{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "JRN005", "name": "Compliance or security claim is near a placeholder link", "shortDescription": {"text": "Compliance or security claim is near a placeholder link"}, "fullDescription": {"text": "Link trust claims to current evidence, downgrade unverifiable wording, and replace placeholder footer/legal/security links with real destinations."}, "properties": {"scanner": "repobility-journey-contract", "category": "quality", "severity": "medium", "confidence": 0.76, "cwe": "", "owasp": ""}}, {"id": "JRN002", "name": "Browser storage is used for session token material", "shortDescription": {"text": "Browser storage is used for session token material"}, "fullDescription": {"text": "Prefer httpOnly, Secure, SameSite cookies or short-lived in-memory tokens. Avoid persistent browser storage for access, refresh, ID, or partner session tokens."}, "properties": {"scanner": "repobility-journey-contract", "category": "auth", "severity": "medium", "confidence": 0.82, "cwe": "", "owasp": ""}}, {"id": "DKR007", "name": "Docker build context has no .dockerignore", "shortDescription": {"text": "Docker build context has no .dockerignore"}, "fullDescription": {"text": "Add .dockerignore with at least .git, .env, private keys, dependency folders, build outputs, and local databases."}, "properties": {"scanner": "repobility-docker", "category": "docker", "severity": "medium", "confidence": 0.9, "cwe": "", "owasp": ""}}, {"id": "DKR001", "name": "Docker final stage has no non-root USER", "shortDescription": {"text": "Docker final stage has no non-root USER"}, "fullDescription": {"text": "Add a non-root USER in the final runtime stage after files and permissions are prepared."}, "properties": {"scanner": "repobility-docker", "category": "docker", "severity": "medium", "confidence": 0.82, "cwe": "", "owasp": ""}}, {"id": "AGT007", "name": "localStorage write failures are swallowed silently", "shortDescription": {"text": "localStorage write failures are swallowed silently"}, "fullDescription": {"text": "Handle QuotaExceededError explicitly, show a toast or error state, and guide the user to export/clear old local data. Log non-quota failures for diagnostics."}, "properties": {"scanner": "repobility-agent-runtime", "category": "quality", "severity": "medium", "confidence": 0.8, "cwe": "", "owasp": ""}}, {"id": "AGT012", "name": "Agent control bridge may listen on a network interface without visible auth", "shortDescription": {"text": "Agent control bridge may listen on a network interface without visible auth"}, "fullDescription": {"text": "Bind local agent bridges to 127.0.0.1 by default. If remote access is required, require a bearer token or mTLS, enforce origin/CSRF checks for browser clients, and document the threat model."}, "properties": {"scanner": "repobility-agent-runtime", "category": "quality", "severity": "medium", "confidence": 0.72, "cwe": "", "owasp": ""}}, {"id": "AIC004", "name": "Suspicious implementation file appears unreferenced", "shortDescription": {"text": "Suspicious implementation file appears unreferenced"}, "fullDescription": {"text": "Confirm whether this file is reachable. If not, delete it; if yes, wire it through explicit imports, routes, or entry points and add a test that proves the path executes."}, "properties": {"scanner": "repobility-ai-code-hygiene", "category": "quality", "severity": "medium", "confidence": 0.78, "cwe": "", "owasp": ""}}, {"id": "AIC001", "name": "Parallel implementation file sits beside a canonical file", "shortDescription": {"text": "Parallel implementation file sits beside a canonical file"}, "fullDescription": {"text": "Merge the intended change into the canonical file, update tests/imports, and delete the parallel implementation if it is not the active entry point."}, "properties": {"scanner": "repobility-ai-code-hygiene", "category": "quality", "severity": "medium", "confidence": 0.82, "cwe": "", "owasp": ""}}, {"id": "ERR002", "name": "[ERR002] Empty Catch Block: Empty catch blocks hide errors.", "shortDescription": {"text": "[ERR002] Empty Catch Block: Empty catch blocks hide errors."}, "fullDescription": {"text": "Log the error or rethrow it. Use console.error() at minimum."}, "properties": {"scanner": "repobility-threat-engine", "category": "error_handling", "severity": "medium", "confidence": 1.0, "cwe": "", "owasp": ""}}, {"id": "COMP001", "name": "[COMP001] High cognitive complexity: Function `format_table` has cognitive complexity 23 (SonarSource scale). Cognitive ", "shortDescription": {"text": "[COMP001] High cognitive complexity: Function `format_table` has cognitive complexity 23 (SonarSource scale). Cognitive complexity measures how hard the function is for a human to understand \u2014 nested branches, boolean chains, and recursion "}, "fullDescription": {"text": "Extract nested branches into named helper functions; flatten early-return / guard clauses; replace long if/elif chains with dispatch dicts or polymorphism. SonarQube's threshold for 'should refactor' is 15 \u2014 yours is 23."}, "properties": {"scanner": "repobility-threat-engine", "category": "quality", "severity": "medium", "confidence": 0.95, "cwe": "", "owasp": ""}}, {"id": "SEC045", "name": "[SEC045] eval()/exec() on stored or user-supplied data: eval() and exec() on data \u2014 even admin-stored data \u2014 is a latera", "shortDescription": {"text": "[SEC045] eval()/exec() on stored or user-supplied data: eval() and exec() on data \u2014 even admin-stored data \u2014 is a lateral-movement vector after any one credential compromise. Sandboxes (__builtins__ cleared) are escapable: attackers use obj"}, "fullDescription": {"text": "For literal data structures: use ast.literal_eval(text) \u2014 only parses literals, raises on code.\nFor formula evaluation: use asteval or simpleeval (purpose-built sandboxes with allow-lists).\nFor Odoo: use odoo.tools.safe_eval(expr, locals_dict, mode='exec').\nIf you genuinely need to execute admin-stored code: require explicit super-admin permission AND log every execution with a stack trace."}, "properties": {"scanner": "repobility-threat-engine", "category": "injection", "severity": "medium", "confidence": 1.0, "cwe": "", "owasp": ""}}, {"id": "CORE_NO_CI", "name": "No CI/CD configuration found", "shortDescription": {"text": "No CI/CD configuration found"}, "fullDescription": {"text": "Add a CI/CD pipeline: create .github/workflows/ci.yml for GitHub Actions with steps to lint, test, and build on every push and pull request."}, "properties": {"scanner": "repobility-core", "category": "practices", "severity": "medium", "confidence": null, "cwe": "", "owasp": ""}}, {"id": "AIC005", "name": "Duplicate top-level symbol appears in a patch-style file", "shortDescription": {"text": "Duplicate top-level symbol appears in a patch-style file"}, "fullDescription": {"text": "Keep one authoritative implementation, update imports to point at it, and remove or rename the duplicate symbol."}, "properties": {"scanner": "repobility-ai-code-hygiene", "category": "quality", "severity": "low", "confidence": 0.64, "cwe": "", "owasp": ""}}, {"id": "AIC003", "name": "Duplicated implementation block across source files", "shortDescription": {"text": "Duplicated implementation block across source files"}, "fullDescription": {"text": "Extract the shared behavior into one function/module or delete the inactive duplicate after proving which path is used."}, "properties": {"scanner": "repobility-ai-code-hygiene", "category": "quality", "severity": "low", "confidence": 0.86, "cwe": "", "owasp": ""}}, {"id": "AIC002", "name": "Source file name looks like an AI patch artifact", "shortDescription": {"text": "Source file name looks like an AI patch artifact"}, "fullDescription": {"text": "Rename it to the domain concept it implements or merge it into the existing module it was meant to change."}, "properties": {"scanner": "repobility-ai-code-hygiene", "category": "quality", "severity": "low", "confidence": 0.62, "cwe": "", "owasp": ""}}, {"id": "AIC006", "name": "Archive or legacy directory is mixed into the active repository root", "shortDescription": {"text": "Archive or legacy directory is mixed into the active repository root"}, "fullDescription": {"text": "Move archived code out of the active repository, mark it with .repobilityignore, or document exactly why it must stay and how scanners should treat it."}, "properties": {"scanner": "repobility-ai-code-hygiene", "category": "quality", "severity": "low", "confidence": 0.68, "cwe": "", "owasp": ""}}, {"id": "SEC132", "name": "[SEC132] String concat where the language has interpolation (AI style drift): String built by concatenation where the la", "shortDescription": {"text": "[SEC132] String concat where the language has interpolation (AI style drift): String built by concatenation where the language has cleaner interpolation (Python f-strings since 3.6, JS template literals since ES6). Not a vulnerability on it"}, "fullDescription": {"text": "Python: `f\"prefix {var} suffix\"`. JS/TS: `` `prefix ${var} suffix` ``. Add a lint rule (pyupgrade UP032, eslint prefer-template) so future PRs catch this automatically."}, "properties": {"scanner": "repobility-threat-engine", "category": "quality", "severity": "low", "confidence": 1.0, "cwe": "", "owasp": ""}}, {"id": "SEC006", "name": "[SEC006] XSS Risk: Direct HTML injection without sanitization.", "shortDescription": {"text": "[SEC006] XSS Risk: Direct HTML injection without sanitization."}, "fullDescription": {"text": "Use textContent instead of innerHTML. Sanitize with DOMPurify."}, "properties": {"scanner": "repobility-threat-engine", "category": "injection", "severity": "low", "confidence": 0.4, "cwe": "", "owasp": ""}}, {"id": "CORE_NO_LICENSE", "name": "No LICENSE file", "shortDescription": {"text": "No LICENSE file"}, "fullDescription": {"text": "Add a LICENSE file to your repository. Use choosealicense.com to pick the right license (MIT for permissive, Apache 2.0 for patent protection, GPL for copyleft)."}, "properties": {"scanner": "repobility-core", "category": "documentation", "severity": "low", "confidence": null, "cwe": "", "owasp": ""}}, {"id": "MINED054", "name": "[MINED054] Ts As Any (and 1 more): Same pattern found in 1 additional files. Review if needed.", "shortDescription": {"text": "[MINED054] Ts As Any (and 1 more): Same pattern found in 1 additional files. Review if needed."}, "fullDescription": {"text": "Review and fix per the pattern semantics. See CWE-704 /  for context."}, "properties": {"scanner": "repobility-threat-engine", "category": "quality", "severity": "info", "confidence": 0.2, "cwe": "", "owasp": ""}}, {"id": "SEC135", "name": "[SEC135] Auth/permission check missing on AI-generated endpoint (and 6 more): Same pattern found in 6 additional files. ", "shortDescription": {"text": "[SEC135] Auth/permission check missing on AI-generated endpoint (and 6 more): Same pattern found in 6 additional files. Review if needed."}, "fullDescription": {"text": "Add the project's auth decorator/middleware: `@login_required` (Django/Flask), `@permission_classes([IsAuthenticated])` (DRF), `Depends(get_current_user)` (FastAPI), `requireAuth` middleware (Express). For genuinely public endpoints, add a `# public-endpoint` marker comment so future scans skip them."}, "properties": {"scanner": "repobility-threat-engine", "category": "quality", "severity": "info", "confidence": 0.2, "cwe": "", "owasp": ""}}, {"id": "MINED049", "name": "[MINED049] Print Pii: Logging password/token/email/ssn directly to stdout.", "shortDescription": {"text": "[MINED049] Print Pii: Logging password/token/email/ssn directly to stdout."}, "fullDescription": {"text": "Review and fix per the pattern semantics. See CWE-532 / A09:2021 for context."}, "properties": {"scanner": "repobility-threat-engine", "category": "quality", "severity": "info", "confidence": 1.0, "cwe": "", "owasp": ""}}, {"id": "MINED067", "name": "[MINED067] Python Requests No Timeout (and 3 more): Same pattern found in 3 additional files. Review if needed.", "shortDescription": {"text": "[MINED067] Python Requests No Timeout (and 3 more): Same pattern found in 3 additional files. Review if needed."