{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-9710c8d059e53154", "name": "No frontend routes/components detected", "shortDescription": {"text": "No frontend routes/components detected"}, "fullDescription": {"text": "No React/Vue/Next routes were found. This is fine for backend-only repos."}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-72f8f6b2aea31dc3", "name": "Insecure pattern 'direct_innerhtml_assignment' in v0.1.html:580", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in v0.1.html:580"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-50211ac082fe760c", "name": "Insecure pattern 'direct_innerhtml_assignment' in v0.3.html:1017", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in v0.3.html:1017"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1e478dbad490e269", "name": "Insecure pattern 'direct_innerhtml_assignment' in v0.5.html:3222", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in v0.5.html:3222"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8b9c0707abd1c015", "name": "Insecure pattern 'direct_innerhtml_assignment' in v0.4.html:1393", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in v0.4.html:1393"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9026266294462804", "name": "Insecure pattern 'direct_innerhtml_assignment' in v0.2.html:646", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in v0.2.html:646"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8ebd188930289ca3", "name": "Insecure pattern 'cors_wildcard' in supabase/functions/guide_media_upload/index.ts:17", "shortDescription": {"text": "Insecure pattern 'cors_wildcard' in supabase/functions/guide_media_upload/index.ts:17"}, "fullDescription": {"text": "Found a known-risky pattern (cors_wildcard). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c2a08ab7ad03f71e", "name": "Insecure pattern 'cors_wildcard' in supabase/functions/translate_tour/index.ts:24", "shortDescription": {"text": "Insecure pattern 'cors_wildcard' in supabase/functions/translate_tour/index.ts:24"}, "fullDescription": {"text": "Found a known-risky pattern (cors_wildcard). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e816c102f35bcec3", "name": "Insecure pattern 'cors_wildcard' in supabase/functions/translate_stop_notes/index.ts:32", "shortDescription": {"text": "Insecure pattern 'cors_wildcard' in supabase/functions/translate_stop_notes/index.ts:32"}, "fullDescription": {"text": "Found a known-risky pattern (cors_wildcard). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6893a6c8b0861585", "name": "Very low test-to-source ratio", "shortDescription": {"text": "Very low test-to-source ratio"}, "fullDescription": {"text": "0 test file(s) for 8 source file(s) (ratio 0.00). Consider adding integration or unit tests for critical paths."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-141b30a41e03817b", "name": "No license file detected", "shortDescription": {"text": "No license file detected"}, "fullDescription": {"text": "No LICENSE/COPYING/NOTICE file was found. Generated repositories often omit licensing, which blocks reuse and automated intake."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-faccb9061e9b52a0", "name": "No README detected", "shortDescription": {"text": "No README detected"}, "fullDescription": {"text": "No README file was found. Generated repos without README context are hard to operate, validate, or safely hand off."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-11825279136b53a3", "name": "CI is configured but no tests are detected", "shortDescription": {"text": "CI is configured but no tests are detected"}, "fullDescription": {"text": "A CI pipeline exists, but the scan found no test files to gate. Opus labeled this generated-code pattern as config theater: release machinery exists, but it has little behavioral signal."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b9088664ace7f748", "name": "Composite production-readiness gap", "shortDescription": {"text": "Composite production-readiness gap"}, "fullDescription": {"text": "Multiple low-cost hardening controls are missing together: license, tests, operator-readme. Opus verification showed these co-occurring gaps are a better readiness signal than reading each flag in isolation."