{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-20683e962ac98a17", "name": "Possibly dead Python function: dep", "shortDescription": {"text": "Possibly dead Python function: dep"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-77a7a94e68081b9b", "name": "Possibly dead Python function: resume", "shortDescription": {"text": "Possibly dead Python function: resume"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1221d7402f6a7cd8", "name": "Possibly dead Python function: cmd_init", "shortDescription": {"text": "Possibly dead Python function: cmd_init"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-587fd91e46a9f2a6", "name": "Possibly dead Python function: cmd_runs_list", "shortDescription": {"text": "Possibly dead Python function: cmd_runs_list"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e98a2628943c4bec", "name": "Possibly dead Python function: cmd_runs_show", "shortDescription": {"text": "Possibly dead Python function: cmd_runs_show"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-95011839260eaf23", "name": "Possibly dead Python function: cmd_events", "shortDescription": {"text": "Possibly dead Python function: cmd_events"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ffaf09e958b3b432", "name": "Possibly dead Python function: cmd_replay", "shortDescription": {"text": "Possibly dead Python function: cmd_replay"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-eb009bd45c9bce15", "name": "Possibly dead Python function: cmd_fork", "shortDescription": {"text": "Possibly dead Python function: cmd_fork"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-12d15e7c55d4942a", "name": "Possibly dead Python function: cmd_tag", "shortDescription": {"text": "Possibly dead Python function: cmd_tag"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-75926b0a2951f52e", "name": "Possibly dead Python function: cmd_note", "shortDescription": {"text": "Possibly dead Python function: cmd_note"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6f378316fc0d1195", "name": "Possibly dead Python function: cmd_license", "shortDescription": {"text": "Possibly dead Python function: cmd_license"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-78ed8e3fe5fb7088", "name": "Possibly dead Python function: cmd_export", "shortDescription": {"text": "Possibly dead Python function: cmd_export"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9e2003467776b060", "name": "Possibly dead Python function: cmd_doctor", "shortDescription": {"text": "Possibly dead Python function: cmd_doctor"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6ca0fda305c76780", "name": "Possibly dead Python function: enable_default_redaction", "shortDescription": {"text": "Possibly dead Python function: enable_default_redaction"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-85ada83312af8706", "name": "Possibly dead Python function: should_execute", "shortDescription": {"text": "Possibly dead Python function: should_execute"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d63da3583b14afc0", "name": "Dockerfile runs as root: Dockerfile", "shortDescription": {"text": "Dockerfile runs as root: Dockerfile"}, "fullDescription": {"text": "No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a35c6a00f751880f", "name": "Docker base image is tag-pinned but not digest-pinned: node:20-slim", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: node:20-slim"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-de3c1f217d72a063", "name": "Docker base image is tag-pinned but not digest-pinned: python:3.12-slim", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: python:3.12-slim"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ea3b5e389d8c9c0f", "name": "Low test-to-source ratio", "shortDescription": {"text": "Low test-to-source ratio"}, "fullDescription": {"text": "15 tests / 77 src (ratio 0.19)."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 123 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-72b2a6250083a784", "name": "Placeholder or mock-heavy implementation detected", "shortDescription": {"text": "Placeholder or mock-heavy implementation detected"}, "fullDescription": {"text": "Found 35 placeholder/mock markers across 12 source files. This often means the repo looks complete while core flows still use generated scaffolding or fake data."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3154a9f490a52437", "name": "Commented-code block (5 lines) in backend/app/redaction/default.py:44", "shortDescription": {"text": "Commented-code block (5 lines) in backend/app/redaction/default.py:44"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-4be12f1537a385a5", "name": "Stub function `on_agent_action` (body is just `pass`/`return`) \u2014 sdk/afr/integrations/langchain.py:313", "shortDescription": {"text": "Stub function `on_agent_action` (body is just `pass`/`return`) \u2014 sdk/afr/integrations/langchain.py:313"}, "fullDescription": {"text": "Likely an AI scaffold that was never filled in. Remove or implement."