}, "fullDescription": {"text": "Review and fix per the pattern semantics. See CWE-400 /  for context."}, "properties": {"scanner": "repobility-threat-engine", "category": "quality", "severity": "info", "confidence": 0.2, "cwe": "", "owasp": ""}}, {"id": "SEC078", "name": "[SEC078] Python: requests without timeout (and 3 more): Same pattern found in 3 additional files. Review if needed.", "shortDescription": {"text": "[SEC078] Python: requests without timeout (and 3 more): Same pattern found in 3 additional files. Review if needed."}, "fullDescription": {"text": "Add `timeout=10` (or appropriate value) to every requests call."}, "properties": {"scanner": "repobility-threat-engine", "category": "quality", "severity": "info", "confidence": 0.2, "cwe": "", "owasp": ""}}, {"id": "SEC020", "name": "[SEC020] Secret Printed to Logs (and 1 more): Same pattern found in 1 additional files. Review if needed.", "shortDescription": {"text": "[SEC020] Secret Printed to Logs (and 1 more): Same pattern found in 1 additional files. Review if needed."}, "fullDescription": {"text": "Log only redacted, hashed, or last-four-style metadata. Rotate any secret that may have reached logs."}, "properties": {"scanner": "repobility-threat-engine", "category": "credential_exposure", "severity": "info", "confidence": 0.2, "cwe": "", "owasp": ""}}, {"id": "MINED056", "name": "[MINED056] React Key As Index: key={index} in map() \u2014 re-renders the wrong elements on re-order.", "shortDescription": {"text": "[MINED056] React Key As Index: key={index} in map() \u2014 re-renders the wrong elements on re-order."}, "fullDescription": {"text": "Review and fix per the pattern semantics. See CWE-682 /  for context."}, "properties": {"scanner": "repobility-threat-engine", "category": "quality", "severity": "info", "confidence": 1.0, "cwe": "", "owasp": ""}}, {"id": "MINED077", "name": "[MINED077] Python Open No Context: fp = open(path) outside with-block leaks file handles.", "shortDescription": {"text": "[MINED077] Python Open No Context: fp = open(path) outside with-block leaks file handles."}, "fullDescription": {"text": "Review and fix per the pattern semantics. See CWE-772 /  for context."}, "properties": {"scanner": "repobility-threat-engine", "category": "quality", "severity": "info", "confidence": 1.0, "cwe": "", "owasp": ""}}, {"id": "MINED050", "name": "[MINED050] Stub Only Function: Function declared but body is just pass, return None, raise NotImplementedError, or TODO ", "shortDescription": {"text": "[MINED050] Stub Only Function: Function declared but body is just pass, return None, raise NotImplementedError, or TODO comment."}, "fullDescription": {"text": "Review and fix per the pattern semantics. See CWE-1188 /  for context."}, "properties": {"scanner": "repobility-threat-engine", "category": "quality", "severity": "info", "confidence": 1.0, "cwe": "", "owasp": ""}}, {"id": "SEC085", "name": "[SEC085] JS: child_process.exec with non-literal (and 2 more): Same pattern found in 2 additional files. Review if neede", "shortDescription": {"text": "[SEC085] JS: child_process.exec with non-literal (and 2 more): Same pattern found in 2 additional files. Review if needed."}, "fullDescription": {"text": "Use execFile / spawn with separate args array; never pass shell strings."}, "properties": {"scanner": "repobility-threat-engine", "category": "quality", "severity": "info", "confidence": 0.2, "cwe": "", "owasp": ""}}, {"id": "MINED044", "name": "[MINED044] Js Console Log Prod (and 41 more): Same pattern found in 41 additional files. Review if needed.", "shortDescription": {"text": "[MINED044] Js Console Log Prod (and 41 more): Same pattern found in 41 additional files. Review if needed."}, "fullDescription": {"text": "Review and fix per the pattern semantics. See CWE-532 /  for context."}, "properties": {"scanner": "repobility-threat-engine", "category": "quality", "severity": "info", "confidence": 0.2, "cwe": "", "owasp": ""}}, {"id": "MINED043", "name": "[MINED043] Http Not Https: Hardcoded http:// (not localhost) for endpoints that handle credentials or data.", "shortDescription": {"text": "[MINED043] Http Not Https: Hardcoded http:// (not localhost) for endpoints that handle credentials or data."}, "fullDescription": {"text": "Review and fix per the pattern semantics. See CWE-319 / A02:2021 for context."}, "properties": {"scanner": "repobility-threat-engine", "category": "quality", "severity": "info", "confidence": 1.0, "cwe": "", "owasp": ""}}, {"id": "SEC128", "name": "[SEC128] Async function without await \u2014 fire-and-forget Promise (AI mistake) (and 6 more): Same pattern found in 6 addit", "shortDescription": {"text": "[SEC128] Async function without await \u2014 fire-and-forget Promise (AI mistake) (and 6 more): Same pattern found in 6 additional files. Review if needed."}, "fullDescription": {"text": "Add `await` before each async call, or chain with `.then`. If you intentionally want fire-and-forget, prefix with `void` (TS) or assign to `_` (Python with `asyncio.create_task`) to make the intent explicit and survive lint."}, "properties": {"scanner": "repobility-threat-engine", "category": "quality", "severity": "info", "confidence": 0.2, "cwe": "", "owasp": ""}}, {"id": "MINED098", "name": "[MINED098] Global Scope Pollution: Attaching libraries/objects directly to the global window scope (e.g., `window.axios ", "shortDescription": {"text": "[MINED098] Global Scope Pollution: Attaching libraries/objects directly to the global window scope (e.g., `window.axios = axios;`) makes the code harder to test and increases the risk of naming collisions."}, "fullDescription": {"text": "Import the library where you need it instead of attaching to window. For legitimate global registries, use a namespaced object (e.g., `window.__myApp.axios`)."}, "properties": {"scanner": "repobility-threat-engine", "category": "quality", "severity": "info", "confidence": 1.0, "cwe": "", "owasp": ""}}, {"id": "SEC001", "name": "[SEC001] Hardcoded Password: Hardcoded password found in source code.", "shortDescription": {"text": "[SEC001] Hardcoded Password: Hardcoded password found in source code."}, "fullDescription": {"text": "Use environment variables or a secrets manager."}, "properties": {"scanner": "repobility-threat-engine", "category": "credential_exposure", "severity": "info", "confidence": 0.1, "cwe": "", "owasp": ""}}, {"id": "MINED134", "name": "[MINED134] Binary file `Clients/Couch Heroes/production/__pycache__/build_v12_clean.cpython-312.pyc` committed in source", "shortDescription": {"text": "[MINED134] Binary file `Clients/Couch Heroes/production/__pycache__/build_v12_clean.cpython-312.pyc` committed in source repo: `Clients/Couch Heroes/production/__pycache__/build_v12_clean.cpython-312.pyc` is a .pyc binary (82,580 bytes) com"}, "fullDescription": {"text": "Audit the binary's provenance. If it's vendored library code, document it in a VENDORED.md. If it's a build artifact, add the extension to .gitignore and rebuild from source."}, "properties": {"scanner": "repobility-supply-chain", "category": "dependency", "severity": "high", "confidence": 0.9, "cwe": "", "owasp": ""}}, {"id": "MINED118", "name": "[MINED118] Dockerfile FROM `node:20-alpine` not pinned by digest: `FROM node:20-alpine` resolves the tag at build time. ", "shortDescription": {"text": "[MINED118] Dockerfile FROM `node:20-alpine` not pinned by digest: `FROM node:20-alpine` resolves the tag at build time. The registry CAN re-push a different image for the same tag, so every build is potentially different. Production images "}, "fullDescription": {"text": "Replace with: `FROM node:20-alpine@sha256:<digest>`. Get the digest from `docker manifest inspect`. Re-pin via a scheduled bot (Renovate, Dependabot)."}, "properties": {"scanner": "repobility-supply-chain", "category": "dependency", "severity": "high", "confidence": 0.9, "cwe": "", "owasp": ""}}, {"id": "MINED113", "name": "[MINED113] Express POST /api/expenses has no auth: Express route POST /api/expenses declared without an auth middleware ", "shortDescription": {"text": "[MINED113] Express POST /api/expenses has no auth: Express route POST /api/expenses declared without an auth middleware in its handler chain. Destructive methods (POST/PUT/DELETE/PATCH) on unauthenticated routes are OWASP A01:2021 broken ac"}, "fullDescription": {"text": "Add an auth middleware: app.post('/api/expenses', requireAuth, handler) \u2014 or mount the router under app.use('/api', authMiddleware) and ensure the path is covered. If truly public, mark with a comment."}, "properties": {"scanner": "repobility-route-auth", "category": "quality", "severity": "high", "confidence": 0.8, "cwe": "", "owasp": ""}}, {"id": "JRN009", "name": "Secret-like setting is echoed into a password input value", "shortDescription": {"text": "Secret-like setting is echoed into a password input value"}, "fullDescription": {"text": "Never prefill secret fields with stored values. Show a masked status such as configured/not configured, require explicit rotation to replace the value, and return the raw key only once at creation time."}, "properties": {"scanner": "repobility-journey-contract", "category": "auth", "severity": "high", "confidence": 0.83, "cwe": "", "owasp": ""}}, {"id": "DKR014", "name": "Dockerfile copies the entire context without .dockerignore", "shortDescription": {"text": "Dockerfile copies the entire context without .dockerignore"}, "fullDescription": {"text": "Create .dockerignore before using broad context copies, or copy only the required files and directories."}, "properties": {"scanner": "repobility-docker", "category": "docker", "severity": "high", "confidence": 0.92, "cwe": "", "owasp": ""}}, {"id": "SEC114", "name": "[SEC114] path.join / Path() on user-controlled segment without containment check: filepath.Clean / path.Join on attacker", "shortDescription": {"text": "[SEC114] path.join / Path() on user-controlled segment without containment check: filepath.Clean / path.Join on attacker-supplied segments does NOT prevent escape from the base directory. `../../../etc/passwd` resolves cleanly."}, "fullDescription": {"text": "After joining, re-check containment: `if !strings.HasPrefix(filepath.Clean(joined), filepath.Clean(baseDir)+string(os.PathSeparator)) { error }`. In Node: `path.resolve(base, x); if (!resolved.startsWith(base + path.sep)) throw`."}, "properties": {"scanner": "repobility-threat-engine", "category": "path_traversal", "severity": "high", "confidence": 1.0, "cwe": "", "owasp": ""}}, {"id": "SEC029", "name": "[SEC029] Server-Side Request Forgery (SSRF) \u2014 outbound HTTP from user input: Outbound HTTP request to a user-controlled ", "shortDescription": {"text": "[SEC029] Server-Side Request Forgery (SSRF) \u2014 outbound HTTP from user input: Outbound HTTP request to a user-controlled URL without allowlist validation. Attackers can probe internal services (169.254.169.254 metadata, internal Kubernetes e"}, "fullDescription": {"text": "Validate the URL against an allowlist BEFORE fetching:\n  ALLOWED = {'images.example.com', 'cdn.example.com'}\n  host = urlparse(url).hostname\n  if host not in ALLOWED: abort(400)\nOr use a server-side proxy (Imgproxy / serve-files-only-from-S3) that isolates outbound network access from the request handler.\nBlock private CIDRs explicitly: 10/8, 172.16/12, 192.168/16, 169.254/16."}, "properties": {"scanner": "repobility-threat-engine", "category": "ssrf", "severity": "high", "confidence": 1.0, "cwe": "", "owasp": ""}}, {"id": "SEC040", "name": "[SEC040] innerHTML XSS \u2014 template literal with server-supplied data: Setting .innerHTML with a template literal that int", "shortDescription": {"text": "[SEC040] innerHTML XSS \u2014 template literal with server-supplied data: Setting .innerHTML with a template literal that interpolates server-supplied or user-supplied data is the canonical stored/reflected XSS vector. The browser parses the HTM"}, "fullDescription": {"text": "For plain text: use el.textContent = data.value (auto-escapes).\nFor HTML you need to render: el.innerHTML = DOMPurify.sanitize(html).