/agents/architecture/system-design/arch-system-design.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e61e17cf59f7a25d", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/agents/development/dev-backend-api.md"}, "properties": {"repobilityId": "816d8791446db06b", "scanner": "scanner-primary", "fingerprint": "e61e17cf59f7a25d", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/agents/development/dev-backend-api.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-2b823d5c65498515", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/agents/development/backend/dev-backend-api.md"}, "properties": {"repobilityId": "0db3d059cab29b08", "scanner": "scanner-primary", "fingerprint": "2b823d5c65498515", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/agents/development/backend/dev-backend-api.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-97feea90675db00b", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/agents/consensus/performance-benchmarker.md"}, "properties": {"repobilityId": "8ac38f3a9954276b", "scanner": "scanner-primary", "fingerprint": "97feea90675db00b", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/agents/consensus/performance-benchmarker.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-fe259f4c78ac36b0", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/agents/consensus/gossip-coordinator.md"}, "properties": {"repobilityId": "c4167901277f2948", "scanner": "scanner-primary", "fingerprint": "fe259f4c78ac36b0", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/agents/consensus/gossip-coordinator.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-eeb9543f41c2a7d6", "level": "error", "message": {"text": "Agent instruction/config may expose a secret: .claude/agents/consensus/security-manager.md"}, "properties": {"repobilityId": "899038eb54d7c203", "scanner": "scanner-primary", "fingerprint": "eeb9543f41c2a7d6", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["agent-instructions", "secrets", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/agents/consensus/security-manager.md"}, "region": {"startLine": 56}}}]}, {"ruleId": "scanner-f29f2979e4a043f5", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/agents/templates/implementer-sparc-coder.md"}, "properties": {"repobilityId": "72b6055bc48018f9", "scanner": "scanner-primary", "fingerprint": "f29f2979e4a043f5", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/agents/templates/implementer-sparc-coder.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-2c0728009383fae8", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/agents/templates/sparc-coordinator.md"}, "properties": {"repobilityId": "adc0cab9da1335be", "scanner": "scanner-primary", "fingerprint": "2c0728009383fae8", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/agents/templates/sparc-coordinator.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-132b4541d9fcd878", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/agents/templates/coordinator-swarm-init.md"}, "properties": {"repobilityId": "67b790669a0ecea8", "scanner": "scanner-primary", "fingerprint": "132b4541d9fcd878", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/agents/templates/coordinator-swarm-init.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d247ecd5855c4986", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/agents/optimization/load-balancer.md"}, "properties": {"repobilityId": "6e71807b0022138f", "scanner": "scanner-primary", "fingerprint": "d247ecd5855c4986", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/agents/optimization/load-balancer.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-0322f93ac74bf40c", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/agents/optimization/resource-allocator.md"}, "properties": {"repobilityId": "6329bdc14c9f42bb", "scanner": "scanner-primary", "fingerprint": "0322f93ac74bf40c", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/agents/optimization/resource-allocator.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-27e6ddbc278993a8", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/agents/optimization/performance-monitor.md"}, "properties": {"repobilityId": "b9357ec7cf989c78", "scanner": "scanner-primary", "fingerprint": "27e6ddbc278993a8", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/agents/optimization/performance-monitor.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-77e284ede4b834f8", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/agents/optimization/topology-optimizer.md"}, "properties": {"repobilityId": "575e40caa01825ef", "scanner": "scanner-primary", "fingerprint": "77e284ede4b834f8", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/agents/optimization/topology-optimizer.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-87803d520586d33f", "level": "error", "message": {"text": "Agent instruction/config may expose a secret: .claude/agents/payments/agentic-payments.md"}, "properties": {"repobilityId": "ec7bfe394a392bf0", "scanner": "scanner-primary", "fingerprint": "87803d520586d33f", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["agent-instructions", "secrets", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/agents/payments/agentic-payments.md"}, "region": {"startLine": 35}}}]}, {"ruleId": "scanner-aae903b86389ba8b", "level": "error", "message": {"text": "Agent instruction/config may expose a secret: .claude/agents/flow-nexus/app-store.md"}, "properties": {"repobilityId": "35c75df470936fdc", "scanner": "scanner-primary", "fingerprint": "aae903b86389ba8b", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["agent-instructions", "secrets", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/agents/flow-nexus/app-store.md"}, "region": {"startLine": 43}}}]}, {"ruleId": "scanner-b725b54cbddb0440", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/agents/flow-nexus/app-store.md"}, "properties": {"repobilityId": "fef7465ca0075171", "scanner": "scanner-primary", "fingerprint": "b725b54cbddb0440", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/agents/flow-nexus/app-store.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ec796bf7604ba2b5", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/agents/flow-nexus/neural-network.md"}, "properties": {"repobilityId": "d9d66f818ec31f71", "scanner": "scanner-primary", "fingerprint": "ec796bf7604ba2b5", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/agents/flow-nexus/neural-network.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-2bcb6a29f75dc3dd", "level": "error", "message": {"text": "Agent instruction/config may expose a secret: .claude/agents/goal/goal-planner.md"}, "properties": {"repobilityId": "6fdcf031dafb898c", "scanner": "scanner-primary", "fingerprint": "2bcb6a29f75dc3dd", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["agent-instructions", "secrets", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/agents/goal/goal-planner.md"}, "region": {"startLine": 70}}}]}, {"ruleId": "scanner-50a7d2d5206f243a", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/agents/goal/goal-planner.md"}, "properties": {"repobilityId": "163f7e6decc15d14", "scanner": "scanner-primary", "fingerprint": "50a7d2d5206f243a", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/agents/goal/goal-planner.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-4cd5cf3f6830a7c8", "level": "error", "message": {"text": "Agent instruction/config may expose a secret: .claude/agents/v3/v3-integration-architect.md"}, "properties": {"repobilityId": "a8d91c0e0109890a", "scanner": "scanner-primary", "fingerprint": "4cd5cf3f6830a7c8", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["agent-instructions", "secrets", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/agents/v3/v3-integration-architect.md"}, "region": {"startLine": 27}}}]}, {"ruleId": "scanner-5ce5b35dab799a7f", "level": "error", "message": {"text": "Agent instruction/config may expose a secret: .claude/agents/v3/reasoningbank-learner.md"}, "properties": {"repobilityId": "ae19da1ffe8f1eed", "scanner": "scanner-primary", "fingerprint": "5ce5b35dab799a7f", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["agent-instructions", "secrets", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/agents/v3/reasoningbank-learner.md"}, "region": {"startLine": 104}}}]}, {"ruleId": "scanner-8ef21dd1be17ca6d", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/agents/v3/reasoningbank-learner.md"}, "properties": {"repobilityId": "798c9b1c53eeedd6", "scanner": "scanner-primary", "fingerprint": "8ef21dd1be17ca6d", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/agents/v3/reasoningbank-learner.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-787c1e5439d9b774", "level": "error", "message": {"text": "Agent instruction/config may expose a secret: .claude/agents/v3/security-architect.md"}, "properties": {"repobilityId": "6a7bf06285e44c57", "scanner": "scanner-primary", "fingerprint": "787c1e5439d9b774", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["agent-instructions", "secrets", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/agents/v3/security-architect.md"}, "region": {"startLine": 446}}}]}, {"ruleId": "scanner-97873c1b4db61af9", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/agents/v3/security-architect.md"}, "properties": {"repobilityId": "f892fac7b1188d94", "scanner": "scanner-primary", "fingerprint": "97873c1b4db61af9", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/agents/v3/security-architect.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b028d7adbc4d89c9", "level": "error", "message": {"text": "Agent instruction/config may expose a secret: .claude/agents/v3/memory-specialist.md"}, "properties": {"repobilityId": "3d2b584eccaaa055", "scanner": "scanner-primary", "fingerprint": "b028d7adbc4d89c9", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["agent-instructions", "secrets", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/agents/v3/memory-specialist.md"}, "region": {"startLine": 30}}}]}, {"ruleId": "scanner-c655dd0ebfed65b8", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/agents/v3/adr-architect.md"}, "properties": {"repobilityId": "e5739597389e5afb", "scanner": "scanner-primary", "fingerprint": "c655dd0ebfed65b8", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/agents/v3/adr-architect.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f2526402460fb434", "level": "error", "message": {"text": "Agent instruction/config may expose a secret: .claude/agents/v3/collective-intelligence-coordinator.md"}, "properties": {"repobilityId": "b9da507d57c6e1f7", "scanner": "scanner-primary", "fingerprint": "f2526402460fb434", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["agent-instructions", "secrets", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/agents/v3/collective-intelligence-coordinator.md"}, "region": {"startLine": 503}}}]}, {"ruleId": "scanner-189c347862131ca4", "level": "error", "message": {"text": "Agent instruction/config may expose a secret: .claude/agents/v3/sparc-orchestrator.md"}, "properties": {"repobilityId": "b16e63998b322b03", "scanner": "scanner-primary", "fingerprint": "189c347862131ca4", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["agent-instructions", "secrets", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/agents/v3/sparc-orchestrator.md"}, "region": {"startLine": 171}}}]}, {"ruleId": "scanner-155860d3bb68a326", "level": "error", "message": {"text": "Agent instruction/config may expose a secret: .claude/agents/v3/security-auditor.md"}, "properties": {"repobilityId": "955f2e466ff8fa84", "scanner": "scanner-primary", "fingerprint": "155860d3bb68a326", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["agent-instructions", "secrets", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/agents/v3/security-auditor.md"}, "region": {"startLine": 611}}}]}, {"ruleId": "scanner-c3daca15335b91d5", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/agents/v3/aidefence-guardian.md"}, "properties": {"repobilityId": "6cb5506e667a3569", "scanner": "scanner-primary", "fingerprint": "c3daca15335b91d5", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/agents/v3/aidefence-guardian.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-86997909df3848e3", "level": "error", "message": {"text": "Agent instruction/config may expose a secret: .claude/agents/v3/swarm-memory-manager.md"}, "properties": {"repobilityId": "e332323be2de0c82", "scanner": "scanner-primary", "fingerprint": "86997909df3848e3", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["agent-instructions", "secrets", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/agents/v3/swarm-memory-manager.md"}, "region": {"startLine": 31}}}]}, {"ruleId": "scanner-1087c1c7c1692ea4", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/agents/v3/swarm-memory-manager.md"}, "properties": {"repobilityId": "ade6e502720b6181", "scanner": "scanner-primary", "fingerprint": "1087c1c7c1692ea4", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/agents/v3/swarm-memory-manager.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c8a0475f3163007c", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/agents/v3/injection-analyst.md"}, "properties": {"repobilityId": "3696359937614436", "scanner": "scanner-primary", "fingerprint": "c8a0475f3163007c", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/agents/v3/injection-analyst.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ebd2fdb57dadc14a", "level": "error", "message": {"text": "Agent instruction/config may expose a secret: .claude/agents/v3/ddd-domain-expert.md"}, "properties": {"repobilityId": "f247c07c32f18ce5", "scanner": "scanner-primary", "fingerprint": "ebd2fdb57dadc14a", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["agent-instructions", "secrets", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/agents/v3/ddd-domain-expert.md"}, "region": {"startLine": 35}}}]}, {"ruleId": "scanner-cec197691a9202c8", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/agents/v3/ddd-domain-expert.md"}, "properties": {"repobilityId": "a38095e510b775f0", "scanner": "scanner-primary", "fingerprint": "cec197691a9202c8", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/agents/v3/ddd-domain-expert.