{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-a13b620350a803ba", "name": "Possibly dead Python function: version_callback", "shortDescription": {"text": "Possibly dead Python function: version_callback"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cbc70e70203fdcf5", "name": "Possibly dead Python function: check_required_files", "shortDescription": {"text": "Possibly dead Python function: check_required_files"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-dbb8ddd2f0b1d094", "name": "Possibly dead Python function: sync_status", "shortDescription": {"text": "Possibly dead Python function: sync_status"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-170faa7ae0cbef7c", "name": "Possibly dead Python function: update_layout", "shortDescription": {"text": "Possibly dead Python function: update_layout"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-dd522185073c3abe", "name": "Possibly dead Python function: update_simulation_progress", "shortDescription": {"text": "Possibly dead Python function: update_simulation_progress"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8f6e94d80113e2a6", "name": "Possibly dead Python function: start_operation", "shortDescription": {"text": "Possibly dead Python function: start_operation"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-de20dce6b35c128a", "name": "Possibly dead Python function: update_operation", "shortDescription": {"text": "Possibly dead Python function: update_operation"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-27c69d8863d30452", "name": "Possibly dead Python function: finish_operation", "shortDescription": {"text": "Possibly dead Python function: finish_operation"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4816988174c34cbb", "name": "Possibly dead Python function: update_stage_progress", "shortDescription": {"text": "Possibly dead Python function: update_stage_progress"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-16d1b7866dc47efe", "name": "Possibly dead Python function: execute_sequence", "shortDescription": {"text": "Possibly dead Python function: execute_sequence"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-56c6e9062dce334c", "name": "Possibly dead Python function: broadcast", "shortDescription": {"text": "Possibly dead Python function: broadcast"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d308651f21acf1b3", "name": "Possibly dead Python function: broadcast_json", "shortDescription": {"text": "Possibly dead Python function: broadcast_json"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1f26a22fdb217b39", "name": "Possibly dead Python function: model_post_init", "shortDescription": {"text": "Possibly dead Python function: model_post_init"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ff3a83d5e1615568", "name": "Possibly dead Python function: model_post_init", "shortDescription": {"text": "Possibly dead Python function: model_post_init"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-81e676ed01489a73", "name": "`truncate` class without `title=` for hover reveal \u2014 planalign_studio/components/CostComparison.tsx:300", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 planalign_studio/components/CostComparison.tsx:300"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-d6d01842ddb30abe", "name": "`truncate` class without `title=` for hover reveal \u2014 planalign_studio/components/SimulationDetail.tsx:444", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 planalign_studio/components/SimulationDetail.tsx:444"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-0a10cef6457373cc", "name": "`truncate` class without `title=` for hover reveal \u2014 planalign_studio/components/Layout.tsx:542", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 planalign_studio/components/Layout.tsx:542"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-7b4cb69d7bdee604", "name": "`truncate` class without `title=` for hover reveal \u2014 planalign_studio/components/NDTTesting.tsx:446", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 planalign_studio/components/NDTTesting.tsx:446"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-c6518d32a13045a2", "name": "`truncate` class without `title=` for hover reveal \u2014 planalign_studio/components/BatchProcessing.tsx:295", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 planalign_studio/components/BatchProcessing.tsx:295"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-e64b566a9f42b3f4", "name": "`truncate` class without `title=` for hover reveal \u2014 planalign_studio/components/ScenarioCostComparison.tsx:757", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 planalign_studio/components/ScenarioCostComparison.tsx:757"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-8a43e91ac98a2b25", "name": "`truncate` class without `title=` for hover reveal \u2014 planalign_studio/components/ScenariosPage.tsx:403", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 planalign_studio/components/ScenariosPage.tsx:403"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-eff35d97f42dcd9d", "name": "`truncate` class without `title=` for hover reveal \u2014 planalign_studio/components/imports/FileUploadStep.tsx:190", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 planalign_studio/components/imports/FileUploadStep.tsx:190"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-160c3596864f8001", "name": "`truncate` class without `title=` for hover reveal \u2014 planalign_studio/components/imports/PreviewStep.tsx:151", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 planalign_studio/components/imports/PreviewStep.tsx:151"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-26139e69ccc4c97d", "name": "`truncate` class without `title=` for hover reveal \u2014 planalign_studio/components/imports/ImportedFilesList.tsx:113", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 planalign_studio/components/imports/ImportedFilesList.tsx:113"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-7c9d858e9fc38699", "name": "Stray `console.log` in TS/JS \u2014 planalign_studio/components/config/ConfigContext.tsx:611", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 planalign_studio/components/config/ConfigContext.tsx:611"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8827a1e27f8c729f", "name": "Stray `console.log` in TS/JS \u2014 planalign_studio/services/websocket.ts:275", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 planalign_studio/services/websocket.ts:275"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cb3f191c20c2b139", "name": "Privileged port 10 in use", "shortDescription": {"text": "Privileged port 10 in use"}, "fullDescription": {"text": "Port 10 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3c3cdc6b244b1b51", "name": "Privileged port 26 in use", "shortDescription": {"text": "Privileged port 26 in use"}, "fullDescription": {"text": "Port 26 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a37be981950a70ab", "name": "Privileged port 31 in use", "shortDescription": {"text": "Privileged port 31 in use"}, "fullDescription": {"text": "Port 31 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d1d647bcfe3e1b04", "name": "Privileged port 50 in use", "shortDescription": {"text": "Privileged port 50 in use"}, "fullDescription": {"text": "Port 50 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-04263a222fc262d3", "name": "Privileged port 38 in use", "shortDescription": {"text": "Privileged port 38 in use"}, "fullDescription": {"text": "Port 38 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d6ca9fb12cacd678", "name": "Privileged port 75 in use", "shortDescription": {"text": "Privileged port 75 in use"}, "fullDescription": {"text": "Port 75 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-04a6afeaed413dc5", "name": "Privileged port 47 in use", "shortDescription": {"text": "Privileged port 47 in use"}, "fullDescription": {"text": "Port 47 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-5b73ddff933558ff", "name": "Privileged port 90 in use", "shortDescription": {"text": "Privileged port 90 in use"}, "fullDescription": {"text": "Port 90 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f90548c448e15361", "name": "Privileged port 55 in use", "shortDescription": {"text": "Privileged port 55 in use"}, "fullDescription": {"text": "Port 55 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ff51c91ee7d5879e", "name": "Privileged port 30 in use", "shortDescription": {"text": "Privileged port 30 in use"}, "fullDescription": {"text": "Port 30 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f7b34a4e4555d5ce", "name": "Privileged port 45 in use", "shortDescription": {"text": "Privileged port 45 in use"}, "fullDescription": {"text": "Port 45 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4525c9e9b05c6af7", "name": "Privileged port 70 in use", "shortDescription": {"text": "Privileged port 70 in use"}, "fullDescription": {"text": "Port 70 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4a210ac3b4b59ff4", "name": "Dockerfile runs as root: .devcontainer/Dockerfile", "shortDescription": {"text": "Dockerfile runs as root: .devcontainer/Dockerfile"}, "fullDescription": {"text": "No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d53891680285d5cd", "name": "Docker base image is tag-pinned but not digest-pinned: node:20", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: node:20"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-42222223b4a3450e", "name": "Dockerfile pipes a remote installer into a shell", "shortDescription": {"text": "Dockerfile pipes a remote installer into a shell"}, "fullDescription": {"text": "Executing downloaded code during image build gives the remote endpoint build-time code execution. Prefer pinned packages or verify downloaded installers by checksum/signature."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "high", "confidence": 1.0}}, {"id": "scanner-12dc62dd121a9f8f", "name": "Insecure pattern 'subprocess_shell_true' in scripts/setup_staging.py:23", "shortDescription": {"text": "Insecure pattern 'subprocess_shell_true' in scripts/setup_staging.py:23"}, "fullDescription": {"text": "Found a known-risky pattern (subprocess_shell_true). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-c7c0f95ad0ac92a6", "name": "Insecure pattern 'eval_used' in planalign_api/services/mapping_engine.py:36", "shortDescription": {"text": "Insecure pattern 'eval_used' in planalign_api/services/mapping_engine.py:36"}, "fullDescription": {"text": "Found a known-risky pattern (eval_used). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-ce40f4bd8474cfae", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a490b82e56b66367", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e194e2e4f57d2a25", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1a50467f36b413ec", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v3 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1eae71a130808faa", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5abe7b30781e9553", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-35e65967ac918aeb", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-de53ac274e5b4ecf", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-37716d9c0a33ad5c", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-27924aa79fa4a517", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/setup-python@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7f1e4527e6fecffa", "name": "GitHub Action tracks a moving branch", "shortDescription": {"text": "GitHub Action tracks a moving branch"}, "fullDescription": {"text": "aquasecurity/trivy-action@master can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "high", "confidence": 1.0}}, {"id": "scanner-c3bb05b88a06705e", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-bba40a7ebc882450", "name": "pip extra-index-url can enable dependency confusion", "shortDescription": {"text": "pip extra-index-url can enable dependency confusion"}, "fullDescription": {"text": "pip --extra-index-url searches an additional package index and can resolve public packages when a private package name is missing or has a lower version. Prefer a single controlled index or explicit hashes and package source policy."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "high", "confidence": 1.0}}, {"id": "scanner-7086cc3d4eac2517", "name": "Very large file: tests/test_analytics_service.py (1208 lines)", "shortDescription": {"text": "Very large file: tests/test_analytics_service.py (1208 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-04df2fe87d1f9281", "name": "Very large file: planalign_api/services/file_service.py (1389 lines)", "shortDescription": {"text": "Very large file: planalign_api/services/file_service.py (1389 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-761756a5897cd4ac", "name": "Very large file: planalign_api/services/ndt_service.py (1379 lines)", "shortDescription": {"text": "Very large file: planalign_api/services/ndt_service.py (1379 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-665df364a4d05cb4", "name": "Very large file: planalign_studio/components/NDTTesting.tsx (1687 lines)", "shortDescription": {"text": "Very large file: planalign_studio/components/NDTTesting.tsx (1687 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-afad0a9acf55e43e", "name": "Very large file: planalign_studio/components/ScenarioCostComparison.tsx (1253 lines)", "shortDescription": {"text": "Very large file: planalign_studio/components/ScenarioCostComparison.tsx (1253 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-972b96ee35023cb6", "name": "Very large file: planalign_studio/components/config/DCPlanSection.tsx (1023 lines)", "shortDescription": {"text": "Very large file: planalign_studio/components/config/DCPlanSection.tsx (1023 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-925771e53f3fbdd1", "name": "Very large file: planalign_studio/services/api.ts (2083 lines)", "shortDescription": {"text": "Very large file: planalign_studio/services/api.ts (2083 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-dce634bf41000119", "name": "Very large file: planalign_orchestrator/config/export.py (1157 lines)", "shortDescription": {"text": "Very large file: planalign_orchestrator/config/export.py (1157 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-141b30a41e03817b", "name": "No license file detected", "shortDescription": {"text": "No license file detected"}, "fullDescription": {"text": "No LICENSE/COPYING/NOTICE file was found. Generated repositories often omit licensing, which blocks reuse and automated intake."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-da2b3920bb00be12", "name": "Node manifest has dependencies but no lockfile: planalign_studio/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: planalign_studio/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 467 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-72b2a6250083a784", "name": "Placeholder or mock-heavy implementation detected", "shortDescription": {"text": "Placeholder or mock-heavy implementation detected"}, "fullDescription": {"text": "Found 43 placeholder/mock markers across 21 source files. This often means the repo looks complete while core flows still use generated scaffolding or fake data."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b9088664ace7f748", "name": "Composite production-readiness gap", "shortDescription": {"text": "Composite production-readiness gap"}, "fullDescription": {"text": "Multiple low-cost hardening controls are missing together: license, lockfile. Opus verification showed these co-occurring gaps are a better readiness signal than reading each flag in isolation."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-749d4bc1bd66df5f", "name": "Agent instructions exist but release-hardening basics are missing", "shortDescription": {"text": "Agent instructions exist but release-hardening basics are missing"}, "fullDescription": {"text": "AI-coder instruction files were found, but the repo is missing license, lockfile. Treat this as a contract gap: the agent is guided, but the generated output is not yet guarded by the controls that make it repeatable."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e725d2ab884fbd49", "name": "Multiple root agent instruction files without precedence", "shortDescription": {"text": "Multiple root agent instruction files without precedence"}, "fullDescription": {"text": "The repo has multiple top-level AI-coder instruction files. Without precedence rules, different agents may follow different policies."