\nFor React/Vue/Svelte: stop using innerHTML; use the framework's binding.\nWhen data comes from CV/PDF parsers, sanitize at the parser boundary too."}, "properties": {"scanner": "repobility-threat-engine", "category": "xss", "severity": "high", "confidence": 1.0, "cwe": "", "owasp": ""}}, {"id": "MINED021", "name": "[MINED021] Path Traversal Os Join: os.path.join(user_dir, filename) where filename can contain \"../\" \u2014 directory escape.", "shortDescription": {"text": "[MINED021] Path Traversal Os Join: os.path.join(user_dir, filename) where filename can contain \"../\" \u2014 directory escape."}, "fullDescription": {"text": "Review and fix per the pattern semantics. See CWE-22 / A01:2021 for context."}, "properties": {"scanner": "repobility-threat-engine", "category": "quality", "severity": "high", "confidence": 1.0, "cwe": "", "owasp": ""}}, {"id": "MINED001", "name": "[MINED001] Bare Except Pass: except: pass or except Exception: pass \u2014 silently swallows everything including KeyboardInt", "shortDescription": {"text": "[MINED001] Bare Except Pass: except: pass or except Exception: pass \u2014 silently swallows everything including KeyboardInterrupt and bugs."}, "fullDescription": {"text": "Review and fix per the pattern semantics. See CWE-755 /  for context."}, "properties": {"scanner": "repobility-threat-engine", "category": "quality", "severity": "high", "confidence": 1.0, "cwe": "", "owasp": ""}}, {"id": "SEC103", "name": "[SEC103] LDAP injection \u2014 non-constant search filter: User input concatenated into an LDAP search filter. Attackers inje", "shortDescription": {"text": "[SEC103] LDAP injection \u2014 non-constant search filter: User input concatenated into an LDAP search filter. Attackers inject `*)(uid=*` style payloads to bypass auth or enumerate accounts."}, "fullDescription": {"text": "Escape with javax.naming.ldap.Rdn.escapeValue or equivalent. For python-ldap, use ldap.filter.escape_filter_chars. Better: use parameterized search APIs (Spring LdapTemplate filter encoders)."}, "properties": {"scanner": "repobility-threat-engine", "category": "injection", "severity": "high", "confidence": 1.0, "cwe": "", "owasp": ""}}, {"id": "MINED004", "name": "[MINED004] Weak Crypto: MD5/SHA1/DES/RC4 used for security context (not just checksums).", "shortDescription": {"text": "[MINED004] Weak Crypto: MD5/SHA1/DES/RC4 used for security context (not just checksums)."}, "fullDescription": {"text": "Review and fix per the pattern semantics. See CWE-327 / A02:2021 for context."}, "properties": {"scanner": "repobility-threat-engine", "category": "quality", "severity": "high", "confidence": 1.0, "cwe": "", "owasp": ""}}, {"id": "MINED114", "name": "[MINED114] Admin endpoint without auth: POST /api/admin/granola-sync: Express route on /admin path (/api/admin/granola-s", "shortDescription": {"text": "[MINED114] Admin endpoint without auth: POST /api/admin/granola-sync: Express route on /admin path (/api/admin/granola-sync) with no auth middleware."}, "fullDescription": {"text": "Add an auth middleware: app.post('/api/admin/granola-sync', requireAuth, handler) \u2014 or mount the router under app.use('/api', authMiddleware) and ensure the path is covered. If truly public, mark with a comment."}, "properties": {"scanner": "repobility-route-auth", "category": "quality", "severity": "critical", "confidence": 0.8, "cwe": "", "owasp": ""}}, {"id": "MINED107", "name": "[MINED107] Missing import: `gc` used but not imported: The file uses `gc.something(...)` but never imports `gc`. This ra", "shortDescription": {"text": "[MINED107] Missing import: `gc` used but not imported: The file uses `gc.something(...)` but never imports `gc`. This raises NameError at runtime the first time the line executes."}, "fullDescription": {"text": "Add `import gc` at the top of the file."}, "properties": {"scanner": "repobility-ast-engine", "category": "quality", "severity": "critical", "confidence": 1.0, "cwe": "", "owasp": ""}}, {"id": "SEC022", "name": "[SEC022] Database URL With Embedded Credential: A database connection URL contains an embedded username and password. Th", "shortDescription": {"text": "[SEC022] Database URL With Embedded Credential: A database connection URL contains an embedded username and password. These URLs are often copied into defaults, docs, and scripts, then leak working credentials."}, "fullDescription": {"text": "Remove the embedded password, require the URL from a secret store or environment variable, and rotate the database credential."}, "properties": {"scanner": "repobility-threat-engine", "category": "credential_exposure", "severity": "critical", "confidence": 1.0, "cwe": "", "owasp": ""}}, {"id": "MINED007", "name": "[MINED007] Sql String Concat: cursor.execute(f\"... {user_input} ...\") \u2014 SQL injection.", "shortDescription": {"text": "[MINED007] Sql String Concat: cursor.execute(f\"... {user_input} ...\") \u2014 SQL injection."}, "fullDescription": {"text": "Review and fix per the pattern semantics. See CWE-89 / A03:2021 for context."}, "properties": {"scanner": "repobility-threat-engine", "category": "quality", "severity": "critical", "confidence": 1.0, "cwe": "", "owasp": ""}}, {"id": "scanner-6372cebde0220094", "name": "No auth library detected", "shortDescription": {"text": "No auth library detected"}, "fullDescription": {"text": "The scanner did not find any standard auth library (JWT, OAuth, NextAuth, Auth0, etc.). The repo has auth/admin/session surface indicators, so auth may live in custom code, in a separate service, or be missing."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 18 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-bea357a6497a2d5d", "name": "Agent authority lacks a verifier contract: CLAUDE.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: CLAUDE.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-08e3339d29ee1acd", "name": "Network/subprocess call without timeout or try/except \u2014 fix_goals_acronyms.py:163", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 fix_goals_acronyms.py:163"}, "fullDescription": {"text": "`requests.get(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/25511"}, "properties": {"repository": "Draigus/NBIAI-TEAM", "repoUrl": "https://github.com/Draigus/NBIAI-TEAM", "branch": "master"}, "results": [{"ruleId": "JRN005", "level": "warning", "message": {"text": "Compliance or security claim is near a placeholder link"}, "properties": {"repobilityId": 224021, "scanner": "repobility-journey-contract", "fingerprint": "07309ec420809ccf2afd1377af2663a2d90106efb701cea7dbf08be1c1ea616f", "category": "quality", "severity": "medium", "confidence": 0.76, "triageState": "open", "verdict": "likely", "isResolved": false, "reason": "Placeholder link appears near compliance/security claim text.", "evidence": {"rule_id": "JRN005", "scanner": "repobility-journey-contract", "references": ["https://repobility.com/library/authorization/"], "correlation_key": "fp|07309ec420809ccf2afd1377af2663a2d90106efb701cea7dbf08be1c1ea616f"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "company/knowledge/design-templates/web-prototype-taste-soft/example.html"}, "region": {"startLine": 529}}}]}, {"ruleId": "JRN002", "level": "warning", "message": {"text": "Browser storage is used for session token material"}, "properties": {"repobilityId": 224020, "scanner": "repobility-journey-contract", "fingerprint": "337fb737285a3bbd1c8aaedee6a3e2204cb7f0a7e6e8a5376ae3b4afd8ff04f7", "category": "auth", "severity": "medium", "confidence": 0.82, "triageState": "open", "verdict": "likely", "isResolved": false, "reason": "Storage API call references token-like key or value names.", "evidence": {"rule_id": "JRN002", "scanner": "repobility-journey-contract", "references": ["https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html"], "correlation_key": "code|auth|token|36|jrn002"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "_archive/nbiai_app/app/client/src/lib/websocket.ts"}, "region": {"startLine": 36}}}]}, {"ruleId": "DKR007", "level": "warning", "message": {"text": "Docker build context has no .dockerignore"}, "properties": {"repobilityId": 224019, "scanner": "repobility-docker", "fingerprint": "c98378cf8c37e4866e89d6ca06a24b7e8c44654aa34e6e4bf1367c4a4c0c5b44", "category": "docker", "severity": "medium", "confidence": 0.9, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Dockerfile exists but repository root has no .dockerignore.", "evidence": {"rule_id": "DKR007", "scanner": "repobility-docker", "references": ["https://docs.docker.com/develop/develop-images/dockerfile_best-practices/"], "correlation_key": "fp|c98378cf8c37e4866e89d6ca06a24b7e8c44654aa34e6e4bf1367c4a4c0c5b44"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".dockerignore"}, "region": {"startLine": 1}}}]}, {"ruleId": "DKR001", "level": "warning", "message": {"text": "Docker final stage has no non-root USER"}, "properties": {"repobilityId": 224018, "scanner": "repobility-docker", "fingerprint": "6edbf7fa824bce8b11f315800d646aa3e0bdd0dc9daefee4f9314b8e4280a074", "category": "docker", "severity": "medium", "confidence": 0.82, "triageState": "open", "verdict": "likely", "isResolved": false, "reason": "No USER directive was found in the final runtime stage.", "evidence": {"rule_id": "DKR001", "scanner": "repobility-docker", "final_base": "base", "references": ["https://docs.docker.com/develop/develop-images/dockerfile_best-practices/", "https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html", "https://github.com/hadolint/hadolint"], "correlation_key": "fp|6edbf7fa824bce8b11f315800d646aa3e0bdd0dc9daefee4f9314b8e4280a074"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "_archive/nbiai_app/app/Dockerfile"}, "region": {"startLine": 30}}}]}, {"ruleId": "AGT007", "level": "warning", "message": {"text": "localStorage write failures are swallowed silently"}, "properties": {"repobilityId": 224016, "scanner": "repobility-agent-runtime", "fingerprint": "b9593f9674423ebf9ba8f5f04f3791369509bf7902cb4775788a0ca0f4528e5d", "category": "quality", "severity": "medium", "confidence": 0.8, "triageState": "open", "verdict": "likely", "isResolved": false, "reason": "File writes to localStorage and has an empty or ignore-only catch block without QuotaExceededError handling.", "evidence": {"rule_id": "AGT007", "scanner": "repobility-agent-runtime", "references": ["https://developer.mozilla.org/en-US/docs/Web/API/Web_Storage_API"], "correlation_key": "fp|b9593f9674423ebf9ba8f5f04f3791369509bf7902cb4775788a0ca0f4528e5d"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "_archive/nbiai_app/app/client/src/components/layout/AppShell.tsx"}, "region": {"startLine": 204}}}]}, {"ruleId": "AGT012", "level": "warning", "message": {"text": "Agent control bridge may listen on a network interface without visible auth"}, "properties": {"repobilityId": 224015, "scanner": "repobility-agent-runtime", "fingerprint": "d47258a801565499048fc0a044ec8e7f4eeae5158b06d41bd939cc0b19a1babf", "category": "quality", "severity": "medium", "confidence": 0.72, "triageState": "open", "verdict": "likely", "isResolved": false, "reason": "File combines agent-control wording with an HTTP/SSE/WebSocket listener on an all-interface host and no visible auth guard.", "evidence": {"rule_id": "AGT012", "scanner": "repobility-agent-runtime", "references": [], "correlation_key": "fp|d47258a801565499048fc0a044ec8e7f4eeae5158b06d41bd939cc0b19a1babf"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/brainstorming/scripts/start-server.sh"}, "region": {"startLine": 12}}}]}, {"ruleId": "AGT012", "level": "warning", "message": {"text": "Agent control bridge may listen on a network interface without visible auth"}, "properties": {"repobilityId": 224014, "scanner": "repobility-agent-runtime", "fingerprint": "61e3d111e468998eba5eb84c79b7831859650e879c120c5d0ffe1ad99e9a47df", "category": "quality", "severity": "medium", "confidence": 0.72, "triageState": "open", "verdict": "likely", "isResolved": false, "reason": "File combines agent-control wording with an HTTP/SSE/WebSocket listener on an all-interface host and no visible auth