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-9713a2fe325a1f0f", "level": "error", "message": {"text": "Agent instruction/config may expose a secret: .claude/agents/v3/performance-engineer.md"}, "properties": {"repobilityId": "4e3f2ce13c73be44", "scanner": "scanner-primary", "fingerprint": "9713a2fe325a1f0f", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["agent-instructions", "secrets", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/agents/v3/performance-engineer.md"}, "region": {"startLine": 538}}}]}, {"ruleId": "scanner-3831123413a49709", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/agents/core/tester.md"}, "properties": {"repobilityId": "e375c873d192333c", "scanner": "scanner-primary", "fingerprint": "3831123413a49709", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/agents/core/tester.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-cc7f015e479f876b", "level": "error", "message": {"text": "Agent instruction/config may expose a secret: .claude/agents/sublinear/pagerank-analyzer.md"}, "properties": {"repobilityId": "7369ece5575eb7f3", "scanner": "scanner-primary", "fingerprint": "cc7f015e479f876b", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["agent-instructions", "secrets", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/agents/sublinear/pagerank-analyzer.md"}, "region": {"startLine": 81}}}]}, {"ruleId": "scanner-069ae2cd2994cd22", "level": "error", "message": {"text": "Agent instruction/config may expose a secret: .claude/agents/sparc/architecture.md"}, "properties": {"repobilityId": "a7b21d8c61ea50c7", "scanner": "scanner-primary", "fingerprint": "069ae2cd2994cd22", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["agent-instructions", "secrets", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/agents/sparc/architecture.md"}, "region": {"startLine": 670}}}]}, {"ruleId": "scanner-176167ecb8446c71", "level": "error", "message": {"text": "Agent instruction/config may expose a secret: .claude/agents/sparc/refinement.md"}, "properties": {"repobilityId": "26679bfccb1562d2", "scanner": "scanner-primary", "fingerprint": "176167ecb8446c71", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["agent-instructions", "secrets", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/agents/sparc/refinement.md"}, "region": {"startLine": 431}}}]}, {"ruleId": "scanner-1f574e7ba291366c", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/agents/sparc/refinement.md"}, "properties": {"repobilityId": "4e51e16020ee8dac", "scanner": "scanner-primary", "fingerprint": "1f574e7ba291366c", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/agents/sparc/refinement.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f1246529183053ac", "level": "error", "message": {"text": "Agent instruction/config may expose a secret: .claude/skills/github-release-management/SKILL.md"}, "properties": {"repobilityId": "9707a5b198ecbdbd", "scanner": "scanner-primary", "fingerprint": "f1246529183053ac", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["agent-instructions", "secrets", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/github-release-management/SKILL.md"}, "region": {"startLine": 209}}}]}, {"ruleId": "scanner-6983649e7d7e43ac", "level": "error", "message": {"text": "Agent instruction/config may expose a secret: .claude/skills/v3-mcp-optimization/SKILL.md"}, "properties": {"repobilityId": "52d56e0ea1f9ddb1", "scanner": "scanner-primary", "fingerprint": "6983649e7d7e43ac", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["agent-instructions", "secrets", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/v3-mcp-optimization/SKILL.md"}, "region": {"startLine": 715}}}]}, {"ruleId": "scanner-a62c458cb61c4e61", "level": "error", "message": {"text": "Agent instruction/config may expose a secret: .claude/skills/agentdb-memory-patterns/SKILL.md"}, "properties": {"repobilityId": "b4e81075dd0dc422", "scanner": "scanner-primary", "fingerprint": "a62c458cb61c4e61", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["agent-instructions", "secrets", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/agentdb-memory-patterns/SKILL.md"}, "region": {"startLine": 336}}}]}, {"ruleId": "scanner-da91f6524b65a9da", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/skills/agentdb-memory-patterns/SKILL.md"}, "properties": {"repobilityId": "54c47d2bed9c2bca", "scanner": "scanner-primary", "fingerprint": "da91f6524b65a9da", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/agentdb-memory-patterns/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e01c464e06447d96", "level": "error", "message": {"text": "Agent instruction/config may expose a secret: .claude/skills/v3-security-overhaul/SKILL.md"}, "properties": {"repobilityId": "4480a36d4e38364d", "scanner": "scanner-primary", "fingerprint": "e01c464e06447d96", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["agent-instructions", "secrets", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/v3-security-overhaul/SKILL.md"}, "region": {"startLine": 42}}}]}, {"ruleId": "scanner-21ec62032ac1355a", "level": "warning", "message": {"text": "Agent instruction contains unpinned remote install: .claude/skills/swarm-advanced/SKILL.md"}, "properties": {"repobilityId": "1bdf952e2567ed66", "scanner": "scanner-primary", "fingerprint": "21ec62032ac1355a", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "supply-chain", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/swarm-advanced/SKILL.md"}, "region": {"startLine": 19}}}]}, {"ruleId": "scanner-8e65337e518ac9af", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/skills/v3-cli-modernization/SKILL.md"}, "properties": {"repobilityId": "d706d5e0663766d1", "scanner": "scanner-primary", "fingerprint": "8e65337e518ac9af", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/v3-cli-modernization/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-de924889b300be84", "level": "error", "message": {"text": "Agent instruction/config may expose a secret: .claude/skills/sparc-methodology/SKILL.md"}, "properties": {"repobilityId": "dd6e43ec302f20db", "scanner": "scanner-primary", "fingerprint": "de924889b300be84", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["agent-instructions", "secrets", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/sparc-methodology/SKILL.md"}, "region": {"startLine": 695}}}]}, {"ruleId": "scanner-c6429d215bd94462", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/skills/v3-performance-optimization/SKILL.md"}, "properties": {"repobilityId": "eeb9cf0cd0fd1e82", "scanner": "scanner-primary", "fingerprint": "c6429d215bd94462", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/v3-performance-optimization/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-0cd7ca04e6382d99", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/skills/v3-memory-unification/SKILL.md"}, "properties": {"repobilityId": "af727e0deb1367eb", "scanner": "scanner-primary", "fingerprint": "0cd7ca04e6382d99", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/v3-memory-unification/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3603ed6d8e3dab44", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/skills/v3-integration-deep/SKILL.md"}, "properties": {"repobilityId": "1c297c5d49639a6b", "scanner": "scanner-primary", "fingerprint": "3603ed6d8e3dab44", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/v3-integration-deep/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-cf01fd75262fa110", "level": "error", "message": {"text": "Agent instruction/config may expose a secret: .claude/skills/github-multi-repo/SKILL.md"}, "properties": {"repobilityId": "fde2346e65f4dec4", "scanner": "scanner-primary", "fingerprint": "cf01fd75262fa110", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["agent-instructions", "secrets", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/github-multi-repo/SKILL.md"}, "region": {"startLine": 174}}}]}, {"ruleId": "scanner-ff1b04715d1cd44b", "level": "error", "message": {"text": "Agent instruction/config may expose a secret: .claude/skills/reasoningbank-intelligence/SKILL.md"}, "properties": {"repobilityId": "bc084102981c18b3", "scanner": "scanner-primary", "fingerprint": "ff1b04715d1cd44b", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["agent-instructions", "secrets", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/reasoningbank-intelligence/SKILL.md"}, "region": {"startLine": 151}}}]}, {"ruleId": "scanner-a58c814f49ae7cf5", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/skills/reasoningbank-intelligence/SKILL.md"}, "properties": {"repobilityId": "7b51b8b19e327782", "scanner": "scanner-primary", "fingerprint": "a58c814f49ae7cf5", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/reasoningbank-intelligence/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-03f10e7d59a3abfb", "level": "error", "message": {"text": "Agent instruction/config may expose a secret: .claude/skills/agentdb-vector-search/SKILL.md"}, "properties": {"repobilityId": "4d12b19d4e830675", "scanner": "scanner-primary", "fingerprint": "03f10e7d59a3abfb", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["agent-instructions", "secrets", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/agentdb-vector-search/SKILL.md"}, "region": {"startLine": 334}}}]}, {"ruleId": "scanner-3e97402e422e2021", "level": "error", "message": {"text": "Agent instruction/config may expose a secret: .claude/skills/hooks-automation/SKILL.md"}, "properties": {"repobilityId": "a0ddac79a2d25895", "scanner": "scanner-primary", "fingerprint": "3e97402e422e2021", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["agent-instructions", "secrets", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/hooks-automation/SKILL.md"}, "region": {"startLine": 612}}}]}, {"ruleId": "scanner-6f46d2ab1ba22022", "level": "warning", "message": {"text": "Agent instruction contains unpinned remote install: .claude/skills/hooks-automation/SKILL.md"}, "properties": {"repobilityId": "64ceda204d400437", "scanner": "scanner-primary", "fingerprint": "6f46d2ab1ba22022", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "supply-chain", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/hooks-automation/SKILL.md"}, "region": {"startLine": 26}}}]}, {"ruleId": "scanner-ab321361b36d8da9", "level": "error", "message": {"text": "Agent instruction/config may expose a secret: .claude/skills/github-workflow-automation/SKILL.md"}, "properties": {"repobilityId": "fb1a91acb0bdd6e7", "scanner": "scanner-primary", "fingerprint": "ab321361b36d8da9", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["agent-instructions", "secrets", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/github-workflow-automation/SKILL.md"}, "region": {"startLine": 689}}}]}, {"ruleId": "scanner-0a761f0bb4b48b29", "level": "warning", "message": {"text": "Agent instruction contains unpinned remote install: .claude/skills/github-workflow-automation/SKILL.md"}, "properties": {"repobilityId": "6e496611d758856d", "scanner": "scanner-primary", "fingerprint": "0a761f0bb4b48b29", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "supply-chain", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/github-workflow-automation/SKILL.md"}, "region": {"startLine": 1020}}}]}, {"ruleId": "scanner-3aac565d04eedcd7", "level": "error", "message": {"text": "Agent instruction/config may expose a secret: .claude/skills/agentdb-advanced/SKILL.md"}, "properties": {"repobilityId": "aeb47a74a8f5cc0f", "scanner": "scanner-primary", "fingerprint": "3aac565d04eedcd7", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["agent-instructions", "secrets", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/agentdb-advanced/SKILL.md"}, "region": {"startLine": 306}}}]}, {"ruleId": "scanner-9ddfe6ab99078478", "level": "warning", "message": {"text": "Agent instruction contains unpinned remote install: .claude/skills/skill-builder/SKILL.md"}, "properties": {"repobilityId": "54a63ffc4d18291c", "scanner": "scanner-primary", "fingerprint": "9ddfe6ab99078478", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "supply-chain", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/skill-builder/SKILL.md"}, "region": {"startLine": 777}}}]}, {"ruleId": "scanner-9a29aa6ba5456e85", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/skills/pair-programming/SKILL.md"}, "properties": {"repobilityId": "baebdce0d7cd32b9", "scanner": "scanner-primary", "fingerprint": "9a29aa6ba5456e85", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/pair-programming/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-9aeb2209d2141de7", "level": "warning", "message": {"text": "Agent instruction contains unpinned remote install: .claude/skills/pair-programming/SKILL.md"}, "properties": {"repobilityId": "a224ee9dfb623f6c", "scanner": "scanner-primary", "fingerprint": "9aeb2209d2141de7", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "supply-chain", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/pair-programming/SKILL.md"}, "region": {"startLine": 25}}}]}, {"ruleId": "scanner-82f673df4b902287", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: plugins/ruview/codex/AGENTS.md"}, "properties": {"repobilityId": "092b25beb30aeed3", "scanner": "scanner-primary", "fingerprint": "82f673df4b902287", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "agents_md"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "plugins/ruview/codex/AGENTS.