{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-bead75b0f9233e05", "name": "No API endpoints detected", "shortDescription": {"text": "No API endpoints detected"}, "fullDescription": {"text": "The scanner did not find FastAPI/Flask/Express/NestJS/GraphQL/gRPC routes. If this repo exposes APIs, the framework may be unsupported."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "info", "confidence": 1.0}}, {"id": "scanner-e1828e564b6321ca", "name": "Stray `console.log` in TS/JS \u2014 scripts/build-search-shards.js:132", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 scripts/build-search-shards.js:132"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-adef736b07fcb651", "name": "Stray `console.log` in TS/JS \u2014 scripts/discover-new-races.js:211", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 scripts/discover-new-races.js:211"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f5fa2bf9a8ebd235", "name": "Stray `console.log` in TS/JS \u2014 scripts/build-histograms.js:201", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 scripts/build-histograms.js:201"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-864140e6c1fb9291", "name": "Stray `console.log` in TS/JS \u2014 scripts/gzip-csvs.js:30", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 scripts/gzip-csvs.js:30"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2812b6f9ca2b1e2b", "name": "Stray `console.log` in TS/JS \u2014 scripts/scrape-all.js:97", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 scripts/scrape-all.js:97"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ed4b46f24eb2e8c9", "name": "Stray `console.log` in TS/JS \u2014 scripts/scrape.js:94", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 scripts/scrape.js:94"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6f3e0e6121e4fa05", "name": "Stray `console.log` in TS/JS \u2014 scripts/discover.js:149", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 scripts/discover.js:149"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-973a65422f4b2ad6", "name": "Stray `console.log` in TS/JS \u2014 scripts/build-athlete-shards.js:180", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 scripts/build-athlete-shards.js:180"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1593d3b15955e8bc", "name": "Stray `console.log` in TS/JS \u2014 scripts/build-search-index.js:270", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 scripts/build-search-index.js:270"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a03e9cf16ccadd99", "name": "`truncate` class without `title=` for hover reveal \u2014 app/src/components/CommandPalette.tsx:187", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 app/src/components/CommandPalette.tsx:187"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-6a4a9a24f498a1c7", "name": "\"active\" state uses light bg in a dark theme \u2014 app/src/app/races/race-list.tsx:41", "shortDescription": {"text": "\"active\" state uses light bg in a dark theme \u2014 app/src/app/races/race-list.tsx:41"}, "fullDescription": {"text": "A ternary like `active ? 'bg-white' : '...'` (or bg-gray-100/200) on a dark theme produces jarring white pills. Use a dark-emphasized active state instead \u2014 border + ring or slightly brighter dark bg. Example: `active ? 'bg-gray-800 border-gray-500 ring-1 ring-blue-500/30' : '\u2026'`.\n\nWhy: P-E in CHECKLIST.md \u2014 light bg in a dark theme is a class of regression.\nRule id: fq.active-light-bg"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0d145d308ec33769", "name": "\"active\" state uses light bg in a dark theme \u2014 app/src/app/courses/course-charts.tsx:57", "shortDescription": {"text": "\"active\" state uses light bg in a dark theme \u2014 app/src/app/courses/course-charts.tsx:57"}, "fullDescription": {"text": "A ternary like `active ? 'bg-white' : '...'` (or bg-gray-100/200) on a dark theme produces jarring white pills. Use a dark-emphasized active state instead \u2014 border + ring or slightly brighter dark bg. Example: `active ? 'bg-gray-800 border-gray-500 ring-1 ring-blue-500/30' : '\u2026'`.\n\nWhy: P-E in CHECKLIST.md \u2014 light bg in a dark theme is a class of regression.\nRule id: fq.active-light-bg"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9f46cd3e4dc1c0b3", "name": "Stray `console.log` in TS/JS \u2014 app/e2e/athlete-search.spec.ts:35", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 app/e2e/athlete-search.spec.ts:35"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e0c179991d759cc2", "name": "Stray `console.log` in TS/JS \u2014 app/e2e/journey-performance.spec.ts:97", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 app/e2e/journey-performance.spec.ts:97"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1e45b59305439be7", "name": "Stray `console.log` in TS/JS \u2014 app/e2e/performance.spec.ts:74", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 app/e2e/performance.spec.ts:74"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cfc22de9667b1bc9", "name": "Insecure pattern 'node_child_process' in scripts/scrape-all.js:16", "shortDescription": {"text": "Insecure pattern 'node_child_process' in scripts/scrape-all.js:16"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6372cebde0220094", "name": "No auth library detected", "shortDescription": {"text": "No auth library detected"}, "fullDescription": {"text": "The scanner did not find any standard auth library (JWT, OAuth, NextAuth, Auth0, etc.). The repo has auth/admin/session surface indicators, so auth may live in custom code, in a separate service, or be missing."