guard.", "evidence": {"rule_id": "AGT012", "scanner": "repobility-agent-runtime", "references": [], "correlation_key": "fp|61e3d111e468998eba5eb84c79b7831859650e879c120c5d0ffe1ad99e9a47df"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".agents/skills/brainstorming/scripts/start-server.sh"}, "region": {"startLine": 12}}}]}, {"ruleId": "AIC004", "level": "warning", "message": {"text": "Suspicious implementation file appears unreferenced"}, "properties": {"repobilityId": 223987, "scanner": "repobility-ai-code-hygiene", "fingerprint": "86b946b6f109ce7d1c134f5c7390add8f048b4ddb082e4a30864072a0747e5da", "category": "quality", "severity": "medium", "confidence": 0.78, "triageState": "open", "verdict": "likely", "isResolved": false, "reason": "Patch-style source file has no detected inbound reference from other repository files.", "evidence": {"suffix": "final", "rule_id": "AIC004", "scanner": "repobility-ai-code-hygiene", "references": ["https://knip.dev/", "https://github.com/jendrikseipp/vulture"], "correlation_key": "fp|86b946b6f109ce7d1c134f5c7390add8f048b4ddb082e4a30864072a0747e5da"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "dashboard-server/fix_usd_final.py"}, "region": {"startLine": 1}}}]}, {"ruleId": "AIC004", "level": "warning", "message": {"text": "Suspicious implementation file appears unreferenced"}, "properties": {"repobilityId": 223986, "scanner": "repobility-ai-code-hygiene", "fingerprint": "91f20e146f1ba2c2096301056a091cc63b50ac3288ca2d3f3a967926709a469e", "category": "quality", "severity": "medium", "confidence": 0.78, "triageState": "open", "verdict": "likely", "isResolved": false, "reason": "Patch-style source file has no detected inbound reference from other repository files.", "evidence": {"suffix": "fix", "rule_id": "AIC004", "scanner": "repobility-ai-code-hygiene", "references": ["https://knip.dev/", "https://github.com/jendrikseipp/vulture"], "correlation_key": "fp|91f20e146f1ba2c2096301056a091cc63b50ac3288ca2d3f3a967926709a469e"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Clients/Couch Heroes/scripts/audit_and_fix.py"}, "region": {"startLine": 1}}}]}, {"ruleId": "AIC004", "level": "warning", "message": {"text": "Suspicious implementation file appears unreferenced"}, "properties": {"repobilityId": 223985, "scanner": "repobility-ai-code-hygiene", "fingerprint": "b8c2b5c0566b81b63f481cf467e207cd84e6edda1cd2272852c8fcadc29827ce", "category": "quality", "severity": "medium", "confidence": 0.78, "triageState": "open", "verdict": "likely", "isResolved": false, "reason": "Patch-style source file has no detected inbound reference from other repository files.", "evidence": {"suffix": "new", "rule_id": "AIC004", "scanner": "repobility-ai-code-hygiene", "references": ["https://knip.dev/", "https://github.com/jendrikseipp/vulture"], "correlation_key": "fp|b8c2b5c0566b81b63f481cf467e207cd84e6edda1cd2272852c8fcadc29827ce"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Clients/Couch Heroes/production/_miro_stories_new.py"}, "region": {"startLine": 1}}}]}, {"ruleId": "AIC001", "level": "warning", "message": {"text": "Parallel implementation file sits beside a canonical file"}, "properties": {"repobilityId": 223982, "scanner": "repobility-ai-code-hygiene", "fingerprint": "61ac1d576a00d0e166fc660e5793cd294d3fdc0a10669903122657ffaf10c329", "category": "quality", "severity": "medium", "confidence": 0.82, "triageState": "open", "verdict": "likely", "isResolved": false, "reason": "Source filename has a patch-style suffix and a same-directory canonical sibling exists.", "evidence": {"suffix": "clean", "rule_id": "AIC001", "scanner": "repobility-ai-code-hygiene", "references": ["https://arxiv.org/abs/2601.15195", "https://knip.dev/"], "canonical_file": "Clients/Couch Heroes/production/build_v12.py", "correlation_key": "fp|61ac1d576a00d0e166fc660e5793cd294d3fdc0a10669903122657ffaf10c329"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Clients/Couch Heroes/production/build_v12_clean.py"}, "region": {"startLine": 1}}}]}, {"ruleId": "ERR002", "level": "warning", "message": {"text": "[ERR002] Empty Catch Block: Empty catch blocks hide errors."}, "properties": {"repobilityId": 223960, "scanner": "repobility-threat-engine", "fingerprint": "d1feeaf782041530a24a15c727a9e0e1565e60833028d90b0653cbd772ce6df8", "category": "error_handling", "severity": "medium", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": "catch(e) {}", "reason": "Pattern matched with no mitigating context found", "rule_id": "ERR002", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "fp|d1feeaf782041530a24a15c727a9e0e1565e60833028d90b0653cbd772ce6df8"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "dashboard-server/public/js/nbi-idb.js"}, "region": {"startLine": 39}}}]}, {"ruleId": "ERR002", "level": "warning", "message": {"text": "[ERR002] Empty Catch Block: Empty catch blocks hide errors."}, "properties": {"repobilityId": 223959, "scanner": "repobility-threat-engine", "fingerprint": "30a5de9346777074edf7a023f14e5f0054e69e5bc8c8b2c420afc1621edb3779", "category": "error_handling", "severity": "medium", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": ".catch(() => {})", "reason": "Pattern matched with no mitigating context found", "rule_id": "ERR002", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "fp|30a5de9346777074edf7a023f14e5f0054e69e5bc8c8b2c420afc1621edb3779"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "dashboard-server/cron/dreaming/index.js"}, "region": {"startLine": 101}}}]}, {"ruleId": "COMP001", "level": "warning", "message": {"text": "[COMP001] High cognitive complexity: Function `format_table` has cognitive complexity 23 (SonarSource scale). Cognitive complexity measures how hard the function is for a human to understand \u2014 nested branches, boolean chains, and recursion all weigh in. Breakdown: for=8, if=2, nested_bonus=12, ternary=1."}, "properties": {"repobilityId": 223937, "scanner": "repobility-threat-engine", "fingerprint": "13b5aa3811f03d068764043261be611d8e489fa6fcc62b3ab6db6a14c2bc6b45", "category": "quality", "severity": "medium", "confidence": 0.95, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "AST-derived cognitive complexity score = 23 (severity threshold for medium: 15+).", "evidence": {"scanner": "repobility-threat-engine", "function": "format_table", "breakdown": {"if": 2, "for": 8, "ternary": 1, "nested_bonus": 12}, "complexity": 23, "correlation_key": "fp|13b5aa3811f03d068764043261be611d8e489fa6fcc62b3ab6db6a14c2bc6b45"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Clients/Couch Heroes/legal_compliance/build_hs_docx.py"}, "region": {"startLine": 60}}}]}, {"ruleId": "SEC045", "level": "warning", "message": {"text": "[SEC045] eval()/exec() on stored or user-supplied data: eval() and exec() on data \u2014 even admin-stored data \u2014 is a lateral-movement vector after any one credential compromise. Sandboxes (__builtins__ cleared) are escapable: attackers use object introspection (().__class__.__mro__[-1].__subclasses__()) to reach os.system. CWE-95 (eval injection)."}, "properties": {"repobilityId": 223932, "scanner": "repobility-threat-engine", "fingerprint": "385820fca775d3d3265a8f7690289824cde73f771d4f0443e6a5a995f14a315b", "category": "injection", "severity": "medium", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": ".exec(", "reason": "Pattern matched with no mitigating context found", "rule_id": "SEC045", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "code|injection|token|45|sec045"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "projects/news-aggregator/src/ingest/enrichment.ts"}, "region": {"startLine": 45}}}]}, {"ruleId": "SEC045", "level": "warning", "message": {"text": "[SEC045] eval()/exec() on stored or user-supplied data: eval() and exec() on data \u2014 even admin-stored data \u2014 is a lateral-movement vector after any one credential compromise. Sandboxes (__builtins__ cleared) are escapable: attackers use object introspection (().__class__.__mro__[-1].__subclasses__()) to reach os.system. CWE-95 (eval injection)."}, "properties": {"repobilityId": 223931, "scanner": "repobility-threat-engine", "fingerprint": "46a8860efb64a0c5688ab32080c6890aa0a6378f142078ed9136c8a8f59e15b9", "category": "injection", "severity": "medium", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found Collapsed 1 duplicate scanner signal(s) for the same underlying issue.", "evidence": {"match": ".exec(", "reason": "Pattern matched with no mitigating context found", "rule_id": "SEC045", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "code|injection|. token|25|sec045", "duplicate_count": 1, "duplicate_rule_ids": ["SEC045"], "duplicate_scanners": ["repobility-threat-engine"], "duplicate_fingerprints": ["46a8860efb64a0c5688ab32080c6890aa0a6378f142078ed9136c8a8f59e15b9", "be0becbec36e928a651a3a06d1d39e5c75f698eb13da8075474891154da9b4ef"]}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".agents/skills/writing-skills/render-graphs.js"}, "region": {"startLine": 25}}}]}, {"ruleId": "CORE_NO_CI", "level": "warning", "message": {"text": "No CI/CD configuration found"}, "properties": {"repobilityId": 223907, "scanner": "repobility-core", "fingerprint": "ca5da3551af97272c4f099fc472740148135a15816b81b90bd862e8f91ec66ce", "category": "practices", "severity": "medium", "confidence": null, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"rule_id": "CORE_NO_CI", "scanner": "repobility-core", "correlation_key": "repo|practices|core_no_ci"}}}, {"ruleId": "AIC005", "level": "note", "message": {"text": "Duplicate top-level symbol appears in a patch-style file"}, "properties": {"repobilityId": 224013, "scanner": "repobility-ai-code-hygiene", "fingerprint": "f5f88c9490d074a864796ed5fd6b7fe5330dfb0651d59594dd47b46b4788c02c", "category": "quality", "severity": "low", "confidence": 0.64, "triageState": "open", "verdict": "needs_review", "isResolved": false, "reason": "Patch-style file defines a top-level symbol also defined in another source file.", "evidence": {"symbol": "get_color", "rule_id": "AIC005", "scanner": "repobility-ai-code-hygiene", "references": ["https://github.com/jendrikseipp/vulture", "https://knip.dev/"], "duplicate_file": "Clients/Couch Heroes/scripts/build_hours_map.py", "correlation_key": "fp|f5f88c9490d074a864796ed5fd6b7fe5330dfb0651d59594dd47b46b4788c02c"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Clients/Couch Heroes/scripts/audit_and_fix.py"}, "region": {"startLine": 1}}}]}, {"ruleId": "AIC005", "level": "note", "message": {"text": "Duplicate top-level symbol appears in a patch-style file"}, "properties": {"repobilityId": 224012, "scanner": "repobility-ai-code-hygiene", "fingerprint": "290d9064f555b3902c9fe508f3194d01e4f5471fbeb075985c2c29cb07cb2e9d", "category": "quality", "severity": "low", "confidence": 0.64, "triageState": "open", "verdict": "needs_review", "isResolved": false, "reason": "Patch-style file defines a top-level symbol also defined in another source file.", "evidence": {"symbol": "build", "rule_id": "AIC005", "scanner": "repobility-ai-code-hygiene", "references": ["https://github.com/jendrikseipp/vulture", "https://knip.dev/"], "duplicate_file": "Clients/Couch Heroes/production/build_v12_exact.py", "correlation_key": "fp|290d9064f555b3902c9fe508f3194d01e4f5471fbeb075985c2c29cb07cb2e9d"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Clients/Couch Heroes/production/build_final.py"}, "region": {"startLine": 1}}}]}, {"ruleId": "AIC005", "level": "note", "message": {"text": "Duplicate top-level symbol appears in a patch-style file"}, "properties": {"repobilityId": 224011, "scanner": "repobility-ai-code-hygiene", "fingerprint": "150e5d4cf8cd23d06c20639b9e01f0efb114e02697abca20ad1bf1e0a6bc9d6c", "category": "quality", "severity": "low", "confidence": 0.64, "triageState": "open", "verdict": "needs_review", "isResolved": false, "reason": "Patch-style file defines a top-level symbol also defined in another source file.", "evidence": {"symbol": "api", "rule_id": "AIC005", "scanner": "repobility-ai-code-hygiene", "references": ["https://github.com/jendrikseipp/vulture", "https://knip.dev/"], "duplicate_file": "dashboard-server/fix_expenses.py", "correlation_key": "fp|150e5d4cf8cd23d06c20639b9e01f0efb114e02697abca20ad1bf1e0a6bc9d6c"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "dashboard-server/fix_usd_final.py"}, "region": {"startLine": 