{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-bead75b0f9233e05", "name": "No API endpoints detected", "shortDescription": {"text": "No API endpoints detected"}, "fullDescription": {"text": "The scanner did not find FastAPI/Flask/Express/NestJS/GraphQL/gRPC routes. If this repo exposes APIs, the framework may be unsupported."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "info", "confidence": 1.0}}, {"id": "scanner-f3ce8a8907bc49a7", "name": "Stray `console.log` in TS/JS \u2014 bot/index.ts:22", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 bot/index.ts:22"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a6466dc7b9223aed", "name": "Stray `console.log` in TS/JS \u2014 bot/commands/_register.ts:25", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 bot/commands/_register.ts:25"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2a228236f36b4b1d", "name": "Stray `console.log` in TS/JS \u2014 bot/core/emojis.ts:14", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 bot/core/emojis.ts:14"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3359fd92b112f691", "name": "Stray `console.log` in TS/JS \u2014 bot/bridge/KTPBridge.ts:73", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 bot/bridge/KTPBridge.ts:73"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-079d529944a6cd56", "name": "Stray `console.log` in TS/JS \u2014 bot-legacy/index.ts:515", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 bot-legacy/index.ts:515"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-11d8fffc38cc89c7", "name": "Stray `console.log` in TS/JS \u2014 bot-legacy/match/MatchManager.ts:84", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 bot-legacy/match/MatchManager.ts:84"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a8d576e8a5f7803f", "name": "Stray `console.log` in TS/JS \u2014 bot-legacy/match/matchPersistence.ts:17", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 bot-legacy/match/matchPersistence.ts:17"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-280656b69409fd39", "name": "Stray `console.log` in TS/JS \u2014 bot-legacy/config/ConfigManager.ts:44", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 bot-legacy/config/ConfigManager.ts:44"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8c51d0a49db594be", "name": "Stray `console.log` in TS/JS \u2014 bot-legacy/commands/registry.ts:52", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 bot-legacy/commands/registry.ts:52"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c989e6e1d0a540a9", "name": "Stray `console.log` in TS/JS \u2014 bot-legacy/draft/DraftManager.ts:176", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 bot-legacy/draft/DraftManager.ts:176"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8eb31a238caaa91a", "name": "Stray `console.log` in TS/JS \u2014 bot-legacy/result/ResultManager.ts:63", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 bot-legacy/result/ResultManager.ts:63"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2e795a244570940e", "name": "Stray `console.log` in TS/JS \u2014 bot-legacy/queue/queuePersistence.ts:42", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 bot-legacy/queue/queuePersistence.ts:42"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7fc094f01487cae8", "name": "Stray `console.log` in TS/JS \u2014 bot-legacy/queue/QueueManager.ts:85", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 bot-legacy/queue/QueueManager.ts:85"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0732ffd497199eb3", "name": "Stray `console.log` in TS/JS \u2014 bot-legacy/bridge/KTPBridge.ts:91", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 bot-legacy/bridge/KTPBridge.ts:91"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-48a91032547522ce", "name": "Icon-only button without accessible name \u2014 src/components/SignupDrawer.tsx:185", "shortDescription": {"text": "Icon-only button without accessible name \u2014 src/components/SignupDrawer.tsx:185"}, "fullDescription": {"text": "A `<button>` whose only child is a single glyph or symbol needs `title=` or `aria-label=` so screen readers (and tooltips on hover) work.\n\nWhy: P3 in CHECKLIST.md \u2014 icon-only buttons skipped a title.\nRule id: fq.button.no-label"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1ead060c6ad264ed", "name": "`dangerouslySetInnerHTML` used in a React component \u2014 src/app/layout.tsx:37", "shortDescription": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 src/app/layout.tsx:37"}, "fullDescription": {"text": "Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library.\n\nWhy: OWASP basics. Already partially flagged by the security analyzer.