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6788e19c356e07e7", "name": "Legacy-named symbol `DM_Old` in tests/unit/monitoring/test_duckdb_monitor.py:449", "shortDescription": {"text": "Legacy-named symbol `DM_Old` in tests/unit/monitoring/test_duckdb_monitor.py:449"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0196d1fd44d99da9", "name": "Legacy-named symbol `PM_Old` in tests/unit/monitoring/test_base_monitor.py:213", "shortDescription": {"text": "Legacy-named symbol `PM_Old` in tests/unit/monitoring/test_base_monitor.py:213"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-715d3216fd3aa55f", "name": "Legacy-named symbol `CM_Old` in tests/unit/resources/test_cpu_monitor.py:214", "shortDescription": {"text": "Legacy-named symbol `CM_Old` in tests/unit/resources/test_cpu_monitor.py:214"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-64fc045f899e0920", "name": "Legacy-named symbol `MM_Old` in tests/unit/resources/test_memory_monitor.py:202", "shortDescription": {"text": "Legacy-named symbol `MM_Old` in tests/unit/resources/test_memory_monitor.py:202"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c124c60fefa60b34", "name": "Legacy-named symbol `_run_stage_models_legacy` in tests/unit/orchestrator/test_year_executor.py:13", "shortDescription": {"text": "Legacy-named symbol `_run_stage_models_legacy` in tests/unit/orchestrator/test_year_executor.py:13"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-14791e5c3da34b1c", "name": "Legacy-named symbol `test_returns_copy` in tests/unit/orchestrator/test_excel_exporter.py:164", "shortDescription": {"text": "Legacy-named symbol `test_returns_copy` in tests/unit/orchestrator/test_excel_exporter.py:164"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2c79146a39a404b4", "name": "Legacy-named symbol `test_dc_plan_overrides_legacy` in tests/unit/orchestrator/test_config_export.py:1032", "shortDescription": {"text": "Legacy-named symbol `test_dc_plan_overrides_legacy` in tests/unit/orchestrator/test_config_export.py:1032"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f48a91c27c56e816", "name": "Legacy-named symbol `test_create_basic_event_deprecated` in tests/unit/events/test_simulation_event.py:330", "shortDescription": {"text": "Legacy-named symbol `test_create_basic_event_deprecated` in tests/unit/events/test_simulation_event.py:330"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-50d8f423dd1382dd", "name": "Commented-code block (6 lines) in planalign_cli/commands/studio.py:272", "shortDescription": {"text": "Commented-code block (6 lines) in planalign_cli/commands/studio.py:272"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-4503d379a989eecb", "name": "Network/subprocess call without timeout or try/except \u2014 planalign_cli/commands/studio.py:333", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 planalign_cli/commands/studio.py:333"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ca83625a3499822a", "name": "Network/subprocess call without timeout or try/except \u2014 scripts/smart_command_wrapper.py:274", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/smart_command_wrapper.py:274"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a05acc11e7211c47", "name": "Legacy-named symbol `create_backup` in scripts/migrate_database_location.py:76", "shortDescription": {"text": "Legacy-named symbol `create_backup` in scripts/migrate_database_location.py:76"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-41a0c88b761c88a9", "name": "Legacy-named symbol `calibration_v1` in scripts/calibrate_compensation.py:194", "shortDescription": {"text": "Legacy-named symbol `calibration_v1` in scripts/calibrate_compensation.py:194"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ec3e2cb94c23325", "name": "Legacy-named symbol `model_copy` in scripts/scale_testing_framework.py:537", "shortDescription": {"text": "Legacy-named symbol `model_copy` in scripts/scale_testing_framework.py:537"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2f645783640da45a", "name": "Commented-code block (5 lines) in planalign_api/services/compensation_solver.py:371", "shortDescription": {"text": "Commented-code block (5 lines) in planalign_api/services/compensation_solver.py:371"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-edf3404cb70522ff", "name": "Network/subprocess call without timeout or try/except \u2014 planalign_api/services/simulation/subprocess_utils.py:44", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 planalign_api/services/simulation/subprocess_utils.py:44"}, "fullDescription": {"text": "`subprocess.Popen(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4ef95cac4665d8f5", "name": "`fetch()` without try/.catch or AbortSignal \u2014 planalign_studio/services/api.ts:305", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 planalign_studio/services/api.ts:305"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-78cd5b8bb01b0e30", "name": "`fetch()` without try/.catch or AbortSignal \u2014 planalign_studio/services/importService.ts:217", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 planalign_studio/services/importService.ts:217"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2af62def0ad45c17", "name": "Legacy-named symbol `has_backup` in planalign_orchestrator/run_summary.py:225", "shortDescription": {"text": "Legacy-named symbol `has_backup` in planalign_orchestrator/run_summary.py:225"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-12af66204a6540f9", "name": "Legacy-named symbol `emergency_backup` in planalign_orchestrator/recovery_manager.py:70", "shortDescription": {"text": "Legacy-named symbol `emergency_backup` in planalign_orchestrator/recovery_manager.py:70"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fa22caff95076eaa", "name": "Network/subprocess call without timeout or try/except \u2014 planalign_orchestrator/dbt_runner.py:385", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 planalign_orchestrator/dbt_runner.py:385"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9607655075d63cb0", "name": "Legacy-named symbol `_execute_parallel_legacy` in planalign_orchestrator/parallel_execution_engine.py:489", "shortDescription": {"text": "Legacy-named symbol `_execute_parallel_legacy` in planalign_orchestrator/parallel_execution_engine.py:489"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-58a27da584ab1923", "name": "Legacy-named symbol `create_backup` in planalign_orchestrator/backup_manager.py:103", "shortDescription": {"text": "Legacy-named symbol `create_backup` in planalign_orchestrator/backup_manager.py:103"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-336bced276ac80e4", "name": "Legacy-named symbol `_save_config_copy` in planalign_orchestrator/scenario_batch_runner.py:287", "shortDescription": {"text": "Legacy-named symbol `_save_config_copy` in planalign_orchestrator/scenario_batch_runner.py:287"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-efe8540eab9233d2", "name": "Legacy-named symbol `_run_stage_models_legacy` in planalign_orchestrator/pipeline/year_executor.py:362", "shortDescription": {"text": "Legacy-named symbol `_run_stage_models_legacy` in planalign_orchestrator/pipeline/year_executor.py:362"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-daffaeebf006443e", "name": "Legacy-named symbol `employer_legacy` in planalign_orchestrator/config/export.py:464", "shortDescription": {"text": "Legacy-named symbol `employer_legacy` in planalign_orchestrator/config/export.py:464"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2c04133e54348533", "name": "Near-duplicate function bodies in 2 places", "shortDescription": {"text": "Near-duplicate function bodies in 2 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nplanalign_cli/main.py:sync_init_cmd, planalign_cli/commands/sync.py:sync_init\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-be46ea126aa5d8dc", "name": "Near-duplicate function bodies in 3 places", "shortDescription": {"text": "Near-duplicate function bodies in 3 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nplanalign_cli/commands/analyze.py:analyze_workforce, planalign_cli/commands/analyze.py:analyze_events, planalign_cli/commands/status.py:show_status\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-49c98f7cedd9c977", "name": "Near-duplicate function bodies in 4 places", "shortDescription": {"text": "Near-duplicate function bodies in 4 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nplanalign_api/services/ndt_service.py:run_acp_test, planalign_api/services/ndt_service.py:run_401a4_test, planalign_api/services/ndt_service.py:run_415_test, planalign_api/services/ndt_service.py:run_adp_test\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5380924c17e07839", "name": "Frontend route `simulate` has no Link/navigate to it \u2014 planalign_studio/App.tsx", "shortDescription": {"text": "Frontend route `simulate` has no Link/navigate to it \u2014 planalign_studio/App.tsx"}, "fullDescription": {"text": "The route is registered but no `<Link to=\u2026>` or `navigate(\u2026)` in the codebase navigates here. Either it's reachable only via direct URL (intentional), it's dead, or the link broke during a refactor."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4fed42dc5904fe16", "name": "Frontend route `simulate/:scenarioId` has no Link/navigate to it \u2014 planalign_studio/App.tsx", "shortDescription": {"text": "Frontend route `simulate/:scenarioId` has no Link/navigate to it \u2014 planalign_studio/App.tsx"}, "fullDescription": {"text": "The route is registered but no `<Link to=\u2026>` or `navigate(\u2026)` in the codebase navigates here. Either it's reachable only via direct URL (intentional), it's dead, or the link broke during a refactor."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-776d46f39163b892", "name": "Frontend route `scenarios` has no Link/navigate to it \u2014 planalign_studio/App.tsx", "shortDescription": {"text": "Frontend route `scenarios` has no Link/navigate to it \u2014 planalign_studio/App.tsx"}, "fullDescription": {"text": "The route is registered but no `<Link to=\u2026>` or `navigate(\u2026)` in the codebase navigates here. Either it's reachable only via direct URL (intentional), it's dead, or the link broke during a refactor."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-abf934e4d7541b25", "name": "Frontend route `config` has no Link/navigate to it \u2014 planalign_studio/App.tsx", "shortDescription": {"text": "Frontend route `config` has no Link/navigate to it \u2014 planalign_studio/App.tsx"}, "fullDescription": {"text": "The route is registered but no `<Link to=\u2026>` or `navigate(\u2026)` in the codebase navigates here. Either it's reachable only via direct URL (intentional), it's dead, or the link broke during a refactor."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e941e2a57f8871b2", "name": "Frontend route `config/:scenarioId` has no Link/navigate to it \u2014 planalign_studio/App.tsx", "shortDescription": {"text": "Frontend route `config/:scenarioId` has no Link/navigate to it \u2014 planalign_studio/App.tsx"}, "fullDescription": {"text": "The route is registered but no `<Link to=\u2026>` or `navigate(\u2026)` in the codebase navigates here. Either it's reachable only via direct URL (intentional), it's dead, or the link broke during a refactor."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a1668ca0ff82657f", "name": "Frontend route `analytics` has no Link/navigate to it \u2014 planalign_studio/App.tsx", "shortDescription": {"text": "Frontend route `analytics` has no Link/navigate to it \u2014 planalign_studio/App.tsx"}, "fullDescription": {"text": "The route is registered but no `<Link to=\u2026>` or `navigate(\u2026)` in the codebase navigates here. Either it's reachable only via direct URL (intentional), it's dead, or the link broke during a refactor."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-36cc5cf2fee33a11", "name": "Frontend route `analytics/compare` has no Link/navigate to it \u2014 planalign_studio/App.tsx", "shortDescription": {"text": "Frontend route `analytics/compare` has no Link/navigate to it \u2014 planalign_studio/App.tsx"}, "fullDescription": {"text": "The route is registered but no `<Link to=\u2026>` or `navigate(\u2026)` in the codebase navigates here. Either it's reachable only via direct URL (intentional), it's dead, or the link broke during a refactor."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-47a39753fb293982", "name": "Frontend route `analytics/dc-plan` has no Link/navigate to it \u2014 planalign_studio/App.tsx", "shortDescription": {"text": "Frontend route `analytics/dc-plan` has no Link/navigate to it \u2014 planalign_studio/App.tsx"}, "fullDescription": {"text": "The route is registered but no `<Link to=\u2026>` or `navigate(\u2026)` in the codebase navigates here. Either it's reachable only via direct URL (intentional), it's dead, or the link broke during a refactor."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-430deadc8ee254da", "name": "Frontend route `analytics/vesting` has no Link/navigate to it \u2014 planalign_studio/App.tsx", "shortDescription": {"text": "Frontend route `analytics/vesting` has no Link/navigate to it \u2014 planalign_studio/App.tsx"}, "fullDescription": {"text": "The route is registered but no `<Link to=\u2026>` or `navigate(\u2026)` in the codebase navigates here. Either it's reachable only via direct URL (intentional), it's dead, or the link broke during a refactor."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e84d53dbdfd3c804", "name": "Frontend route `analytics/ndt` has no Link/navigate to it \u2014 planalign_studio/App.tsx", "shortDescription": {"text": "Frontend route `analytics/ndt` has no Link/navigate to it \u2014 planalign_studio/App.tsx"}, "fullDescription": {"text": "The route is registered but no `<Link to=\u2026>` or `navigate(\u2026)` in the codebase navigates here. Either it's reachable only via direct URL (intentional), it's dead, or the link broke during a refactor."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-faf6d10cd4475b36", "name": "Frontend route `analytics/winners-losers` has no Link/navigate to it \u2014 planalign_studio/App.tsx", "shortDescription": {"text": "Frontend route `analytics/winners-losers` has no Link/navigate to it \u2014 planalign_studio/App.tsx"}, "fullDescription": {"text": "The route is registered but no `<Link to=\u2026>` or `navigate(\u2026)` in the codebase navigates here. Either it's reachable only via direct URL (intentional), it's dead, or the link broke during a refactor."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6f64a9869a89d6d4", "name": "Frontend route `compare` has no Link/navigate to it \u2014 planalign_studio/App.tsx", "shortDescription": {"text": "Frontend route `compare` has no Link/navigate to it \u2014 planalign_studio/App.tsx"}, "fullDescription": {"text": "The route is registered but no `<Link to=\u2026>` or `navigate(\u2026)` in the codebase navigates here. Either it's reachable only via direct URL (intentional), it's dead, or the link broke during a refactor."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e67ce7ac0bff666f", "name": "Frontend route `batch` has no Link/navigate to it \u2014 planalign_studio/App.tsx", "shortDescription": {"text": "Frontend route `batch` has no Link/navigate to it \u2014 planalign_studio/App.tsx"}, "fullDescription": {"text": "The route is registered but no `<Link to=\u2026>` or `navigate(\u2026)` in the codebase navigates here. Either it's reachable only via direct URL (intentional), it's dead, or the link broke during a refactor."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-620e5d37a44d7323", "name": "Frontend route `workspaces` has no Link/navigate to it \u2014 planalign_studio/App.tsx", "shortDescription": {"text": "Frontend route `workspaces` has no Link/navigate to it \u2014 planalign_studio/App.tsx"}, "fullDescription": {"text": "The route is registered but no `<Link to=\u2026>` or `navigate(\u2026)` in the codebase navigates here. Either it's reachable only via direct URL (intentional), it's dead, or the link broke during a refactor."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-cf4fa1678cd65f91", "name": "Frontend route `import` has no Link/navigate to it \u2014 planalign_studio/App.tsx", "shortDescription": {"text": "Frontend route `import` has no Link/navigate to it \u2014 planalign_studio/App.tsx"}, "fullDescription": {"text": "The route is registered but no `<Link to=\u2026>` or `navigate(\u2026)` in the codebase navigates here. Either it's reachable only via direct URL (intentional), it's dead, or the link broke during a refactor."