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-0038dea688dd9031", "level": "warning", "message": {"text": "Agent instruction contains unpinned remote install: plugins/ruview/skills/ruview-rvagent/SKILL.md"}, "properties": {"repobilityId": "b8dc08e16ffd3d47", "scanner": "scanner-primary", "fingerprint": "0038dea688dd9031", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "supply-chain", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "plugins/ruview/skills/ruview-rvagent/SKILL.md"}, "region": {"startLine": 12}}}]}, {"ruleId": "scanner-23924d984e417cb6", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: plugins/ruview/skills/ruview-configure/SKILL.md"}, "properties": {"repobilityId": "d0703c3eef6e99da", "scanner": "scanner-primary", "fingerprint": "23924d984e417cb6", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "plugins/ruview/skills/ruview-configure/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c1a2d72f4bc28961", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: plugins/ruview/skills/ruview-verify/SKILL.md"}, "properties": {"repobilityId": "6262b725d941516f", "scanner": "scanner-primary", "fingerprint": "c1a2d72f4bc28961", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "plugins/ruview/skills/ruview-verify/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e227fc1fd2f56d0c", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: harness/ruview/CLAUDE.md"}, "properties": {"repobilityId": "84689fc1975549fc", "scanner": "scanner-primary", "fingerprint": "e227fc1fd2f56d0c", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "harness/ruview/CLAUDE.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-5f82775317387cae", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: harness/ruview/.claude/settings.json"}, "properties": {"repobilityId": "a0425a07494a3e86", "scanner": "scanner-primary", "fingerprint": "5f82775317387cae", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "harness/ruview/.claude/settings.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e2fe3d82eb96cdcc", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: harness/ruview/.claude/skills/verify/SKILL.md"}, "properties": {"repobilityId": "78428a5aa17f1a26", "scanner": "scanner-primary", "fingerprint": "e2fe3d82eb96cdcc", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "harness/ruview/.claude/skills/verify/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6a992022ef1ff799", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: harness/ruview/.claude/skills/calibrate-room/SKILL.md"}, "properties": {"repobilityId": "e4f0aa0df690d88d", "scanner": "scanner-primary", "fingerprint": "6a992022ef1ff799", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "harness/ruview/.claude/skills/calibrate-room/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-86339cac97410d89", "level": "warning", "message": {"text": "SkillSpector RA2 (rogue-agent) in .claude/skills/agentdb-memory-patterns/SKILL.md"}, "properties": {"repobilityId": "5e0c0062d45c9b32", "scanner": "scanner-primary", "fingerprint": "86339cac97410d89", "layer": "security", "severity": "medium", "confidence": 0.75, "tags": ["skillspector", "mcp-skill", "rogue-agent", "RA2"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/agentdb-memory-patterns/SKILL.md"}, "region": {"startLine": 10}}}]}, {"ruleId": "scanner-ea09b02f64b2748c", "level": "warning", "message": {"text": "SkillSpector MP2 (memory-poisoning) in .claude/skills/browser/SKILL.md"}, "properties": {"repobilityId": "e6658432dd12d98b", "scanner": "scanner-primary", "fingerprint": "ea09b02f64b2748c", "layer": "security", "severity": "medium", "confidence": 0.85, "tags": ["skillspector", "mcp-skill", "memory-poisoning", "MP2"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/browser/SKILL.md"}, "region": {"startLine": 66}}}]}, {"ruleId": "scanner-212cccd3f959a4e8", "level": "error", "message": {"text": "SkillSpector P2 (prompt-injection) in .claude/skills/github-code-review/SKILL.md"}, "properties": {"repobilityId": "29c88440310cb7e0", "scanner": "scanner-primary", "fingerprint": "212cccd3f959a4e8", "layer": "security", "severity": "high", "confidence": 0.7, "tags": ["skillspector", "mcp-skill", "prompt-injection", "P2"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/github-code-review/SKILL.md"}, "region": {"startLine": 381}}}]}, {"ruleId": "scanner-adb65864c9941c3d", "level": "warning", "message": {"text": "SkillSpector E1 (data-exfil) in .claude/skills/github-project-management/SKILL.md"}, "properties": {"repobilityId": "e3426039ff1146fc", "scanner": "scanner-primary", "fingerprint": "adb65864c9941c3d", "layer": "security", "severity": "medium", "confidence": 0.5, "tags": ["skillspector", "mcp-skill", "data-exfil", "E1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/github-project-management/SKILL.md"}, "region": {"startLine": 450}}}]}, {"ruleId": "scanner-86c212e3a2b19bed", "level": "error", "message": {"text": "SkillSpector P2 (prompt-injection) in .claude/skills/github-project-management/SKILL.md"}, "properties": {"repobilityId": "4e34fab468ba5b55", "scanner": "scanner-primary", "fingerprint": "86c212e3a2b19bed", "layer": "security", "severity": "high", "confidence": 0.7, "tags": ["skillspector", "mcp-skill", "prompt-injection", "P2"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/github-project-management/SKILL.md"}, "region": {"startLine": 171}}}]}, {"ruleId": "scanner-ca893afcd6a5ea6e", "level": "warning", "message": {"text": "SkillSpector RA2 (rogue-agent) in .claude/skills/github-project-management/SKILL.md"}, "properties": {"repobilityId": "f9fffc74379d6f87", "scanner": "scanner-primary", "fingerprint": "ca893afcd6a5ea6e", "layer": "security", "severity": "medium", "confidence": 0.8, "tags": ["skillspector", "mcp-skill", "rogue-agent", "RA2"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/github-project-management/SKILL.md"}, "region": {"startLine": 947}}}]}, {"ruleId": "scanner-c58b390228949246", "level": "warning", "message": {"text": "SkillSpector EA2 (excessive-agency) in .claude/skills/github-release-management/SKILL.md"}, "properties": {"repobilityId": "133e3f9d026f73be", "scanner": "scanner-primary", "fingerprint": "c58b390228949246", "layer": "security", "severity": "medium", "confidence": 0.85, "tags": ["skillspector", "mcp-skill", "excessive-agency", "EA2"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/github-release-management/SKILL.md"}, "region": {"startLine": 530}}}]}, {"ruleId": "scanner-253a0466c70e6368", "level": "error", "message": {"text": "SkillSpector PE3 (priv-esc) in .claude/skills/github-release-management/SKILL.md"}, "properties": {"repobilityId": "951bfbc6043b29ae", "scanner": "scanner-primary", "fingerprint": "253a0466c70e6368", "layer": "security", "severity": "high", "confidence": 0.7, "tags": ["skillspector", "mcp-skill", "priv-esc", "PE3"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/github-release-management/SKILL.md"}, "region": {"startLine": 795}}}]}, {"ruleId": "scanner-d7db0c2ef7f0bad7", "level": "warning", "message": {"text": "SkillSpector EA1 (excessive-agency) in .claude/skills/hooks-automation/SKILL.md"}, "properties": {"repobilityId": "fed439564f64e4a8", "scanner": "scanner-primary", "fingerprint": "d7db0c2ef7f0bad7", "layer": "security", "severity": "medium", "confidence": 0.85, "tags": ["skillspector", "mcp-skill", "excessive-agency", "EA1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/hooks-automation/SKILL.md"}, "region": {"startLine": 248}}}]}, {"ruleId": "scanner-b3972ca73d76c98e", "level": "error", "message": {"text": "SkillSpector PE3 (priv-esc) in .claude/skills/hooks-automation/SKILL.md"}, "properties": {"repobilityId": "d3141ccdf63f4cf3", "scanner": "scanner-primary", "fingerprint": "b3972ca73d76c98e", "layer": "security", "severity": "high", "confidence": 0.6, "tags": ["skillspector", "mcp-skill", "priv-esc", "PE3"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/hooks-automation/SKILL.md"}, "region": {"startLine": 740}}}]}, {"ruleId": "scanner-4b55d32b32109034", "level": "error", "message": {"text": "SkillSpector P1 (prompt-injection) in .claude/skills/hooks-automation/SKILL.md"}, "properties": {"repobilityId": "0f2a306f26c67d1e", "scanner": "scanner-primary", "fingerprint": "4b55d32b32109034", "layer": "security", "severity": "high", "confidence": 0.7, "tags": ["skillspector", "mcp-skill", "prompt-injection", "P1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/hooks-automation/SKILL.md"}, "region": {"startLine": 1113}}}]}, {"ruleId": "scanner-d92535e162c49863", "level": "warning", "message": {"text": "SkillSpector RA2 (rogue-agent) in .claude/skills/hooks-automation/SKILL.md"}, "properties": {"repobilityId": "41bea5bfb7509733", "scanner": "scanner-primary", "fingerprint": "d92535e162c49863", "layer": "security", "severity": "medium", "confidence": 0.55, "tags": ["skillspector", "mcp-skill", "rogue-agent", "RA2"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/hooks-automation/SKILL.md"}, "region": {"startLine": 335}}}]}, {"ruleId": "scanner-17754be427edccdd", "level": "note", "message": {"text": "SkillSpector TM1 (tool-misuse) in .claude/skills/hooks-automation/SKILL.md"}, "properties": {"repobilityId": "d4912799e36cf2c6", "scanner": "scanner-primary", "fingerprint": "17754be427edccdd", "layer": "security", "severity": "low", "confidence": 0.15, "tags": ["skillspector", "mcp-skill", "tool-misuse", "TM1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/hooks-automation/SKILL.md"}, "region": {"startLine": 106}}}]}, {"ruleId": "scanner-9467a560a4a91f77", "level": "error", "message": {"text": "SkillSpector TM1 (tool-misuse) in .claude/skills/pair-programming/SKILL.md"}, "properties": {"repobilityId": "d6912a75a709e579", "scanner": "scanner-primary", "fingerprint": "9467a560a4a91f77", "layer": "security", "severity": "high", "confidence": 0.8, "tags": ["skillspector", "mcp-skill", "tool-misuse", "TM1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/pair-programming/SKILL.md"}, "region": {"startLine": 872}}}]}, {"ruleId": "scanner-c4a13f789404c449", "level": "warning", "message": {"text": "SkillSpector RA2 (rogue-agent) in .claude/skills/skill-builder/SKILL.md"}, "properties": {"repobilityId": "a1b1e9b8f6c6e070", "scanner": "scanner-primary", "fingerprint": "c4a13f789404c449", "layer": "security", "severity": "medium", "confidence": 0.6, "tags": ["skillspector", "mcp-skill", "rogue-agent", "RA2"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/skill-builder/SKILL.md"}, "region": {"startLine": 3}}}]}, {"ruleId": "scanner-a28892bd66bc9a82", "level": "warning", "message": {"text": "SkillSpector EA2 (excessive-agency) in .claude/skills/sparc-methodology/SKILL.md"}, "properties": {"repobilityId": "fbc9006c041faf76", "scanner": "scanner-primary", "fingerprint": "a28892bd66bc9a82", "layer": "security", "severity": "medium", "confidence": 0.8, "tags": ["skillspector", "mcp-skill", "excessive-agency", "EA2"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/sparc-methodology/SKILL.md"}, "region": {"startLine": 976}}}]}, {"ruleId": "scanner-a73cc99e1856a902", "level": "error", "message": {"text": "SkillSpector P1 (prompt-injection) in .claude/skills/stream-chain/SKILL.md"}, "properties": {"repobilityId": "5533a692bd159f93", "scanner": "scanner-primary", "fingerprint": "a73cc99e1856a902", "layer": "security", "severity": "high", "confidence": 0.7, "tags": ["skillspector", "mcp-skill", "prompt-injection", "P1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/stream-chain/SKILL.md"}, "region": {"startLine": 64}}}]}, {"ruleId": "scanner-e637c415447867e4", "level": "none", "message": {"text": "Run SkillSpector's LLM-backed analysis in your own pipeline"}, "properties": {"repobilityId": "1936f198ff5212bf", "scanner": "scanner-primary", "fingerprint": "e637c415447867e4", "layer": "security", "severity": "info", "confidence": 1.0, "tags": ["skillspector", "mcp-skill", "llm-advisory", "ai-coder"]}}, {"ruleId": "scanner-3b68aac4db558ee4", "level": "warning", "message": {"text": "Privileged port 52 in use"}, "properties": {"repobilityId": "2b6877fa37212075", "scanner": "scanner-primary", "fingerprint": "3b68aac4db558ee4", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/qemu-mesh-test.sh"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-69fafe084287960e", "level": "warning", "message": {"text": "Privileged port 54 in use"}, "properties": {"repobilityId": "cfa860c24fdc3eef", "scanner": "scanner-primary", "fingerprint": "69fafe084287960e", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/qemu-mesh-test.sh"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6d86d153c613abbc", "level": "warning", "message": {"text": "Privileged port 1 in use"}, "properties": {"repobilityId": "ddf3fa6c29abb8d2", "scanner": "scanner-primary", "fingerprint": "6d86d153c613abbc", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/clone-tracking.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-1713a10ee9ec5426", "level": "warning", "message": {"text": "Privileged port 23 in use"}, "properties": {"repobilityId": "a1230e3dfc4becfa", "scanner": "scanner-primary", "fingerprint": "1713a10ee9ec5426", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/clone-tracking.