\nRule id: fq.dangerous-html"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d47546b1a05fc886", "name": "`dangerouslySetInnerHTML` used in a React component \u2014 src/app/rules/page.tsx:30", "shortDescription": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 src/app/rules/page.tsx:30"}, "fullDescription": {"text": "Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library.\n\nWhy: OWASP basics. Already partially flagged by the security analyzer.\nRule id: fq.dangerous-html"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-922b57b2105d9313", "name": "Stray `console.log` in TS/JS \u2014 src/app/api/verify/grant/route.ts:65", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 src/app/api/verify/grant/route.ts:65"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-54eabb6fb2958bf1", "name": "Icon-only button without accessible name \u2014 src/app/portal/page.tsx:80", "shortDescription": {"text": "Icon-only button without accessible name \u2014 src/app/portal/page.tsx:80"}, "fullDescription": {"text": "A `<button>` whose only child is a single glyph or symbol needs `title=` or `aria-label=` so screen readers (and tooltips on hover) work.\n\nWhy: P3 in CHECKLIST.md \u2014 icon-only buttons skipped a title.\nRule id: fq.button.no-label"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-503952c54c9b0ccf", "name": "Dockerfile runs as root: bot/Dockerfile", "shortDescription": {"text": "Dockerfile runs as root: bot/Dockerfile"}, "fullDescription": {"text": "No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-671606a2d1f2f1cb", "name": "Docker base image is tag-pinned but not digest-pinned: node:20-alpine", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: node:20-alpine"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4d78bce945997820", "name": "Dockerfile runs as root: bot-legacy/Dockerfile", "shortDescription": {"text": "Dockerfile runs as root: bot-legacy/Dockerfile"}, "fullDescription": {"text": "No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6d65fc0b3967c1a4", "name": "Docker base image is tag-pinned but not digest-pinned: node:20-alpine", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: node:20-alpine"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-aa5acaa49eb8315b", "name": "Containers defined but no K8s/orchestration manifest found", "shortDescription": {"text": "Containers defined but no K8s/orchestration manifest found"}, "fullDescription": {"text": "Repo has Dockerfiles/compose but no Kubernetes/Nomad manifests. If the target deployment is K8s, the manifests may live in a separate ops repo."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1ac7655f75a4334b", "name": "Insecure pattern 'dangerous_innerhtml' in src/app/layout.tsx:37", "shortDescription": {"text": "Insecure pattern 'dangerous_innerhtml' in src/app/layout.tsx:37"}, "fullDescription": {"text": "Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3148b9829190ac6a", "name": "Insecure pattern 'dangerous_innerhtml' in src/app/rules/page.tsx:30", "shortDescription": {"text": "Insecure pattern 'dangerous_innerhtml' in src/app/rules/page.tsx:30"}, "fullDescription": {"text": "Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4601e3ad3bb28677", "name": "No CI/CD pipelines detected", "shortDescription": {"text": "No CI/CD pipelines detected"}, "fullDescription": {"text": "No GitHub Actions, GitLab CI, or CircleCI configs found. Without CI you can't gate deploys on tests/lints."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ab291fed786a075a", "name": "Very large file: src/app/events/[id]/draft/page.tsx (1134 lines)", "shortDescription": {"text": "Very large file: src/app/events/[id]/draft/page.tsx (1134 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-dc44cfb45a74c4a4", "name": "Very large file: src/app/events/[id]/tournament/page.tsx (969 lines)", "shortDescription": {"text": "Very large file: src/app/events/[id]/tournament/page.tsx (969 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6893a6c8b0861585", "name": "Very low test-to-source ratio", "shortDescription": {"text": "Very low test-to-source ratio"}, "fullDescription": {"text": "0 test file(s) for 114 source file(s) (ratio 0.00). Consider adding integration or unit tests for critical paths."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-141b30a41e03817b", "name": "No license file detected", "shortDescription": {"text": "No license file detected"}, "fullDescription": {"text": "No LICENSE/COPYING/NOTICE file was found. Generated repositories often omit licensing, which blocks reuse and automated intake."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 25 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-72b2a6250083a784", "name": "Placeholder or mock-heavy implementation detected", "shortDescription": {"text": "Placeholder or mock-heavy implementation detected"}, "fullDescription": {"text": "Found 53 placeholder/mock markers across 22 source files. This often means the repo looks complete while core flows still use generated scaffolding or fake data."