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-53c8e5e104eaa70f", "name": "FastAPI POST `upload_census_file` without auth dependency \u2014 planalign_api/routers/files.py:53", "shortDescription": {"text": "FastAPI POST `upload_census_file` without auth dependency \u2014 planalign_api/routers/files.py:53"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-eac930f3cc23d336", "name": "FastAPI POST `validate_file_path` without auth dependency \u2014 planalign_api/routers/files.py:184", "shortDescription": {"text": "FastAPI POST `validate_file_path` without auth dependency \u2014 planalign_api/routers/files.py:184"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-7244e5a731374ea2", "name": "FastAPI POST `set_census_path` without auth dependency \u2014 planalign_api/routers/files.py:208", "shortDescription": {"text": "FastAPI POST `set_census_path` without auth dependency \u2014 planalign_api/routers/files.py:208"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-fe4f83bd69542b4b", "name": "FastAPI POST `analyze_age_distribution` without auth dependency \u2014 planalign_api/routers/files.py:244", "shortDescription": {"text": "FastAPI POST `analyze_age_distribution` without auth dependency \u2014 planalign_api/routers/files.py:244"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-4b77013bb98e5661", "name": "FastAPI POST `analyze_part_time_pct` without auth dependency \u2014 planalign_api/routers/files.py:275", "shortDescription": {"text": "FastAPI POST `analyze_part_time_pct` without auth dependency \u2014 planalign_api/routers/files.py:275"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-355d7570d6704d50", "name": "FastAPI POST `analyze_compensation_by_level` without auth dependency \u2014 planalign_api/routers/files.py:310", "shortDescription": {"text": "FastAPI POST `analyze_compensation_by_level` without auth dependency \u2014 planalign_api/routers/files.py:310"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-47ea49c84620a575", "name": "FastAPI POST `solve_compensation_growth` without auth dependency \u2014 planalign_api/routers/files.py:346", "shortDescription": {"text": "FastAPI POST `solve_compensation_growth` without auth dependency \u2014 planalign_api/routers/files.py:346"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-274032ed3dd26568", "name": "FastAPI POST `run_all_scenarios` without auth dependency \u2014 planalign_api/routers/batch.py:31", "shortDescription": {"text": "FastAPI POST `run_all_scenarios` without auth dependency \u2014 planalign_api/routers/batch.py:31"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-431d270d0f4553ba", "name": "FastAPI POST `analyze_age_bands` without auth dependency \u2014 planalign_api/routers/bands.py:145", "shortDescription": {"text": "FastAPI POST `analyze_age_bands` without auth dependency \u2014 planalign_api/routers/bands.py:145"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-8469eb8c45d1e512", "name": "FastAPI POST `analyze_tenure_bands` without auth dependency \u2014 planalign_api/routers/bands.py:195", "shortDescription": {"text": "FastAPI POST `analyze_tenure_bands` without auth dependency \u2014 planalign_api/routers/bands.py:195"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-e1a1544b5c901a92", "name": "FastAPI POST `analyze_turnover` without auth dependency \u2014 planalign_api/routers/bands.py:250", "shortDescription": {"text": "FastAPI POST `analyze_turnover` without auth dependency \u2014 planalign_api/routers/bands.py:250"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-e5f1d4b1e2485440", "name": "FastAPI POST `analyze_opt_out_rate` without auth dependency \u2014 planalign_api/routers/bands.py:304", "shortDescription": {"text": "FastAPI POST `analyze_opt_out_rate` without auth dependency \u2014 planalign_api/routers/bands.py:304"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-1834c84f6541dedc", "name": "FastAPI POST `start_simulation` without auth dependency \u2014 planalign_api/routers/simulations.py:74", "shortDescription": {"text": "FastAPI POST `start_simulation` without auth dependency \u2014 planalign_api/routers/simulations.py:74"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-c1fb4216fc727b45", "name": "FastAPI POST `cancel_simulation` without auth dependency \u2014 planalign_api/routers/simulations.py:239", "shortDescription": {"text": "FastAPI POST `cancel_simulation` without auth dependency \u2014 planalign_api/routers/simulations.py:239"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-4565254c6036a0e9", "name": "FastAPI POST `reset_simulation_status` without auth dependency \u2014 planalign_api/routers/simulations.py:270", "shortDescription": {"text": "FastAPI POST `reset_simulation_status` without auth dependency \u2014 planalign_api/routers/simulations.py:270"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-237c148209d73cc8", "name": "FastAPI POST `create_workspace` without auth dependency \u2014 planalign_api/routers/workspaces.py:111", "shortDescription": {"text": "FastAPI POST `create_workspace` without auth dependency \u2014 planalign_api/routers/workspaces.py:111"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-3dea0afa3ba61924", "name": "FastAPI PUT `update_workspace` without auth dependency \u2014 planalign_api/routers/workspaces.py:144", "shortDescription": {"text": "FastAPI PUT `update_workspace` without auth dependency \u2014 planalign_api/routers/workspaces.py:144"}, "fullDescription": {"text": "`@router.put` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-a105ba76f76e2d7e", "name": "FastAPI DELETE `delete_workspace` without auth dependency \u2014 planalign_api/routers/workspaces.py:186", "shortDescription": {"text": "FastAPI DELETE `delete_workspace` without auth dependency \u2014 planalign_api/routers/workspaces.py:186"}, "fullDescription": {"text": "`@router.delete` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-c9626a5195de8390", "name": "FastAPI POST `export_workspace` without auth dependency \u2014 planalign_api/routers/workspaces.py:208", "shortDescription": {"text": "FastAPI POST `export_workspace` without auth dependency \u2014 planalign_api/routers/workspaces.py:208"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-a8ee6830c20cb0f5", "name": "FastAPI POST `start_bulk_export` without auth dependency \u2014 planalign_api/routers/workspaces.py:250", "shortDescription": {"text": "FastAPI POST `start_bulk_export` without auth dependency \u2014 planalign_api/routers/workspaces.py:250"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-a8054d479f2d67a4", "name": "FastAPI POST `validate_import` without auth dependency \u2014 planalign_api/routers/workspaces.py:316", "shortDescription": {"text": "FastAPI POST `validate_import` without auth dependency \u2014 planalign_api/routers/workspaces.py:316"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-7ffb241ad7e69550", "name": "FastAPI POST `import_workspace` without auth dependency \u2014 planalign_api/routers/workspaces.py:364", "shortDescription": {"text": "FastAPI POST `import_workspace` without auth dependency \u2014 planalign_api/routers/workspaces.py:364"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-aa502ba23d01d053", "name": "FastAPI POST `start_bulk_import` without auth dependency \u2014 planalign_api/routers/workspaces.py:418", "shortDescription": {"text": "FastAPI POST `start_bulk_import` without auth dependency \u2014 planalign_api/routers/workspaces.py:418"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-641f295a6c43175d", "name": "FastAPI POST `create_scenario` without auth dependency \u2014 planalign_api/routers/scenarios.py:49", "shortDescription": {"text": "FastAPI POST `create_scenario` without auth dependency \u2014 planalign_api/routers/scenarios.py:49"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-be40fde7e5f71f74", "name": "FastAPI PUT `update_scenario` without auth dependency \u2014 planalign_api/routers/scenarios.py:116", "shortDescription": {"text": "FastAPI PUT `update_scenario` without auth dependency \u2014 planalign_api/routers/scenarios.py:116"}, "fullDescription": {"text": "`@router.put` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-da3164bbe7bb5d29", "name": "FastAPI POST `apply_workforce_params` without auth dependency \u2014 planalign_api/routers/scenarios.py:160", "shortDescription": {"text": "FastAPI POST `apply_workforce_params` without auth dependency \u2014 planalign_api/routers/scenarios.py:160"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-9c262ee047c94d44", "name": "FastAPI DELETE `delete_scenario` without auth dependency \u2014 planalign_api/routers/scenarios.py:206", "shortDescription": {"text": "FastAPI DELETE `delete_scenario` without auth dependency \u2014 planalign_api/routers/scenarios.py:206"}, "fullDescription": {"text": "`@router.delete` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-7081d3d2e0050e92", "name": "FastAPI DELETE `delete_scenario_database` without auth dependency \u2014 planalign_api/routers/scenarios.py:226", "shortDescription": {"text": "FastAPI DELETE `delete_scenario_database` without auth dependency \u2014 planalign_api/routers/scenarios.py:226"}, "fullDescription": {"text": "`@router.delete` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-226a513a5c9b43cd", "name": "FastAPI POST `upload_file` without auth dependency \u2014 planalign_api/routers/imports.py:197", "shortDescription": {"text": "FastAPI POST `upload_file` without auth dependency \u2014 planalign_api/routers/imports.py:197"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-1f33d8e1c4598d62", "name": "FastAPI PATCH `select_sheet` without auth dependency \u2014 planalign_api/routers/imports.py:268", "shortDescription": {"text": "FastAPI PATCH `select_sheet` without auth dependency \u2014 planalign_api/routers/imports.py:268"}, "fullDescription": {"text": "`@router.patch` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-fb4b7b5e7c14d730", "name": "FastAPI PUT `save_mapping` without auth dependency \u2014 planalign_api/routers/imports.py:316", "shortDescription": {"text": "FastAPI PUT `save_mapping` without auth dependency \u2014 planalign_api/routers/imports.py:316"}, "fullDescription": {"text": "`@router.put` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-c1cd0ed682436382", "name": "FastAPI POST `generate_parquet` without auth dependency \u2014 planalign_api/routers/imports.py:498", "shortDescription": {"text": "FastAPI POST `generate_parquet` without auth dependency \u2014 planalign_api/routers/imports.py:498"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-46fa2ee6f60a1417", "name": "FastAPI DELETE `delete_parquet_file` without auth dependency \u2014 planalign_api/routers/imports.py:597", "shortDescription": {"text": "FastAPI DELETE `delete_parquet_file` without auth dependency \u2014 planalign_api/routers/imports.py:597"}, "fullDescription": {"text": "`@router.delete` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-7de4476d644c6c2c", "name": "FastAPI POST `save_mapping_template` without auth dependency \u2014 planalign_api/routers/imports.py:635", "shortDescription": {"text": "FastAPI POST `save_mapping_template` without auth dependency \u2014 planalign_api/routers/imports.py:635"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-2310a28bb845f6fa", "name": "FastAPI POST `apply_template` without auth dependency \u2014 planalign_api/routers/imports.py:665", "shortDescription": {"text": "FastAPI POST `apply_template` without auth dependency \u2014 planalign_api/routers/imports.py:665"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-0f82479499bf870c", "name": "FastAPI POST `init_sync` without auth dependency \u2014 planalign_api/routers/sync.py:64", "shortDescription": {"text": "FastAPI POST `init_sync` without auth dependency \u2014 planalign_api/routers/sync.py:64"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-fe81c4dc1726d00d", "name": "FastAPI POST `push_changes` without auth dependency \u2014 planalign_api/routers/sync.py:86", "shortDescription": {"text": "FastAPI POST `push_changes` without auth dependency \u2014 planalign_api/routers/sync.py:86"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-e4a1c53307e505fd", "name": "FastAPI POST `pull_changes` without auth dependency \u2014 planalign_api/routers/sync.py:111", "shortDescription": {"text": "FastAPI POST `pull_changes` without auth dependency \u2014 planalign_api/routers/sync.py:111"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-5d9bf5bfae60998e", "name": "FastAPI POST `disconnect_sync` without auth dependency \u2014 planalign_api/routers/sync.py:171", "shortDescription": {"text": "FastAPI POST `disconnect_sync` without auth dependency \u2014 planalign_api/routers/sync.py:171"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-af9f17269e0b3267", "name": "FastAPI POST `analyze_vesting` without auth dependency \u2014 planalign_api/routers/vesting.py:78", "shortDescription": {"text": "FastAPI POST `analyze_vesting` without auth dependency \u2014 planalign_api/routers/vesting.py:78"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/25144"}, "properties": {"repository": "crzyc98/planwise_navigator", "repoUrl": "https://github.com/crzyc98/planwise_navigator", "branch": "main"}, "results": [{"ruleId": "scanner-a13b620350a803ba", "level": "note", "message": {"text": "Possibly dead Python function: version_callback"}, "properties": {"repobilityId": "29bbc1b0b3de41cf", "scanner": "scanner-primary", "fingerprint": "a13b620350a803ba", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "planalign_cli/main.py:48"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-cbc70e70203fdcf5", "level": "note", "message": {"text": "Possibly dead Python function: check_required_files"}, "properties": {"repobilityId": "4430e16469899a41", "scanner": "scanner-primary", "fingerprint": "cbc70e70203fdcf5", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "planalign_cli/utils/config_helpers.py:157"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-dbb8ddd2f0b1d094", "level": "note", "message": {"text": "Possibly dead Python function: sync_status"}, "properties": {"repobilityId": "d144223f7a1c1013", "scanner": "scanner-primary", "fingerprint": "dbb8ddd2f0b1d094", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "planalign_cli/commands/sync.py:210"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-170faa7ae0cbef7c", "level": "note", "message": {"text": "Possibly dead Python function: update_layout"}, "properties": {"repobilityId": "09d304659f0c3274", "scanner": "scanner-primary", "fingerprint": "170faa7ae0cbef7c", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "planalign_cli/commands/simulate.py:508"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-dd522185073c3abe", "level": "note", "message": {"text": "Possibly dead Python function: update_simulation_progress"}, "properties": {"repobilityId": "1d156a9b0cfcd232", "scanner": "scanner-primary", "fingerprint": "dd522185073c3abe", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "planalign_cli/ui/progress.py:73"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-8f6e94d80113e2a6", "level": "note", "message": {"text": "Possibly dead Python function: start_operation"}, "properties": {"repobilityId": "579d86d6c16d879b", "scanner": "scanner-primary", "fingerprint": "8f6e94d80113e2a6", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "planalign_cli/ui/progress.py:140"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-de20dce6b35c128a", "level": "note", "message": {"text": "Possibly dead Python function: update_operation"}, "properties": {"repobilityId": "b74a6c6dfe777c50", "scanner": "scanner-primary", "fingerprint": "de20dce6b35c128a", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "planalign_cli/ui/progress.py:150"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-27c69d8863d30452", "level": "note", "message": {"text": "Possibly dead Python function: finish_operation"}, "properties": {"repobilityId": "05169b9cd805d0f6", "scanner": "scanner-primary", "fingerprint": "27c69d8863d30452", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "planalign_cli/ui/progress.py:158"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-4816988174c34cbb", "level": "note", "message": {"text": "Possibly dead Python function: update_stage_progress"}, "properties": {"repobilityId": "6273964d2a745444", "scanner": "scanner-primary", "fingerprint": "4816988174c34cbb", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "planalign_cli/ui/progress.py:287"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-16d1b7866dc47efe", "level": "note", "message": {"text": "Possibly dead Python function: execute_sequence"}, "properties": {"repobilityId": "e5805b8cfd1774fd", "scanner": "scanner-primary", "fingerprint": "16d1b7866dc47efe", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/smart_command_wrapper.py:331"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-56c6e9062dce334c", "level": "note", "message": {"text": "Possibly