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2c04133e54348533", "name": "Near-duplicate function bodies in 2 places", "shortDescription": {"text": "Near-duplicate function bodies in 2 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nbackend/app/redaction/hooks.py:register_redactor, sdk/afr/redaction.py:register_redactor\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e98868b9859aed03", "name": "Frontend route `/runs/:runId` has no Link/navigate to it \u2014 ui/src/App.tsx", "shortDescription": {"text": "Frontend route `/runs/:runId` has no Link/navigate to it \u2014 ui/src/App.tsx"}, "fullDescription": {"text": "The route is registered but no `<Link to=\u2026>` or `navigate(\u2026)` in the codebase navigates here. Either it's reachable only via direct URL (intentional), it's dead, or the link broke during a refactor."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-dcacd9dcbe85fb0d", "name": "FastAPI POST `seed_demo` without auth dependency \u2014 backend/app/api/routes_demo.py:18", "shortDescription": {"text": "FastAPI POST `seed_demo` without auth dependency \u2014 backend/app/api/routes_demo.py:18"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-52c27eb406fc0bd0", "name": "FastAPI POST `replay` without auth dependency \u2014 backend/app/api/routes_replay.py:21", "shortDescription": {"text": "FastAPI POST `replay` without auth dependency \u2014 backend/app/api/routes_replay.py:21"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-df6272921461982c", "name": "FastAPI POST `append_event` without auth dependency \u2014 backend/app/api/routes_events.py:14", "shortDescription": {"text": "FastAPI POST `append_event` without auth dependency \u2014 backend/app/api/routes_events.py:14"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-d3019e732c8fcd5f", "name": "FastAPI POST `create_run` without auth dependency \u2014 backend/app/api/routes_runs.py:25", "shortDescription": {"text": "FastAPI POST `create_run` without auth dependency \u2014 backend/app/api/routes_runs.py:25"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-eb7d7a2e826d18f3", "name": "FastAPI PATCH `update_run` without auth dependency \u2014 backend/app/api/routes_runs.py:46", "shortDescription": {"text": "FastAPI PATCH `update_run` without auth dependency \u2014 backend/app/api/routes_runs.py:46"}, "fullDescription": {"text": "`@router.patch` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-736ea73651ee4a41", "name": "FastAPI POST `fork_run` without auth dependency \u2014 backend/app/api/routes_runs.py:56", "shortDescription": {"text": "FastAPI POST `fork_run` without auth dependency \u2014 backend/app/api/routes_runs.py:56"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-02e4c8bbbe49de5c", "name": "FastAPI POST `end_run` without auth dependency \u2014 backend/app/api/routes_runs.py:67", "shortDescription": {"text": "FastAPI POST `end_run` without auth dependency \u2014 backend/app/api/routes_runs.py:67"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-05ee97ad90b547f2", "name": "FastAPI POST `create_checkpoint` without auth dependency \u2014 backend/app/api/routes_runs.py:73", "shortDescription": {"text": "FastAPI POST `create_checkpoint` without auth dependency \u2014 backend/app/api/routes_runs.py:73"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-7af5ec856a489b81", "name": "FastAPI POST `call` without auth dependency \u2014 backend/app/mcp/router.py:27", "shortDescription": {"text": "FastAPI POST `call` without auth dependency \u2014 backend/app/mcp/router.py:27"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/25171"}, "properties": {"repository": "cwwjacobs/agent-flight-recorder", "repoUrl": "https://github.com/cwwjacobs/agent-flight-recorder", "branch": "main"}, "results": [{"ruleId": "scanner-20683e962ac98a17", "level": "note", "message": {"text": "Possibly dead Python function: dep"}, "properties": {"repobilityId": "97535eb9200fecfe", "scanner": "scanner-primary", "fingerprint": "20683e962ac98a17", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/license.py:81"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-77a7a94e68081b9b", "level": "note", "message": {"text": "Possibly dead Python function: resume"}, "properties": {"repobilityId": "ec6ace357a0cc819", "scanner": "scanner-primary", "fingerprint": "77a7a94e68081b9b", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "examples/toy_agent/replay_handler.py:24"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-1221d7402f6a7cd8", "level": "note", "message": {"text": "Possibly dead Python function: cmd_init"}, "properties": {"repobilityId": "3f17b7245a36f920", "scanner": "scanner-primary", "fingerprint": "1221d7402f6a7cd8", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "cli/afr_cli/main.py:132"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-587fd91e46a9f2a6", "level": "note", "message": {"text": "Possibly dead Python function: cmd_runs_list"}, "properties": {"repobilityId": "5a84d9be85f01f23", "scanner": "scanner-primary", "fingerprint": "587fd91e46a9f2a6", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "cli/afr_cli/main.py:147"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e98a2628943c4bec", "level": "note", "message": {"text": "Possibly dead Python function: cmd_runs_show"}, "properties": {"repobilityId": "d1b53071c320dfb8", "scanner": "scanner-primary", "fingerprint": "e98a2628943c4bec", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "cli/afr_cli/main.py:173"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-95011839260eaf23", "level": "note", "message": {"text": "Possibly