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b9088664ace7f748", "name": "Composite production-readiness gap", "shortDescription": {"text": "Composite production-readiness gap"}, "fullDescription": {"text": "Multiple low-cost hardening controls are missing together: license, ci, tests. Opus verification showed these co-occurring gaps are a better readiness signal than reading each flag in isolation."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-749d4bc1bd66df5f", "name": "Agent instructions exist but release-hardening basics are missing", "shortDescription": {"text": "Agent instructions exist but release-hardening basics are missing"}, "fullDescription": {"text": "AI-coder instruction files were found, but the repo is missing license, ci, tests. Treat this as a contract gap: the agent is guided, but the generated output is not yet guarded by the controls that make it repeatable."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-83fc54ba21536a34", "name": "`fetch()` without try/.catch or AbortSignal \u2014 bot-legacy/index.ts:636", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 bot-legacy/index.ts:636"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c00a648e67b4cfcb", "name": "`fetch()` without try/.catch or AbortSignal \u2014 bot-legacy/match/MatchManager.ts:151", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 bot-legacy/match/MatchManager.ts:151"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b26d44ac50a3890e", "name": "`fetch()` without try/.catch or AbortSignal \u2014 bot-legacy/commands/verify.ts:20", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 bot-legacy/commands/verify.ts:20"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-084cf496b051f51f", "name": "`fetch()` without try/.catch or AbortSignal \u2014 bot-legacy/draft/DraftManager.ts:80", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 bot-legacy/draft/DraftManager.ts:80"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b4111f11d74f03d3", "name": "`fetch()` without try/.catch or AbortSignal \u2014 bot-legacy/result/ResultManager.ts:158", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 bot-legacy/result/ResultManager.ts:158"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-097fc8163452d6d9", "name": "`fetch()` without try/.catch or AbortSignal \u2014 bot-legacy/votes/VoteEngine.ts:73", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 bot-legacy/votes/VoteEngine.ts:73"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7197a05bb4fb7cd6", "name": "`fetch()` without try/.catch or AbortSignal \u2014 bot-legacy/queue/QueueManager.ts:61", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 bot-legacy/queue/QueueManager.ts:61"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-36dbb46a5b2b75e2", "name": "`fetch()` without try/.catch or AbortSignal \u2014 bot-legacy/bridge/KTPBridge.ts:157", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 bot-legacy/bridge/KTPBridge.ts:157"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3a7032c235b9c183", "name": "`fetch()` without try/.catch or AbortSignal \u2014 src/components/SignupDrawer.tsx:53", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/components/SignupDrawer.tsx:53"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2fa6d7bd67a6f5d6", "name": "`fetch()` without try/.catch or AbortSignal \u2014 src/app/settings/page.tsx:84", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/app/settings/page.tsx:84"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1217fcfb46fb560c", "name": "`fetch()` without try/.catch or AbortSignal \u2014 src/app/rules/edit/page.tsx:86", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/app/rules/edit/page.tsx:86"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0e700b637bbf95e5", "name": "`fetch()` without try/.catch or AbortSignal \u2014 src/app/events/page.tsx:54", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/app/events/page.tsx:54"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-91381efb1356cda9", "name": "`fetch()` without try/.catch or AbortSignal \u2014 src/app/events/new/page.tsx:115", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/app/events/new/page.tsx:115"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b1c6d526239e2bbb", "name": "`fetch()` without try/.catch or AbortSignal \u2014 src/app/events/[id]/page.tsx:93", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/app/events/[id]/page.tsx:93"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-61fecfe3a34199e6", "name": "`fetch()` without try/.catch or AbortSignal \u2014 src/app/events/[id]/draft/page.tsx:137", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/app/events/[id]/draft/page.tsx:137"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-5c19fd469be82354", "name": "`fetch()` without