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f12b8051a0aac21a", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea3b5e389d8c9c0f", "name": "Low test-to-source ratio", "shortDescription": {"text": "Low test-to-source ratio"}, "fullDescription": {"text": "16 tests / 71 src (ratio 0.23)."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 40 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-ecb0d2c55ed6875d", "name": "Agent authority lacks a verifier contract: .claude/settings.local.json", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/settings.local.json"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8c0591d1f68c979f", "name": "Commented-code block (7 lines) in scripts/scrape-all.js:6", "shortDescription": {"text": "Commented-code block (7 lines) in scripts/scrape-all.js:6"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-3a327780df8707aa", "name": "`fetch()` without try/.catch or AbortSignal \u2014 scripts/scrape.js:95", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 scripts/scrape.js:95"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-95b2cb04b7e0d172", "name": "`fetch()` without try/.catch or AbortSignal \u2014 scripts/discover.js:18", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 scripts/discover.js:18"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c677511aa5521306", "name": "Commented-code block (5 lines) in app/next.config.ts:43", "shortDescription": {"text": "Commented-code block (5 lines) in app/next.config.ts:43"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-855c1e96a4c9bcd2", "name": "Commented-code block (5 lines) in app/src/components/chart-utils.ts:3", "shortDescription": {"text": "Commented-code block (5 lines) in app/src/components/chart-utils.ts:3"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-2e54b8ec3ad83f6c", "name": "Commented-code block (6 lines) in app/src/app/athlete/[slug]/page.tsx:7", "shortDescription": {"text": "Commented-code block (6 lines) in app/src/app/athlete/[slug]/page.tsx:7"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-07f1861b18074c72", "name": "`fetch()` without try/.catch or AbortSignal \u2014 app/src/lib/client-search-index.ts:68", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 app/src/lib/client-search-index.ts:68"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f8952c26f91b4942", "name": "Commented-code block (6 lines) in app/src/lib/athlete-shards.ts:3", "shortDescription": {"text": "Commented-code block (6 lines) in app/src/lib/athlete-shards.ts:3"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-a42a081abc893f54", "name": "`fetch()` without try/.catch or AbortSignal \u2014 app/src/lib/athlete-shards.ts:50", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 app/src/lib/athlete-shards.ts:50"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e19118a25df265cf", "name": "Commented-code block (5 lines) in app/src/lib/search-index.ts:22", "shortDescription": {"text": "Commented-code block (5 lines) in app/src/lib/search-index.ts:22"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-1a64511f3dd5f439", "name": "`fetch()` without try/.catch or AbortSignal \u2014 app/src/lib/search-index.ts:46", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 app/src/lib/search-index.ts:46"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e1abd46dd59aec50", "name": "Commented-code block (6 lines) in app/src/lib/races.ts:5", "shortDescription": {"text": "Commented-code block (6 lines) in app/src/lib/races.ts:5"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-919552c0e8862328", "name": "Commented-code block (5 lines) in app/src/lib/data.ts:7", "shortDescription": {"text": "Commented-code block (5 lines) in app/src/lib/data.ts:7"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/18464"}, "properties": {"repository": "rootulp/tritimes", "repoUrl": "https://github.com/rootulp/tritimes", "branch": "main"}, "results": [{"ruleId": "scanner-bead75b0f9233e05", "level": "none", "message": {"text": "No API endpoints detected"}, "properties": {"repobilityId": "0f8bb852027c38f8", "scanner": "scanner-primary", "fingerprint": "bead75b0f9233e05", "layer": "api", "severity": "info", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-e1828e564b6321ca", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 