1}}}]}, {"ruleId": "AIC003", "level": "note", "message": {"text": "Duplicated implementation block across source files"}, "properties": {"repobilityId": 224010, "scanner": "repobility-ai-code-hygiene", "fingerprint": "a4fd40a41f5c8842c2da3e30979ba5f976bbddae2d088be9f730c5738d1bf0ae", "category": "quality", "severity": "low", "confidence": 0.86, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "A normalized source-code window appears in two different non-test files.", "evidence": {"lines": 12, "rule_id": "AIC003", "scanner": "repobility-ai-code-hygiene", "references": ["https://jscpd.dev/"], "duplicate_file": "scripts/fix_goals_worksage.py", "duplicate_line": 40, "correlation_key": "fp|a4fd40a41f5c8842c2da3e30979ba5f976bbddae2d088be9f730c5738d1bf0ae"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/update_goals_fields.py"}, "region": {"startLine": 83}}}]}, {"ruleId": "AIC003", "level": "note", "message": {"text": "Duplicated implementation block across source files"}, "properties": {"repobilityId": 224009, "scanner": "repobility-ai-code-hygiene", "fingerprint": "6314ca221a8d9906527308f324cc29b4654e2288c34004fff64d94c09fea11fe", "category": "quality", "severity": "low", "confidence": 0.86, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "A normalized source-code window appears in two different non-test files.", "evidence": {"lines": 12, "rule_id": "AIC003", "scanner": "repobility-ai-code-hygiene", "references": ["https://jscpd.dev/"], "duplicate_file": "dashboard-server/fix_expenses.py", "duplicate_line": 14, "correlation_key": "fp|6314ca221a8d9906527308f324cc29b4654e2288c34004fff64d94c09fea11fe"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "dashboard-server/verify_expenses.py"}, "region": {"startLine": 10}}}]}, {"ruleId": "AIC003", "level": "note", "message": {"text": "Duplicated implementation block across source files"}, "properties": {"repobilityId": 224008, "scanner": "repobility-ai-code-hygiene", "fingerprint": "ce3882cb604a8688e23272e9a795b04fe6c788e7ed60b6c7997f3d310f51ce9e", "category": "quality", "severity": "low", "confidence": 0.86, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "A normalized source-code window appears in two different non-test files.", "evidence": {"lines": 12, "rule_id": "AIC003", "scanner": "repobility-ai-code-hygiene", "references": ["https://jscpd.dev/"], "duplicate_file": "dashboard-server/redact_pdfs_v2.py", "duplicate_line": 3, "correlation_key": "fp|ce3882cb604a8688e23272e9a795b04fe6c788e7ed60b6c7997f3d310f51ce9e"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "dashboard-server/verify_expenses.py"}, "region": {"startLine": 2}}}]}, {"ruleId": "AIC003", "level": "note", "message": {"text": "Duplicated implementation block across source files"}, "properties": {"repobilityId": 224007, "scanner": "repobility-ai-code-hygiene", "fingerprint": "2171c10d855224d7a14bdbaf46dbe4c9502f6deb63ae808c71ff536cbc8f7969", "category": "quality", "severity": "low", "confidence": 0.86, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "A normalized source-code window appears in two different non-test files.", "evidence": {"lines": 12, "rule_id": "AIC003", "scanner": "repobility-ai-code-hygiene", "references": ["https://jscpd.dev/"], "duplicate_file": "dashboard-server/lib/slack-bot.js", "duplicate_line": 224, "correlation_key": "fp|2171c10d855224d7a14bdbaf46dbe4c9502f6deb63ae808c71ff536cbc8f7969"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "dashboard-server/routes/slack.js"}, "region": {"startLine": 78}}}]}, {"ruleId": "AIC003", "level": "note", "message": {"text": "Duplicated implementation block across source files"}, "properties": {"repobilityId": 224006, "scanner": "repobility-ai-code-hygiene", "fingerprint": "43dc307e0b02e31ae8e86cf5b6d46c9ea9b114d6a6d99fbccac86e2919f739c5", "category": "quality", "severity": "low", "confidence": 0.86, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "A normalized source-code window appears in two different non-test files.", "evidence": {"lines": 12, "rule_id": "AIC003", "scanner": "repobility-ai-code-hygiene", "references": ["https://jscpd.dev/"], "duplicate_file": "dashboard-server/cron/index.js", "duplicate_line": 321, "correlation_key": "fp|43dc307e0b02e31ae8e86cf5b6d46c9ea9b114d6a6d99fbccac86e2919f739c5"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "dashboard-server/routes/documents.js"}, "region": {"startLine": 2}}}]}, {"ruleId": "AIC003", "level": "note", "message": {"text": "Duplicated implementation block across source files"}, "properties": {"repobilityId": 224005, "scanner": "repobility-ai-code-hygiene", "fingerprint": "6e2e9a91c3e622e1f87142bd41b547b242e0ebea36c9dfe52b603604d026c93f", "category": "quality", "severity": "low", "confidence": 0.86, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "A normalized source-code window appears in two different non-test files.", "evidence": {"lines": 12, "rule_id": "AIC003", "scanner": "repobility-ai-code-hygiene", "references": ["https://jscpd.dev/"], "duplicate_file": "dashboard-server/redact_pdfs.py", "duplicate_line": 86, "correlation_key": "fp|6e2e9a91c3e622e1f87142bd41b547b242e0ebea36c9dfe52b603604d026c93f"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "dashboard-server/redact_pdfs_v2.py"}, "region": {"startLine": 92}}}]}, {"ruleId": "AIC003", "level": "note", "message": {"text": "Duplicated implementation block across source files"}, "properties": {"repobilityId": 224004, "scanner": "repobility-ai-code-hygiene", "fingerprint": "c92a47547ce44f681ffb26d67b2e2a6fe0ee5e8801247f17a9cd9ac7d98b0a7c", "category": "quality", "severity": "low", "confidence": 0.86, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "A normalized source-code window appears in two different non-test files.", "evidence": {"lines": 12, "rule_id": "AIC003", "scanner": "repobility-ai-code-hygiene", "references": ["https://jscpd.dev/"], "duplicate_file": "dashboard-server/fix_expenses.py", "duplicate_line": 14, "correlation_key": "fp|c92a47547ce44f681ffb26d67b2e2a6fe0ee5e8801247f17a9cd9ac7d98b0a7c"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "dashboard-server/redact_pdfs_v2.py"}, "region": {"startLine": 11}}}]}, {"ruleId": "AIC003", "level": "note", "message": {"text": "Duplicated implementation block across source files"}, "properties": {"repobilityId": 224003, "scanner": "repobility-ai-code-hygiene", "fingerprint": "d38ff16360118a8201c2bf239125a4ecb43d4f2e71c1755d100cfce961b4e532", "category": "quality", "severity": "low", "confidence": 0.86, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "A normalized source-code window appears in two different non-test files.", "evidence": {"lines": 12, "rule_id": "AIC003", "scanner": "repobility-ai-code-hygiene", "references": ["https://jscpd.dev/"], "duplicate_file": "dashboard-server/public/js/nbi-api.js", "duplicate_line": 224, "correlation_key": "fp|d38ff16360118a8201c2bf239125a4ecb43d4f2e71c1755d100cfce961b4e532"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "dashboard-server/public/js/nbi-themes.js"}, "region": {"startLine": 143}}}]}, {"ruleId": "AIC003", "level": "note", "message": {"text": "Duplicated implementation block across source files"}, "properties": {"repobilityId": 224002, "scanner": "repobility-ai-code-hygiene", "fingerprint": "60276f9dd830862744f8132e52a8a8b48e9ca7343c82a3c1456a1da7f87796e3", "category": "quality", "severity": "low", "confidence": 0.86, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "A normalized source-code window appears in two different non-test files.", "evidence": {"lines": 12, "rule_id": "AIC003", "scanner": "repobility-ai-code-hygiene", "references": ["https://jscpd.dev/"], "duplicate_file": "dashboard-server/fix_usd_final.py", "duplicate_line": 1, "correlation_key": "fp|60276f9dd830862744f8132e52a8a8b48e9ca7343c82a3c1456a1da7f87796e3"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "dashboard-server/fix_usd_dates.py"}, "region": {"startLine": 1}}}]}, {"ruleId": "AIC003", "level": "note", "message": {"text": "Duplicated implementation block across source files"}, "properties": {"repobilityId": 224001, "scanner": "repobility-ai-code-hygiene", "fingerprint": "da46a2dfdbe86e7cf326d27e74db8e9b797826ce6d193e826556aa54ffab1a78", "category": "quality", "severity": "low", "confidence": 0.86, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "A normalized source-code window appears in two different non-test files.", "evidence": {"lines": 12, "rule_id": "AIC003", "scanner": "repobility-ai-code-hygiene", "references": ["https://jscpd.dev/"], "duplicate_file": "dashboard-server/fix_usd_final.py", "duplicate_line": 1, "correlation_key": "fp|da46a2dfdbe86e7cf326d27e74db8e9b797826ce6d193e826556aa54ffab1a78"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "dashboard-server/fix_expenses.py"}, "region": {"startLine": 1}}}]}, {"ruleId": "AIC003", "level": "note", "message": {"text": "Duplicated implementation block across source files"}, "properties": {"repobilityId": 224000, "scanner": "repobility-ai-code-hygiene", "fingerprint": "ca454c24b9d5084808c0e38e5a9efcbcf9303432c748cb7f752218d6ea847048", "category": "quality", "severity": "low", "confidence": 0.86, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "A normalized source-code window appears in two different non-test files.", "evidence": {"lines": 12, "rule_id": "AIC003", "scanner": "repobility-ai-code-hygiene", "references": ["https://jscpd.dev/"], "duplicate_file": "Clients/Couch Heroes/scripts/audit_and_fix.py", "duplicate_line": 228, "correlation_key": "fp|ca454c24b9d5084808c0e38e5a9efcbcf9303432c748cb7f752218d6ea847048"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Clients/Couch Heroes/scripts/write_excel.py"}, "region": {"startLine": 145}}}]}, {"ruleId": "AIC003", "level": "note", "message": {"text": "Duplicated implementation block across source files"}, "properties": {"repobilityId": 223999, "scanner": "repobility-ai-code-hygiene", "fingerprint": "3866a0b60f82f88975724995727f6fa4ddbba3aa3ce33c0631163b6fd6d27cca", "category": "quality", "severity": "low", "confidence": 0.86, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "A normalized source-code window appears in two different non-test files.", "evidence": {"lines": 12, "rule_id": "AIC003", "scanner": "repobility-ai-code-hygiene", "references": ["https://jscpd.dev/"], "duplicate_file": "Clients/Couch Heroes/scripts/build_hours_map.py", "duplicate_line": 2, "correlation_key": "fp|3866a0b60f82f88975724995727f6fa4ddbba3aa3ce33c0631163b6fd6d27cca"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Clients/Couch Heroes/scripts/write_excel.py"}, "region": {"startLine": 2}}}]}, {"ruleId": "AIC003", "level": "note", "message": {"text": "Duplicated implementation block across source files"}, "properties": {"repobilityId": 223998, "scanner": "repobility-ai-code-hygiene", "fingerprint": "d3fec6b88c244f6db1bdae826f158da2ee7e3cce7ab723899574f6a849341e77", "category": "quality", "severity": "low", "confidence": 0.86, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "A normalized source-code window appears in two different non-test files.", "evidence": {"lines": 12, "rule_id": "AIC003", "scanner": "repobility-ai-code-hygiene", "references": ["https://jscpd.dev/"], "duplicate_file": "Clients/Couch Heroes/save_glen_answers.py", "duplicate_line": 56, "correlation_key": "fp|d3fec6b88c244f6db1bdae826f158da2ee7e3cce7ab723899574f6a849341e77"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Clients/Couch Heroes/scripts/save_glen_answers.py"}, "region": {"startLine": 56}}}]}, {"ruleId": "AIC003", "level": "note", "message": {"text": "Duplicated implementation block across source files"}, "properties": {"repobilityId": 223997, "scanner": "repobility-ai-code-hygiene", "fingerprint": "0d72e12d293e44d6fce26afe35a86d2c3501e92a755901c39c4cdd739dfe646f", "category": "quality", "severity": "low", "confidence": 0.86, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "A normalized source-code window appears in two different non-test files.", "evidence": {"lines": 