try/.catch or AbortSignal \u2014 src/app/events/[id]/draft/lobby/page.tsx:82", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/app/events/[id]/draft/lobby/page.tsx:82"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-dbc5fc753de0b28d", "name": "`fetch()` without try/.catch or AbortSignal \u2014 src/app/events/[id]/teams/page.tsx:70", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/app/events/[id]/teams/page.tsx:70"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e55c4d097ad220e5", "name": "`fetch()` without try/.catch or AbortSignal \u2014 src/app/events/[id]/tournament/page.tsx:156", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/app/events/[id]/tournament/page.tsx:156"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ac0d0542fe179457", "name": "`fetch()` without try/.catch or AbortSignal \u2014 src/app/events/[id]/edit/page.tsx:69", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/app/events/[id]/edit/page.tsx:69"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-18aadc3af1ce6fb6", "name": "`fetch()` without try/.catch or AbortSignal \u2014 src/app/events/[id]/tournament-setup/page.tsx:58", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/app/events/[id]/tournament-setup/page.tsx:58"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-bb18e5fa8a6363a5", "name": "`fetch()` without try/.catch or AbortSignal \u2014 src/app/api/draft/[id]/reset/route.ts:48", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/app/api/draft/[id]/reset/route.ts:48"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-af5768df635e29ce", "name": "`fetch()` without try/.catch or AbortSignal \u2014 src/app/api/draft/[id]/lobby/route.ts:73", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/app/api/draft/[id]/lobby/route.ts:73"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-97af638dd63041f8", "name": "Commented-code block (5 lines) in src/app/api/tournaments/[id]/matches/[matchId]/route.ts:368", "shortDescription": {"text": "Commented-code block (5 lines) in src/app/api/tournaments/[id]/matches/[matchId]/route.ts:368"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-40aebf814f81a98f", "name": "`fetch()` without try/.catch or AbortSignal \u2014 src/app/api/verify/callback/route.ts:72", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/app/api/verify/callback/route.ts:72"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b69acf3f04f17604", "name": "`fetch()` without try/.catch or AbortSignal \u2014 src/app/api/verify/grant/route.ts:42", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/app/api/verify/grant/route.ts:42"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-094687b34b28284a", "name": "`fetch()` without try/.catch or AbortSignal \u2014 src/app/dashboard/page.tsx:60", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/app/dashboard/page.tsx:60"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-90fbcb9b9db940e0", "name": "`fetch()` without try/.catch or AbortSignal \u2014 src/app/admin/audit/page.tsx:118", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/app/admin/audit/page.tsx:118"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e66d055863d5a77a", "name": "Legacy-named symbol `DevLogLegacy` in src/app/dev/log/page.tsx:3", "shortDescription": {"text": "Legacy-named symbol `DevLogLegacy` in src/app/dev/log/page.tsx:3"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ba2fdbd363be2eaa", "name": "`fetch()` without try/.catch or AbortSignal \u2014 src/app/portal/page.tsx:118", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/app/portal/page.tsx:118"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d18c0556cbf8179c", "name": "`fetch()` without try/.catch or AbortSignal \u2014 src/app/portal/[id]/page.tsx:83", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/app/portal/[id]/page.tsx:83"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/19062"}, "properties": {"repository": "schwalby/draftman5.0", "repoUrl": "https://github.com/schwalby/draftman5.0", "branch": "main"}, "results": [{"ruleId": "scanner-bead75b0f9233e05", "level": "none", "message": {"text": "No API endpoints detected"}, "properties": {"repobilityId": "0f8bb852027c38f8", "scanner": "scanner-primary", "fingerprint": "bead75b0f9233e05", "layer": "api", "severity": "info", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-f3ce8a8907bc49a7", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 bot/index.ts:22"}, "properties": {"repobilityId": "f8193f6cbe776059", "scanner": "scanner-primary", "fingerprint": "f3ce8a8907bc49a7", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-a6466dc7b9223aed", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 