scripts/build-search-shards.js:132"}, "properties": {"repobilityId": "2050b549663b087d", "scanner": "scanner-primary", "fingerprint": "e1828e564b6321ca", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-adef736b07fcb651", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 scripts/discover-new-races.js:211"}, "properties": {"repobilityId": "cda1a74887fa598d", "scanner": "scanner-primary", "fingerprint": "adef736b07fcb651", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-f5fa2bf9a8ebd235", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 scripts/build-histograms.js:201"}, "properties": {"repobilityId": "0a488d8f9141e485", "scanner": "scanner-primary", "fingerprint": "f5fa2bf9a8ebd235", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-864140e6c1fb9291", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 scripts/gzip-csvs.js:30"}, "properties": {"repobilityId": "5a2fae4c1cf46ffe", "scanner": "scanner-primary", "fingerprint": "864140e6c1fb9291", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-2812b6f9ca2b1e2b", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 scripts/scrape-all.js:97"}, "properties": {"repobilityId": "9e07e2cc044b28b6", "scanner": "scanner-primary", "fingerprint": "2812b6f9ca2b1e2b", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-ed4b46f24eb2e8c9", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 scripts/scrape.js:94"}, "properties": {"repobilityId": "9fc82535e6528867", "scanner": "scanner-primary", "fingerprint": "ed4b46f24eb2e8c9", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-6f3e0e6121e4fa05", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 scripts/discover.js:149"}, "properties": {"repobilityId": "2ac6317421766ce5", "scanner": "scanner-primary", "fingerprint": "6f3e0e6121e4fa05", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-973a65422f4b2ad6", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 scripts/build-athlete-shards.js:180"}, "properties": {"repobilityId": "7fa8489ad461fc34", "scanner": "scanner-primary", "fingerprint": "973a65422f4b2ad6", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-1593d3b15955e8bc", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 scripts/build-search-index.js:270"}, "properties": {"repobilityId": "2050e8cf7c502296", "scanner": "scanner-primary", "fingerprint": "1593d3b15955e8bc", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-a03e9cf16ccadd99", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 app/src/components/CommandPalette.tsx:187"}, "properties": {"repobilityId": "8cb61984a2d8d1dc", "scanner": "scanner-primary", "fingerprint": "a03e9cf16ccadd99", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-6a4a9a24f498a1c7", "level": "note", "message": {"text": "\"active\" state uses light bg in a dark theme \u2014 app/src/app/races/race-list.tsx:41"}, "properties": {"repobilityId": "c193c38ba2ebfef4", "scanner": "scanner-primary", "fingerprint": "6a4a9a24f498a1c7", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.active-light-bg"]}}, {"ruleId": "scanner-0d145d308ec33769", "level": "note", "message": {"text": "\"active\" state uses light bg in a dark theme \u2014 app/src/app/courses/course-charts.tsx:57"}, "properties": {"repobilityId": "6fa6b595d79e630b", "scanner": "scanner-primary", "fingerprint": "0d145d308ec33769", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.active-light-bg"]}}, {"ruleId": "scanner-9f46cd3e4dc1c0b3", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 app/e2e/athlete-search.spec.ts:35"}, "properties": {"repobilityId": "b20952ae7c154737", "scanner": "scanner-primary", "fingerprint": "9f46cd3e4dc1c0b3", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-e0c179991d759cc2", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 app/e2e/journey-performance.spec.ts:97"}, "properties": {"repobilityId": "05343ccda7346599", "scanner": "scanner-primary", "fingerprint": "e0c179991d759cc2", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-1e45b59305439be7", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 app/e2e/performance.spec.ts:74"}, "properties": {"repobilityId": "fc79b92606ae436e", "scanner": "scanner-primary", "fingerprint": "1e45b59305439be7", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-cfc22de9667b1bc9", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in scripts/scrape-all.js:16"}, "properties": {"repobilityId": "dfd37bfdcf36bf2e", "scanner": "scanner-primary", "fingerprint": "cfc22de9667b1bc9", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/scrape-all.js"}, "region": {"startLine": 16}}}]}, {"ruleId": "scanner-6372cebde0220094", "level": "warning", "message": {"text": "No auth library detected"}, "properties": {"repobilityId": "a5b6035a5bbf8054", "scanner": "scanner-primary", "fingerprint": "6372cebde0220094", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["coverage", "auth"]}}, {"ruleId": "scanner-f12b8051a0aac21a", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "23f89d5adb4dd94e", "scanner": "scanner-primary", "fingerprint": "f12b8051a0aac21a", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/scrape.