dead Python function: broadcast"}, "properties": {"repobilityId": "e1f71900663f75f3", "scanner": "scanner-primary", "fingerprint": "56c6e9062dce334c", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "planalign_api/websocket/manager.py:43"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d308651f21acf1b3", "level": "note", "message": {"text": "Possibly dead Python function: broadcast_json"}, "properties": {"repobilityId": "079dbfac3a32de38", "scanner": "scanner-primary", "fingerprint": "d308651f21acf1b3", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "planalign_api/websocket/manager.py:62"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-1f26a22fdb217b39", "level": "note", "message": {"text": "Possibly dead Python function: model_post_init"}, "properties": {"repobilityId": "92fde611a57364a6", "scanner": "scanner-primary", "fingerprint": "1f26a22fdb217b39", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "planalign_api/models/suggestion.py:72"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ff3a83d5e1615568", "level": "note", "message": {"text": "Possibly dead Python function: model_post_init"}, "properties": {"repobilityId": "92fde611a57364a6", "scanner": "scanner-primary", "fingerprint": "ff3a83d5e1615568", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "planalign_api/models/imports.py:118"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-81e676ed01489a73", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 planalign_studio/components/CostComparison.tsx:300"}, "properties": {"repobilityId": "af3f93e4f0dd5c64", "scanner": "scanner-primary", "fingerprint": "81e676ed01489a73", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-d6d01842ddb30abe", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 planalign_studio/components/SimulationDetail.tsx:444"}, "properties": {"repobilityId": "ee71070dc18cc286", "scanner": "scanner-primary", "fingerprint": "d6d01842ddb30abe", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-0a10cef6457373cc", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 planalign_studio/components/Layout.tsx:542"}, "properties": {"repobilityId": "7a76334f735dc34c", "scanner": "scanner-primary", "fingerprint": "0a10cef6457373cc", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-7b4cb69d7bdee604", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 planalign_studio/components/NDTTesting.tsx:446"}, "properties": {"repobilityId": "432fedc0a355c99e", "scanner": "scanner-primary", "fingerprint": "7b4cb69d7bdee604", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-c6518d32a13045a2", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 planalign_studio/components/BatchProcessing.tsx:295"}, "properties": {"repobilityId": "e7f81040be69ad1e", "scanner": "scanner-primary", "fingerprint": "c6518d32a13045a2", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-e64b566a9f42b3f4", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 planalign_studio/components/ScenarioCostComparison.tsx:757"}, "properties": {"repobilityId": "e3cb5c00295279b3", "scanner": "scanner-primary", "fingerprint": "e64b566a9f42b3f4", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-8a43e91ac98a2b25", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 planalign_studio/components/ScenariosPage.tsx:403"}, "properties": {"repobilityId": "c604c85687f7683b", "scanner": "scanner-primary", "fingerprint": "8a43e91ac98a2b25", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-eff35d97f42dcd9d", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 planalign_studio/components/imports/FileUploadStep.tsx:190"}, "properties": {"repobilityId": "eaad5a5dd7574466", "scanner": "scanner-primary", "fingerprint": "eff35d97f42dcd9d", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-160c3596864f8001", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 planalign_studio/components/imports/PreviewStep.tsx:151"}, "properties": {"repobilityId": "9d74c43aec9ad94d", "scanner": "scanner-primary", "fingerprint": "160c3596864f8001", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-26139e69ccc4c97d", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 planalign_studio/components/imports/ImportedFilesList.tsx:113"}, "properties": {"repobilityId": "edfccd58625dec4e", "scanner": "scanner-primary", "fingerprint": "26139e69ccc4c97d", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-7c9d858e9fc38699", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 planalign_studio/components/config/ConfigContext.tsx:611"}, "properties": {"repobilityId": "0ee8c679ea5168b5", "scanner": "scanner-primary", "fingerprint": "7c9d858e9fc38699", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-8827a1e27f8c729f", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 planalign_studio/services/websocket.ts:275"}, "properties": {"repobilityId": "077df797a215b9b8", "scanner": "scanner-primary", "fingerprint": "8827a1e27f8c729f", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-cb3f191c20c2b139", "level": "warning", "message": {"text": "Privileged port 10 in use"}, "properties": {"repobilityId": "735372d6b5594915", "scanner": "scanner-primary", "fingerprint": "cb3f191c20c2b139", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "specs/003-studio-band-config/contracts/bands-api.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3c3cdc6b244b1b51", "level": "warning", "message": {"text": "Privileged port 26 in use"}, "properties": {"repobilityId": "9c5e4d9c5edd9bd2", "scanner": "scanner-primary", "fingerprint": "3c3cdc6b244b1b51", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "specs/003-studio-band-config/contracts/bands-api.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a37be981950a70ab", "level": "warning", "message": {"text": "Privileged port 31 in use"}, "properties": {"repobilityId": "8a1049d03b927a2d", "scanner": "scanner-primary", "fingerprint": "a37be981950a70ab", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "specs/003-studio-band-config/contracts/bands-api.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d1d647bcfe3e1b04", "level": "warning", "message": {"text": "Privileged port 50 in use"}, "properties": {"repobilityId": "da61f654c07ea7a9", "scanner": "scanner-primary", "fingerprint": "d1d647bcfe3e1b04", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "specs/003-studio-band-config/contracts/bands-api.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-04263a222fc262d3", "level": "warning", "message": {"text": "Privileged port 38 in use"}, "properties": {"repobilityId": "b7214bb254c5881d", "scanner": "scanner-primary", "fingerprint": "04263a222fc262d3", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "specs/003-studio-band-config/contracts/bands-api.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d6ca9fb12cacd678", "level": "warning", "message": {"text": "Privileged port 75 in use"}, "properties": {"repobilityId": "d378eb1c9eebd8b0", "scanner": "scanner-primary", "fingerprint": "d6ca9fb12cacd678", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "specs/003-studio-band-config/contracts/bands-api.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-04a6afeaed413dc5", "level": "warning", "message": {"text": "Privileged port 47 in use"}, "properties": {"repobilityId": "986e85543d70890d", "scanner": "scanner-primary", "fingerprint": "04a6afeaed413dc5", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "specs/003-studio-band-config/contracts/bands-api.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-5b73ddff933558ff", "level": "warning", "message": {"text": "Privileged port 90 in use"}, "properties": {"repobilityId": "3c0b21a827c3d75d", "scanner": "scanner-primary", "fingerprint": "5b73ddff933558ff", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "specs/003-studio-band-config/contracts/bands-api.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f90548c448e15361", "level": "warning", "message": {"text": "Privileged port 55 in use"}, "properties": {"repobilityId": "51a768b3e1831ac0", "scanner": "scanner-primary", "fingerprint": "f90548c448e15361", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "specs/003-studio-band-config/contracts/bands-api.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ff51c91ee7d5879e", "level": "warning", "message": {"text": "Privileged port 30 in use"}, "properties": {"repobilityId": "54f172e7d16fc662", "scanner": "scanner-primary", "fingerprint": "ff51c91ee7d5879e", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "config/simulation_config.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f7b34a4e4555d5ce", "level": "warning", "message": {"text": "Privileged port 45 in use"}, "properties": {"repobilityId": "73cf64d92574d41c", "scanner": "scanner-primary", "fingerprint": "f7b34a4e4555d5ce", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "config/simulation_config.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-4525c9e9b05c6af7", "level": "warning", "message": {"text": "Privileged port 70 in use"}, "properties": {"repobilityId": "353d31c086b0a24a", "scanner": "scanner-primary", "fingerprint": "4525c9e9b05c6af7", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "config/simulation_config.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-4a210ac3b4b59ff4", "level": "warning", "message": {"text": "Dockerfile runs as root: .devcontainer/Dockerfile"}, "properties": {"repobilityId": "7855b1f55d0800cf", "scanner": "scanner-primary", "fingerprint": "4a210ac3b4b59ff4", "layer": "hardware", "severity": "medium", "confidence": 1.0, "tags": ["security", "container"]}}, {"ruleId": "scanner-d53891680285d5cd", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: node:20"}, "properties": {"repobilityId": "9644c8a61443bc00", "scanner": "scanner-primary", "fingerprint": "d53891680285d5cd", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".devcontainer/Dockerfile"}, "region": {"startLine": 3}}}]}, {"ruleId": "scanner-42222223b4a3450e", "level": "error", "message": {"text": "Dockerfile pipes a remote installer into a shell"}, "properties": {"repobilityId": "75e579f8bf1e8136", "scanner": "scanner-primary", "fingerprint": "42222223b4a3450e", "layer": "hardware", "severity": "high", "confidence": 1.0, "tags": ["supply-chain", "docker", "remote-installer"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".devcontainer/Dockerfile"}, "region": {"startLine": 64}}}]}, {"ruleId": "scanner-42222223b4a3450e", "level": "error", "message": {"text": "Dockerfile pipes a remote installer into a shell"}, "properties": {"repobilityId": "b4bbc6e204a1baff", "scanner": "scanner-primary", "fingerprint": "42222223b4a3450e", "layer": "hardware", "severity": "high", "confidence": 1.0, "tags": ["supply-chain", "docker", "remote-installer"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".devcontainer/Dockerfile"}, "region": {"startLine": 83}}}]}, {"ruleId": "scanner-42222223b4a3450e", "level": "error", "message": {"text": "Dockerfile pipes a remote installer into a shell"}, "properties": {"repobilityId": "c0ece37b5179f85f", "scanner": "scanner-primary", "fingerprint": "42222223b4a3450e", "layer": "hardware", "severity": "high", "confidence": 1.0, "tags": ["supply-chain", "docker", "remote-installer"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".devcontainer/Dockerfile"}, "region": {"startLine": 92}}}]}, {"ruleId": "scanner-12dc62dd121a9f8f", "level": "error", "message": {"text": "Insecure pattern 'subprocess_shell_true' in scripts/setup_staging.py:23"}, "properties": {"repobilityId": "fbed937ec4d7788d", "scanner": "scanner-primary", "fingerprint": "12dc62dd121a9f8f", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "subprocess_shell_true"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/setup_staging.py"}, "region": {"startLine": 23}}}]}, {"ruleId": "scanner-c7c0f95ad0ac92a6", "level": "error", "message": {"text": "Insecure pattern 'eval_used' in planalign_api/services/mapping_engine.py:36"}, "properties": {"repobilityId": "b7e455c22a370232", "scanner": "scanner-primary", "fingerprint": "c7c0f95ad0ac92a6", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "eval_used"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "planalign_api/services/mapping_engine.py"}, "region": {"startLine": 36}}}]}, {"ruleId": "scanner-ce40f4bd8474cfae", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "194eccef75403674", "scanner": "scanner-primary", "fingerprint": "ce40f4bd8474cfae", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/erisa-compliance-validation.yml"}, "region": {"startLine": 36}}}]}, {"ruleId": "scanner-ce40f4bd8474cfae", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "40a452b43d478194", "scanner": "scanner-primary", "fingerprint": "ce40f4bd8474cfae", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/erisa-compliance-validation.yml"}, "region": {"startLine": 39}}}]}, {"ruleId": "scanner-ce40f4bd8474cfae", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "1bfa2ae90fe24839", "scanner": "scanner-primary", "fingerprint": "ce40f4bd8474cfae", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/erisa-compliance-validation.yml"}, "region": {"startLine": 82}}}]}, {"ruleId": "scanner-ce40f4bd8474cfae", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "1bfa2ae90fe24839", "scanner": "scanner-primary", "fingerprint": "ce40f4bd8474cfae", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/erisa-compliance-validation.yml"}, "region": {"startLine": 135}}}]}, {"ruleId": "scanner-ce40f4bd8474cfae", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "194eccef75403674", "scanner": "scanner-primary", "fingerprint": "ce40f4bd8474cfae", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/erisa-compliance-validation.yml"}, "region": {"startLine": 162}}}]}, {"ruleId": "scanner-ce40f4bd8474cfae", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "40a452b43d478194", "scanner": "scanner-primary", "fingerprint": "ce40f4bd8474cfae", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/erisa-compliance-validation.yml"}, "region": {"startLine": 165}}}]}, {"ruleId": "scanner-ce40f4bd8474cfae", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "1bfa2ae90fe24839", "scanner": "scanner-primary", "fingerprint": "ce40f4bd8474cfae", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/erisa-compliance-validation.yml"}, "region": {"startLine": 209}}}]}, {"ruleId": "scanner-a490b82e56b66367", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "5792b168dd0c7feb", "scanner": "scanner-primary", "fingerprint": "a490b82e56b66367", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/performance-benchmark.yml"}, "region": {"startLine": 73}}}]}, {"ruleId": "scanner-a490b82e56b66367", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "8c8fb48c8bbf4d92", "scanner": "scanner-primary", "fingerprint": "a490b82e56b66367", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/performance-benchmark.yml"}, "region": {"startLine": 78}}}]}, {"ruleId": "scanner-a490b82e56b66367", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "16fc8a3f344fe0df", "scanner": "scanner-primary", "fingerprint": "a490b82e56b66367", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/performance-benchmark.yml"}, "region": {"startLine": 86}}}]}, {"ruleId": "scanner-a490b82e56b66367", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "16fc8a3f344fe0df", "scanner": "scanner-primary", "fingerprint": "a490b82e56b66367", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/performance-benchmark.yml"}, "region": {"startLine": 105}}}]}, {"ruleId": "scanner-a490b82e56b66367", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "e7a997baa2d47e75", "scanner": "scanner-primary", "fingerprint": "a490b82e56b66367", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/performance-benchmark.yml"}, "region": {"startLine": 232}}}]}, {"ruleId": "scanner-a490b82e56b66367", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "459f58bf7e896adc", "scanner": "scanner-primary", "fingerprint": "a490b82e56b66367", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/performance-benchmark.yml"}, "region": {"startLine": 243}}}]}, {"ruleId": "scanner-a490b82e56b66367", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "459f58bf7e896adc", "scanner": "scanner-primary", "fingerprint": "a490b82e56b66367", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/performance-benchmark.yml"}, "region": {"startLine": 296}}}]}, {"ruleId": "scanner-a490b82e56b66367", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "5792b168dd0c7feb", "scanner": "scanner-primary", "fingerprint": "a490b82e56b66367", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/performance-benchmark.yml"}, "region": {"startLine": 