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-264164d174e3cbdf", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: rust:1.81-slim-bookworm"}, "properties": {"repobilityId": "85e6fa1f7beb72f2", "scanner": "scanner-primary", "fingerprint": "264164d174e3cbdf", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "v2/crates/nvsim-server/Dockerfile"}, "region": {"startLine": 8}}}]}, {"ruleId": "scanner-9484af26b72335d7", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: debian:bookworm-slim"}, "properties": {"repobilityId": "7edd1d76b1809a2b", "scanner": "scanner-primary", "fingerprint": "9484af26b72335d7", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "v2/crates/nvsim-server/Dockerfile"}, "region": {"startLine": 48}}}]}, {"ruleId": "scanner-efa63d098a74a3d8", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in v2/crates/homecore-server/ui/js/ui.js:24"}, "properties": {"repobilityId": "a928b68cf3472a83", "scanner": "scanner-primary", "fingerprint": "efa63d098a74a3d8", "layer": "security", "severity": "medium", "confidence": 0.65, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "v2/crates/homecore-server/ui/js/ui.js"}, "region": {"startLine": 24}}}]}, {"ruleId": "scanner-eb2d6079edd9db4c", "level": "warning", "message": {"text": "Possible secret in v2/crates/wifi-densepose-desktop/tests/api_integration.rs"}, "properties": {"repobilityId": "c37340fa3097026b", "scanner": "scanner-primary", "fingerprint": "eb2d6079edd9db4c", "layer": "security", "severity": "medium", "confidence": 0.58, "tags": ["secrets", "password_literal"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "v2/crates/wifi-densepose-desktop/tests/api_integration.rs"}, "region": {"startLine": 359}}}]}, {"ruleId": "scanner-92b5d4ee35665267", "level": "note", "message": {"text": "Insecure pattern 'debug_true' in archive/v1/src/cli.py:110"}, "properties": {"repobilityId": "2a525e5256aa3294", "scanner": "scanner-primary", "fingerprint": "92b5d4ee35665267", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["owasp", "debug_true"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "archive/v1/src/cli.py"}, "region": {"startLine": 110}}}]}, {"ruleId": "scanner-d1a39860910a55a7", "level": "note", "message": {"text": "Insecure pattern 'debug_true' in archive/v1/src/config/settings.py:407"}, "properties": {"repobilityId": "bc95e96814599a1e", "scanner": "scanner-primary", "fingerprint": "d1a39860910a55a7", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["owasp", "debug_true"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "archive/v1/src/config/settings.py"}, "region": {"startLine": 407}}}]}, {"ruleId": "scanner-f4abfed92025559e", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in ui/observatory/js/hud-controller.js:542"}, "properties": {"repobilityId": "a0f98775f4008f8a", "scanner": "scanner-primary", "fingerprint": "f4abfed92025559e", "layer": "security", "severity": "medium", "confidence": 0.65, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "ui/observatory/js/hud-controller.js"}, "region": {"startLine": 542}}}]}, {"ruleId": "scanner-3eb8804bdb2eacf9", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in ui/utils/notification-center.js:27"}, "properties": {"repobilityId": "2f964ad7092d2b0f", "scanner": "scanner-primary", "fingerprint": "3eb8804bdb2eacf9", "layer": "security", "severity": "medium", "confidence": 0.65, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "ui/utils/notification-center.js"}, "region": {"startLine": 27}}}]}, {"ruleId": "scanner-e7809d571f9c8b7e", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in ui/utils/perf-monitor.js:25"}, "properties": {"repobilityId": "72a4e72747c85297", "scanner": "scanner-primary", "fingerprint": "e7809d571f9c8b7e", "layer": "security", "severity": "medium", "confidence": 0.65, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "ui/utils/perf-monitor.js"}, "region": {"startLine": 25}}}]}, {"ruleId": "scanner-764bca6a10063f0c", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in ui/utils/activity-log.js:25"}, "properties": {"repobilityId": "656d8e1c9fb71356", "scanner": "scanner-primary", "fingerprint": "764bca6a10063f0c", "layer": "security", "severity": "medium", "confidence": 0.65, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "ui/utils/activity-log.js"}, "region": {"startLine": 25}}}]}, {"ruleId": "scanner-ec0f9dbde47c2fd5", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in ui/utils/onboarding.js:120"}, "properties": {"repobilityId": "c35c8ba7cbebe641", "scanner": "scanner-primary", "fingerprint": "ec0f9dbde47c2fd5", "layer": "security", "severity": "medium", "confidence": 0.65, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "ui/utils/onboarding.js"}, "region": {"startLine": 120}}}]}, {"ruleId": "scanner-ae8c2514292d2b93", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in ui/utils/toast.js:47"}, "properties": {"repobilityId": "b0b73a684bcd03b5", "scanner": "scanner-primary", "fingerprint": "ae8c2514292d2b93", "layer": "security", "severity": "medium", "confidence": 0.65, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "ui/utils/toast.js"}, "region": {"startLine": 47}}}]}, {"ruleId": "scanner-3af5287af9be0c4c", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in ui/utils/theme-toggle.js:55"}, "properties": {"repobilityId": "9e5b12a25cca00e7", "scanner": "scanner-primary", "fingerprint": "3af5287af9be0c4c", "layer": "security", "severity": "medium", "confidence": 0.65, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "ui/utils/theme-toggle.js"}, "region": {"startLine": 55}}}]}, {"ruleId": "scanner-799f8bf2f6388ec8", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in ui/utils/command-palette.js:116"}, "properties": {"repobilityId": "1d70d4594618b335", "scanner": "scanner-primary", "fingerprint": "799f8bf2f6388ec8", "layer": "security", "severity": "medium", "confidence": 0.65, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "ui/utils/command-palette.js"}, "region": {"startLine": 116}}}]}, {"ruleId": "scanner-d6e3510149e026af", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in ui/utils/keyboard-shortcuts.js:89"}, "properties": {"repobilityId": "46b06aee11d9c064", "scanner": "scanner-primary", "fingerprint": "d6e3510149e026af", "layer": "security", "severity": "medium", "confidence": 0.65, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "ui/utils/keyboard-shortcuts.js"}, "region": {"startLine": 89}}}]}, {"ruleId": "scanner-6529c745de3402a1", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in ui/utils/data-export.js:52"}, "properties": {"repobilityId": "f6408b3fc2f3262a", "scanner": "scanner-primary", "fingerprint": "6529c745de3402a1", "layer": "security", "severity": "medium", "confidence": 0.65, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "ui/utils/data-export.js"}, "region": {"startLine": 52}}}]}, {"ruleId": "scanner-8640923a01fd78e7", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in ui/utils/connection-status.js:22"}, "properties": {"repobilityId": "4934fd9b1b32765e", "scanner": "scanner-primary", "fingerprint": "8640923a01fd78e7", "layer": "security", "severity": "medium", "confidence": 0.65, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "ui/utils/connection-status.js"}, "region": {"startLine": 22}}}]}, {"ruleId": "scanner-1d83c6c7b9056adb", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in ui/components/LiveDemoTab.js:326"}, "properties": {"repobilityId": "cac12a37767f3948", "scanner": "scanner-primary", "fingerprint": "1d83c6c7b9056adb", "layer": "security", "severity": "medium", "confidence": 0.65, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "ui/components/LiveDemoTab.js"}, "region": {"startLine": 326}}}]}, {"ruleId": "scanner-a3b43d61c4937432", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in ui/components/PoseDetectionCanvas.js:86"}, "properties": {"repobilityId": "81891f3e40419d53", "scanner": "scanner-primary", "fingerprint": "a3b43d61c4937432", "layer": "security", "severity": "medium", "confidence": 0.65, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "ui/components/PoseDetectionCanvas.js"}, "region": {"startLine": 86}}}]}, {"ruleId": "scanner-09095d78210e361f", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in ui/components/dashboard-hud.js:33"}, "properties": {"repobilityId": "b1789700bb826881", "scanner": "scanner-primary", "fingerprint": "09095d78210e361f", "layer": "security", "severity": "medium", "confidence": 0.65, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "ui/components/dashboard-hud.js"}, "region": {"startLine": 33}}}]}, {"ruleId": "scanner-2c7f0b4778118c2f", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in ui/components/SensingTab.js:34"}, "properties": {"repobilityId": "e3cf2d5780df31b4", "scanner": "scanner-primary", "fingerprint": "2c7f0b4778118c2f", "layer": "security", "severity": "medium", "confidence": 0.65, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "ui/components/SensingTab.js"}, "region": {"startLine": 34}}}]}, {"ruleId": "scanner-7a46a6cc8643032c", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in ui/components/SettingsPanel.js:119"}, "properties": {"repobilityId": "8f91d41bc127022f", "scanner": "scanner-primary", "fingerprint": "7a46a6cc8643032c", "layer": "security", "severity": "medium", "confidence": 0.65, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "ui/components/SettingsPanel.js"}, "region": {"startLine": 119}}}]}, {"ruleId": "scanner-9746b81d162ef851", "level": "error", "message": {"text": "Insecure pattern 'exec_used' in dashboard/src/components/nv-console.ts:119"}, "properties": {"repobilityId": "ab6cbaacaa4a2a3c", "scanner": "scanner-primary", "fingerprint": "9746b81d162ef851", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "exec_used"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "dashboard/src/components/nv-console.ts"}, "region": {"startLine": 119}}}]}, {"ruleId": "scanner-0218c5e58a629d27", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in dashboard/src/components/nv-console.ts:254"}, "properties": {"repobilityId": "35d1c7a3bbbb72f1", "scanner": "scanner-primary", "fingerprint": "0218c5e58a629d27", "layer": "security", "severity": "medium", "confidence": 0.65, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "dashboard/src/components/nv-console.ts"}, "region": {"startLine": 254}}}]}, {"ruleId": "scanner-fa5b6bb371fcd88d", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in dashboard/src/components/nv-onboarding.ts:375"}, "properties": {"repobilityId": "7361632e3d88941c", "scanner": "scanner-primary", "fingerprint": "fa5b6bb371fcd88d", "layer": "security", "severity": "medium", "confidence": 0.65, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "dashboard/src/components/nv-onboarding.ts"}, "region": {"startLine": 375}}}]}, {"ruleId": "scanner-6ef029e09bdf6b0a", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in dashboard/src/components/nv-modal.ts:140"}, "properties": {"repobilityId": "32840bb25bca4794", "scanner": "scanner-primary", "fingerprint": "6ef029e09bdf6b0a", "layer": "security", "severity": "medium", "confidence": 0.65, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "dashboard/src/components/nv-modal.ts"}, "region": {"startLine": 140}}}]}, {"ruleId": "scanner-c059cd940154f5d1", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in dashboard/src/components/nv-help.ts:347"}, "properties": {"repobilityId": "b3be96e87d321796", "scanner": "scanner-primary", "fingerprint": "c059cd940154f5d1", "layer": "security", "severity": "medium", "confidence": 0.65, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "dashboard/src/components/nv-help.ts"}, "region": {"startLine": 347}}}]}, {"ruleId": "scanner-4fee2f9ce8583df9", "level": "error", "message": {"text": "Insecure pattern 'node_child_process' in .claude/helpers/github-safe.js:12"}, "properties": {"repobilityId": "2d56a3c5a4e7ca64", "scanner": "scanner-primary", "fingerprint": "4fee2f9ce8583df9", "layer": "security", "severity": "high", "confidence": 0.9, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/helpers/github-safe.js"}, "region": {"startLine": 12}}}]}, {"ruleId": "scanner-68ce8f3bdd5109ba", "level": "error", "message": {"text": "Insecure pattern 'node_child_process' in .claude/helpers/metrics-db.mjs:12"}, "properties": {"repobilityId": "79f8447c21ecc431", "scanner": "scanner-primary", "fingerprint": "68ce8f3bdd5109ba", "layer": "security", "severity": "high", "confidence": 0.9, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/helpers/metrics-db.mjs"}, "region": {"startLine": 12}}}]}, {"ruleId": "scanner-ecd34fb455fa14ee", "level": "error", "message": {"text": "Insecure pattern 'node_child_process' in .claude/helpers/statusline.cjs:19"}, "properties": {"repobilityId": "ab071a8f21604a91", "scanner": "scanner-primary", "fingerprint": "ecd34fb455fa14ee", "layer": "security", "severity": "high", "confidence": 0.9, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/helpers/statusline.cjs"}, "region": {"startLine": 19}}}]}, {"ruleId": "scanner-035e3001a0c57ad1", "level": "error", "message": {"text": "Insecure pattern 'node_child_process' in .claude/helpers/statusline.js:11"}, "properties": {"repobilityId": "ddfa45eedcc306d5", "scanner": "scanner-primary", "fingerprint": "035e3001a0c57ad1", "layer": "security", "severity": "high", "confidence": 0.9, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/helpers/statusline.js"}, "region": {"startLine": 11}}}]}, {"ruleId": "scanner-a3d049e794f5c8be", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "577ad5cf987f7129", "scanner": "scanner-primary", "fingerprint": "a3d049e794f5c8be", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/sensing-server-docker.yml"}, "region": {"startLine": 76}}}]}, {"ruleId": "scanner-317d9044b94be58e", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "3cbbf84679653a5c", "scanner": "scanner-primary", "fingerprint": "317d9044b94be58e", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/sensing-server-docker.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-8253322df11538dc", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "211759bb9cd7091e", "scanner": "scanner-primary", "fingerprint": "8253322df11538dc", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/mqtt-integration.yml"}, "region": {"startLine": 73}}}]}, {"ruleId": "scanner-e0662b204e97cff6", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "cb88b360dab5f9c4", "scanner": "scanner-primary", "fingerprint": "e0662b204e97cff6", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/security-scan.yml"}, "region": {"startLine": 29}}}]}, {"ruleId": "scanner-99613dc1ad09765c", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "eb86717532f27e61", "scanner": "scanner-primary", "fingerprint": "99613dc1ad09765c", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/desktop-release.yml"}, "region": {"startLine": 30}}}]}, {"ruleId": "scanner-c098ebdea4e7053a", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "ecbb68810a135b54", "scanner": "scanner-primary", "fingerprint": "c098ebdea4e7053a", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/desktop-release.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-2a776c16dd0fe7d7", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "25ff783bfc74c2fb", "scanner": "scanner-primary", "fingerprint": "2a776c16dd0fe7d7", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/cd.yml"}, "region": {"startLine": 44}}}]}, {"ruleId": "scanner-e3b3ce5c668ed0df", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "1e5f4cb488a78a74", "scanner": "scanner-primary", "fingerprint": "e3b3ce5c668ed0df", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ruview-npm-release.