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-118b83ba9df73cc7", "name": "Commented-code block (7 lines) in sw.js:3", "shortDescription": {"text": "Commented-code block (7 lines) in sw.js:3"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-2eab4a0fe1d7c7ab", "name": "Commented-code block (6 lines) in supabase/functions/send_stop_update_push/index.ts:129", "shortDescription": {"text": "Commented-code block (6 lines) in supabase/functions/send_stop_update_push/index.ts:129"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-1eb7902f2a701285", "name": "Commented-code block (7 lines) in supabase/functions/translate_tour/index.ts:3", "shortDescription": {"text": "Commented-code block (7 lines) in supabase/functions/translate_tour/index.ts:3"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-5c218b44fe99b1f9", "name": "`fetch()` without try/.catch or AbortSignal \u2014 supabase/functions/translate_tour/index.ts:34", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 supabase/functions/translate_tour/index.ts:34"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-48841003d74da163", "name": "Commented-code block (5 lines) in supabase/functions/translate_stop_notes/index.ts:3", "shortDescription": {"text": "Commented-code block (5 lines) in supabase/functions/translate_stop_notes/index.ts:3"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-9f0380a60c4a3ae2", "name": "`fetch()` without try/.catch or AbortSignal \u2014 supabase/functions/translate_stop_notes/index.ts:42", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 supabase/functions/translate_stop_notes/index.ts:42"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3b7ff8fbc6a9707c", "name": "Commented-code block (6 lines) in supabase/functions/send_stop_push/index.ts:8", "shortDescription": {"text": "Commented-code block (6 lines) in supabase/functions/send_stop_push/index.ts:8"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-dd5b35b0b1f22e1c", "name": "Commented-code block (6 lines) in tools/generate_icons.mjs:5", "shortDescription": {"text": "Commented-code block (6 lines) in tools/generate_icons.mjs:5"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/22496"}, "properties": {"repository": "walczaq/guideapp", "repoUrl": "https://github.com/walczaq/guideapp", "branch": "main"}, "results": [{"ruleId": "scanner-9710c8d059e53154", "level": "none", "message": {"text": "No frontend routes/components detected"}, "properties": {"repobilityId": "44ca61485762e494", "scanner": "scanner-primary", "fingerprint": "9710c8d059e53154", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-72f8f6b2aea31dc3", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in v0.1.html:580"}, "properties": {"repobilityId": "f938f03da21413c2", "scanner": "scanner-primary", "fingerprint": "72f8f6b2aea31dc3", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "v0.1.html"}, "region": {"startLine": 580}}}]}, {"ruleId": "scanner-50211ac082fe760c", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in v0.3.html:1017"}, "properties": {"repobilityId": "e68af3ff5275c7c1", "scanner": "scanner-primary", "fingerprint": "50211ac082fe760c", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "v0.3.html"}, "region": {"startLine": 1017}}}]}, {"ruleId": "scanner-1e478dbad490e269", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in v0.5.html:3222"}, "properties": {"repobilityId": "40661b1b9bd4e228", "scanner": "scanner-primary", "fingerprint": "1e478dbad490e269", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "v0.5.html"}, "region": {"startLine": 3222}}}]}, {"ruleId": "scanner-8b9c0707abd1c015", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in v0.4.html:1393"}, "properties": {"repobilityId": "db2992f96d5d449b", "scanner": "scanner-primary", "fingerprint": "8b9c0707abd1c015", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "v0.4.html"}, "region": {"startLine": 1393}}}]}, {"ruleId": "scanner-9026266294462804", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in v0.2.html:646"}, "properties": {"repobilityId": "fce930d4befd769f", "scanner": "scanner-primary", "fingerprint": "9026266294462804", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "v0.2.html"}, "region": {"startLine": 646}}}]}, {"ruleId": "scanner-8ebd188930289ca3", "level": "warning", "message": {"text": "Insecure pattern 'cors_wildcard' in supabase/functions/guide_media_upload/index.ts:17"}, "properties": {"repobilityId": "31e5abbbe5d97152", "scanner": "scanner-primary", "fingerprint": "8ebd188930289ca3", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "cors_wildcard"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "supabase/functions/guide_media_upload/index.ts"}, "region": {"startLine": 17}}}]}, {"ruleId": "scanner-c2a08ab7ad03f71e", "level": "warning", "message": {"text": "Insecure pattern 'cors_wildcard' in supabase/functions/translate_tour/index.ts:24"}, "properties": {"repobilityId": "fbe23a788f1f4281", "scanner": "scanner-primary", "fingerprint": "c2a08ab7ad03f71e", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "cors_wildcard"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "supabase/functions/translate_tour/index.ts"}, "region": {"startLine": 