360}}}]}, {"ruleId": "scanner-a490b82e56b66367", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "8c8fb48c8bbf4d92", "scanner": "scanner-primary", "fingerprint": "a490b82e56b66367", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/performance-benchmark.yml"}, "region": {"startLine": 363}}}]}, {"ruleId": "scanner-a490b82e56b66367", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "e7a997baa2d47e75", "scanner": "scanner-primary", "fingerprint": "a490b82e56b66367", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/performance-benchmark.yml"}, "region": {"startLine": 384}}}]}, {"ruleId": "scanner-e194e2e4f57d2a25", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "f86c3bc3e9dd2c9c", "scanner": "scanner-primary", "fingerprint": "e194e2e4f57d2a25", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/e068h-validation.yml"}, "region": {"startLine": 48}}}]}, {"ruleId": "scanner-e194e2e4f57d2a25", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "43dc55df5f3f9e95", "scanner": "scanner-primary", "fingerprint": "e194e2e4f57d2a25", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/e068h-validation.yml"}, "region": {"startLine": 53}}}]}, {"ruleId": "scanner-e194e2e4f57d2a25", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "031b9b37ad9a4b05", "scanner": "scanner-primary", "fingerprint": "e194e2e4f57d2a25", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/e068h-validation.yml"}, "region": {"startLine": 113}}}]}, {"ruleId": "scanner-e194e2e4f57d2a25", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "f86c3bc3e9dd2c9c", "scanner": "scanner-primary", "fingerprint": "e194e2e4f57d2a25", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/e068h-validation.yml"}, "region": {"startLine": 131}}}]}, {"ruleId": "scanner-e194e2e4f57d2a25", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "43dc55df5f3f9e95", "scanner": "scanner-primary", "fingerprint": "e194e2e4f57d2a25", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/e068h-validation.yml"}, "region": {"startLine": 136}}}]}, {"ruleId": "scanner-e194e2e4f57d2a25", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "031b9b37ad9a4b05", "scanner": "scanner-primary", "fingerprint": "e194e2e4f57d2a25", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/e068h-validation.yml"}, "region": {"startLine": 149}}}]}, {"ruleId": "scanner-e194e2e4f57d2a25", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "ddddce50da0659b4", "scanner": "scanner-primary", "fingerprint": "e194e2e4f57d2a25", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/e068h-validation.yml"}, "region": {"startLine": 168}}}]}, {"ruleId": "scanner-e194e2e4f57d2a25", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "f86c3bc3e9dd2c9c", "scanner": "scanner-primary", "fingerprint": "e194e2e4f57d2a25", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/e068h-validation.yml"}, "region": {"startLine": 193}}}]}, {"ruleId": "scanner-e194e2e4f57d2a25", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "43dc55df5f3f9e95", "scanner": "scanner-primary", "fingerprint": "e194e2e4f57d2a25", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/e068h-validation.yml"}, "region": {"startLine": 196}}}]}, {"ruleId": "scanner-e194e2e4f57d2a25", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "031b9b37ad9a4b05", "scanner": "scanner-primary", "fingerprint": "e194e2e4f57d2a25", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/e068h-validation.yml"}, "region": {"startLine": 209}}}]}, {"ruleId": "scanner-e194e2e4f57d2a25", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "ddddce50da0659b4", "scanner": "scanner-primary", "fingerprint": "e194e2e4f57d2a25", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/e068h-validation.yml"}, "region": {"startLine": 262}}}]}, {"ruleId": "scanner-e194e2e4f57d2a25", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "f86c3bc3e9dd2c9c", "scanner": "scanner-primary", "fingerprint": "e194e2e4f57d2a25", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/e068h-validation.yml"}, "region": {"startLine": 332}}}]}, {"ruleId": "scanner-e194e2e4f57d2a25", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "43dc55df5f3f9e95", "scanner": "scanner-primary", "fingerprint": "e194e2e4f57d2a25", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/e068h-validation.yml"}, "region": {"startLine": 335}}}]}, {"ruleId": "scanner-e194e2e4f57d2a25", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "031b9b37ad9a4b05", "scanner": "scanner-primary", "fingerprint": "e194e2e4f57d2a25", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/e068h-validation.yml"}, "region": {"startLine": 348}}}]}, {"ruleId": "scanner-e194e2e4f57d2a25", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "ddddce50da0659b4", "scanner": "scanner-primary", "fingerprint": "e194e2e4f57d2a25", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/e068h-validation.yml"}, "region": {"startLine": 386}}}]}, {"ruleId": "scanner-e194e2e4f57d2a25", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "f86c3bc3e9dd2c9c", "scanner": "scanner-primary", "fingerprint": "e194e2e4f57d2a25", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/e068h-validation.yml"}, "region": {"startLine": 449}}}]}, {"ruleId": "scanner-e194e2e4f57d2a25", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "43dc55df5f3f9e95", "scanner": "scanner-primary", "fingerprint": "e194e2e4f57d2a25", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/e068h-validation.yml"}, "region": {"startLine": 452}}}]}, {"ruleId": "scanner-e194e2e4f57d2a25", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "72ee05100e70a938", "scanner": "scanner-primary", "fingerprint": "e194e2e4f57d2a25", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/e068h-validation.yml"}, "region": {"startLine": 465}}}]}, {"ruleId": "scanner-e194e2e4f57d2a25", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "ddddce50da0659b4", "scanner": "scanner-primary", "fingerprint": "e194e2e4f57d2a25", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/e068h-validation.yml"}, "region": {"startLine": 529}}}]}, {"ruleId": "scanner-e194e2e4f57d2a25", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "e901e2f73e897bdf", "scanner": "scanner-primary", "fingerprint": "e194e2e4f57d2a25", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/e068h-validation.yml"}, "region": {"startLine": 537}}}]}, {"ruleId": "scanner-1a50467f36b413ec", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "36cd59f0085096eb", "scanner": "scanner-primary", "fingerprint": "1a50467f36b413ec", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/tests.yml"}, "region": {"startLine": 19}}}]}, {"ruleId": "scanner-1a50467f36b413ec", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "d0e38602e9760add", "scanner": "scanner-primary", "fingerprint": "1a50467f36b413ec", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/tests.yml"}, "region": {"startLine": 22}}}]}, {"ruleId": "scanner-1a50467f36b413ec", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "f1cc69f7504aa95d", "scanner": "scanner-primary", "fingerprint": "1a50467f36b413ec", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/tests.yml"}, "region": {"startLine": 30}}}]}, {"ruleId": "scanner-1a50467f36b413ec", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "818fe09647a7c97d", "scanner": "scanner-primary", "fingerprint": "1a50467f36b413ec", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/tests.yml"}, "region": {"startLine": 56}}}]}, {"ruleId": "scanner-1a50467f36b413ec", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "d2d7809ef39c9916", "scanner": "scanner-primary", "fingerprint": "1a50467f36b413ec", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/tests.yml"}, "region": {"startLine": 62}}}]}, {"ruleId": "scanner-1eae71a130808faa", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "02743810807b913a", "scanner": "scanner-primary", "fingerprint": "1eae71a130808faa", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/performance-validation.yml"}, "region": {"startLine": 27}}}]}, {"ruleId": "scanner-1eae71a130808faa", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "e0c154744541c425", "scanner": "scanner-primary", "fingerprint": "1eae71a130808faa", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/performance-validation.yml"}, "region": {"startLine": 30}}}]}, {"ruleId": "scanner-1eae71a130808faa", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "210d9ff1dc1e448a", "scanner": "scanner-primary", "fingerprint": "1eae71a130808faa", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/performance-validation.yml"}, "region": {"startLine": 35}}}]}, {"ruleId": "scanner-1eae71a130808faa", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "97bdc82324bf86d4", "scanner": "scanner-primary", "fingerprint": "1eae71a130808faa", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/performance-validation.yml"}, "region": {"startLine": 109}}}]}, {"ruleId": "scanner-1eae71a130808faa", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "02743810807b913a", "scanner": "scanner-primary", "fingerprint": "1eae71a130808faa", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/performance-validation.yml"}, "region": {"startLine": 123}}}]}, {"ruleId": "scanner-1eae71a130808faa", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "e0c154744541c425", "scanner": "scanner-primary", "fingerprint": "1eae71a130808faa", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/performance-validation.yml"}, "region": {"startLine": 126}}}]}, {"ruleId": "scanner-1eae71a130808faa", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "97bdc82324bf86d4", "scanner": "scanner-primary", "fingerprint": "1eae71a130808faa", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/performance-validation.yml"}, "region": {"startLine": 157}}}]}, {"ruleId": "scanner-1eae71a130808faa", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "02743810807b913a", "scanner": "scanner-primary", "fingerprint": "1eae71a130808faa", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/performance-validation.yml"}, "region": {"startLine": 171}}}]}, {"ruleId": "scanner-1eae71a130808faa", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "e0c154744541c425", "scanner": "scanner-primary", "fingerprint": "1eae71a130808faa", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/performance-validation.yml"}, "region": {"startLine": 174}}}]}, {"ruleId": "scanner-1eae71a130808faa", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "97bdc82324bf86d4", "scanner": "scanner-primary", "fingerprint": "1eae71a130808faa", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/performance-validation.yml"}, "region": {"startLine": 205}}}]}, {"ruleId": "scanner-1eae71a130808faa", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "02743810807b913a", "scanner": "scanner-primary", "fingerprint": "1eae71a130808faa", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/performance-validation.yml"}, "region": {"startLine": 219}}}]}, {"ruleId": "scanner-1eae71a130808faa", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "e0c154744541c425", "scanner": "scanner-primary", "fingerprint": "1eae71a130808faa", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/performance-validation.yml"}, "region": {"startLine": 222}}}]}, {"ruleId": "scanner-1eae71a130808faa", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "0dcd9ad077fc57a8", "scanner": "scanner-primary", "fingerprint": "1eae71a130808faa", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/performance-validation.yml"}, "region": {"startLine": 287}}}]}, {"ruleId": "scanner-1eae71a130808faa", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "97bdc82324bf86d4", "scanner": "scanner-primary", "fingerprint": "1eae71a130808faa", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/performance-validation.yml"}, "region": {"startLine": 369}}}]}, {"ruleId": "scanner-5abe7b30781e9553", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "37397e224caf9e4d", "scanner": "scanner-primary", "fingerprint": "5abe7b30781e9553", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/validation-framework.yml"}, "region": {"startLine": 40}}}]}, {"ruleId": "scanner-5abe7b30781e9553", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "f4787942b80f98ed", "scanner": "scanner-primary", "fingerprint": "5abe7b30781e9553", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/validation-framework.yml"}, "region": {"startLine": 43}}}]}, {"ruleId": "scanner-5abe7b30781e9553", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "fcea5a06d8dc543f", "scanner": "scanner-primary", "fingerprint": "5abe7b30781e9553", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/validation-framework.yml"}, "region": {"startLine": 173}}}]}, {"ruleId": "scanner-5abe7b30781e9553", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "37397e224caf9e4d", "scanner": "scanner-primary", "fingerprint": "5abe7b30781e9553", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/validation-framework.yml"}, "region": {"startLine": 189}}}]}, {"ruleId": "scanner-5abe7b30781e9553", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "f4787942b80f98ed", "scanner": "scanner-primary", "fingerprint": "5abe7b30781e9553", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/validation-framework.yml"}, "region": {"startLine": 192}}}]}, {"ruleId": "scanner-5abe7b30781e9553", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "50e1f0f95736b374", "scanner": "scanner-primary", "fingerprint": "5abe7b30781e9553", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/validation-framework.yml"}, "region": {"startLine": 206}}}]}, {"ruleId": "scanner-5abe7b30781e9553", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "fcea5a06d8dc543f", "scanner": "scanner-primary", "fingerprint": "5abe7b30781e9553", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/validation-framework.yml"}, "region": {"startLine": 331}}}]}, {"ruleId": "scanner-5abe7b30781e9553", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "37397e224caf9e4d", "scanner": "scanner-primary", "fingerprint": "5abe7b30781e9553", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/validation-framework.yml"}, "region": {"startLine": 346}}}]}, {"ruleId": "scanner-5abe7b30781e9553", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "f4787942b80f98ed", "scanner": "scanner-primary", "fingerprint": "5abe7b30781e9553", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/validation-framework.yml"}, "region": {"startLine": 349}}}]}, {"ruleId": "scanner-5abe7b30781e9553", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "50e1f0f95736b374", "scanner": "scanner-primary", "fingerprint": "5abe7b30781e9553", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/validation-framework.yml"}, "region": {"startLine": 362}}}]}, {"ruleId": "scanner-5abe7b30781e9553", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "fcea5a06d8dc543f", "scanner": "scanner-primary", "fingerprint": "5abe7b30781e9553", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/validation-framework.yml"}, "region": {"startLine": 443}}}]}, {"ruleId": "scanner-5abe7b30781e9553", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "37397e224caf9e4d", "scanner": "scanner-primary", "fingerprint": "5abe7b30781e9553", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/validation-framework.yml"}, "region": {"startLine": 454}}}]}, {"ruleId": "scanner-5abe7b30781e9553", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "f4787942b80f98ed", "scanner": "scanner-primary", "fingerprint": "5abe7b30781e9553", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/validation-framework.yml"}, "region": {"startLine": 457}}}]}, {"ruleId": "scanner-5abe7b30781e9553", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "50e1f0f95736b374", "scanner": "scanner-primary", "fingerprint": "5abe7b30781e9553", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/validation-framework.yml"}, "region": {"startLine": 470}}}]}, {"ruleId": "scanner-5abe7b30781e9553", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "fcea5a06d8dc543f", "scanner": "scanner-primary", "fingerprint": "5abe7b30781e9553", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/validation-framework.yml"}, "region": {"startLine": 584}}}]}, {"ruleId": "scanner-5abe7b30781e9553", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "37397e224caf9e4d", "scanner": "scanner-primary", "fingerprint": "5abe7b30781e9553", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/validation-framework.yml"}, "region": {"startLine": 595}}}]}, {"ruleId": "scanner-5abe7b30781e9553", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "f4787942b80f98ed", "scanner": "scanner-primary", "fingerprint": "5abe7b30781e9553", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/validation-framework.yml"}, "region": {"startLine": 