bot/commands/_register.ts:25"}, "properties": {"repobilityId": "6fd93dde03c7b6f7", "scanner": "scanner-primary", "fingerprint": "a6466dc7b9223aed", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-2a228236f36b4b1d", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 bot/core/emojis.ts:14"}, "properties": {"repobilityId": "c3ef99ec6868f0ca", "scanner": "scanner-primary", "fingerprint": "2a228236f36b4b1d", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-3359fd92b112f691", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 bot/bridge/KTPBridge.ts:73"}, "properties": {"repobilityId": "6938329dbeade015", "scanner": "scanner-primary", "fingerprint": "3359fd92b112f691", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-079d529944a6cd56", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 bot-legacy/index.ts:515"}, "properties": {"repobilityId": "a9496b87137905ea", "scanner": "scanner-primary", "fingerprint": "079d529944a6cd56", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-11d8fffc38cc89c7", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 bot-legacy/match/MatchManager.ts:84"}, "properties": {"repobilityId": "56f9b2065332ce97", "scanner": "scanner-primary", "fingerprint": "11d8fffc38cc89c7", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-a8d576e8a5f7803f", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 bot-legacy/match/matchPersistence.ts:17"}, "properties": {"repobilityId": "d343e8c34a2bc715", "scanner": "scanner-primary", "fingerprint": "a8d576e8a5f7803f", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-280656b69409fd39", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 bot-legacy/config/ConfigManager.ts:44"}, "properties": {"repobilityId": "e3707f6f55bfd1e1", "scanner": "scanner-primary", "fingerprint": "280656b69409fd39", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-8c51d0a49db594be", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 bot-legacy/commands/registry.ts:52"}, "properties": {"repobilityId": "ad92745912588abf", "scanner": "scanner-primary", "fingerprint": "8c51d0a49db594be", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-c989e6e1d0a540a9", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 bot-legacy/draft/DraftManager.ts:176"}, "properties": {"repobilityId": "52e1dfddeffce6e8", "scanner": "scanner-primary", "fingerprint": "c989e6e1d0a540a9", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-8eb31a238caaa91a", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 bot-legacy/result/ResultManager.ts:63"}, "properties": {"repobilityId": "bba572531391a87e", "scanner": "scanner-primary", "fingerprint": "8eb31a238caaa91a", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-2e795a244570940e", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 bot-legacy/queue/queuePersistence.ts:42"}, "properties": {"repobilityId": "b55cc767f0a7626b", "scanner": "scanner-primary", "fingerprint": "2e795a244570940e", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-7fc094f01487cae8", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 bot-legacy/queue/QueueManager.ts:85"}, "properties": {"repobilityId": "fd67a3011cce2b81", "scanner": "scanner-primary", "fingerprint": "7fc094f01487cae8", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-0732ffd497199eb3", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 bot-legacy/bridge/KTPBridge.ts:91"}, "properties": {"repobilityId": "00fc65f8fb3bdf18", "scanner": "scanner-primary", "fingerprint": "0732ffd497199eb3", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-48a91032547522ce", "level": "note", "message": {"text": "Icon-only button without accessible name \u2014 src/components/SignupDrawer.tsx:185"}, "properties": {"repobilityId": "d85b91b87a58853d", "scanner": "scanner-primary", "fingerprint": "48a91032547522ce", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.button.no-label"]}}, {"ruleId": "scanner-1ead060c6ad264ed", "level": "warning", "message": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 src/app/layout.tsx:37"}, "properties": {"repobilityId": "0d72350965068f5b", "scanner": "scanner-primary", "fingerprint": "1ead060c6ad264ed", "layer": "frontend", "severity": "medium", "confidence": 1.0, "tags": ["frontend-quality", "fq.dangerous-html"]}}, {"ruleId": "scanner-d47546b1a05fc886", "level": "warning", "message": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 src/app/rules/page.tsx:30"}, "properties": {"repobilityId": "22ab72eff5cfd452", "scanner": "scanner-primary", "fingerprint": "d47546b1a05fc886", "layer": "frontend", "severity": "medium", "confidence": 1.0, "tags": ["frontend-quality", "fq.dangerous-html"]}}, {"ruleId": "scanner-922b57b2105d9313", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 