24}}}]}, {"ruleId": "scanner-e816c102f35bcec3", "level": "warning", "message": {"text": "Insecure pattern 'cors_wildcard' in supabase/functions/translate_stop_notes/index.ts:32"}, "properties": {"repobilityId": "f963e7656454b9bf", "scanner": "scanner-primary", "fingerprint": "e816c102f35bcec3", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "cors_wildcard"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "supabase/functions/translate_stop_notes/index.ts"}, "region": {"startLine": 32}}}]}, {"ruleId": "scanner-6893a6c8b0861585", "level": "warning", "message": {"text": "Very low test-to-source ratio"}, "properties": {"repobilityId": "54a7de3f06314bf0", "scanner": "scanner-primary", "fingerprint": "6893a6c8b0861585", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["tests", "coverage"]}}, {"ruleId": "scanner-141b30a41e03817b", "level": "note", "message": {"text": "No license file detected"}, "properties": {"repobilityId": "9d03d42d67ae7958", "scanner": "scanner-primary", "fingerprint": "141b30a41e03817b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["license", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-faccb9061e9b52a0", "level": "note", "message": {"text": "No README detected"}, "properties": {"repobilityId": "67def60c040def45", "scanner": "scanner-primary", "fingerprint": "faccb9061e9b52a0", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["docs", "readme", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-11825279136b53a3", "level": "warning", "message": {"text": "CI is configured but no tests are detected"}, "properties": {"repobilityId": "5d90684543818712", "scanner": "scanner-primary", "fingerprint": "11825279136b53a3", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["tests", "ci", "config-theater", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-b9088664ace7f748", "level": "warning", "message": {"text": "Composite production-readiness gap"}, "properties": {"repobilityId": "0291c6ef57058cd3", "scanner": "scanner-primary", "fingerprint": "b9088664ace7f748", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["production-readiness", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "b4806f0913c63dc2", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "8f7fa7df724c3049", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-118b83ba9df73cc7", "level": "none", "message": {"text": "Commented-code block (7 lines) in sw.js:3"}, "properties": {"repobilityId": "eb49923928caa1f6", "scanner": "scanner-primary", "fingerprint": "118b83ba9df73cc7", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-2eab4a0fe1d7c7ab", "level": "none", "message": {"text": "Commented-code block (6 lines) in supabase/functions/send_stop_update_push/index.ts:129"}, "properties": {"repobilityId": "16f5810ddbc4f2a6", "scanner": "scanner-primary", "fingerprint": "2eab4a0fe1d7c7ab", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-1eb7902f2a701285", "level": "none", "message": {"text": "Commented-code block (7 lines) in supabase/functions/translate_tour/index.ts:3"}, "properties": {"repobilityId": "3a5889b9f3d812d8", "scanner": "scanner-primary", "fingerprint": "1eb7902f2a701285", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-5c218b44fe99b1f9", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 supabase/functions/translate_tour/index.ts:34"}, "properties": {"repobilityId": "bf6bc723b485aa14", "scanner": "scanner-primary", "fingerprint": "5c218b44fe99b1f9", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-48841003d74da163", "level": "none", "message": {"text": "Commented-code block (5 lines) in supabase/functions/translate_stop_notes/index.ts:3"}, "properties": {"repobilityId": "d10f907d491956a7", "scanner": "scanner-primary", "fingerprint": "48841003d74da163", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-9f0380a60c4a3ae2", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 supabase/functions/translate_stop_notes/index.ts:42"}, "properties": {"repobilityId": "d2856b1bdf1e2cde", "scanner": "scanner-primary", "fingerprint": "9f0380a60c4a3ae2", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-3b7ff8fbc6a9707c", "level": "none", "message": {"text": "Commented-code block (6 lines) in supabase/functions/send_stop_push/index.ts:8"}, "properties": {"repobilityId": "c74be3549992da22", "scanner": "scanner-primary", "fingerprint": "3b7ff8fbc6a9707c", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-dd5b35b0b1f22e1c", "level": "none", "message": {"text": "Commented-code block (6 lines) in tools/generate_icons.mjs:5"}, "properties": {"repobilityId": "b97b071b112c092b", "scanner": "scanner-primary", "fingerprint": "dd5b35b0b1f22e1c", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}]}]}