598}}}]}, {"ruleId": "scanner-5abe7b30781e9553", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "50e1f0f95736b374", "scanner": "scanner-primary", "fingerprint": "5abe7b30781e9553", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/validation-framework.yml"}, "region": {"startLine": 611}}}]}, {"ruleId": "scanner-5abe7b30781e9553", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "fcea5a06d8dc543f", "scanner": "scanner-primary", "fingerprint": "5abe7b30781e9553", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/validation-framework.yml"}, "region": {"startLine": 705}}}]}, {"ruleId": "scanner-5abe7b30781e9553", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "37397e224caf9e4d", "scanner": "scanner-primary", "fingerprint": "5abe7b30781e9553", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/validation-framework.yml"}, "region": {"startLine": 717}}}]}, {"ruleId": "scanner-35e65967ac918aeb", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "1f9071547a6a7fce", "scanner": "scanner-primary", "fingerprint": "35e65967ac918aeb", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/production-validation.yml"}, "region": {"startLine": 24}}}]}, {"ruleId": "scanner-35e65967ac918aeb", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "7f678b350739c098", "scanner": "scanner-primary", "fingerprint": "35e65967ac918aeb", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/production-validation.yml"}, "region": {"startLine": 27}}}]}, {"ruleId": "scanner-35e65967ac918aeb", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "220b6eaa60873009", "scanner": "scanner-primary", "fingerprint": "35e65967ac918aeb", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/production-validation.yml"}, "region": {"startLine": 35}}}]}, {"ruleId": "scanner-35e65967ac918aeb", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "0d3eafbbfc96259e", "scanner": "scanner-primary", "fingerprint": "35e65967ac918aeb", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/production-validation.yml"}, "region": {"startLine": 103}}}]}, {"ruleId": "scanner-35e65967ac918aeb", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "1f9071547a6a7fce", "scanner": "scanner-primary", "fingerprint": "35e65967ac918aeb", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/production-validation.yml"}, "region": {"startLine": 119}}}]}, {"ruleId": "scanner-35e65967ac918aeb", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "7f678b350739c098", "scanner": "scanner-primary", "fingerprint": "35e65967ac918aeb", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/production-validation.yml"}, "region": {"startLine": 122}}}]}, {"ruleId": "scanner-35e65967ac918aeb", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "0d3eafbbfc96259e", "scanner": "scanner-primary", "fingerprint": "35e65967ac918aeb", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/production-validation.yml"}, "region": {"startLine": 191}}}]}, {"ruleId": "scanner-35e65967ac918aeb", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "1f9071547a6a7fce", "scanner": "scanner-primary", "fingerprint": "35e65967ac918aeb", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/production-validation.yml"}, "region": {"startLine": 207}}}]}, {"ruleId": "scanner-35e65967ac918aeb", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "7f678b350739c098", "scanner": "scanner-primary", "fingerprint": "35e65967ac918aeb", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/production-validation.yml"}, "region": {"startLine": 210}}}]}, {"ruleId": "scanner-35e65967ac918aeb", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "0d3eafbbfc96259e", "scanner": "scanner-primary", "fingerprint": "35e65967ac918aeb", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/production-validation.yml"}, "region": {"startLine": 229}}}]}, {"ruleId": "scanner-35e65967ac918aeb", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "58bc3e11f1693932", "scanner": "scanner-primary", "fingerprint": "35e65967ac918aeb", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/production-validation.yml"}, "region": {"startLine": 238}}}]}, {"ruleId": "scanner-35e65967ac918aeb", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "1f9071547a6a7fce", "scanner": "scanner-primary", "fingerprint": "35e65967ac918aeb", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/production-validation.yml"}, "region": {"startLine": 279}}}]}, {"ruleId": "scanner-35e65967ac918aeb", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "7f678b350739c098", "scanner": "scanner-primary", "fingerprint": "35e65967ac918aeb", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/production-validation.yml"}, "region": {"startLine": 282}}}]}, {"ruleId": "scanner-35e65967ac918aeb", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "0d3eafbbfc96259e", "scanner": "scanner-primary", "fingerprint": "35e65967ac918aeb", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/production-validation.yml"}, "region": {"startLine": 305}}}]}, {"ruleId": "scanner-de53ac274e5b4ecf", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "02600186fc092bd4", "scanner": "scanner-primary", "fingerprint": "de53ac274e5b4ecf", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/claude.yml"}, "region": {"startLine": 28}}}]}, {"ruleId": "scanner-de53ac274e5b4ecf", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "1767eb8fd5b0b814", "scanner": "scanner-primary", "fingerprint": "de53ac274e5b4ecf", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/claude.yml"}, "region": {"startLine": 33}}}]}, {"ruleId": "scanner-37716d9c0a33ad5c", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "abfb5752158cf655", "scanner": "scanner-primary", "fingerprint": "37716d9c0a33ad5c", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/claude.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-27924aa79fa4a517", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "c21050f25dc92953", "scanner": "scanner-primary", "fingerprint": "27924aa79fa4a517", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 21}}}]}, {"ruleId": "scanner-27924aa79fa4a517", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "5b2c585f16cb03ef", "scanner": "scanner-primary", "fingerprint": "27924aa79fa4a517", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 29}}}]}, {"ruleId": "scanner-27924aa79fa4a517", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "c21050f25dc92953", "scanner": "scanner-primary", "fingerprint": "27924aa79fa4a517", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 53}}}]}, {"ruleId": "scanner-27924aa79fa4a517", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "5b2c585f16cb03ef", "scanner": "scanner-primary", "fingerprint": "27924aa79fa4a517", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 61}}}]}, {"ruleId": "scanner-27924aa79fa4a517", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "0f6f2de4561c226b", "scanner": "scanner-primary", "fingerprint": "27924aa79fa4a517", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 85}}}]}, {"ruleId": "scanner-7f1e4527e6fecffa", "level": "error", "message": {"text": "GitHub Action tracks a moving branch"}, "properties": {"repobilityId": "e790d4d334398ef3", "scanner": "scanner-primary", "fingerprint": "7f1e4527e6fecffa", "layer": "cicd", "severity": "high", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 101}}}]}, {"ruleId": "scanner-27924aa79fa4a517", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "98ccee374d81e8ac", "scanner": "scanner-primary", "fingerprint": "27924aa79fa4a517", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 108}}}]}, {"ruleId": "scanner-27924aa79fa4a517", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "c21050f25dc92953", "scanner": "scanner-primary", "fingerprint": "27924aa79fa4a517", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 119}}}]}, {"ruleId": "scanner-c3bb05b88a06705e", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "425e5ed8bd2bf2c1", "scanner": "scanner-primary", "fingerprint": "c3bb05b88a06705e", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/snapshot-architecture-validation.yml"}, "region": {"startLine": 53}}}]}, {"ruleId": "scanner-c3bb05b88a06705e", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "2c3584ee1384ba8c", "scanner": "scanner-primary", "fingerprint": "c3bb05b88a06705e", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/snapshot-architecture-validation.yml"}, "region": {"startLine": 56}}}]}, {"ruleId": "scanner-c3bb05b88a06705e", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "8bc78cdda8886227", "scanner": "scanner-primary", "fingerprint": "c3bb05b88a06705e", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/snapshot-architecture-validation.yml"}, "region": {"startLine": 363}}}]}, {"ruleId": "scanner-c3bb05b88a06705e", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "425e5ed8bd2bf2c1", "scanner": "scanner-primary", "fingerprint": "c3bb05b88a06705e", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/snapshot-architecture-validation.yml"}, "region": {"startLine": 379}}}]}, {"ruleId": "scanner-c3bb05b88a06705e", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "2c3584ee1384ba8c", "scanner": "scanner-primary", "fingerprint": "c3bb05b88a06705e", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/snapshot-architecture-validation.yml"}, "region": {"startLine": 382}}}]}, {"ruleId": "scanner-c3bb05b88a06705e", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "5428b324ba7eb882", "scanner": "scanner-primary", "fingerprint": "c3bb05b88a06705e", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/snapshot-architecture-validation.yml"}, "region": {"startLine": 396}}}]}, {"ruleId": "scanner-c3bb05b88a06705e", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "8bc78cdda8886227", "scanner": "scanner-primary", "fingerprint": "c3bb05b88a06705e", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/snapshot-architecture-validation.yml"}, "region": {"startLine": 518}}}]}, {"ruleId": "scanner-c3bb05b88a06705e", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "425e5ed8bd2bf2c1", "scanner": "scanner-primary", "fingerprint": "c3bb05b88a06705e", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/snapshot-architecture-validation.yml"}, "region": {"startLine": 533}}}]}, {"ruleId": "scanner-c3bb05b88a06705e", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "2c3584ee1384ba8c", "scanner": "scanner-primary", "fingerprint": "c3bb05b88a06705e", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/snapshot-architecture-validation.yml"}, "region": {"startLine": 536}}}]}, {"ruleId": "scanner-c3bb05b88a06705e", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "5428b324ba7eb882", "scanner": "scanner-primary", "fingerprint": "c3bb05b88a06705e", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/snapshot-architecture-validation.yml"}, "region": {"startLine": 550}}}]}, {"ruleId": "scanner-c3bb05b88a06705e", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "8bc78cdda8886227", "scanner": "scanner-primary", "fingerprint": "c3bb05b88a06705e", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/snapshot-architecture-validation.yml"}, "region": {"startLine": 695}}}]}, {"ruleId": "scanner-c3bb05b88a06705e", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "425e5ed8bd2bf2c1", "scanner": "scanner-primary", "fingerprint": "c3bb05b88a06705e", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/snapshot-architecture-validation.yml"}, "region": {"startLine": 707}}}]}, {"ruleId": "scanner-c3bb05b88a06705e", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "5428b324ba7eb882", "scanner": "scanner-primary", "fingerprint": "c3bb05b88a06705e", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/snapshot-architecture-validation.yml"}, "region": {"startLine": 710}}}]}, {"ruleId": "scanner-c3bb05b88a06705e", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "5428b324ba7eb882", "scanner": "scanner-primary", "fingerprint": "c3bb05b88a06705e", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/snapshot-architecture-validation.yml"}, "region": {"startLine": 716}}}]}, {"ruleId": "scanner-c3bb05b88a06705e", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "8bc78cdda8886227", "scanner": "scanner-primary", "fingerprint": "c3bb05b88a06705e", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/snapshot-architecture-validation.yml"}, "region": {"startLine": 873}}}]}, {"ruleId": "scanner-bba40a7ebc882450", "level": "error", "message": {"text": "pip extra-index-url can enable dependency confusion"}, "properties": {"repobilityId": "3b4bc6e637db27d6", "scanner": "scanner-primary", "fingerprint": "bba40a7ebc882450", "layer": "cicd", "severity": "high", "confidence": 1.0, "tags": ["supply-chain", "pypi", "dependency-confusion"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "requirements-dev.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-7086cc3d4eac2517", "level": "note", "message": {"text": "Very large file: tests/test_analytics_service.py (1208 lines)"}, "properties": {"repobilityId": "e74da94d9f68a9f1", "scanner": "scanner-primary", "fingerprint": "7086cc3d4eac2517", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-04df2fe87d1f9281", "level": "note", "message": {"text": "Very large file: planalign_api/services/file_service.py (1389 lines)"}, "properties": {"repobilityId": "7d88c532babdb3e2", "scanner": "scanner-primary", "fingerprint": "04df2fe87d1f9281", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-761756a5897cd4ac", "level": "note", "message": {"text": "Very large file: planalign_api/services/ndt_service.py (1379 lines)"}, "properties": {"repobilityId": "70783f938dc9f127", "scanner": "scanner-primary", "fingerprint": "761756a5897cd4ac", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-665df364a4d05cb4", "level": "note", "message": {"text": "Very large file: planalign_studio/components/NDTTesting.tsx (1687 lines)"}, "properties": {"repobilityId": "c1c473ada64b79bc", "scanner": "scanner-primary", "fingerprint": "665df364a4d05cb4", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-afad0a9acf55e43e", "level": "note", "message": {"text": "Very large file: planalign_studio/components/ScenarioCostComparison.tsx (1253 lines)"}, "properties": {"repobilityId": "14b3c805f6df78d4", "scanner": "scanner-primary", "fingerprint": "afad0a9acf55e43e", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-972b96ee35023cb6", "level": "note", "message": {"text": "Very large file: planalign_studio/components/config/DCPlanSection.tsx (1023 lines)"}, "properties": {"repobilityId": "c387e388628f20c8", "scanner": "scanner-primary", "fingerprint": "972b96ee35023cb6", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-925771e53f3fbdd1", "level": "note", "message": {"text": "Very large file: planalign_studio/services/api.ts (2083 lines)"}, "properties": {"repobilityId": "f68dfcd463156da7", "scanner": "scanner-primary", "fingerprint": "925771e53f3fbdd1", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-dce634bf41000119", "level": "note", "message": {"text": "Very large file: planalign_orchestrator/config/export.py (1157 lines)"}, "properties": {"repobilityId": "16233d85647a53a7", "scanner": "scanner-primary", "fingerprint": "dce634bf41000119", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-141b30a41e03817b", "level": "note", "message": {"text": "No license file detected"}, "properties": {"repobilityId": "5f0683e11e153e6f", "scanner": "scanner-primary", "fingerprint": "141b30a41e03817b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["license", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-da2b3920bb00be12", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: planalign_studio/package.json"}, "properties": {"repobilityId": "137b7cb4aa01d631", "scanner": "scanner-primary", "fingerprint": "da2b3920bb00be12", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "planalign_studio/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "b1c89d71fef1913f", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-72b2a6250083a784", "level": "warning", "message": {"text": "Placeholder or mock-heavy implementation detected"}, "properties": {"repobilityId": "1a1386a6fb154e89", "scanner": "scanner-primary", "fingerprint": "72b2a6250083a784", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "incomplete", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "d908a999088f6ab6", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-b9088664ace7f748", "level": "note", "message": {"text": "Composite production-readiness