src/app/api/verify/grant/route.ts:65"}, "properties": {"repobilityId": "7653072abaccabeb", "scanner": "scanner-primary", "fingerprint": "922b57b2105d9313", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-54eabb6fb2958bf1", "level": "note", "message": {"text": "Icon-only button without accessible name \u2014 src/app/portal/page.tsx:80"}, "properties": {"repobilityId": "c248e699bea98e16", "scanner": "scanner-primary", "fingerprint": "54eabb6fb2958bf1", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.button.no-label"]}}, {"ruleId": "scanner-503952c54c9b0ccf", "level": "warning", "message": {"text": "Dockerfile runs as root: bot/Dockerfile"}, "properties": {"repobilityId": "9aa8300e507540e8", "scanner": "scanner-primary", "fingerprint": "503952c54c9b0ccf", "layer": "hardware", "severity": "medium", "confidence": 1.0, "tags": ["security", "container"]}}, {"ruleId": "scanner-671606a2d1f2f1cb", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: node:20-alpine"}, "properties": {"repobilityId": "a58019d0b49c4b00", "scanner": "scanner-primary", "fingerprint": "671606a2d1f2f1cb", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "bot/Dockerfile"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-671606a2d1f2f1cb", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: node:20-alpine"}, "properties": {"repobilityId": "f447577fc9cbe282", "scanner": "scanner-primary", "fingerprint": "671606a2d1f2f1cb", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "bot/Dockerfile"}, "region": {"startLine": 7}}}]}, {"ruleId": "scanner-4d78bce945997820", "level": "warning", "message": {"text": "Dockerfile runs as root: bot-legacy/Dockerfile"}, "properties": {"repobilityId": "60dd2bc64004cee5", "scanner": "scanner-primary", "fingerprint": "4d78bce945997820", "layer": "hardware", "severity": "medium", "confidence": 1.0, "tags": ["security", "container"]}}, {"ruleId": "scanner-6d65fc0b3967c1a4", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: node:20-alpine"}, "properties": {"repobilityId": "1d7031406ef2f29b", "scanner": "scanner-primary", "fingerprint": "6d65fc0b3967c1a4", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "bot-legacy/Dockerfile"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-aa5acaa49eb8315b", "level": "note", "message": {"text": "Containers defined but no K8s/orchestration manifest found"}, "properties": {"repobilityId": "b230ea9b68736081", "scanner": "scanner-primary", "fingerprint": "aa5acaa49eb8315b", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["coverage", "deployment"]}}, {"ruleId": "scanner-1ac7655f75a4334b", "level": "warning", "message": {"text": "Insecure pattern 'dangerous_innerhtml' in src/app/layout.tsx:37"}, "properties": {"repobilityId": "0bca654fa2052eb0", "scanner": "scanner-primary", "fingerprint": "1ac7655f75a4334b", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "dangerous_innerhtml"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/app/layout.tsx"}, "region": {"startLine": 37}}}]}, {"ruleId": "scanner-3148b9829190ac6a", "level": "warning", "message": {"text": "Insecure pattern 'dangerous_innerhtml' in src/app/rules/page.tsx:30"}, "properties": {"repobilityId": "e0afdf1450e03d31", "scanner": "scanner-primary", "fingerprint": "3148b9829190ac6a", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "dangerous_innerhtml"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/app/rules/page.tsx"}, "region": {"startLine": 30}}}]}, {"ruleId": "scanner-4601e3ad3bb28677", "level": "warning", "message": {"text": "No CI/CD pipelines detected"}, "properties": {"repobilityId": "c3ee439bce2bc51e", "scanner": "scanner-primary", "fingerprint": "4601e3ad3bb28677", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-ab291fed786a075a", "level": "note", "message": {"text": "Very large file: src/app/events/[id]/draft/page.tsx (1134 lines)"}, "properties": {"repobilityId": "835861de5756c3a6", "scanner": "scanner-primary", "fingerprint": "ab291fed786a075a", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-dc44cfb45a74c4a4", "level": "note", "message": {"text": "Very large file: src/app/events/[id]/tournament/page.tsx (969 lines)"}, "properties": {"repobilityId": "76992e384583839a", "scanner": "scanner-primary", "fingerprint": "dc44cfb45a74c4a4", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-6893a6c8b0861585", "level": "warning", "message": {"text": "Very low test-to-source ratio"}, "properties": {"repobilityId": "54a7de3f06314bf0", "scanner": "scanner-primary", "fingerprint": "6893a6c8b0861585", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["tests", "coverage"]}}, {"ruleId": "scanner-141b30a41e03817b", "level": "note", "message": {"text": "No license file detected"}, "properties": {"repobilityId": "dcd2e354283763ce", "scanner": "scanner-primary", "fingerprint": "141b30a41e03817b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["license", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "1a60f92191bd025b", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-72b2a6250083a784", "level": "warning", "message": {"text": "Placeholder