12, "rule_id": "AIC003", "scanner": "repobility-ai-code-hygiene", "references": ["https://jscpd.dev/"], "duplicate_file": "Clients/Couch Heroes/save_all_answers.py", "duplicate_line": 1, "correlation_key": "fp|0d72e12d293e44d6fce26afe35a86d2c3501e92a755901c39c4cdd739dfe646f"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Clients/Couch Heroes/scripts/save_glen_answers.py"}, "region": {"startLine": 1}}}]}, {"ruleId": "AIC003", "level": "note", "message": {"text": "Duplicated implementation block across source files"}, "properties": {"repobilityId": 223996, "scanner": "repobility-ai-code-hygiene", "fingerprint": "e0d50e4997d395fbcc02a3b79d5ec578501933585ede91b2a37f48646b172e4a", "category": "quality", "severity": "low", "confidence": 0.86, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "A normalized source-code window appears in two different non-test files.", "evidence": {"lines": 12, "rule_id": "AIC003", "scanner": "repobility-ai-code-hygiene", "references": ["https://jscpd.dev/"], "duplicate_file": "Clients/Couch Heroes/save_all_answers.py", "duplicate_line": 1, "correlation_key": "fp|e0d50e4997d395fbcc02a3b79d5ec578501933585ede91b2a37f48646b172e4a"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Clients/Couch Heroes/scripts/save_all_answers.py"}, "region": {"startLine": 1}}}]}, {"ruleId": "AIC003", "level": "note", "message": {"text": "Duplicated implementation block across source files"}, "properties": {"repobilityId": 223995, "scanner": "repobility-ai-code-hygiene", "fingerprint": "c2495f4ad1f6a66d4c8ea504da9ec9eb8982caa1f702a02f30030a2f70bb6070", "category": "quality", "severity": "low", "confidence": 0.86, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "A normalized source-code window appears in two different non-test files.", "evidence": {"lines": 12, "rule_id": "AIC003", "scanner": "repobility-ai-code-hygiene", "references": ["https://jscpd.dev/"], "duplicate_file": "Clients/Couch Heroes/build_inputs/classify.py", "duplicate_line": 1, "correlation_key": "fp|c2495f4ad1f6a66d4c8ea504da9ec9eb8982caa1f702a02f30030a2f70bb6070"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Clients/Couch Heroes/scripts/classify.py"}, "region": {"startLine": 1}}}]}, {"ruleId": "AIC003", "level": "note", "message": {"text": "Duplicated implementation block across source files"}, "properties": {"repobilityId": 223994, "scanner": "repobility-ai-code-hygiene", "fingerprint": "e6eeaf2965b6bd88bc569ad64f5360f39faca203868666b20ebf7f195706fb4e", "category": "quality", "severity": "low", "confidence": 0.86, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "A normalized source-code window appears in two different non-test files.", "evidence": {"lines": 12, "rule_id": "AIC003", "scanner": "repobility-ai-code-hygiene", "references": ["https://jscpd.dev/"], "duplicate_file": "Clients/Couch Heroes/build_deduped_ama.py", "duplicate_line": 1, "correlation_key": "fp|e6eeaf2965b6bd88bc569ad64f5360f39faca203868666b20ebf7f195706fb4e"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Clients/Couch Heroes/scripts/build_deduped_ama.py"}, "region": {"startLine": 1}}}]}, {"ruleId": "AIC003", "level": "note", "message": {"text": "Duplicated implementation block across source files"}, "properties": {"repobilityId": 223993, "scanner": "repobility-ai-code-hygiene", "fingerprint": "4e76bb3421ee835c5dd9c63907885687edb8f101d464813a39f325ee1b481daa", "category": "quality", "severity": "low", "confidence": 0.86, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "A normalized source-code window appears in two different non-test files.", "evidence": {"lines": 12, "rule_id": "AIC003", "scanner": "repobility-ai-code-hygiene", "references": ["https://jscpd.dev/"], "duplicate_file": "Clients/Couch Heroes/build_ama_deck.py", "duplicate_line": 3, "correlation_key": "fp|4e76bb3421ee835c5dd9c63907885687edb8f101d464813a39f325ee1b481daa"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Clients/Couch Heroes/scripts/build_ama_deck.py"}, "region": {"startLine": 3}}}]}, {"ruleId": "AIC003", "level": "note", "message": {"text": "Duplicated implementation block across source files"}, "properties": {"repobilityId": 223992, "scanner": "repobility-ai-code-hygiene", "fingerprint": "0234189b2bb6448a79b426f0e2fafa8da7b4a2c296fe6da580fc54fb686167c1", "category": "quality", "severity": "low", "confidence": 0.86, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "A normalized source-code window appears in two different non-test files.", "evidence": {"lines": 12, "rule_id": "AIC003", "scanner": "repobility-ai-code-hygiene", "references": ["https://jscpd.dev/"], "duplicate_file": "Clients/Couch Heroes/build_ama_breakout.py", "duplicate_line": 1, "correlation_key": "fp|0234189b2bb6448a79b426f0e2fafa8da7b4a2c296fe6da580fc54fb686167c1"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Clients/Couch Heroes/scripts/build_ama_breakout.py"}, "region": {"startLine": 1}}}]}, {"ruleId": "AIC003", "level": "note", "message": {"text": "Duplicated implementation block across source files"}, "properties": {"repobilityId": 223991, "scanner": "repobility-ai-code-hygiene", "fingerprint": "518c4707df6d8079035204b31c3a62591ce6293e2265741da3d1c5dd91749626", "category": "quality", "severity": "low", "confidence": 0.86, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "A normalized source-code window appears in two different non-test files.", "evidence": {"lines": 12, "rule_id": "AIC003", "scanner": "repobility-ai-code-hygiene", "references": ["https://jscpd.dev/"], "duplicate_file": "Clients/Couch Heroes/save_all_answers.py", "duplicate_line": 1, "correlation_key": "fp|518c4707df6d8079035204b31c3a62591ce6293e2265741da3d1c5dd91749626"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Clients/Couch Heroes/save_glen_answers.py"}, "region": {"startLine": 1}}}]}, {"ruleId": "AIC003", "level": "note", "message": {"text": "Duplicated implementation block across source files"}, "properties": {"repobilityId": 223990, "scanner": "repobility-ai-code-hygiene", "fingerprint": "098154b16b5b3ea4abc2075c00d531a613b3280dc02bdc6d5e1131391b639a9e", "category": "quality", "severity": "low", "confidence": 0.86, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "A normalized source-code window appears in two different non-test files.", "evidence": {"lines": 12, "rule_id": "AIC003", "scanner": "repobility-ai-code-hygiene", "references": ["https://jscpd.dev/"], "duplicate_file": "Clients/Couch Heroes/production/qa_check.py", "duplicate_line": 6, "correlation_key": "fp|098154b16b5b3ea4abc2075c00d531a613b3280dc02bdc6d5e1131391b639a9e"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Clients/Couch Heroes/production/qa_strict.py"}, "region": {"startLine": 6}}}]}, {"ruleId": "AIC003", "level": "note", "message": {"text": "Duplicated implementation block across source files"}, "properties": {"repobilityId": 223989, "scanner": "repobility-ai-code-hygiene", "fingerprint": "da290ef4a8eefa542c2e09c03c2e1372d25d487644b4cbb781582f91b4314f2e", "category": "quality", "severity": "low", "confidence": 0.86, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "A normalized source-code window appears in two different non-test files.", "evidence": {"lines": 12, "rule_id": "AIC003", "scanner": "repobility-ai-code-hygiene", "references": ["https://jscpd.dev/"], "duplicate_file": "Clients/Couch Heroes/production/build_v12.py", "duplicate_line": 297, "correlation_key": "fp|da290ef4a8eefa542c2e09c03c2e1372d25d487644b4cbb781582f91b4314f2e"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Clients/Couch Heroes/production/consolidate_template_style.py"}, "region": {"startLine": 458}}}]}, {"ruleId": "AIC003", "level": "note", "message": {"text": "Duplicated implementation block across source files"}, "properties": {"repobilityId": 223988, "scanner": "repobility-ai-code-hygiene", "fingerprint": "c3a3b2432165594aa8cfbfc2b5908934a8d902c58c106dae415c01eb9fea7541", "category": "quality", "severity": "low", "confidence": 0.86, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "A normalized source-code window appears in two different non-test files.", "evidence": {"lines": 12, "rule_id": "AIC003", "scanner": "repobility-ai-code-hygiene", "references": ["https://jscpd.dev/"], "duplicate_file": ".claude/harness/lib/shell-guard.js", "duplicate_line": 30, "correlation_key": "fp|c3a3b2432165594aa8cfbfc2b5908934a8d902c58c106dae415c01eb9fea7541"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/harness/lib/write-guard.js"}, "region": {"startLine": 55}}}]}, {"ruleId": "AIC002", "level": "note", "message": {"text": "Source file name looks like an AI patch artifact"}, "properties": {"repobilityId": 223984, "scanner": "repobility-ai-code-hygiene", "fingerprint": "897702fd6a4275b2e31f1685314c364a274681e52510510b27ea266015c8fee2", "category": "quality", "severity": "low", "confidence": 0.62, "triageState": "open", "verdict": "needs_review", "isResolved": false, "reason": "Source filename contains a temporary or patch-style suffix.", "evidence": {"suffix": "final", "rule_id": "AIC002", "scanner": "repobility-ai-code-hygiene", "references": ["https://arxiv.org/abs/2601.15195"], "correlation_key": "fp|897702fd6a4275b2e31f1685314c364a274681e52510510b27ea266015c8fee2"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "dashboard-server/fix_usd_final.py"}, "region": {"startLine": 1}}}]}, {"ruleId": "AIC002", "level": "note", "message": {"text": "Source file name looks like an AI patch artifact"}, "properties": {"repobilityId": 223983, "scanner": "repobility-ai-code-hygiene", "fingerprint": "1f689167044e6c36675b005ab94f1037f67798028ae4ff03b481b89f937f0cc8", "category": "quality", "severity": "low", "confidence": 0.62, "triageState": "open", "verdict": "needs_review", "isResolved": false, "reason": "Source filename contains a temporary or patch-style suffix.", "evidence": {"suffix": "fix", "rule_id": "AIC002", "scanner": "repobility-ai-code-hygiene", "references": ["https://arxiv.org/abs/2601.15195"], "correlation_key": "fp|1f689167044e6c36675b005ab94f1037f67798028ae4ff03b481b89f937f0cc8"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Clients/Couch Heroes/scripts/audit_and_fix.py"}, "region": {"startLine": 1}}}]}, {"ruleId": "AIC002", "level": "note", "message": {"text": "Source file name looks like an AI patch artifact"}, "properties": {"repobilityId": 223981, "scanner": "repobility-ai-code-hygiene", "fingerprint": "7d5649c670289894271bbff8ea92e9c7d02ae774c7460fac3a49eebb67c2c540", "category": "quality", "severity": "low", "confidence": 0.62, "triageState": "open", "verdict": "needs_review", "isResolved": false, "reason": "Source filename contains a temporary or patch-style suffix.", "evidence": {"suffix": "final", "rule_id": "AIC002", "scanner": "repobility-ai-code-hygiene", "references": ["https://arxiv.org/abs/2601.15195"], "correlation_key": "fp|7d5649c670289894271bbff8ea92e9c7d02ae774c7460fac3a49eebb67c2c540"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Clients/Couch Heroes/production/build_final.py"}, "region": {"startLine": 1}}}]}, {"ruleId": "AIC002", "level": "note", "message": {"text": "Source file name looks like an AI patch artifact"}, "properties": {"repobilityId": 223980, "scanner": "repobility-ai-code-hygiene", "fingerprint": "e467b0ca7de4da70b5412477afd74dc90c30f56fd9842f1b40bbdf0c62d6145b", "category": "quality", "severity": "low", "confidence": 0.62, "triageState": "open", "verdict": "needs_review", "isResolved": false, "reason": "Source filename contains a temporary or patch-style suffix.", "evidence": {"suffix": "new", "rule_id": "AIC002", "scanner": "repobility-ai-code-hygiene", "references": ["https://arxiv.org/abs/2601.15195"], "correlation_key": "fp|e467b0ca7de4da70b5412477afd74dc90c30f56fd9842f1b40bbdf0c62d6145b"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Clients/Couch Heroes/production/_miro_stories_new.py"}, "region": {"startLine": 1}}}]}, {"ruleId": "AIC006", "level": "note", "message": {"text": "Archive or legacy directory is mixed into the active repository root"}, "properties": {"repobilityId": 223979, "scanner": "repobility-ai-code-hygiene", "fingerprint": "71e6b03d6b2249a3e748e64635893588c39cd2ae260f382d5dfa735904573f34", "category": "quality", "severity": "low", "confidence": 