gap"}, "properties": {"repobilityId": "2453a7833f7e43e9", "scanner": "scanner-primary", "fingerprint": "b9088664ace7f748", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["production-readiness", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-749d4bc1bd66df5f", "level": "warning", "message": {"text": "Agent instructions exist but release-hardening basics are missing"}, "properties": {"repobilityId": "f9e199dd12038838", "scanner": "scanner-primary", "fingerprint": "749d4bc1bd66df5f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-e725d2ab884fbd49", "level": "note", "message": {"text": "Multiple root agent instruction files without precedence"}, "properties": {"repobilityId": "1953db6c89508d22", "scanner": "scanner-primary", "fingerprint": "e725d2ab884fbd49", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["agent-instructions", "governance"]}}, {"ruleId": "scanner-6788e19c356e07e7", "level": "note", "message": {"text": "Legacy-named symbol `DM_Old` in tests/unit/monitoring/test_duckdb_monitor.py:449"}, "properties": {"repobilityId": "ebcf5f64579b3057", "scanner": "scanner-primary", "fingerprint": "6788e19c356e07e7", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-0196d1fd44d99da9", "level": "note", "message": {"text": "Legacy-named symbol `PM_Old` in tests/unit/monitoring/test_base_monitor.py:213"}, "properties": {"repobilityId": "da05ddbb9efc2ed1", "scanner": "scanner-primary", "fingerprint": "0196d1fd44d99da9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-715d3216fd3aa55f", "level": "note", "message": {"text": "Legacy-named symbol `CM_Old` in tests/unit/resources/test_cpu_monitor.py:214"}, "properties": {"repobilityId": "f0b0fefe282214dd", "scanner": "scanner-primary", "fingerprint": "715d3216fd3aa55f", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-64fc045f899e0920", "level": "note", "message": {"text": "Legacy-named symbol `MM_Old` in tests/unit/resources/test_memory_monitor.py:202"}, "properties": {"repobilityId": "87be068ff5a12426", "scanner": "scanner-primary", "fingerprint": "64fc045f899e0920", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-c124c60fefa60b34", "level": "note", "message": {"text": "Legacy-named symbol `_run_stage_models_legacy` in tests/unit/orchestrator/test_year_executor.py:13"}, "properties": {"repobilityId": "aba26b4308208c3d", "scanner": "scanner-primary", "fingerprint": "c124c60fefa60b34", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-14791e5c3da34b1c", "level": "note", "message": {"text": "Legacy-named symbol `test_returns_copy` in tests/unit/orchestrator/test_excel_exporter.py:164"}, "properties": {"repobilityId": "72f26d05b83a674a", "scanner": "scanner-primary", "fingerprint": "14791e5c3da34b1c", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-2c79146a39a404b4", "level": "note", "message": {"text": "Legacy-named symbol `test_dc_plan_overrides_legacy` in tests/unit/orchestrator/test_config_export.py:1032"}, "properties": {"repobilityId": "b66035211e61750a", "scanner": "scanner-primary", "fingerprint": "2c79146a39a404b4", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-f48a91c27c56e816", "level": "note", "message": {"text": "Legacy-named symbol `test_create_basic_event_deprecated` in tests/unit/events/test_simulation_event.py:330"}, "properties": {"repobilityId": "cf0dbfa98e5efef2", "scanner": "scanner-primary", "fingerprint": "f48a91c27c56e816", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-50d8f423dd1382dd", "level": "none", "message": {"text": "Commented-code block (6 lines) in planalign_cli/commands/studio.py:272"}, "properties": {"repobilityId": "1471da6ece4d3aef", "scanner": "scanner-primary", "fingerprint": "50d8f423dd1382dd", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-4503d379a989eecb", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 planalign_cli/commands/studio.py:333"}, "properties": {"repobilityId": "bc3622a7c3102cf1", "scanner": "scanner-primary", "fingerprint": "4503d379a989eecb", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-ca83625a3499822a", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/smart_command_wrapper.py:274"}, "properties": {"repobilityId": "7b4ea87bbcaf808b", "scanner": "scanner-primary", "fingerprint": "ca83625a3499822a", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-a05acc11e7211c47", "level": "note", "message": {"text": "Legacy-named symbol `create_backup` in scripts/migrate_database_location.py:76"}, "properties": {"repobilityId": "00eebad0936a70f9", "scanner": "scanner-primary", "fingerprint": "a05acc11e7211c47", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-41a0c88b761c88a9", "level": "note", "message": {"text": "Legacy-named symbol `calibration_v1` in scripts/calibrate_compensation.py:194"}, "properties": {"repobilityId": "eea8618614fc9ff6", "scanner": "scanner-primary", "fingerprint": "41a0c88b761c88a9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-3ec3e2cb94c23325", "level": "note", "message": {"text": "Legacy-named symbol `model_copy` in scripts/scale_testing_framework.py:537"}, "properties": {"repobilityId": "3dcd1f21d8d02ac4", "scanner": "scanner-primary", "fingerprint": "3ec3e2cb94c23325", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-2f645783640da45a", "level": "none", "message": {"text": "Commented-code block (5 lines) in planalign_api/services/compensation_solver.py:371"}, "properties": {"repobilityId": "fac8b18be09bd7c3", "scanner": "scanner-primary", "fingerprint": "2f645783640da45a", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-edf3404cb70522ff", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 planalign_api/services/simulation/subprocess_utils.py:44"}, "properties": {"repobilityId": "3d243b7287e05a65", "scanner": "scanner-primary", "fingerprint": "edf3404cb70522ff", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-4ef95cac4665d8f5", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 planalign_studio/services/api.ts:305"}, "properties": {"repobilityId": "23b723c9ef2b8604", "scanner": "scanner-primary", "fingerprint": "4ef95cac4665d8f5", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-78cd5b8bb01b0e30", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 planalign_studio/services/importService.ts:217"}, "properties": {"repobilityId": "f9e2cd8a8334a540", "scanner": "scanner-primary", "fingerprint": "78cd5b8bb01b0e30", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-2af62def0ad45c17", "level": "note", "message": {"text": "Legacy-named symbol `has_backup` in planalign_orchestrator/run_summary.py:225"}, "properties": {"repobilityId": "0b6d62d16b1dbe21", "scanner": "scanner-primary", "fingerprint": "2af62def0ad45c17", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-12af66204a6540f9", "level": "note", "message": {"text": "Legacy-named symbol `emergency_backup` in planalign_orchestrator/recovery_manager.py:70"}, "properties": {"repobilityId": "1140eee7ba3e0bf2", "scanner": "scanner-primary", "fingerprint": "12af66204a6540f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-fa22caff95076eaa", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 planalign_orchestrator/dbt_runner.py:385"}, "properties": {"repobilityId": "b230f70d9bf44f95", "scanner": "scanner-primary", "fingerprint": "fa22caff95076eaa", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-9607655075d63cb0", "level": "note", "message": {"text": "Legacy-named symbol `_execute_parallel_legacy` in planalign_orchestrator/parallel_execution_engine.py:489"}, "properties": {"repobilityId": "f7e6c3c709ddcdfc", "scanner": "scanner-primary", "fingerprint": "9607655075d63cb0", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-58a27da584ab1923", "level": "note", "message": {"text": "Legacy-named symbol `create_backup` in planalign_orchestrator/backup_manager.py:103"}, "properties": {"repobilityId": "57a40ee0feea690f", "scanner": "scanner-primary", "fingerprint": "58a27da584ab1923", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-336bced276ac80e4", "level": "note", "message": {"text": "Legacy-named symbol `_save_config_copy` in planalign_orchestrator/scenario_batch_runner.py:287"}, "properties": {"repobilityId": "1b155cc9f8246252", "scanner": "scanner-primary", "fingerprint": "336bced276ac80e4", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-efe8540eab9233d2", "level": "note", "message": {"text": "Legacy-named symbol `_run_stage_models_legacy` in planalign_orchestrator/pipeline/year_executor.py:362"}, "properties": {"repobilityId": "03e6f4a43a9412fa", "scanner": "scanner-primary", "fingerprint": "efe8540eab9233d2", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-daffaeebf006443e", "level": "note", "message": {"text": "Legacy-named symbol `employer_legacy` in planalign_orchestrator/config/export.py:464"}, "properties": {"repobilityId": "0fe11ef68edbf895", "scanner": "scanner-primary", "fingerprint": "daffaeebf006443e", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "74795d2cce5df012", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "91080260dc6b5035", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "735cba643259dbef", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-be46ea126aa5d8dc", "level": "note", "message": {"text": "Near-duplicate function bodies in 3 places"}, "properties": {"repobilityId": "03ebb3438c109608", "scanner": "scanner-primary", "fingerprint": "be46ea126aa5d8dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-be46ea126aa5d8dc", "level": "note", "message": {"text": "Near-duplicate function bodies in 3 places"}, "properties": {"repobilityId": "e6c2fd95818b027a", "scanner": "scanner-primary", "fingerprint": "be46ea126aa5d8dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "6f60d4d456742127", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "9f86dba452d8a16d", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "1f9e1c1ba8dc023b", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "21887cd5037f90d5", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-be46ea126aa5d8dc", "level": "note", "message": {"text": "Near-duplicate function bodies in 3 places"}, "properties": {"repobilityId": "b8f9a59a1f6807f5", "scanner": "scanner-primary", "fingerprint": "be46ea126aa5d8dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "b1b466ce135546a2", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-49c98f7cedd9c977", "level": "note", "message": {"text": "Near-duplicate function bodies in 4 places"}, "properties": {"repobilityId": "c640d27fefe3df43", "scanner": "scanner-primary", "fingerprint": "49c98f7cedd9c977", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "10d9f721f68c29dc", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "e0b8e4b44a40ad1f", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "7d45aa07aba2e607", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "5af1a85043e2b360", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "7e77521705e736fe", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "3075c02fa190e675", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "28a6a04e45b3cb39", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "523eda9b0e308c31", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-5380924c17e07839", "level": "warning", "message": {"text": "Frontend route `simulate` has no Link/navigate to it \u2014 planalign_studio/App.tsx"}, "properties": {"repobilityId": "8752978271b0dc0e", "scanner": "scanner-primary", "fingerprint": "5380924c17e07839", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "orphan-page", "wiring"]}}, {"ruleId": "scanner-4fed42dc5904fe16", "level": "warning", "message": {"text": "Frontend route `simulate/:scenarioId` has no Link/navigate to it \u2014 planalign_studio/App.tsx"}, "properties": {"repobilityId": "9ab244438045c537", "scanner": "scanner-primary", "fingerprint": "4fed42dc5904fe16", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "orphan-page", "wiring"]}}, {"ruleId": "scanner-776d46f39163b892", "level": "warning", "message": {"text": "Frontend route `scenarios` has no Link/navigate to it \u2014 planalign_studio/App.tsx"}, "properties": {"repobilityId": "5ea3332d30281ad4", "scanner": "scanner-primary", "fingerprint": "776d46f39163b892", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "orphan-page", "wiring"]}}, {"ruleId": "scanner-abf934e4d7541b25", "level": "warning", "message": {"text": "Frontend route `config` has no Link/navigate to it \u2014 planalign_studio/App.tsx"}, "properties": {"repobilityId": "17fd3f5bfbe655bc", "scanner": "scanner-primary", "fingerprint": "abf934e4d7541b25", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "orphan-page", "wiring"]}}, {"ruleId": "scanner-e941e2a57f8871b2", "level": "warning", "message": {"text": "Frontend route `config/:scenarioId` has no Link/navigate to it \u2014 planalign_studio/App.tsx"}, "properties": {"repobilityId": "c421affbab538030", "scanner": "scanner-primary", "fingerprint": "e941e2a57f8871b2", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "orphan-page", "wiring"]}}, {"ruleId": "scanner-a1668ca0ff82657f", "level": "warning", "message": {"text": "Frontend route `analytics` has no Link/navigate to it \u2014 planalign_studio/App.tsx"}, "properties": {"repobilityId": "1ce2707bf91da54d", "scanner": "scanner-primary", "fingerprint": "a1668ca0ff82657f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "orphan-page", "wiring"]}}, {"ruleId": "scanner-36cc5cf2fee33a11", "level": "warning", "message": {"text": "Frontend route `analytics/compare` has no Link/navigate to it \u2014 planalign_studio/App.tsx"}, "properties": {"repobilityId": "15c30b4898ca34f1", "scanner": "scanner-primary", "fingerprint": "36cc5cf2fee33a11", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "orphan-page", "wiring"]}}, {"ruleId": "scanner-47a39753fb293982", "level": "warning", "message": {"text": "Frontend route `analytics/dc-plan` has no Link/navigate to it \u2014 planalign_studio/App.tsx"}, "properties": {"repobilityId": "9d2c03dbff6a6f05", "scanner": "scanner-primary", "fingerprint": "47a39753fb293982", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "orphan-page", "wiring"]}}, {"ruleId": "scanner-430deadc8ee254da", "level": "warning", "message": {"text": "Frontend route `analytics/vesting` has no Link/navigate to it \u2014 planalign_studio/App.tsx"}, "properties": {"repobilityId": "bda7bb7138c72ee4", "scanner": "scanner-primary", "fingerprint": "430deadc8ee254da", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "orphan-page", "wiring"]}}, {"ruleId": "scanner-e84d53dbdfd3c804", "level": "warning", "message": {"text": "Frontend route `analytics/ndt` has no Link/navigate to it \u2014 planalign_studio/App.tsx"}, "properties": {"repobilityId": "d77abe39c793ab04", "scanner": "scanner-primary", "fingerprint": "e84d53dbdfd3c804", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "orphan-page", "wiring"]}}, {"ruleId": "scanner-faf6d10cd4475b36", "level": "warning", "message": {"text": "Frontend route `analytics/winners-losers` has no Link/navigate to it \u2014 planalign_studio/App.tsx"}, "properties": {"repobilityId": "f3ad8f00cabbd534", "scanner": "scanner-primary", "fingerprint": "faf6d10cd4475b36", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "orphan-page", "wiring"]}}, {"ruleId": "scanner-6f64a9869a89d6d4", "level": "warning", "message": {"text": "Frontend route `compare` has no Link/navigate to it \u2014 planalign_studio/App.tsx"}, "properties": {"repobilityId": "76b6284d99e0070e", "scanner": "scanner-primary", "fingerprint": "6f64a9869a89d6d4", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "orphan-page", "wiring"]}}, {"ruleId": "scanner-e67ce7ac0bff666f", "level": "warning", "message": {"text": "Frontend route `batch` has no Link/navigate to it \u2014 planalign_studio/App.tsx"}, "properties": {"repobilityId": "cd982083e1bc0736", "scanner": "scanner-primary", "fingerprint": "e67ce7ac0bff666f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "orphan-page", "wiring"]}}, {"ruleId": "scanner-620e5d37a44d7323", "level": "warning", "message": {"text": "Frontend route `workspaces` has no Link/navigate to it \u2014 planalign_studio/App.tsx"}, "properties": {"repobilityId": "de8ebeb8d48d1e56", "scanner": "scanner-primary", "fingerprint": "620e5d37a44d7323", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "orphan-page", "wiring"]}}, {"ruleId": "scanner-cf4fa1678cd65f91", "level": "warning", "message": {"text": "Frontend route `import` has no Link/navigate to it \u2014 planalign_studio/App.tsx"}, "properties": {"repobilityId": "51f63e226c2463b6", "scanner": "scanner-primary", "fingerprint": "cf4fa1678cd65f91", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "orphan-page", "wiring"]}}, {"ruleId": "scanner-53c8e5e104eaa70f", "level": "error", "message": {"text": "FastAPI POST `upload_census_file` without auth dependency \u2014 