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-746c31a1f6b7f70e", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "3501f95671ad880d", "scanner": "scanner-primary", "fingerprint": "746c31a1f6b7f70e", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/fix-regression-guard.yml"}, "region": {"startLine": 52}}}]}, {"ruleId": "scanner-530f7a4ca135f065", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "7a8036e6c336355a", "scanner": "scanner-primary", "fingerprint": "530f7a4ca135f065", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/bfld-mqtt-integration.yml"}, "region": {"startLine": 55}}}]}, {"ruleId": "scanner-27924aa79fa4a517", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "ae16880318b99912", "scanner": "scanner-primary", "fingerprint": "27924aa79fa4a517", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 30}}}]}, {"ruleId": "scanner-64192a3c67110d01", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "87338a8bfcb6f435", "scanner": "scanner-primary", "fingerprint": "64192a3c67110d01", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a27d51649a1bbd2d", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "ddc547e7d4bd58c6", "scanner": "scanner-primary", "fingerprint": "a27d51649a1bbd2d", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/update-submodules.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3f7c1423cc9b422d", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "27657213679bd83f", "scanner": "scanner-primary", "fingerprint": "3f7c1423cc9b422d", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/clone-tracking.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-8624e3983b173174", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "cdce93de3e05efc8", "scanner": "scanner-primary", "fingerprint": "8624e3983b173174", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/firmware-ci.yml"}, "region": {"startLine": 178}}}]}, {"ruleId": "scanner-f01c3712ada95f9a", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "02044f521c325494", "scanner": "scanner-primary", "fingerprint": "f01c3712ada95f9a", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/bench-regression.yml"}, "region": {"startLine": 74}}}]}, {"ruleId": "scanner-6d01f13bb130f536", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "e2a0f68012a15b64", "scanner": "scanner-primary", "fingerprint": "6d01f13bb130f536", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/cog-ha-matter-release.yml"}, "region": {"startLine": 35}}}]}, {"ruleId": "scanner-183fe5addf2d2c46", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "aeb091c2f625ca23", "scanner": "scanner-primary", "fingerprint": "183fe5addf2d2c46", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/pointcloud-pages.yml"}, "region": {"startLine": 31}}}]}, {"ruleId": "scanner-d6e3107b94b42841", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "99ca962e6efeaf32", "scanner": "scanner-primary", "fingerprint": "d6e3107b94b42841", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/pointcloud-pages.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-0be68d74c2ba7f54", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "fd64a5feb2492ab1", "scanner": "scanner-primary", "fingerprint": "0be68d74c2ba7f54", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/pip-release.yml"}, "region": {"startLine": 85}}}]}, {"ruleId": "scanner-85765ab67e39bd96", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "8b3c8218452cf50d", "scanner": "scanner-primary", "fingerprint": "85765ab67e39bd96", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/threejs-pages.yml"}, "region": {"startLine": 32}}}]}, {"ruleId": "scanner-658e95f58a731bfb", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "aada68d8197fe4eb", "scanner": "scanner-primary", "fingerprint": "658e95f58a731bfb", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/threejs-pages.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-9f1cbecfd5c42193", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "6dac9c8f108ffa3b", "scanner": "scanner-primary", "fingerprint": "9f1cbecfd5c42193", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ruview-swarm-ci.yml"}, "region": {"startLine": 47}}}]}, {"ruleId": "scanner-140f3244824794d0", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "08ae3b0e51794482", "scanner": "scanner-primary", "fingerprint": "140f3244824794d0", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/firmware-qemu.yml"}, "region": {"startLine": 37}}}]}, {"ruleId": "scanner-bb5d3556f833c398", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "9e42599e32acca98", "scanner": "scanner-primary", "fingerprint": "bb5d3556f833c398", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/nvsim-server-docker.yml"}, "region": {"startLine": 42}}}]}, {"ruleId": "scanner-fa59bee241142ed2", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "7e5c62914f92b00c", "scanner": "scanner-primary", "fingerprint": "fa59bee241142ed2", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/nvsim-server-docker.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-11e08a7aff298fde", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "6caf8d2d0c6fe6fd", "scanner": "scanner-primary", "fingerprint": "11e08a7aff298fde", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/dashboard-pages.yml"}, "region": {"startLine": 28}}}]}, {"ruleId": "scanner-3daccc541395ad13", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "6141c4d347294644", "scanner": "scanner-primary", "fingerprint": "3daccc541395ad13", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/dashboard-pages.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-89ad4c59baf55eeb", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "d939cf3edbb84f64", "scanner": "scanner-primary", "fingerprint": "89ad4c59baf55eeb", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/aether-arena-harness.yml"}, "region": {"startLine": 43}}}]}, {"ruleId": "scanner-3c42bf95e7fe6f02", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "85131bd2ab56e19d", "scanner": "scanner-primary", "fingerprint": "3c42bf95e7fe6f02", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/verify-pipeline.yml"}, "region": {"startLine": 32}}}]}, {"ruleId": "scanner-d1456233361847e2", "level": "note", "message": {"text": "Very large file: v2/crates/wifi-densepose-ruvector/src/crv/mod.rs (1439 lines)"}, "properties": {"repobilityId": "681f9e0809de180e", "scanner": "scanner-primary", "fingerprint": "d1456233361847e2", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-b456e6c971eb6a68", "level": "note", "message": {"text": "Very large file: v2/crates/wifi-densepose-sensing-server/src/training_api.rs (2135 lines)"}, "properties": {"repobilityId": "d65a697b60bca959", "scanner": "scanner-primary", "fingerprint": "b456e6c971eb6a68", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-017d71867f46115f", "level": "note", "message": {"text": "Very large file: v2/crates/wifi-densepose-sensing-server/src/embedding.rs (1589 lines)"}, "properties": {"repobilityId": "2d8f7d63740a7a21", "scanner": "scanner-primary", "fingerprint": "017d71867f46115f", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-60ecf1e43d798a9e", "level": "note", "message": {"text": "Very large file: v2/crates/wifi-densepose-sensing-server/src/trainer.rs (1684 lines)"}, "properties": {"repobilityId": "cffbba11aab3bda1", "scanner": "scanner-primary", "fingerprint": "60ecf1e43d798a9e", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-b212c0681da9d34e", "level": "note", "message": {"text": "Very large file: v2/crates/wifi-densepose-sensing-server/src/main.rs (9065 lines)"}, "properties": {"repobilityId": "b74366644bbacd62", "scanner": "scanner-primary", "fingerprint": "b212c0681da9d34e", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-04a86017a3d9e973", "level": "note", "message": {"text": "Very large file: v2/crates/wifi-densepose-wasm/src/mat.rs (1696 lines)"}, "properties": {"repobilityId": "0dbfbdbd8bf365c8", "scanner": "scanner-primary", "fingerprint": "04a86017a3d9e973", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-cacbdadfc859a67d", "level": "note", "message": {"text": "Very large file: v2/crates/wifi-densepose-mat/src/integration/hardware_adapter.rs (1655 lines)"}, "properties": {"repobilityId": "a84130084a6d7611", "scanner": "scanner-primary", "fingerprint": "cacbdadfc859a67d", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-01e30b584364fb29", "level": "note", "message": {"text": "Very large file: v2/crates/wifi-densepose-signal/src/ruvsense/cir.rs (1547 lines)"}, "properties": {"repobilityId": "efebde4d8be81f88", "scanner": "scanner-primary", "fingerprint": "01e30b584364fb29", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-ec66505395293737", "level": "note", "message": {"text": "Very large file: v2/crates/wifi-densepose-signal/src/ruvsense/pose_tracker.rs (1577 lines)"}, "properties": {"repobilityId": "1b3b6c8205397514", "scanner": "scanner-primary", "fingerprint": "ec66505395293737", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-27d08ebe89285419", "level": "note", "message": {"text": "Very large file: v2/crates/wifi-densepose-signal/src/ruvsense/multistatic.rs (1250 lines)"}, "properties": {"repobilityId": "ce413b0fffe2b600", "scanner": "scanner-primary", "fingerprint": "27d08ebe89285419", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-ae70244a6fb0a48c", "level": "note", "message": {"text": "Very large file: v2/crates/wifi-densepose-signal/src/ruvsense/field_model.rs (1476 lines)"}, "properties": {"repobilityId": "ed50ceecda80230f", "scanner": "scanner-primary", "fingerprint": "ae70244a6fb0a48c", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-034b804386d1cd0b", "level": "note", "message": {"text": "Very large file: v2/crates/wifi-densepose-desktop/ui/src/pages/EdgeModules.tsx (1822 lines)"}, "properties": {"repobilityId": "a7f921778730f00c", "scanner": "scanner-primary", "fingerprint": "034b804386d1cd0b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-49e714575329ffcd", "level": "note", "message": {"text": "Very large file: v2/crates/wifi-densepose-core/src/types.rs (1802 lines)"}, "properties": {"repobilityId": "e70980d31d45c4b7", "scanner": "scanner-primary", "fingerprint": "49e714575329ffcd", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-81774e8b88386a12", "level": "note", "message": {"text": "Very large file: v2/crates/wifi-densepose-train/src/metrics.rs (1653 lines)"}, "properties": {"repobilityId": "206c14dbf6f83251", "scanner": "scanner-primary", "fingerprint": "81774e8b88386a12", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-c9c318cc090cb3c7", "level": "note", "message": {"text": "Very large file: v2/crates/wifi-densepose-train/src/dataset.rs (1518 lines)"}, "properties": {"repobilityId": "ecf24bdaa4facc8f", "scanner": "scanner-primary", "fingerprint": "c9c318cc090cb3c7", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-9d6b9dfdeaf14103", "level": "note", "message": {"text": "Very large file: v2/crates/wifi-densepose-engine/src/lib.rs (1362 lines)"}, "properties": {"repobilityId": "59d79b2cccd1148c", "scanner": "scanner-primary", "fingerprint": "9d6b9dfdeaf14103", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-cee9332605417bed", "level": "note", "message": {"text": "Very large file: v2/crates/wifi-densepose-cli/src/calibrate_api.rs (1208 lines)"}, "properties": {"repobilityId": "45c089d72702f056", "scanner": "scanner-primary", "fingerprint": "cee9332605417bed", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-87ae2e30b8151c1a", "level": "note", "message": {"text": "Very large file: ui/observatory/js/demo-data.js (1794 lines)"}, "properties": {"repobilityId": "74c1a7bf72d93178", "scanner": "scanner-primary", "fingerprint": "87ae2e30b8151c1a", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-227af50706e8d70d", "level": "note", "message": {"text": "Very large file: ui/components/LiveDemoTab.js (1885 lines)"}, "properties": {"repobilityId": "3acdbd5040885e7d", "scanner": "scanner-primary", "fingerprint": "227af50706e8d70d", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-08ccc4c098c0a7f9", "level": "note", "message": {"text": "Very large file: scripts/train-wiflow-supervised.js (1657 lines)"}, "properties": {"repobilityId": "f519d57cfddc0158", "scanner": "scanner-primary", "fingerprint": "08ccc4c098c0a7f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-4a1bebaefedba21a", "level": "note", "message": {"text": "Very large file: scripts/train-camera-free.js (2489 lines)"}, "properties": {"repobilityId": "b3fdd7231710d3d0", "scanner": "scanner-primary", "fingerprint": "4a1bebaefedba21a", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-befdb2c35dc95c2b", "level": "note", "message": {"text": "Very large file: scripts/train-ruvllm.js (1745 lines)"}, "properties": {"repobilityId": "98e0f88795ac0278", "scanner": "scanner-primary", "fingerprint": "befdb2c35dc95c2b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-ea3b5e389d8c9c0f", "level": "note", "message": {"text": "Low test-to-source ratio"}, "properties": {"repobilityId": "ef7b2552cc00a375", "scanner": "scanner-primary", "fingerprint": "ea3b5e389d8c9c0f", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["tests"]}}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "74a385bee826c61d", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-72b2a6250083a784", "level": "warning", "message": {"text": "Placeholder or mock-heavy implementation detected"}, "properties": {"repobilityId": "3e4e9201db647818", "scanner": "scanner-primary", "fingerprint": "72b2a6250083a784", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "incomplete", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "3f917faff30f1b69", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-245e5285ebacad4d", "level": "note", "message": {"text": "Legacy-named symbol `pose_v1` in aether-arena/calibration/cog_calibrate.py:2"}, "properties": {"repobilityId": "e1a63c27aac8f308", "scanner": "scanner-primary", "fingerprint": "245e5285ebacad4d", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-22ba68229f6045d1", "level": "note", "message": {"text": "Legacy-named symbol `run_periodic_backup` in