0.68, "triageState": "open", "verdict": "likely", "isResolved": false, "reason": "Repository root contains an archive/legacy directory name.", "evidence": {"rule_id": "AIC006", "scanner": "repobility-ai-code-hygiene", "directory": "_archive", "references": ["https://arxiv.org/abs/2601.15195"], "correlation_key": "fp|71e6b03d6b2249a3e748e64635893588c39cd2ae260f382d5dfa735904573f34"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "_archive"}, "region": {"startLine": 1}}}]}, {"ruleId": "SEC132", "level": "note", "message": {"text": "[SEC132] String concat where the language has interpolation (AI style drift): String built by concatenation where the language has cleaner interpolation (Python f-strings since 3.6, JS template literals since ES6). Not a vulnerability on its own, but a style signature of cross-language AI rewrites \u2014 the model wrote idiomatic Java/C# and then translated mechanically. When this style appears in only *some* files of a repo, it's a strong indicator of an AI-driven rewrite that needs a human review p"}, "properties": {"repobilityId": 223920, "scanner": "repobility-threat-engine", "fingerprint": "c06539e80b913630811f79dfd8eb35ec47c60670d2aeb1d97468ba47be5b5c72", "category": "quality", "severity": "low", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": "' bugs closed vs ' + opened + ' opened this week. Backlog is shrinking.'", "reason": "Pattern matched with no mitigating context found", "rule_id": "SEC132", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "fp|c06539e80b913630811f79dfd8eb35ec47c60670d2aeb1d97468ba47be5b5c72"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "dashboard-server/cron/dreaming/achievements.js"}, "region": {"startLine": 16}}}]}, {"ruleId": "SEC132", "level": "note", "message": {"text": "[SEC132] String concat where the language has interpolation (AI style drift): String built by concatenation where the language has cleaner interpolation (Python f-strings since 3.6, JS template literals since ES6). Not a vulnerability on its own, but a style signature of cross-language AI rewrites \u2014 the model wrote idiomatic Java/C# and then translated mechanically. When this style appears in only *some* files of a repo, it's a strong indicator of an AI-driven rewrite that needs a human review p"}, "properties": {"repobilityId": 223919, "scanner": "repobility-threat-engine", "fingerprint": "b763acd16660d59987545b1d2073364c7c18786cd313e1a929c8b6d6c4e82bb3", "category": "quality", "severity": "low", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": "'<script>\\n' + helperScript + '\\n</script>'", "reason": "Pattern matched with no mitigating context found", "rule_id": "SEC132", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "fp|b763acd16660d59987545b1d2073364c7c18786cd313e1a929c8b6d6c4e82bb3"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/brainstorming/scripts/server.cjs"}, "region": {"startLine": 103}}}]}, {"ruleId": "SEC132", "level": "note", "message": {"text": "[SEC132] String concat where the language has interpolation (AI style drift): String built by concatenation where the language has cleaner interpolation (Python f-strings since 3.6, JS template literals since ES6). Not a vulnerability on its own, but a style signature of cross-language AI rewrites \u2014 the model wrote idiomatic Java/C# and then translated mechanically. When this style appears in only *some* files of a repo, it's a strong indicator of an AI-driven rewrite that needs a human review p"}, "properties": {"repobilityId": 223918, "scanner": "repobility-threat-engine", "fingerprint": "c1cd71a6428bad7a239c0ca00dae176a4d18bd0c857defe70c368a89ae350f67", "category": "quality", "severity": "low", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": "'<script>\\n' + helperScript + '\\n</script>'", "reason": "Pattern matched with no mitigating context found", "rule_id": "SEC132", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "fp|c1cd71a6428bad7a239c0ca00dae176a4d18bd0c857defe70c368a89ae350f67"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".agents/skills/brainstorming/scripts/server.cjs"}, "region": {"startLine": 103}}}]}, {"ruleId": "SEC006", "level": "note", "message": {"text": "[SEC006] XSS Risk: Direct HTML injection without sanitization."}, "properties": {"repobilityId": 223910, "scanner": "repobility-threat-engine", "fingerprint": "f226d9cf87f7f9050e8d50facabf8955af831c8878ee96fd96347f6869e5f510", "category": "injection", "severity": "low", "confidence": 0.4, "triageState": "false_positive", "verdict": "likely_fp", "isResolved": true, "reason": "No user-input source (request/query/fetch/URL) found \u2014 may be static content", "evidence": {"match": ".innerHTML = h", "reason": "No user-input source (request/query/fetch/URL) found \u2014 may be static content", "rule_id": "SEC006", "scanner": "repobility-threat-engine", "confidence": 0.4, "correlation_key": "code|injection|token|99|sec006"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "dashboard-server/public/js/views/nbi-chat.js"}, "region": {"startLine": 99}}}]}, {"ruleId": "SEC006", "level": "note", "message": {"text": "[SEC006] XSS Risk: Direct HTML injection without sanitization."}, "properties": {"repobilityId": 223909, "scanner": "repobility-threat-engine", "fingerprint": "24f2f9202f23bcb747bfe8b67d83a7d8f3bbedc4b5047651a2a8816d6222b632", "category": "injection", "severity": "low", "confidence": 0.4, "triageState": "false_positive", "verdict": "likely_fp", "isResolved": true, "reason": "No user-input source (request/query/fetch/URL) found \u2014 may be static content Collapsed 1 duplicate scanner signal(s) for the same underlying issue.", "evidence": {"match": ".innerHTML = '<span class=\"selected-text\">' + l", "reason": "No user-input source (request/query/fetch/URL) found \u2014 may be static content", "rule_id": "SEC006", "scanner": "repobility-threat-engine", "confidence": 0.4, "correlation_key": "code|injection|. token|57|sec006", "duplicate_count": 1, "duplicate_rule_ids": ["SEC006"], "duplicate_scanners": ["repobility-threat-engine"], "duplicate_fingerprints": ["24f2f9202f23bcb747bfe8b67d83a7d8f3bbedc4b5047651a2a8816d6222b632", "af2927f9aa48eddf0e8fba229f569ba9a7f4698d134aea5a443a7d7194533f69"]}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".agents/skills/brainstorming/scripts/helper.js"}, "region": {"startLine": 57}}}]}, {"ruleId": "CORE_NO_LICENSE", "level": "note", "message": {"text": "No LICENSE file"}, "properties": {"repobilityId": 223906, "scanner": "repobility-core", "fingerprint": "9314e9238cd99885865b92490d1aaa96ca62b1390c9377878d5f3d99227e1c3c", "category": "documentation", "severity": "low", "confidence": null, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"rule_id": "CORE_NO_LICENSE", "scanner": "repobility-core", "correlation_key": "repo|documentation|core_no_license"}}}, {"ruleId": "MINED054", "level": "none", "message": {"text": "[MINED054] Ts As Any (and 1 more): Same pattern found in 1 additional files. Review if needed."}, "properties": {"repobilityId": 223976, "scanner": "repobility-threat-engine", "fingerprint": "729b643e6bca2592aa4fc4944c630a8412fcea5fbfca0cb8905d71a0efec47d6", "category": "quality", "severity": "info", "confidence": 0.2, "triageState": "false_positive", "verdict": "likely_fp", "isResolved": true, "reason": "Deduplicated summary only: 1 additional occurrences found. The top occurrences remain visible as actionable findings.", "evidence": {"mined": true, "mining": {"slug": "ts-as-any", "owasp": null, "cwe_ids": ["CWE-704"], "languages": ["typescript", "tsx"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.348028+00:00", "triaged_in_corpus": 12, "observations_count": 341218, "ai_coder_pattern_id": 98}, "scanner": "repobility-threat-engine", "aggregated": true, "correlation_key": "fp|729b643e6bca2592aa4fc4944c630a8412fcea5fbfca0cb8905d71a0efec47d6", "aggregated_count": 1}}}, {"ruleId": "MINED054", "level": "none", "message": {"text": "[MINED054] Ts As Any: Casting to any (as any) bypasses type checking entirely."}, "properties": {"repobilityId": 223975, "scanner": "repobility-threat-engine", "fingerprint": "3b57edc3c813eabe1edb75dc2ae8e6ac1bf8c13ace29c0989132ee044432da62", "category": "quality", "severity": "info", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "ts-as-any", "owasp": null, "cwe_ids": ["CWE-704"], "languages": ["typescript", "tsx"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.348028+00:00", "triaged_in_corpus": 12, "observations_count": 341218, "ai_coder_pattern_id": 98}, "scanner": "repobility-threat-engine", "correlation_key": "fp|3b57edc3c813eabe1edb75dc2ae8e6ac1bf8c13ace29c0989132ee044432da62"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "projects/news-aggregator/src/routes/admin/prompts.ts"}, "region": {"startLine": 15}}}]}, {"ruleId": "MINED054", "level": "none", "message": {"text": "[MINED054] Ts As Any: Casting to any (as any) bypasses type checking entirely."}, "properties": {"repobilityId": 223974, "scanner": "repobility-threat-engine", "fingerprint": "3018d6417a268b709b6a4aaeac1a08cfb52ac5d2b342c9e704832c36169dc50b", "category": "quality", "severity": "info", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "ts-as-any", "owasp": null, "cwe_ids": ["CWE-704"], "languages": ["typescript", "tsx"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.348028+00:00", "triaged_in_corpus": 12, "observations_count": 341218, "ai_coder_pattern_id": 98}, "scanner": "repobility-threat-engine", "correlation_key": "fp|3018d6417a268b709b6a4aaeac1a08cfb52ac5d2b342c9e704832c36169dc50b"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "projects/news-aggregator/src/ingest/fetcher.ts"}, "region": {"startLine": 26}}}]}, {"ruleId": "MINED054", "level": "none", "message": {"text": "[MINED054] Ts As Any: Casting to any (as any) bypasses type checking entirely."}, "properties": {"repobilityId": 223973, "scanner": "repobility-threat-engine", "fingerprint": "e783f583fa203bd9dd2411a2adda5c60a2308ab8f2a0d74246451fc8ed2cf7be", "category": "quality", "severity": "info", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "ts-as-any", "owasp": null, "cwe_ids": ["CWE-704"], "languages": ["typescript", "tsx"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.348028+00:00", "triaged_in_corpus": 12, "observations_count": 341218, "ai_coder_pattern_id": 98}, "scanner": "repobility-threat-engine", "correlation_key": "fp|e783f583fa203bd9dd2411a2adda5c60a2308ab8f2a0d74246451fc8ed2cf7be"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "projects/news-aggregator/src/auth/internal.ts"}, "region": {"startLine": 20}}}]}, {"ruleId": "SEC135", "level": "none", "message": {"text": "[SEC135] Auth/permission check missing on AI-generated endpoint (and 6 more): Same pattern found in 6 additional files. Review if needed."}, "properties": {"repobilityId": 223972, "scanner": "repobility-threat-engine", "fingerprint": "0e6e1eba61c6534138b0e996edff7f84d3befe0034fc817c7ee20f69e696ce17", "category": "quality", "severity": "info", "confidence": 0.2, "triageState": "false_positive", "verdict": "likely_fp", "isResolved": true, "reason": "Deduplicated summary only: 6 additional occurrences found. The top occurrences remain visible as actionable findings.", "evidence": {"reason": "Deduplicated summary only: 6 additional occurrences found. The top occurrences remain visible as actionable findings.", "rule_id": "SEC135", "scanner": "repobility-threat-engine", "confidence": 0.2, "correlation_key": "fp|0e6e1eba61c6534138b0e996edff7f84d3befe0034fc817c7ee20f69e696ce17"}}}, {"ruleId": "MINED049", "level": "none", "message": {"text": "[MINED049] Print Pii: Logging password/token/email/ssn directly to stdout."}, "properties": {"repobilityId": 223963, "scanner": "repobility-threat-engine", "fingerprint": "15c88936c1ced7495e74810e5b7db1234472153b3b854d9dc9e76248077fdbc7", "category": "quality", "severity": "info", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "print-pii", "owasp": "A09:2021", "cwe_ids": ["CWE-532"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.348015+00:00", "triaged_in_corpus": 12, "observations_count": 676566, "ai_coder_pattern_id": 26}, "scanner": "repobility-threat-engine", "correlation_key": "fp|15c88936c1ced7495e74810e5b7db1234472153b3b854d9dc9e76248077fdbc7"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "fix_goals_acronyms.py"}, "region": {"startLine": 21}}}]}, {"ruleId": "MINED049", "level": "none", "message": {"text": "[MINED049] Print Pii: Logging password/token/email/ssn directly to stdout."