dead Python function: cmd_events"}, "properties": {"repobilityId": "b6d729f2a5eb2525", "scanner": "scanner-primary", "fingerprint": "95011839260eaf23", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "cli/afr_cli/main.py:209"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ffaf09e958b3b432", "level": "note", "message": {"text": "Possibly dead Python function: cmd_replay"}, "properties": {"repobilityId": "afefb07bf19e7540", "scanner": "scanner-primary", "fingerprint": "ffaf09e958b3b432", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "cli/afr_cli/main.py:243"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-eb009bd45c9bce15", "level": "note", "message": {"text": "Possibly dead Python function: cmd_fork"}, "properties": {"repobilityId": "39ec645ca9941445", "scanner": "scanner-primary", "fingerprint": "eb009bd45c9bce15", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "cli/afr_cli/main.py:277"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-12d15e7c55d4942a", "level": "note", "message": {"text": "Possibly dead Python function: cmd_tag"}, "properties": {"repobilityId": "be1f2cf04487ccb2", "scanner": "scanner-primary", "fingerprint": "12d15e7c55d4942a", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "cli/afr_cli/main.py:291"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-75926b0a2951f52e", "level": "note", "message": {"text": "Possibly dead Python function: cmd_note"}, "properties": {"repobilityId": "45a8d899888a034e", "scanner": "scanner-primary", "fingerprint": "75926b0a2951f52e", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "cli/afr_cli/main.py:307"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6f378316fc0d1195", "level": "note", "message": {"text": "Possibly dead Python function: cmd_license"}, "properties": {"repobilityId": "fda859a9fe5d0120", "scanner": "scanner-primary", "fingerprint": "6f378316fc0d1195", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "cli/afr_cli/main.py:319"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-78ed8e3fe5fb7088", "level": "note", "message": {"text": "Possibly dead Python function: cmd_export"}, "properties": {"repobilityId": "3b8bb19d51ab5ed8", "scanner": "scanner-primary", "fingerprint": "78ed8e3fe5fb7088", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "cli/afr_cli/main.py:332"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-9e2003467776b060", "level": "note", "message": {"text": "Possibly dead Python function: cmd_doctor"}, "properties": {"repobilityId": "9a95a890c390a044", "scanner": "scanner-primary", "fingerprint": "9e2003467776b060", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "cli/afr_cli/main.py:413"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6ca0fda305c76780", "level": "note", "message": {"text": "Possibly dead Python function: enable_default_redaction"}, "properties": {"repobilityId": "981f6badb7a70e72", "scanner": "scanner-primary", "fingerprint": "6ca0fda305c76780", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "sdk/afr/redaction.py:73"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-85ada83312af8706", "level": "note", "message": {"text": "Possibly dead Python function: should_execute"}, "properties": {"repobilityId": "bbe80433145653b7", "scanner": "scanner-primary", "fingerprint": "85ada83312af8706", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "sdk/afr/hooks.py:70"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d63da3583b14afc0", "level": "warning", "message": {"text": "Dockerfile runs as root: Dockerfile"}, "properties": {"repobilityId": "a2ed1bd120e507db", "scanner": "scanner-primary", "fingerprint": "d63da3583b14afc0", "layer": "hardware", "severity": "medium", "confidence": 1.0, "tags": ["security", "container"]}}, {"ruleId": "scanner-a35c6a00f751880f", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: node:20-slim"}, "properties": {"repobilityId": "004bcdec0b721f3d", "scanner": "scanner-primary", "fingerprint": "a35c6a00f751880f", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Dockerfile"}, "region": {"startLine": 7}}}]}, {"ruleId": "scanner-de3c1f217d72a063", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: python:3.12-slim"}, "properties": {"repobilityId": "a2425290dea5b227", "scanner": "scanner-primary", "fingerprint": "de3c1f217d72a063", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Dockerfile"}, "region": {"startLine": 14}}}]}, {"ruleId": "scanner-ea3b5e389d8c9c0f", "level": "note", "message": {"text": "Low test-to-source ratio"}, "properties": {"repobilityId": "ef7b2552cc00a375", "scanner": "scanner-primary", "fingerprint": "ea3b5e389d8c9c0f", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["tests"]}}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "f2fdfe7c0ea09f4b", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-72b2a6250083a784", "level": "warning", "message": {"text": "Placeholder or mock-heavy implementation detected"}, "properties": {"repobilityId": "144ecec92a06fde0", "scanner": "scanner-primary", "fingerprint": "72b2a6250083a784", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "incomplete", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "8225a8cac6e9c8a5", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-3154a9f490a52437", "level": "none", "message": {"text": "Commented-code