archive/v1/src/commands/start.py:175"}, "properties": {"repobilityId": "507024c2452387e5", "scanner": "scanner-primary", "fingerprint": "22ba68229f6045d1", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-760b7c0fc68e1de8", "level": "note", "message": {"text": "Legacy-named symbol `execute_backup` in archive/v1/src/tasks/backup.py:39"}, "properties": {"repobilityId": "e8de6cf71f5f0c7d", "scanner": "scanner-primary", "fingerprint": "760b7c0fc68e1de8", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-9e44d5b94682fd9e", "level": "note", "message": {"text": "Legacy-named symbol `ht_legacy` in archive/v1/src/hardware/csi_extractor.py:174"}, "properties": {"repobilityId": "fb8d1a5315f41962", "scanner": "scanner-primary", "fingerprint": "9e44d5b94682fd9e", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-b81d6a102f758485", "level": "note", "message": {"text": "Legacy-named symbol `sample_copy` in archive/v1/src/services/hardware_service.py:360"}, "properties": {"repobilityId": "b46d75e8c2c38ad8", "scanner": "scanner-primary", "fingerprint": "b81d6a102f758485", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-cd78478572a50392", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/generate_nvs_matrix.py:320"}, "properties": {"repobilityId": "9e53617ab1228653", "scanner": "scanner-primary", "fingerprint": "cd78478572a50392", "layer": "quality", "severity": "medium", "confidence": 0.85, "tags": ["integrity", "fragile-runtime", "robustness"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/generate_nvs_matrix.py"}, "region": {"startLine": 320}}}]}, {"ruleId": "scanner-41aa7a3202a55fdb", "level": "note", "message": {"text": "Legacy-named symbol `count_v1` in scripts/train-count.py:10"}, "properties": {"repobilityId": "f0fe3e88bb710009", "scanner": "scanner-primary", "fingerprint": "41aa7a3202a55fdb", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-f7db6be1a0053328", "level": "none", "message": {"text": "Commented-code block (5 lines) in scripts/ruview-hap-bridge.py:117"}, "properties": {"repobilityId": "8139f5a69cd6258d", "scanner": "scanner-primary", "fingerprint": "f7db6be1a0053328", "layer": "quality", "severity": "info", "confidence": 0.72, "tags": ["integrity", "commented-code", "dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/ruview-hap-bridge.py"}, "region": {"startLine": 117}}}]}, {"ruleId": "scanner-e339c868414e663e", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/provision.py:106"}, "properties": {"repobilityId": "909c9604e16e485d", "scanner": "scanner-primary", "fingerprint": "e339c868414e663e", "layer": "quality", "severity": "medium", "confidence": 0.85, "tags": ["integrity", "fragile-runtime", "robustness"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/provision.py"}, "region": {"startLine": 106}}}]}, {"ruleId": "scanner-f17dbf95d304eee1", "level": "note", "message": {"text": "Legacy-named symbol `pose_v1` in scripts/export-onnx.py:2"}, "properties": {"repobilityId": "987250969c478fb9", "scanner": "scanner-primary", "fingerprint": "f17dbf95d304eee1", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-f38ae9ac3a4024eb", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 firmware/esp32-csi-node/provision.py:267"}, "properties": {"repobilityId": "be35270adfff9c5f", "scanner": "scanner-primary", "fingerprint": "f38ae9ac3a4024eb", "layer": "quality", "severity": "medium", "confidence": 0.85, "tags": ["integrity", "fragile-runtime", "robustness"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "firmware/esp32-csi-node/provision.py"}, "region": {"startLine": 267}}}]}, {"ruleId": "scanner-ea149c43b0af2624", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 examples/through-wall/wiflow_capture.py:38"}, "properties": {"repobilityId": "8551e60e63edc7b2", "scanner": "scanner-primary", "fingerprint": "ea149c43b0af2624", "layer": "quality", "severity": "medium", "confidence": 0.85, "tags": ["integrity", "fragile-runtime", "robustness"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "examples/through-wall/wiflow_capture.py"}, "region": {"startLine": 38}}}]}, {"ruleId": "scanner-0cb71633a7dca2a3", "level": "note", "message": {"text": "Legacy-named symbol `count_v1` in examples/research-sota/03-spatial-intelligence/r5_subcarrier_saliency.py:9"}, "properties": {"repobilityId": "6911e730fda1014d", "scanner": "scanner-primary", "fingerprint": "0cb71633a7dca2a3", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-b6f6fc7cd1ce0df6", "level": "note", "message": {"text": "Legacy-named symbol `count_v1` in tools/ruview-mcp/src/tools/train-count.ts:8"}, "properties": {"repobilityId": "52ba3781ed63ae4e", "scanner": "scanner-primary", "fingerprint": "b6f6fc7cd1ce0df6", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-65df07ab4020db79", "level": "note", "message": {"text": "18 env vars used in code but missing from .env.example"}, "properties": {"repobilityId": "5e334d56f52c02e1", "scanner": "scanner-primary", "fingerprint": "65df07ab4020db79", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "config-drift"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "3c0cc689497e2748", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-be46ea126aa5d8dc", "level": "note", "message": {"text": "Near-duplicate function bodies in 3 places"}, "properties": {"repobilityId": "26c25108d4d2d4dc", "scanner": "scanner-primary", "fingerprint": "be46ea126aa5d8dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-b61635ed512d2c37", "level": "warning", "message": {"text": "FastAPI POST `dev_reset` without auth dependency \u2014 archive/v1/src/app.py:312"}, "properties": {"repobilityId": "0180b56e59c77f38", "scanner": "scanner-primary", "fingerprint": "b61635ed512d2c37", "layer": "security", "severity": "medium", "confidence": 0.5, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation", "non-production-context"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "archive/v1/src/app.py"}, "region": {"startLine": 312}}}]}, {"ruleId": "scanner-3a6c8682263a25e9", "level": "warning", "message": {"text": "FastAPI POST `dev_reset` without auth dependency \u2014 archive/v1/src/api/main.py:405"}, "properties": {"repobilityId": "4e4f4968d4e070f3", "scanner": "scanner-primary", "fingerprint": "3a6c8682263a25e9", "layer": "security", "severity": "medium", "confidence": 0.5, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation", "non-production-context"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "archive/v1/src/api/main.py"}, "region": {"startLine": 405}}}]}, {"ruleId": "scanner-a3d65b3d3a1d8d9f", "level": "warning", "message": {"text": "Vulnerable dependency vite 5.4.21: GHSA-4w7w-66w2-5vf9"}, "properties": {"repobilityId": "90685dbb72b15019", "scanner": "scanner-primary", "fingerprint": "a3d65b3d3a1d8d9f", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-4w7w-66w2-5vf9", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "dashboard/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3f6aaa6fcd282f8a", "level": "error", "message": {"text": "Vulnerable dependency vite 5.4.21: GHSA-fx2h-pf6j-xcff"}, "properties": {"repobilityId": "d9b9604813f5ec55", "scanner": "scanner-primary", "fingerprint": "3f6aaa6fcd282f8a", "layer": "dependencies", "severity": "high", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-fx2h-pf6j-xcff", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "dashboard/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c2ca33f314aadf10", "level": "warning", "message": {"text": "Vulnerable dependency vite 5.4.21: GHSA-v6wh-96g9-6wx3"}, "properties": {"repobilityId": "6d8cd9b06e1669ff", "scanner": "scanner-primary", "fingerprint": "c2ca33f314aadf10", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-v6wh-96g9-6wx3", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "dashboard/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-16f6a8a051b52738", "level": "error", "message": {"text": "Vulnerable dependency vitest 2.1.9: GHSA-5xrq-8626-4rwp"}, "properties": {"repobilityId": "da08ac2611c1f580", "scanner": "scanner-primary", "fingerprint": "16f6a8a051b52738", "layer": "dependencies", "severity": "high", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-5xrq-8626-4rwp", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "dashboard/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-fa07bca0883e94f3", "level": "error", "message": {"text": "Vulnerable dependency vite 6.4.2: GHSA-fx2h-pf6j-xcff"}, "properties": {"repobilityId": "eab07cdb6033978e", "scanner": "scanner-primary", "fingerprint": "fa07bca0883e94f3", "layer": "dependencies", "severity": "high", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-fx2h-pf6j-xcff", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "examples/frontend/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-4efd7492e6fa40fd", "level": "warning", "message": {"text": "Vulnerable dependency vite 6.4.2: GHSA-v6wh-96g9-6wx3"}, "properties": {"repobilityId": "cc4b5000fe61f491", "scanner": "scanner-primary", "fingerprint": "4efd7492e6fa40fd", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-v6wh-96g9-6wx3", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "examples/frontend/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-5f1f6b5e80067783", "level": "warning", "message": {"text": "Vulnerable dependency anyhow 1.0.102: RUSTSEC-2026-0190"}, "properties": {"repobilityId": "b0f8e201981c9769", "scanner": "scanner-primary", "fingerprint": "5f1f6b5e80067783", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "RUSTSEC-2026-0190"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "v2/Cargo.toml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-2accc5891a61e565", "level": "error", "message": {"text": "Vulnerable dependency pyo3 0.22.6: GHSA-36hh-v3qg-5jq4"}, "properties": {"repobilityId": "b67aba4bd4659a63", "scanner": "scanner-primary", "fingerprint": "2accc5891a61e565", "layer": "dependencies", "severity": "high", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-36hh-v3qg-5jq4"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "python/Cargo.toml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-1384b5d4ae3b4326", "level": "warning", "message": {"text": "Vulnerable dependency pyo3 0.22.6: GHSA-chgr-c6px-7xpp"}, "properties": {"repobilityId": "7ea74461b21b08cc", "scanner": "scanner-primary", "fingerprint": "1384b5d4ae3b4326", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-chgr-c6px-7xpp"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "python/Cargo.toml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-acd70946754d3bbd", "level": "warning", "message": {"text": "Vulnerable dependency pyo3 0.22.6: GHSA-pph8-gcv7-4qj5"}, "properties": {"repobilityId": "bbcbf3513e9b0415", "scanner": "scanner-primary", "fingerprint": "acd70946754d3bbd", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-pph8-gcv7-4qj5"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "python/Cargo.toml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a3c2e6a99debc235", "level": "warning", "message": {"text": "Vulnerable dependency pyo3 0.22.6: RUSTSEC-2025-0020"}, "properties": {"repobilityId": "f94d6b1cde71bb66", "scanner": "scanner-primary", "fingerprint": "a3c2e6a99debc235", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "RUSTSEC-2025-0020"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "python/Cargo.toml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-bda556c5f5526821", "level": "warning", "message": {"text": "Vulnerable dependency pyo3 0.22.6: RUSTSEC-2026-0177"}, "properties": {"repobilityId": "981b50f611af75e8", "scanner": "scanner-primary", "fingerprint": "bda556c5f5526821", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "RUSTSEC-2026-0177"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "python/Cargo.toml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-bdf36a3b4e7c2df5", "level": "error", "message": {"text": "Vulnerable dependency axios 1.15.2: GHSA-35jp-ww65-95wh"}, "properties": {"repobilityId": "490018abfb55aa37", "scanner": "scanner-primary", "fingerprint": "bdf36a3b4e7c2df5", "layer": "dependencies", "severity": "high", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-35jp-ww65-95wh"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "ui/mobile/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-701330646ac2c677", "level": "warning", "message": {"text": "Vulnerable dependency axios 1.15.2: GHSA-42h9-826w-cgv3"}, "properties": {"repobilityId": "9bac47a54c2d2285", "scanner": "scanner-primary", "fingerprint": "701330646ac2c677", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-42h9-826w-cgv3"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "ui/mobile/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-357f6abebf247797", "level": "note", "message": {"text": "Vulnerable dependency axios 1.15.2: GHSA-654m-c8p4-x5fp"}, "properties": {"repobilityId": "0a746fcafffd24d5", "scanner": "scanner-primary", "fingerprint": "357f6abebf247797", "layer": "dependencies", "severity": "low", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-654m-c8p4-x5fp"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "ui/mobile/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-731b8a93aa26d8f6", "level": "warning", "message": {"text": "Vulnerable dependency axios 1.15.2: GHSA-777c-7fjr-54vf"}, "properties": {"repobilityId": "6acfb54da0a07725", "scanner": "scanner-primary", "fingerprint": "731b8a93aa26d8f6", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-777c-7fjr-54vf"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "ui/mobile/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-fc0168187b1e8d74", "level": "warning", "message": {"text": "Vulnerable dependency axios 1.15.2: GHSA-7q8q-rj6j-mhjq"}, "properties": {"repobilityId": "1f1392c58a054edf", "scanner": "scanner-primary", "fingerprint": "fc0168187b1e8d74", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-7q8q-rj6j-mhjq"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "ui/mobile/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6d0aa722656ad809", "level": "warning", "message": {"text": "Vulnerable dependency axios 1.15.2: GHSA-898c-q2cr-xwhg"}, "properties": {"repobilityId": "228f1d198f0ff1df", "scanner": "scanner-primary", "fingerprint": "6d0aa722656ad809", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-898c-q2cr-xwhg"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "ui/mobile/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-773de9ecd0cdb1b5", "level": "warning", "message": {"text": "Vulnerable dependency axios 1.15.2: GHSA-f4gw-2p7v-4548"}, "properties": {"repobilityId": "d4d82f0fe8af734c", "scanner": "scanner-primary", "fingerprint": "773de9ecd0cdb1b5", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-f4gw-2p7v-4548"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "ui/mobile/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-bbfd40bcb1a9ce72", "level": "warning", "message": {"text": "Vulnerable dependency axios 1.15.2: GHSA-gcfj-64vw-6mp9"}, "properties": {"repobilityId": "990453725fb2cdcc", "scanner": "scanner-primary", "fingerprint": "bbfd40bcb1a9ce72", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-gcfj-64vw-6mp9"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "ui/mobile/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-4d8104e475dca2b0", "level": "warning", "message": {"text": "Vulnerable dependency axios 1.15.2: GHSA-hcpx-6fm6-wx23"}, "properties": {"repobilityId": "2b2a64b2246ede18", "scanner": "scanner-primary", "fingerprint": "4d8104e475dca2b0", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-hcpx-6fm6-wx23"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "ui/mobile/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-50f8aba4fd4aab2b", "level": "warning", "message": {"text": "Vulnerable dependency axios 1.15.2: GHSA-hfxv-24rg-xrqf"}, "properties": {"repobilityId": "7b85a74daa43e5a5", "scanner": "scanner-primary", "fingerprint": "50f8aba4fd4aab2b", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-hfxv-24rg-xrqf"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "ui/mobile/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-7ae5dac514331cf4", "level": "warning", "message": {"text": "Vulnerable dependency axios 1.15.2: GHSA-j5f8-grm9-p9fc"}, "properties": {"repobilityId": "f34fe17ea09b9e54", "scanner": "scanner-primary", "fingerprint": "7ae5dac514331cf4", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-j5f8-grm9-p9fc"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "ui/mobile/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-94dc465509993d28", "level": "warning", "message": {"text": "Vulnerable dependency axios 1.15.2: GHSA-jqh4-m9w3-8hp9"}, "properties": {"repobilityId": "e704c8652cb42dd2", "scanner": "scanner-primary", "fingerprint": "94dc465509993d28", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-jqh4-m9w3-8hp9"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "ui/mobile/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-0262e0ebb79e5e3b", "level": "warning", "message": {"text": "Vulnerable dependency axios 1.15.2: GHSA-mmx7-hfxf-jppx"}, "properties": {"repobilityId": "5499ddb2841ca800", "scanner": "scanner-primary", "fingerprint": "0262e0ebb79e5e3b", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-mmx7-hfxf-jppx"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "ui/mobile/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-fafde89cd1ab24f0", "level": "warning", "message": {"text": "Vulnerable dependency axios 1.15.2: GHSA-mwf2-3pr3-8698"}, "properties": {"repobilityId": "7f4068bde334f3dd", "scanner": "scanner-primary", "fingerprint": "fafde89cd1ab24f0", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-mwf2-3pr3-8698"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "ui/mobile/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c89b290bfdb016ca", "level": "warning", "message": {"text": "Vulnerable dependency axios 1.15.2: GHSA-p92q-9vqr-4j8v"}, "properties": {"repobilityId": "2172890568c6e4b1", "scanner": "scanner-primary", "fingerprint": "c89b290bfdb016ca", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-p92q-9vqr-4j8v"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "ui/mobile/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-376e7e7da7e8bb83", "level": "warning", "message": {"text": "Vulnerable dependency axios 1.15.2: GHSA-pjwm-pj3p-43mv"}, "properties": {"repobilityId": "c97fdcf5633a3602", "scanner": "scanner-primary", "fingerprint": "376e7e7da7e8bb83", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-pjwm-pj3p-43mv"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "ui/mobile/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-4040860d05752b65", "level": "warning", "message": {"text": "Vulnerable dependency axios 1.15.2: GHSA-pmv8-rq9r-6j72"}, "properties": {"repobilityId": "f7027094fd3a943c", "scanner": "scanner-primary", "fingerprint": "4040860d05752b65", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-pmv8-rq9r-6j72"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "ui/mobile/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-1c04c4bcea952336", "level": "warning", "message": {"text": "Vulnerable dependency axios 1.15.2: GHSA-xj6q-8x83-jv6g"}, "properties": {"repobilityId": "2af7f4e06ba51496", "scanner": "scanner-primary", "fingerprint": "1c04c4bcea952336", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-xj6q-8x83-jv6g"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "ui/mobile/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-5a1bbf5b20306289", "level": "warning", "message": {"text": "Vulnerable dependency memmap2 0.9.10: RUSTSEC-2026-0186"}, "properties": {"repobilityId": "09a8acb9d7c246c8", "scanner": "scanner-primary", "fingerprint": "5a1bbf5b20306289", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "RUSTSEC-2026-0186"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "v2/crates/wifi-densepose-nn/Cargo.toml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-fd231f714a362434", "level": "warning", "message": {"text": "Vulnerable dependency rand 0.7.3: GHSA-cq8v-f236-94qc"}, "properties": {"repobilityId": "0e726951f702cd3e", "scanner": "scanner-primary", "fingerprint": "fd231f714a362434", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-cq8v-f236-94qc"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "v2/Cargo.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-650cc16aff63adbc", "level": "warning", "message": {"text": "Vulnerable dependency rand 0.8.5: GHSA-cq8v-f236-94qc"}, "properties": {"repobilityId": "ba2e00fa76b72ddf", "scanner": "scanner-primary", "fingerprint": "650cc16aff63adbc", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-cq8v-f236-94qc"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "v2/crates/nvsim/Cargo.toml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-100d88a63f1c00c5", "level": "warning", "message": {"text": "Vulnerable dependency rand 0.9.2: GHSA-cq8v-f236-94qc"}, "properties": {"repobilityId": "8b40e66ae7f26243", "scanner": "scanner-primary", "fingerprint": "100d88a63f1c00c5", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-cq8v-f236-94qc"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "v2/Cargo.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-8203ce3539e39784", "level": "warning", "message": {"text": "Vulnerable dependency tauri 2.10.3: GHSA-7gmj-67g7-phm9"}, "properties": {"repobilityId": "5e04a00e4ab7f7c6", "scanner": "scanner-primary", "fingerprint": "8203ce3539e39784", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-7gmj-67g7-phm9"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "v2/crates/wifi-densepose-desktop/Cargo.toml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e42714a1ac6fa9a1", "level": "warning", "message": {"text": "Vulnerable dependency wasm3 0.3.1: GHSA-crf8-h2wq-2h9x"}, "properties": {"repobilityId": "1a96fd4dfe274230", "scanner": "scanner-primary", "fingerprint": "e42714a1ac6fa9a1", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-crf8-h2wq-2h9x"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "v2/crates/homecore-plugins/Cargo.toml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e0701c78f9adbb0b", "level": "warning", "message": {"text": "Vulnerable dependency wasm3 0.3.1: GHSA-fmq6-4w57-2w3v"}, "properties": {"repobilityId": "9569badf47038907", "scanner": "scanner-primary", "fingerprint": "e0701c78f9adbb0b", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-fmq6-4w57-2w3v"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "v2/crates/homecore-plugins/Cargo.toml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e10b2fe2ab7bcc25", "level": "warning", "message": {"text": "Vulnerable dependency wasm3 0.3.1: GHSA-gq4p-4hxv-5rg9"}, "properties": {"repobilityId": "3be480f3495299e7", "scanner": "scanner-primary", "fingerprint": "e10b2fe2ab7bcc25", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-gq4p-4hxv-5rg9"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "v2/crates/homecore-plugins/Cargo.toml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e5b5f1152bd4c595", "level": "warning", "message": {"text": "Vulnerable dependency wasmtime 42.0.2: GHSA-p8xm-42r7-89xg"}, "properties": {"repobilityId": "d4922620e38986e4", "scanner": "scanner-primary", "fingerprint": "e5b5f1152bd4c595", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-p8xm-42r7-89xg"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "v2/crates/homecore-plugins/Cargo.toml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-2a9da560db6f2887", "level": "warning", "message": {"text": "Vulnerable dependency wasmtime 42.0.2: RUSTSEC-2026-0114"}, "properties": {"repobilityId": "ffd82d445cfc3045", "scanner": "scanner-primary", "fingerprint": "2a9da560db6f2887", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "RUSTSEC-2026-0114"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "v2/crates/homecore-plugins/Cargo.toml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-23542a1d2a67d5c4", "level": "warning", "message": {"text": "Vulnerable dependency vite 6.4.1: GHSA-4w7w-66w2-5vf9"}, "properties": {"repobilityId": "8f492a912139007a", "scanner": "scanner-primary", "fingerprint": "23542a1d2a67d5c4", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-4w7w-66w2-5vf9", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "v2/crates/wifi-densepose-desktop/ui/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3c12e884bd940cf4", "level": "error", "message": {"text": "Vulnerable dependency vite 6.4.1: GHSA-fx2h-pf6j-xcff"}, "properties": {"repobilityId": "ea2c1060b30e2ff5", "scanner": "scanner-primary", "fingerprint": "3c12e884bd940cf4", "layer": "dependencies", "severity": "high", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-fx2h-pf6j-xcff", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "v2/crates/wifi-densepose-desktop/ui/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-2d45ebb04f4c4df9", "level": "warning", "message": {"text": "Vulnerable dependency vite 6.4.1: GHSA-p9ff-h696-f583"}, "properties": {"repobilityId": "27aa331eba031f35", "scanner": "scanner-primary", "fingerprint": "2d45ebb04f4c4df9", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-p9ff-h696-f583", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "v2/crates/wifi-densepose-desktop/ui/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-dcbd6df70eea9c92", "level": "warning", "message": {"text": "Vulnerable dependency vite 6.4.1: GHSA-v6wh-96g9-6wx3"}, "properties": {"repobilityId": "ab7386e4ced67400", "scanner": "scanner-primary", "fingerprint": "dcbd6df70eea9c92", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-v6wh-96g9-6wx3", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "v2/crates/wifi-densepose-desktop/ui/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-1942cfe4f41fcc96", "level": "warning", "message": {"text": "Vulnerable dependency anyhow 1.0.100: RUSTSEC-2026-0190"}, "properties": {"repobilityId": "aa0bcc428b4f1e68", "scanner": "scanner-primary", "fingerprint": "1942cfe4f41fcc96", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "RUSTSEC-2026-0190"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "v2/patches/ruvector-crv/Cargo.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-af3adc90b6c0e9ce", "level": "error", "message": {"text": "Vulnerable dependency gradio 5.9.1: GHSA-39mp-8hj3-5c49"}, "properties": {"repobilityId": "f99d7bd703f2294d", "scanner": "scanner-primary", "fingerprint": "af3adc90b6c0e9ce", "layer": "dependencies", "severity": "high", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-39mp-8hj3-5c49"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "aether-arena/space/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-fe2e4c63b73cdf2b", "level": "error", "message": {"text": "Vulnerable dependency gradio 5.9.1: GHSA-5cpq-9538-jm2j"}, "properties": {"repobilityId": "0d5865e1f327e152", "scanner": "scanner-primary", "fingerprint": "fe2e4c63b73cdf2b", "layer": "dependencies", "severity": "high", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-5cpq-9538-jm2j"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "aether-arena/space/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c857ba00df7c2150", "level": "warning", "message": {"text": "Vulnerable dependency gradio 5.9.1: GHSA-6655-8ph2-63j3"}, "properties": {"repobilityId": "8da3282fffafcb3d", "scanner": "scanner-primary", "fingerprint": "c857ba00df7c2150", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-6655-8ph2-63j3"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "aether-arena/space/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-49ac708e9a46dd70", "level": "warning", "message": {"text": "Vulnerable dependency gradio 5.9.1: GHSA-7hp7-4p35-3cx2"}, "properties": {"repobilityId": "36bd039e7aacca02", "scanner": "scanner-primary", "fingerprint": "49ac708e9a46dd70", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-7hp7-4p35-3cx2"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "aether-arena/space/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-5df9b40425e57492", "level": "warning", "message": {"text": "Vulnerable dependency gradio 5.9.1: GHSA-8jw3-6x8j-v96g"}, "properties": {"repobilityId": "07dce72d7ea67840", "scanner": "scanner-primary", "fingerprint": "5df9b40425e57492", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-8jw3-6x8j-v96g"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "aether-arena/space/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-90522bea54acb2ea", "level": "warning", "message": {"text": "Vulnerable