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ea3b5e389d8c9c0f", "level": "note", "message": {"text": "Low test-to-source ratio"}, "properties": {"repobilityId": "ef7b2552cc00a375", "scanner": "scanner-primary", "fingerprint": "ea3b5e389d8c9c0f", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["tests"]}}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "344606447722a2ba", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "c64cf89c67d34dd8", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "7d1499e8d0aa7c37", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "647f474354ae1fab", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-ecb0d2c55ed6875d", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/settings.local.json"}, "properties": {"repobilityId": "d8bae33a6d517bf0", "scanner": "scanner-primary", "fingerprint": "ecb0d2c55ed6875d", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/settings.local.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-8c0591d1f68c979f", "level": "none", "message": {"text": "Commented-code block (7 lines) in scripts/scrape-all.js:6"}, "properties": {"repobilityId": "216a7eda058dce03", "scanner": "scanner-primary", "fingerprint": "8c0591d1f68c979f", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-3a327780df8707aa", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 scripts/scrape.js:95"}, "properties": {"repobilityId": "b51ebbc3aa095020", "scanner": "scanner-primary", "fingerprint": "3a327780df8707aa", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-95b2cb04b7e0d172", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 scripts/discover.js:18"}, "properties": {"repobilityId": "036ed1596e8e01eb", "scanner": "scanner-primary", "fingerprint": "95b2cb04b7e0d172", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-c677511aa5521306", "level": "none", "message": {"text": "Commented-code block (5 lines) in app/next.config.ts:43"}, "properties": {"repobilityId": "0b7bcc318a93b880", "scanner": "scanner-primary", "fingerprint": "c677511aa5521306", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-855c1e96a4c9bcd2", "level": "none", "message": {"text": "Commented-code block (5 lines) in app/src/components/chart-utils.ts:3"}, "properties": {"repobilityId": "e5bfbc75709ecfee", "scanner": "scanner-primary", "fingerprint": "855c1e96a4c9bcd2", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-2e54b8ec3ad83f6c", "level": "none", "message": {"text": "Commented-code block (6 lines) in app/src/app/athlete/[slug]/page.tsx:7"}, "properties": {"repobilityId": "65528f27c3d3d509", "scanner": "scanner-primary", "fingerprint": "2e54b8ec3ad83f6c", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-07f1861b18074c72", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 app/src/lib/client-search-index.ts:68"}, "properties": {"repobilityId": "ab518c701ac4a935", "scanner": "scanner-primary", "fingerprint": "07f1861b18074c72", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-f8952c26f91b4942", "level": "none", "message": {"text": "Commented-code block (6 lines) in app/src/lib/athlete-shards.ts:3"}, "properties": {"repobilityId": "f2c95b069db786b3", "scanner": "scanner-primary", "fingerprint": "f8952c26f91b4942", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-a42a081abc893f54", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 app/src/lib/athlete-shards.ts:50"}, "properties": {"repobilityId": "252a224afd4816d8", "scanner": "scanner-primary", "fingerprint": "a42a081abc893f54", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-e19118a25df265cf", "level": "none", "message": {"text": "Commented-code block (5 lines) in app/src/lib/search-index.ts:22"}, "properties": {"repobilityId": "378a363467a764b7", "scanner": "scanner-primary", "fingerprint": "e19118a25df265cf", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-1a64511f3dd5f439", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 app/src/lib/search-index.ts:46"}, "properties": {"repobilityId": "86950619f7e666ed", "scanner": "scanner-primary", "fingerprint": "1a64511f3dd5f439", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-e1abd46dd59aec50", "level": "none", "message": {"text": "Commented-code block (6 lines) in app/src/lib/races.ts:5"}, "properties": {"repobilityId": "9fa749c3fdc5cef3", "scanner": "scanner-primary", "fingerprint": "e1abd46dd59aec50", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-919552c0e8862328", "level": "none", "message": {"text": "Commented-code block (5 lines) in app/src/lib/data.ts:7"}, "properties": {"repobilityId": "babec19725e4492e", "scanner": "scanner-primary", "fingerprint": "919552c0e8862328", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}]}]}