or mock-heavy implementation detected"}, "properties": {"repobilityId": "4583641383a44c4c", "scanner": "scanner-primary", "fingerprint": "72b2a6250083a784", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "incomplete", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "023fdb2387abdb5d", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-b9088664ace7f748", "level": "warning", "message": {"text": "Composite production-readiness gap"}, "properties": {"repobilityId": "ab0ba8cae5f44f44", "scanner": "scanner-primary", "fingerprint": "b9088664ace7f748", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["production-readiness", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-749d4bc1bd66df5f", "level": "warning", "message": {"text": "Agent instructions exist but release-hardening basics are missing"}, "properties": {"repobilityId": "3699f5fe2e7b3ee7", "scanner": "scanner-primary", "fingerprint": "749d4bc1bd66df5f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "c7c4d0931717a162", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "57f31e262f807c37", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-83fc54ba21536a34", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 bot-legacy/index.ts:636"}, "properties": {"repobilityId": "43e66c22d5ed7f99", "scanner": "scanner-primary", "fingerprint": "83fc54ba21536a34", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-c00a648e67b4cfcb", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 bot-legacy/match/MatchManager.ts:151"}, "properties": {"repobilityId": "e219f028aaa329ac", "scanner": "scanner-primary", "fingerprint": "c00a648e67b4cfcb", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-b26d44ac50a3890e", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 bot-legacy/commands/verify.ts:20"}, "properties": {"repobilityId": "526e7d3bf047f536", "scanner": "scanner-primary", "fingerprint": "b26d44ac50a3890e", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-084cf496b051f51f", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 bot-legacy/draft/DraftManager.ts:80"}, "properties": {"repobilityId": "341468c220f9aeb1", "scanner": "scanner-primary", "fingerprint": "084cf496b051f51f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-b4111f11d74f03d3", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 bot-legacy/result/ResultManager.ts:158"}, "properties": {"repobilityId": "929fe76a69204717", "scanner": "scanner-primary", "fingerprint": "b4111f11d74f03d3", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-097fc8163452d6d9", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 bot-legacy/votes/VoteEngine.ts:73"}, "properties": {"repobilityId": "5c2373de620676c0", "scanner": "scanner-primary", "fingerprint": "097fc8163452d6d9", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-7197a05bb4fb7cd6", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 bot-legacy/queue/QueueManager.ts:61"}, "properties": {"repobilityId": "bc9634296e273b3b", "scanner": "scanner-primary", "fingerprint": "7197a05bb4fb7cd6", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-36dbb46a5b2b75e2", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 bot-legacy/bridge/KTPBridge.ts:157"}, "properties": {"repobilityId": "576713eb88e0ebc4", "scanner": "scanner-primary", "fingerprint": "36dbb46a5b2b75e2", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-3a7032c235b9c183", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/components/SignupDrawer.tsx:53"}, "properties": {"repobilityId": "8afa55ff7a0a911d", "scanner": "scanner-primary", "fingerprint": "3a7032c235b9c183", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-2fa6d7bd67a6f5d6", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/app/settings/page.tsx:84"}, "properties": {"repobilityId": "5ae537fc2d830745", "scanner": "scanner-primary", "fingerprint": "2fa6d7bd67a6f5d6", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-1217fcfb46fb560c", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/app/rules/edit/page.tsx:86"}, "properties": {"repobilityId": "d16813a5e2bec5cd", "scanner": "scanner-primary", "fingerprint": "1217fcfb46fb560c", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-0e700b637bbf95e5", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/app/events/page.tsx:54"}, "properties": {"repobilityId": "8b0dfd2382b44d46", "scanner": "scanner-primary", "fingerprint": "0e700b637bbf95e5", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-91381efb1356cda9", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/app/events/new/page.tsx:115"}, "properties": {"repobilityId": "cbda14c1beb10001", "scanner": "scanner-primary", "fingerprint": "91381efb1356cda9", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-b1c6d526239e2bbb", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/app/events/[id]/page.tsx:93"}, "properties": {"repobilityId": "1fead49e53668aeb", "scanner": "scanner-primary", "fingerprint": "b1c6d526239e2bbb", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-61fecfe3a34199e6", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/app/events/[id]/draft/page.tsx:137"}, "properties": {"repobilityId": "343c2b4d62b650b6", "scanner": "scanner-primary", "fingerprint": "61fecfe3a34199e6", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-5c19fd469be82354", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/app/events/[id]/draft/lobby/page.tsx:82"}, "properties": {"repobilityId": "ec06e3b749467bf9", "scanner": "scanner-primary", "fingerprint": "5c19fd469be82354", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-dbc5fc753de0b28d", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/app/events/[id]/teams/page.tsx:70"}, "properties": {"repobilityId": "ec32f2b7c6ff3ae0", "scanner": "scanner-primary", "fingerprint": "dbc5fc753de0b28d", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-e55c4d097ad220e5", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/app/events/[id]/tournament/page.tsx:156"}, "properties": {"repobilityId": "fcea2aaab31b47d7", "scanner": "scanner-primary", "fingerprint": "e55c4d097ad220e5", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-ac0d0542fe179457", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/app/events/[id]/edit/page.tsx:69"}, "properties": {"repobilityId": "07f0064ef5c359d1", "scanner": "scanner-primary", "fingerprint": "ac0d0542fe179457", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-18aadc3af1ce6fb6", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/app/events/[id]/tournament-setup/page.tsx:58"}, "properties": {"repobilityId": "9709e859a9cb199b", "scanner": "scanner-primary", "fingerprint": "18aadc3af1ce6fb6", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-bb18e5fa8a6363a5", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/app/api/draft/[id]/reset/route.ts:48"}, "properties": {"repobilityId": "63c9ce21a3d6d928", "scanner": "scanner-primary", "fingerprint": "bb18e5fa8a6363a5", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-af5768df635e29ce", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/app/api/draft/[id]/lobby/route.ts:73"}, "properties": {"repobilityId": "51273975d2cbc8f2", "scanner": "scanner-primary", "fingerprint": "af5768df635e29ce", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-97af638dd63041f8", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/app/api/tournaments/[id]/matches/[matchId]/route.ts:368"}, "properties": {"repobilityId": "3c2753c14e07e872", "scanner": "scanner-primary", "fingerprint": "97af638dd63041f8", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-40aebf814f81a98f", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/app/api/verify/callback/route.ts:72"}, "properties": {"repobilityId": "587a3a9968a6d3be", "scanner": "scanner-primary", "fingerprint": "40aebf814f81a98f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-b69acf3f04f17604", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/app/api/verify/grant/route.ts:42"}, "properties": {"repobilityId": "83124adeb967b44c", "scanner": "scanner-primary", "fingerprint": "b69acf3f04f17604", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-094687b34b28284a", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/app/dashboard/page.tsx:60"}, "properties": {"repobilityId": "ef75a3772e9936db", "scanner": "scanner-primary", "fingerprint": "094687b34b28284a", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-90fbcb9b9db940e0", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/app/admin/audit/page.tsx:118"}, "properties": {"repobilityId": "00009b773173f299", "scanner": "scanner-primary", "fingerprint": "90fbcb9b9db940e0", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-e66d055863d5a77a", "level": "note", "message": {"text": "Legacy-named symbol `DevLogLegacy` in src/app/dev/log/page.tsx:3"}, "properties": {"repobilityId": "96153384c953908c", "scanner": "scanner-primary", "fingerprint": "e66d055863d5a77a", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-ba2fdbd363be2eaa", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/app/portal/page.tsx:118"}, "properties": {"repobilityId": "861ccff1fdbfb67a", "scanner": "scanner-primary", "fingerprint": "ba2fdbd363be2eaa", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-d18c0556cbf8179c", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/app/portal/[id]/page.tsx:83"}, "properties": {"repobilityId": "e984a197bc89ba53", "scanner": "scanner-primary", "fingerprint": "d18c0556cbf8179c", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}]}]}