dependency gradio 5.9.1: GHSA-h3h8-3v2v-rg7m"}, "properties": {"repobilityId": "8b50394186a4905f", "scanner": "scanner-primary", "fingerprint": "90522bea54acb2ea", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-h3h8-3v2v-rg7m"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "aether-arena/space/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-85629fff7bb936ea", "level": "warning", "message": {"text": "Vulnerable dependency gradio 5.9.1: GHSA-j2jg-fq62-7c3h"}, "properties": {"repobilityId": "a946f049faceaa93", "scanner": "scanner-primary", "fingerprint": "85629fff7bb936ea", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-j2jg-fq62-7c3h"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "aether-arena/space/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e3485569be58ec99", "level": "warning", "message": {"text": "Vulnerable dependency gradio 5.9.1: GHSA-jmh7-g254-2cq9"}, "properties": {"repobilityId": "2075534d589109a1", "scanner": "scanner-primary", "fingerprint": "e3485569be58ec99", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-jmh7-g254-2cq9"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "aether-arena/space/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a6a2114e3e01cc22", "level": "warning", "message": {"text": "Vulnerable dependency gradio 5.9.1: GHSA-pfjf-5gxr-995x"}, "properties": {"repobilityId": "34563028da449280", "scanner": "scanner-primary", "fingerprint": "a6a2114e3e01cc22", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-pfjf-5gxr-995x"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "aether-arena/space/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-2dbdeedbaee83b92", "level": "warning", "message": {"text": "Vulnerable dependency gradio 5.9.1: GHSA-wmjh-cpqj-4v6x"}, "properties": {"repobilityId": "4b4c4d004c94087c", "scanner": "scanner-primary", "fingerprint": "2dbdeedbaee83b92", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-wmjh-cpqj-4v6x"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "aether-arena/space/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d62f0bb16e90bf36", "level": "warning", "message": {"text": "Vulnerable dependency gradio 5.9.1: PYSEC-2026-1423"}, "properties": {"repobilityId": "fc381c3c9864bc20", "scanner": "scanner-primary", "fingerprint": "d62f0bb16e90bf36", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "PYSEC-2026-1423"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "aether-arena/space/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-17acbdb9a038dacf", "level": "warning", "message": {"text": "Vulnerable dependency gradio 5.9.1: PYSEC-2026-2178"}, "properties": {"repobilityId": "82af55aa31f5469c", "scanner": "scanner-primary", "fingerprint": "17acbdb9a038dacf", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "PYSEC-2026-2178"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "aether-arena/space/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-65f0b5f96f2761fd", "level": "warning", "message": {"text": "Vulnerable dependency gradio 5.9.1: PYSEC-2026-2179"}, "properties": {"repobilityId": "7ef0f6744bbb975d", "scanner": "scanner-primary", "fingerprint": "65f0b5f96f2761fd", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "PYSEC-2026-2179"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "aether-arena/space/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6d7b1883f0e3fd69", "level": "warning", "message": {"text": "Vulnerable dependency gradio 5.9.1: PYSEC-2026-63"}, "properties": {"repobilityId": "ec246bc3ea59b4da", "scanner": "scanner-primary", "fingerprint": "6d7b1883f0e3fd69", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "PYSEC-2026-63"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "aether-arena/space/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d12fe13f6ba7e602", "level": "warning", "message": {"text": "Vulnerable dependency gradio 5.9.1: PYSEC-2026-65"}, "properties": {"repobilityId": "763a583cc3cfd1fb", "scanner": "scanner-primary", "fingerprint": "d12fe13f6ba7e602", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "PYSEC-2026-65"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "aether-arena/space/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-044b0df4c950e7e6", "level": "warning", "message": {"text": "Vulnerable dependency gradio 5.9.1: PYSEC-2026-66"}, "properties": {"repobilityId": "128a691a3ec360bd", "scanner": "scanner-primary", "fingerprint": "044b0df4c950e7e6", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "PYSEC-2026-66"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "aether-arena/space/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d451a8ca1fd35465", "level": "note", "message": {"text": "Vulnerable dependency @babel/core 7.29.0: GHSA-4x5r-pxfx-6jf8"}, "properties": {"repobilityId": "048ec5a9afac1732", "scanner": "scanner-primary", "fingerprint": "d451a8ca1fd35465", "layer": "dependencies", "severity": "low", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-4x5r-pxfx-6jf8", "transitive", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "dashboard/package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-66c99a1590ffca72", "level": "warning", "message": {"text": "Vulnerable dependency @babel/plugin-transform-modules-systemjs 7.29.0: GHSA-fv7c-fp4j-7gwp"}, "properties": {"repobilityId": "c372c42eae2cf701", "scanner": "scanner-primary", "fingerprint": "66c99a1590ffca72", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-fv7c-fp4j-7gwp", "transitive", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "dashboard/package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-5847001aa44b14a8", "level": "error", "message": {"text": "Vulnerable dependency brace-expansion 5.0.5: GHSA-3jxr-9vmj-r5cp"}, "properties": {"repobilityId": "0940821b310c907f", "scanner": "scanner-primary", "fingerprint": "5847001aa44b14a8", "layer": "dependencies", "severity": "high", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-3jxr-9vmj-r5cp", "transitive", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "dashboard/package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c1ea30621303716e", "level": "warning", "message": {"text": "Vulnerable dependency brace-expansion 5.0.5: GHSA-jxxr-4gwj-5jf2"}, "properties": {"repobilityId": "07e03d2ef8e21c6c", "scanner": "scanner-primary", "fingerprint": "c1ea30621303716e", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-jxxr-4gwj-5jf2", "transitive", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "dashboard/package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-40651b83e54fdd7b", "level": "warning", "message": {"text": "Vulnerable dependency esbuild 0.21.5: GHSA-67mh-4wv8-2f99"}, "properties": {"repobilityId": "be00f073db852f14", "scanner": "scanner-primary", "fingerprint": "40651b83e54fdd7b", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-67mh-4wv8-2f99", "transitive", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "dashboard/package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-02a8133c16c1b381", "level": "error", "message": {"text": "Vulnerable dependency fast-uri 3.1.0: GHSA-4c8g-83qw-93j6"}, "properties": {"repobilityId": "ccba8e073dd684ab", "scanner": "scanner-primary", "fingerprint": "02a8133c16c1b381", "layer": "dependencies", "severity": "high", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-4c8g-83qw-93j6", "transitive", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "dashboard/package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-5245649defb1f493", "level": "warning", "message": {"text": "Vulnerable dependency fast-uri 3.1.0: GHSA-q3j6-qgpj-74h6"}, "properties": {"repobilityId": "9eb02b57c07aeb74", "scanner": "scanner-primary", "fingerprint": "5245649defb1f493", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-q3j6-qgpj-74h6", "transitive", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "dashboard/package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a78b40675f1202ba", "level": "warning", "message": {"text": "Vulnerable dependency fast-uri 3.1.0: GHSA-v2hh-gcrm-f6hx"}, "properties": {"repobilityId": "c516ccc3502eb13b", "scanner": "scanner-primary", "fingerprint": "a78b40675f1202ba", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-v2hh-gcrm-f6hx", "transitive", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "dashboard/package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-faf380dd883d5484", "level": "warning", "message": {"text": "Vulnerable dependency fast-uri 3.1.0: GHSA-v39h-62p7-jpjc"}, "properties": {"repobilityId": "06c91e3216e3fe95", "scanner": "scanner-primary", "fingerprint": "faf380dd883d5484", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-v39h-62p7-jpjc", "transitive", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "dashboard/package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-317d586d319e2152", "level": "error", "message": {"text": "Vulnerable dependency brace-expansion 2.1.0: GHSA-3jxr-9vmj-r5cp"}, "properties": {"repobilityId": "99627bea33b3e44f", "scanner": "scanner-primary", "fingerprint": "317d586d319e2152", "layer": "dependencies", "severity": "high", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-3jxr-9vmj-r5cp", "transitive", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "dashboard/package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-56efa0f976e30e40", "level": "note", "message": {"text": "Dependency colored is a major version behind"}, "properties": {"repobilityId": "e0c056a19fddd82f", "scanner": "scanner-primary", "fingerprint": "56efa0f976e30e40", "layer": "dependencies", "severity": "low", "confidence": 0.9, "tags": ["dependency", "freshness", "outdated"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "v2/crates/wifi-densepose-cli/Cargo.toml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f81bccbf4cdeb67a", "level": "note", "message": {"text": "Dependency dirs is a major version behind"}, "properties": {"repobilityId": "387dbbf8a59eff9d", "scanner": "scanner-primary", "fingerprint": "f81bccbf4cdeb67a", "layer": "dependencies", "severity": "low", "confidence": 0.9, "tags": ["dependency", "freshness", "outdated"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "v2/crates/wifi-densepose-pointcloud/Cargo.toml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e6ae1beeb662afc2", "level": "note", "message": {"text": "Dependency ed25519-dalek is a major version behind"}, "properties": {"repobilityId": "f271e3dc28850fcb", "scanner": "scanner-primary", "fingerprint": "e6ae1beeb662afc2", "layer": "dependencies", "severity": "low", "confidence": 0.9, "tags": ["dependency", "freshness", "outdated"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "v2/crates/cog-ha-matter/Cargo.toml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d2f08ce387d95f52", "level": "warning", "message": {"text": "Dangling fetch: DELETE /api/states/${encodeURIComponent(target.entity_id)} (examples/frontend/src/pages/Dashboard.ts:158)"}, "properties": {"repobilityId": "85a4fd3f514f103e", "scanner": "scanner-primary", "fingerprint": "d2f08ce387d95f52", "layer": "api", "severity": "medium", "confidence": 0.55, "tags": ["wiring", "dangling-fetch", "fetch", "non-production-context", "development-endpoint"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "examples/frontend/src/pages/Dashboard.ts"}, "region": {"startLine": 158}}}]}, {"ruleId": "scanner-4f285b6dce2314dc", "level": "warning", "message": {"text": "Dangling fetch: POST /api/states/${encodeURIComponent(entity_id)} (examples/frontend/src/pages/Dashboard.ts:179)"}, "properties": {"repobilityId": "837676a28743cdd7", "scanner": "scanner-primary", "fingerprint": "4f285b6dce2314dc", "layer": "api", "severity": "medium", "confidence": 0.55, "tags": ["wiring", "dangling-fetch", "fetch", "non-production-context", "development-endpoint"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "examples/frontend/src/pages/Dashboard.ts"}, "region": {"startLine": 179}}}]}, {"ruleId": "scanner-03cc1f9bb2736128", "level": "warning", "message": {"text": "Dangling fetch: GET /api/config (examples/frontend/src/pages/Settings.ts:118)"}, "properties": {"repobilityId": "7303c6c1c2618acf", "scanner": "scanner-primary", "fingerprint": "03cc1f9bb2736128", "layer": "api", "severity": "medium", "confidence": 0.55, "tags": ["wiring", "dangling-fetch", "fetch", "non-production-context", "development-endpoint"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "examples/frontend/src/pages/Settings.ts"}, "region": {"startLine": 118}}}]}, {"ruleId": "scanner-66cf29f958eb227d", "level": "warning", "message": {"text": "Dangling fetch: GET /api/services (examples/frontend/src/pages/Services.ts:125)"}, "properties": {"repobilityId": "97b96a4f803f3a92", "scanner": "scanner-primary", "fingerprint": "66cf29f958eb227d", "layer": "api", "severity": "medium", "confidence": 0.55, "tags": ["wiring", "dangling-fetch", "fetch", "non-production-context", "development-endpoint"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "examples/frontend/src/pages/Services.ts"}, "region": {"startLine": 125}}}]}, {"ruleId": "scanner-12c58f342e0e01d8", "level": "warning", "message": {"text": "Dangling fetch: POST /api/services/${encodeURIComponent(domain)}/${encodeURIComponent(service)} (examples/frontend/src/pages/Services.ts:177)"}, "properties": {"repobilityId": "9445b44a8c92aa78", "scanner": "scanner-primary", "fingerprint": "12c58f342e0e01d8", "layer": "api", "severity": "medium", "confidence": 0.55, "tags": ["wiring", "dangling-fetch", "fetch", "non-production-context", "development-endpoint"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "examples/frontend/src/pages/Services.ts"}, "region": {"startLine": 177}}}]}, {"ruleId": "scanner-523c9550836aa90f", "level": "note", "message": {"text": "28 backend endpoints not called by scanned frontend"}, "properties": {"repobilityId": "3c8e96670c5e1f9f", "scanner": "scanner-primary", "fingerprint": "523c9550836aa90f", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}]}]}