planalign_api/routers/files.py:53"}, "properties": {"repobilityId": "45677bad72d51661", "scanner": "scanner-primary", "fingerprint": "53c8e5e104eaa70f", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "planalign_api/routers/files.py"}, "region": {"startLine": 53}}}]}, {"ruleId": "scanner-eac930f3cc23d336", "level": "error", "message": {"text": "FastAPI POST `validate_file_path` without auth dependency \u2014 planalign_api/routers/files.py:184"}, "properties": {"repobilityId": "d0562cb575174924", "scanner": "scanner-primary", "fingerprint": "eac930f3cc23d336", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "planalign_api/routers/files.py"}, "region": {"startLine": 184}}}]}, {"ruleId": "scanner-7244e5a731374ea2", "level": "error", "message": {"text": "FastAPI POST `set_census_path` without auth dependency \u2014 planalign_api/routers/files.py:208"}, "properties": {"repobilityId": "98a2ef2c94778574", "scanner": "scanner-primary", "fingerprint": "7244e5a731374ea2", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "planalign_api/routers/files.py"}, "region": {"startLine": 208}}}]}, {"ruleId": "scanner-fe4f83bd69542b4b", "level": "error", "message": {"text": "FastAPI POST `analyze_age_distribution` without auth dependency \u2014 planalign_api/routers/files.py:244"}, "properties": {"repobilityId": "f9c42fa1652972b5", "scanner": "scanner-primary", "fingerprint": "fe4f83bd69542b4b", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "planalign_api/routers/files.py"}, "region": {"startLine": 244}}}]}, {"ruleId": "scanner-4b77013bb98e5661", "level": "error", "message": {"text": "FastAPI POST `analyze_part_time_pct` without auth dependency \u2014 planalign_api/routers/files.py:275"}, "properties": {"repobilityId": "4011e4566faed609", "scanner": "scanner-primary", "fingerprint": "4b77013bb98e5661", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "planalign_api/routers/files.py"}, "region": {"startLine": 275}}}]}, {"ruleId": "scanner-355d7570d6704d50", "level": "error", "message": {"text": "FastAPI POST `analyze_compensation_by_level` without auth dependency \u2014 planalign_api/routers/files.py:310"}, "properties": {"repobilityId": "b182a88c0d7ac80a", "scanner": "scanner-primary", "fingerprint": "355d7570d6704d50", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "planalign_api/routers/files.py"}, "region": {"startLine": 310}}}]}, {"ruleId": "scanner-47ea49c84620a575", "level": "error", "message": {"text": "FastAPI POST `solve_compensation_growth` without auth dependency \u2014 planalign_api/routers/files.py:346"}, "properties": {"repobilityId": "955eb621cacee1a7", "scanner": "scanner-primary", "fingerprint": "47ea49c84620a575", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "planalign_api/routers/files.py"}, "region": {"startLine": 346}}}]}, {"ruleId": "scanner-274032ed3dd26568", "level": "error", "message": {"text": "FastAPI POST `run_all_scenarios` without auth dependency \u2014 planalign_api/routers/batch.py:31"}, "properties": {"repobilityId": "e7ed2081f81bb367", "scanner": "scanner-primary", "fingerprint": "274032ed3dd26568", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "planalign_api/routers/batch.py"}, "region": {"startLine": 31}}}]}, {"ruleId": "scanner-431d270d0f4553ba", "level": "error", "message": {"text": "FastAPI POST `analyze_age_bands` without auth dependency \u2014 planalign_api/routers/bands.py:145"}, "properties": {"repobilityId": "94470b96f4c35f01", "scanner": "scanner-primary", "fingerprint": "431d270d0f4553ba", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "planalign_api/routers/bands.py"}, "region": {"startLine": 145}}}]}, {"ruleId": "scanner-8469eb8c45d1e512", "level": "error", "message": {"text": "FastAPI POST `analyze_tenure_bands` without auth dependency \u2014 planalign_api/routers/bands.py:195"}, "properties": {"repobilityId": "8b78cb66813b7623", "scanner": "scanner-primary", "fingerprint": "8469eb8c45d1e512", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "planalign_api/routers/bands.py"}, "region": {"startLine": 195}}}]}, {"ruleId": "scanner-e1a1544b5c901a92", "level": "error", "message": {"text": "FastAPI POST `analyze_turnover` without auth dependency \u2014 planalign_api/routers/bands.py:250"}, "properties": {"repobilityId": "ecddc4221e5dc22d", "scanner": "scanner-primary", "fingerprint": "e1a1544b5c901a92", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "planalign_api/routers/bands.py"}, "region": {"startLine": 250}}}]}, {"ruleId": "scanner-e5f1d4b1e2485440", "level": "error", "message": {"text": "FastAPI POST `analyze_opt_out_rate` without auth dependency \u2014 planalign_api/routers/bands.py:304"}, "properties": {"repobilityId": "00eac60d2cb222b2", "scanner": "scanner-primary", "fingerprint": "e5f1d4b1e2485440", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "planalign_api/routers/bands.py"}, "region": {"startLine": 304}}}]}, {"ruleId": "scanner-1834c84f6541dedc", "level": "error", "message": {"text": "FastAPI POST `start_simulation` without auth dependency \u2014 planalign_api/routers/simulations.py:74"}, "properties": {"repobilityId": "86f99edf6be4f491", "scanner": "scanner-primary", "fingerprint": "1834c84f6541dedc", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "planalign_api/routers/simulations.py"}, "region": {"startLine": 74}}}]}, {"ruleId": "scanner-c1fb4216fc727b45", "level": "error", "message": {"text": "FastAPI POST `cancel_simulation` without auth dependency \u2014 planalign_api/routers/simulations.py:239"}, "properties": {"repobilityId": "9bc3996bba134d8e", "scanner": "scanner-primary", "fingerprint": "c1fb4216fc727b45", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "planalign_api/routers/simulations.py"}, "region": {"startLine": 239}}}]}, {"ruleId": "scanner-4565254c6036a0e9", "level": "error", "message": {"text": "FastAPI POST `reset_simulation_status` without auth dependency \u2014 planalign_api/routers/simulations.py:270"}, "properties": {"repobilityId": "748427be747c9e6f", "scanner": "scanner-primary", "fingerprint": "4565254c6036a0e9", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "planalign_api/routers/simulations.py"}, "region": {"startLine": 270}}}]}, {"ruleId": "scanner-237c148209d73cc8", "level": "error", "message": {"text": "FastAPI POST `create_workspace` without auth dependency \u2014 planalign_api/routers/workspaces.py:111"}, "properties": {"repobilityId": "5ac8570d4a5b520b", "scanner": "scanner-primary", "fingerprint": "237c148209d73cc8", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "planalign_api/routers/workspaces.py"}, "region": {"startLine": 111}}}]}, {"ruleId": "scanner-3dea0afa3ba61924", "level": "error", "message": {"text": "FastAPI PUT `update_workspace` without auth dependency \u2014 planalign_api/routers/workspaces.py:144"}, "properties": {"repobilityId": "a358e1b89f390fcb", "scanner": "scanner-primary", "fingerprint": "3dea0afa3ba61924", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "planalign_api/routers/workspaces.py"}, "region": {"startLine": 144}}}]}, {"ruleId": "scanner-a105ba76f76e2d7e", "level": "error", "message": {"text": "FastAPI DELETE `delete_workspace` without auth dependency \u2014 planalign_api/routers/workspaces.py:186"}, "properties": {"repobilityId": "92fd8fcbad7679d2", "scanner": "scanner-primary", "fingerprint": "a105ba76f76e2d7e", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "planalign_api/routers/workspaces.py"}, "region": {"startLine": 186}}}]}, {"ruleId": "scanner-c9626a5195de8390", "level": "error", "message": {"text": "FastAPI POST `export_workspace` without auth dependency \u2014 planalign_api/routers/workspaces.py:208"}, "properties": {"repobilityId": "7555c3f59f7bd6dd", "scanner": "scanner-primary", "fingerprint": "c9626a5195de8390", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "planalign_api/routers/workspaces.py"}, "region": {"startLine": 208}}}]}, {"ruleId": "scanner-a8ee6830c20cb0f5", "level": "error", "message": {"text": "FastAPI POST `start_bulk_export` without auth dependency \u2014 planalign_api/routers/workspaces.py:250"}, "properties": {"repobilityId": "bf0ec1aa5ac63e11", "scanner": "scanner-primary", "fingerprint": "a8ee6830c20cb0f5", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "planalign_api/routers/workspaces.py"}, "region": {"startLine": 250}}}]}, {"ruleId": "scanner-a8054d479f2d67a4", "level": "error", "message": {"text": "FastAPI POST `validate_import` without auth dependency \u2014 planalign_api/routers/workspaces.py:316"}, "properties": {"repobilityId": "0c2aebb478d67a7f", "scanner": "scanner-primary", "fingerprint": "a8054d479f2d67a4", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "planalign_api/routers/workspaces.py"}, "region": {"startLine": 316}}}]}, {"ruleId": "scanner-7ffb241ad7e69550", "level": "error", "message": {"text": "FastAPI POST `import_workspace` without auth dependency \u2014 planalign_api/routers/workspaces.py:364"}, "properties": {"repobilityId": "9964b09083349703", "scanner": "scanner-primary", "fingerprint": "7ffb241ad7e69550", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "planalign_api/routers/workspaces.py"}, "region": {"startLine": 364}}}]}, {"ruleId": "scanner-aa502ba23d01d053", "level": "error", "message": {"text": "FastAPI POST `start_bulk_import` without auth dependency \u2014 planalign_api/routers/workspaces.py:418"}, "properties": {"repobilityId": "c5fb7fa935946450", "scanner": "scanner-primary", "fingerprint": "aa502ba23d01d053", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "planalign_api/routers/workspaces.py"}, "region": {"startLine": 418}}}]}, {"ruleId": "scanner-641f295a6c43175d", "level": "error", "message": {"text": "FastAPI POST `create_scenario` without auth dependency \u2014 planalign_api/routers/scenarios.py:49"}, "properties": {"repobilityId": "b5ea6506236f4782", "scanner": "scanner-primary", "fingerprint": "641f295a6c43175d", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "planalign_api/routers/scenarios.py"}, "region": {"startLine": 49}}}]}, {"ruleId": "scanner-be40fde7e5f71f74", "level": "error", "message": {"text": "FastAPI PUT `update_scenario` without auth dependency \u2014 planalign_api/routers/scenarios.py:116"}, "properties": {"repobilityId": "c411ed8e53855b1d", "scanner": "scanner-primary", "fingerprint": "be40fde7e5f71f74", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "planalign_api/routers/scenarios.py"}, "region": {"startLine": 116}}}]}, {"ruleId": "scanner-da3164bbe7bb5d29", "level": "error", "message": {"text": "FastAPI POST `apply_workforce_params` without auth dependency \u2014 planalign_api/routers/scenarios.py:160"}, "properties": {"repobilityId": "bd1df53266aa0fd7", "scanner": "scanner-primary", "fingerprint": "da3164bbe7bb5d29", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "planalign_api/routers/scenarios.py"}, "region": {"startLine": 160}}}]}, {"ruleId": "scanner-9c262ee047c94d44", "level": "error", "message": {"text": "FastAPI DELETE `delete_scenario` without auth dependency \u2014 planalign_api/routers/scenarios.py:206"}, "properties": {"repobilityId": "c8450d3037723892", "scanner": "scanner-primary", "fingerprint": "9c262ee047c94d44", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "planalign_api/routers/scenarios.py"}, "region": {"startLine": 206}}}]}, {"ruleId": "scanner-7081d3d2e0050e92", "level": "error", "message": {"text": "FastAPI DELETE `delete_scenario_database` without auth dependency \u2014 planalign_api/routers/scenarios.py:226"}, "properties": {"repobilityId": "b2ca775d9d86a914", "scanner": "scanner-primary", "fingerprint": "7081d3d2e0050e92", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "planalign_api/routers/scenarios.py"}, "region": {"startLine": 226}}}]}, {"ruleId": "scanner-226a513a5c9b43cd", "level": "error", "message": {"text": "FastAPI POST `upload_file` without auth dependency \u2014 planalign_api/routers/imports.py:197"}, "properties": {"repobilityId": "56008498a5a7b0fc", "scanner": "scanner-primary", "fingerprint": "226a513a5c9b43cd", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "planalign_api/routers/imports.py"}, "region": {"startLine": 197}}}]}, {"ruleId": "scanner-1f33d8e1c4598d62", "level": "error", "message": {"text": "FastAPI PATCH `select_sheet` without auth dependency \u2014 planalign_api/routers/imports.py:268"}, "properties": {"repobilityId": "390d6d41abf17eda", "scanner": "scanner-primary", "fingerprint": "1f33d8e1c4598d62", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "planalign_api/routers/imports.py"}, "region": {"startLine": 268}}}]}, {"ruleId": "scanner-fb4b7b5e7c14d730", "level": "error", "message": {"text": "FastAPI PUT `save_mapping` without auth dependency \u2014 planalign_api/routers/imports.py:316"}, "properties": {"repobilityId": "b1da57400cb4d689", "scanner": "scanner-primary", "fingerprint": "fb4b7b5e7c14d730", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "planalign_api/routers/imports.py"}, "region": {"startLine": 316}}}]}, {"ruleId": "scanner-c1cd0ed682436382", "level": "error", "message": {"text": "FastAPI POST `generate_parquet` without auth dependency \u2014 planalign_api/routers/imports.py:498"}, "properties": {"repobilityId": "f00d8f47ebaf976e", "scanner": "scanner-primary", "fingerprint": "c1cd0ed682436382", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "planalign_api/routers/imports.py"}, "region": {"startLine": 498}}}]}, {"ruleId": "scanner-46fa2ee6f60a1417", "level": "error", "message": {"text": "FastAPI DELETE `delete_parquet_file` without auth dependency \u2014 planalign_api/routers/imports.py:597"}, "properties": {"repobilityId": "cef79d961574eb3d", "scanner": "scanner-primary", "fingerprint": "46fa2ee6f60a1417", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "planalign_api/routers/imports.py"}, "region": {"startLine": 597}}}]}, {"ruleId": "scanner-7de4476d644c6c2c", "level": "error", "message": {"text": "FastAPI POST `save_mapping_template` without auth dependency \u2014 planalign_api/routers/imports.py:635"}, "properties": {"repobilityId": "224404853dde1ee6", "scanner": "scanner-primary", "fingerprint": "7de4476d644c6c2c", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "planalign_api/routers/imports.py"}, "region": {"startLine": 635}}}]}, {"ruleId": "scanner-2310a28bb845f6fa", "level": "error", "message": {"text": "FastAPI POST `apply_template` without auth dependency \u2014 planalign_api/routers/imports.py:665"}, "properties": {"repobilityId": "9902051587d34a31", "scanner": "scanner-primary", "fingerprint": "2310a28bb845f6fa", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "planalign_api/routers/imports.py"}, "region": {"startLine": 665}}}]}, {"ruleId": "scanner-0f82479499bf870c", "level": "error", "message": {"text": "FastAPI POST `init_sync` without auth dependency \u2014 planalign_api/routers/sync.py:64"}, "properties": {"repobilityId": "7f21d38a0904c672", "scanner": "scanner-primary", "fingerprint": "0f82479499bf870c", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "planalign_api/routers/sync.py"}, "region": {"startLine": 64}}}]}, {"ruleId": "scanner-fe81c4dc1726d00d", "level": "error", "message": {"text": "FastAPI POST `push_changes` without auth dependency \u2014 planalign_api/routers/sync.py:86"}, "properties": {"repobilityId": "760d435b0855c1df", "scanner": "scanner-primary", "fingerprint": "fe81c4dc1726d00d", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "planalign_api/routers/sync.py"}, "region": {"startLine": 86}}}]}, {"ruleId": "scanner-e4a1c53307e505fd", "level": "error", "message": {"text": "FastAPI POST `pull_changes` without auth dependency \u2014 planalign_api/routers/sync.py:111"}, "properties": {"repobilityId": "b19f66f67d42db15", "scanner": "scanner-primary", "fingerprint": "e4a1c53307e505fd", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "planalign_api/routers/sync.py"}, "region": {"startLine": 111}}}]}, {"ruleId": "scanner-5d9bf5bfae60998e", "level": "error", "message": {"text": "FastAPI POST `disconnect_sync` without auth dependency \u2014 planalign_api/routers/sync.py:171"}, "properties": {"repobilityId": "4e90df38877174f2", "scanner": "scanner-primary", "fingerprint": "5d9bf5bfae60998e", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "planalign_api/routers/sync.py"}, "region": {"startLine": 171}}}]}, {"ruleId": "scanner-af9f17269e0b3267", "level": "error", "message": {"text": "FastAPI POST `analyze_vesting` without auth dependency \u2014 planalign_api/routers/vesting.py:78"}, "properties": {"repobilityId": "8217ac8ff45036c4", "scanner": "scanner-primary", "fingerprint": "af9f17269e0b3267", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "planalign_api/routers/vesting.py"}, "region": {"startLine": 78}}}]}]}]}