block (5 lines) in backend/app/redaction/default.py:44"}, "properties": {"repobilityId": "41c6f57ae4ee61e4", "scanner": "scanner-primary", "fingerprint": "3154a9f490a52437", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-4be12f1537a385a5", "level": "note", "message": {"text": "Stub function `on_agent_action` (body is just `pass`/`return`) \u2014 sdk/afr/integrations/langchain.py:313"}, "properties": {"repobilityId": "9765f765b4ed4b00", "scanner": "scanner-primary", "fingerprint": "4be12f1537a385a5", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "empty-handler", "dead-code"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "6428e0bb08e1fde6", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "12dcbc1e7bd5262b", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "11c6d9f44bfba9be", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "86ae11237904caf1", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "ca4ab685bd47957f", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "837c1976f5e8a9f7", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "10cdcfac86704d88", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "6c2019dfc3703863", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-e98868b9859aed03", "level": "warning", "message": {"text": "Frontend route `/runs/:runId` has no Link/navigate to it \u2014 ui/src/App.tsx"}, "properties": {"repobilityId": "1d3814af78aca476", "scanner": "scanner-primary", "fingerprint": "e98868b9859aed03", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "orphan-page", "wiring"]}}, {"ruleId": "scanner-dcacd9dcbe85fb0d", "level": "error", "message": {"text": "FastAPI POST `seed_demo` without auth dependency \u2014 backend/app/api/routes_demo.py:18"}, "properties": {"repobilityId": "c94420ab53d3fdd5", "scanner": "scanner-primary", "fingerprint": "dcacd9dcbe85fb0d", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/api/routes_demo.py"}, "region": {"startLine": 18}}}]}, {"ruleId": "scanner-52c27eb406fc0bd0", "level": "error", "message": {"text": "FastAPI POST `replay` without auth dependency \u2014 backend/app/api/routes_replay.py:21"}, "properties": {"repobilityId": "3f65249fea7280e8", "scanner": "scanner-primary", "fingerprint": "52c27eb406fc0bd0", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/api/routes_replay.py"}, "region": {"startLine": 21}}}]}, {"ruleId": "scanner-df6272921461982c", "level": "error", "message": {"text": "FastAPI POST `append_event` without auth dependency \u2014 backend/app/api/routes_events.py:14"}, "properties": {"repobilityId": "97075b1d1ab02d46", "scanner": "scanner-primary", "fingerprint": "df6272921461982c", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/api/routes_events.py"}, "region": {"startLine": 14}}}]}, {"ruleId": "scanner-d3019e732c8fcd5f", "level": "error", "message": {"text": "FastAPI POST `create_run` without auth dependency \u2014 backend/app/api/routes_runs.py:25"}, "properties": {"repobilityId": "6eb256ad76bc6021", "scanner": "scanner-primary", "fingerprint": "d3019e732c8fcd5f", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/api/routes_runs.py"}, "region": {"startLine": 25}}}]}, {"ruleId": "scanner-eb7d7a2e826d18f3", "level": "error", "message": {"text": "FastAPI PATCH `update_run` without auth dependency \u2014 backend/app/api/routes_runs.py:46"}, "properties": {"repobilityId": "f8fa7674a7df77c9", "scanner": "scanner-primary", "fingerprint": "eb7d7a2e826d18f3", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/api/routes_runs.py"}, "region": {"startLine": 46}}}]}, {"ruleId": "scanner-736ea73651ee4a41", "level": "error", "message": {"text": "FastAPI POST `fork_run` without auth dependency \u2014 backend/app/api/routes_runs.py:56"}, "properties": {"repobilityId": "d1daa506f1bc6787", "scanner": "scanner-primary", "fingerprint": "736ea73651ee4a41", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/api/routes_runs.py"}, "region": {"startLine": 56}}}]}, {"ruleId": "scanner-02e4c8bbbe49de5c", "level": "error", "message": {"text": "FastAPI POST `end_run` without auth dependency \u2014 backend/app/api/routes_runs.py:67"}, "properties": {"repobilityId": "733105e2e3e82ec3", "scanner": "scanner-primary", "fingerprint": "02e4c8bbbe49de5c", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/api/routes_runs.py"}, "region": {"startLine": 67}}}]}, {"ruleId": "scanner-05ee97ad90b547f2", "level": "error", "message": {"text": "FastAPI POST `create_checkpoint` without auth dependency \u2014 backend/app/api/routes_runs.py:73"}, "properties": {"repobilityId": "42564ecd6e20bd59", "scanner": "scanner-primary", "fingerprint": "05ee97ad90b547f2", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/api/routes_runs.py"}, "region": {"startLine": 73}}}]}, {"ruleId": "scanner-7af5ec856a489b81", "level": "error", "message": {"text": "FastAPI POST `call` without auth dependency \u2014 backend/app/mcp/router.py:27"}, "properties": {"repobilityId": "76828604dd4c3bfa", "scanner": "scanner-primary", "fingerprint": "7af5ec856a489b81", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/mcp/router.py"}, "region": {"startLine": 27}}}]}]}]}