}, "properties": {"repobilityId": 223962, "scanner": "repobility-threat-engine", "fingerprint": "3dd5d9a51c259fa5e5d9770273f4f1ed3002db3a57970a261aa9b5dde6eea634", "category": "quality", "severity": "info", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "print-pii", "owasp": "A09:2021", "cwe_ids": ["CWE-532"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.348015+00:00", "triaged_in_corpus": 12, "observations_count": 676566, "ai_coder_pattern_id": 26}, "scanner": "repobility-threat-engine", "correlation_key": "fp|3dd5d9a51c259fa5e5d9770273f4f1ed3002db3a57970a261aa9b5dde6eea634"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "dashboard-server/migrate-password-reset.js"}, "region": {"startLine": 17}}}]}, {"ruleId": "MINED049", "level": "none", "message": {"text": "[MINED049] Print Pii: Logging password/token/email/ssn directly to stdout."}, "properties": {"repobilityId": 223961, "scanner": "repobility-threat-engine", "fingerprint": "ba753afdd277214508fd65f959f1d15beb6d5f8c5553a06c0058c14220c5cc45", "category": "quality", "severity": "info", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "print-pii", "owasp": "A09:2021", "cwe_ids": ["CWE-532"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.348015+00:00", "triaged_in_corpus": 12, "observations_count": 676566, "ai_coder_pattern_id": 26}, "scanner": "repobility-threat-engine", "correlation_key": "fp|ba753afdd277214508fd65f959f1d15beb6d5f8c5553a06c0058c14220c5cc45"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "dashboard-server/init-db.js"}, "region": {"startLine": 197}}}]}, {"ruleId": "MINED067", "level": "none", "message": {"text": "[MINED067] Python Requests No Timeout (and 3 more): Same pattern found in 3 additional files. Review if needed."}, "properties": {"repobilityId": 223957, "scanner": "repobility-threat-engine", "fingerprint": "22c0d567d696a6862689f7c9fd8c307213fa0bf7df0ff8c77916ef3d9279f800", "category": "quality", "severity": "info", "confidence": 0.2, "triageState": "false_positive", "verdict": "likely_fp", "isResolved": true, "reason": "Deduplicated summary only: 3 additional occurrences found. The top occurrences remain visible as actionable findings.", "evidence": {"mined": true, "mining": {"slug": "python-requests-no-timeout", "owasp": null, "cwe_ids": ["CWE-400"], "languages": ["python"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.348058+00:00", "triaged_in_corpus": 12, "observations_count": 45429, "ai_coder_pattern_id": 122}, "scanner": "repobility-threat-engine", "aggregated": true, "correlation_key": "fp|22c0d567d696a6862689f7c9fd8c307213fa0bf7df0ff8c77916ef3d9279f800", "aggregated_count": 3}}}, {"ruleId": "MINED067", "level": "none", "message": {"text": "[MINED067] Python Requests No Timeout: requests.get/post/etc. without timeout= can hang forever."}, "properties": {"repobilityId": 223956, "scanner": "repobility-threat-engine", "fingerprint": "e45ae998051aa705224d15ce7b1fd36da3a3e8e482856acae8c55284d588928d", "category": "quality", "severity": "info", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "python-requests-no-timeout", "owasp": null, "cwe_ids": ["CWE-400"], "languages": ["python"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.348058+00:00", "triaged_in_corpus": 12, "observations_count": 45429, "ai_coder_pattern_id": 122}, "scanner": "repobility-threat-engine", "correlation_key": "fp|e45ae998051aa705224d15ce7b1fd36da3a3e8e482856acae8c55284d588928d"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "_archive/nbiai_app/scripts/populate_agents_v2.py"}, "region": {"startLine": 203}}}]}, {"ruleId": "MINED067", "level": "none", "message": {"text": "[MINED067] Python Requests No Timeout: requests.get/post/etc. without timeout= can hang forever."}, "properties": {"repobilityId": 223955, "scanner": "repobility-threat-engine", "fingerprint": "a4224ed5d0d3e940c27e204bba92cc45b1a6158512c762b4421a66971aa57edc", "category": "quality", "severity": "info", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "python-requests-no-timeout", "owasp": null, "cwe_ids": ["CWE-400"], "languages": ["python"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.348058+00:00", "triaged_in_corpus": 12, "observations_count": 45429, "ai_coder_pattern_id": 122}, "scanner": "repobility-threat-engine", "correlation_key": "fp|a4224ed5d0d3e940c27e204bba92cc45b1a6158512c762b4421a66971aa57edc"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "_archive/nbiai_app/scripts/fix_dispatcher.py"}, "region": {"startLine": 13}}}]}, {"ruleId": "MINED067", "level": "none", "message": {"text": "[MINED067] Python Requests No Timeout: requests.get/post/etc. without timeout= can hang forever."}, "properties": {"repobilityId": 223954, "scanner": "repobility-threat-engine", "fingerprint": "1fa7d623a96891af80604939e457d6e9a4f489c2df72a5fdeb051592fe8a796d", "category": "quality", "severity": "info", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "python-requests-no-timeout", "owasp": null, "cwe_ids": ["CWE-400"], "languages": ["python"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.348058+00:00", "triaged_in_corpus": 12, "observations_count": 45429, "ai_coder_pattern_id": 122}, "scanner": "repobility-threat-engine", "correlation_key": "fp|1fa7d623a96891af80604939e457d6e9a4f489c2df72a5fdeb051592fe8a796d"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "_archive/nbiai_app/scripts/create_dashboard_issue.py"}, "region": {"startLine": 106}}}]}, {"ruleId": "SEC078", "level": "none", "message": {"text": "[SEC078] Python: requests without timeout (and 3 more): Same pattern found in 3 additional files. Review if needed."}, "properties": {"repobilityId": 223953, "scanner": "repobility-threat-engine", "fingerprint": "4ad6f55494afe619cae3e4cf741803a5646a33d13c8bf832506da6d5a11f8beb", "category": "quality", "severity": "info", "confidence": 0.2, "triageState": "false_positive", "verdict": "likely_fp", "isResolved": true, "reason": "Deduplicated summary only: 3 additional occurrences found. The top occurrences remain visible as actionable findings.", "evidence": {"reason": "Deduplicated summary only: 3 additional occurrences found. The top occurrences remain visible as actionable findings.", "rule_id": "SEC078", "scanner": "repobility-threat-engine", "confidence": 0.2, "correlation_key": "fp|4ad6f55494afe619cae3e4cf741803a5646a33d13c8bf832506da6d5a11f8beb"}}}, {"ruleId": "SEC020", "level": "none", "message": {"text": "[SEC020] Secret Printed to Logs (and 1 more): Same pattern found in 1 additional files. Review if needed."}, "properties": {"repobilityId": 223949, "scanner": "repobility-threat-engine", "fingerprint": "b6edddaddab6b62ff63a87b52b7d7b3bab2a5af6b4d7361c1238d18c2c6e3162", "category": "credential_exposure", "severity": "info", "confidence": 0.2, "triageState": "false_positive", "verdict": "likely_fp", "isResolved": true, "reason": "Deduplicated summary only: 1 additional occurrences found. The top occurrences remain visible as actionable findings.", "evidence": {"reason": "Deduplicated summary only: 1 additional occurrences found. The top occurrences remain visible as actionable findings.", "rule_id": "SEC020", "scanner": "repobility-threat-engine", "confidence": 0.2, "correlation_key": "fp|b6edddaddab6b62ff63a87b52b7d7b3bab2a5af6b4d7361c1238d18c2c6e3162"}}}, {"ruleId": "SEC020", "level": "none", "message": {"text": "[SEC020] Secret Printed to Logs: Debug or diagnostic code appears to print a credential-bearing value. This is a frequent AI-assisted coding failure: the helper exposes the exact value needed for troubleshooting."}, "properties": {"repobilityId": 223948, "scanner": "repobility-threat-engine", "fingerprint": "65809c628991737fd16243387f41346346522435c854b7af8bb871a6468133d3", "category": "credential_exposure", "severity": "info", "confidence": 0.15, "triageState": "false_positive", "verdict": "likely_fp", "isResolved": true, "reason": "Log message mentions credential-related metadata but does not print a credential-bearing value", "evidence": {"match": "console.log('Created password_reset_tokens table')", "reason": "Log message mentions credential-related metadata but does not print a credential-bearing value", "rule_id": "SEC020", "scanner": "repobility-threat-engine", "confidence": 0.15, "correlation_key": "secret|token|1|console.log created password_reset_tokens table"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "dashboard-server/migrate-password-reset.js"}, "region": {"startLine": 17}}}]}, {"ruleId": "SEC020", "level": "none", "message": {"text": "[SEC020] Secret Printed to Logs: Debug or diagnostic code appears to print a credential-bearing value. This is a frequent AI-assisted coding failure: the helper exposes the exact value needed for troubleshooting."}, "properties": {"repobilityId": 223947, "scanner": "repobility-threat-engine", "fingerprint": "3952fb2b758a3ee30857ba32af375d8555ea9dc3661e1950b5a2a10a8e11c0f0", "category": "credential_exposure", "severity": "info", "confidence": 0.15, "triageState": "false_positive", "verdict": "likely_fp", "isResolved": true, "reason": "Log message mentions credential-related metadata but does not print a credential-bearing value", "evidence": {"match": "console.log('Default users seeded with random passwords (change immediately)", "reason": "Log message mentions credential-related metadata but does not print a credential-bearing value", "rule_id": "SEC020", "scanner": "repobility-threat-engine", "confidence": 0.15, "correlation_key": "secret|dashboard-server/init-db.js|19|console.log default users seeded with random passwords change immediately"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "dashboard-server/init-db.js"}, "region": {"startLine": 197}}}]}, {"ruleId": "MINED056", "level": "none", "message": {"text": "[MINED056] React Key As Index: key={index} in map() \u2014 re-renders the wrong elements on re-order."}, "properties": {"repobilityId": 223945, "scanner": "repobility-threat-engine", "fingerprint": "7e434259a80dca0bc930030c8656983ed5415d3d8a2db493f307f1475df87519", "category": "quality", "severity": "info", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "react-key-as-index", "owasp": null, "cwe_ids": ["CWE-682"], "languages": ["typescript", "tsx", "javascript", "jsx"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.348032+00:00", "triaged_in_corpus": 12, "observations_count": 299917, "ai_coder_pattern_id": 135}, "scanner": "repobility-threat-engine", "correlation_key": "fp|7e434259a80dca0bc930030c8656983ed5415d3d8a2db493f307f1475df87519"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "_archive/nbiai_app/app/client/src/pages/SessionsPage.tsx"}, "region": {"startLine": 196}}}]}, {"ruleId": "MINED077", "level": "none", "message": {"text": "[MINED077] Python Open No Context: fp = open(path) outside with-block leaks file handles."}, "properties": {"repobilityId": 223944, "scanner": "repobility-threat-engine", "fingerprint": "3bdb8450ae6077d395f42e189b35649e8c125bea20de3becf02bddb86d12a475", "category": "quality", "severity": "info", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "python-open-no-context", "owasp": null, "cwe_ids": ["CWE-772"], "languages": ["python"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.348081+00:00", "triaged_in_corpus": 12, "observations_count": 7864, "ai_coder_pattern_id": 123}, "scanner": "repobility-threat-engine", "correlation_key": "fp|3bdb8450ae6077d395f42e189b35649e8c125bea20de3becf02bddb86d12a475"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Clients/Couch Heroes/scripts/build_hours_map.py"}, "region": {"startLine": 181}}}]}, {"ruleId": "MINED050", "level": "none", "message": {"text": "[MINED050] Stub Only Function: Function declared but body is just pass, return None, raise NotImplementedError, or TODO comment."}, "properties": {"repobilityId": 223943, "scanner": "repobility-threat-engine", "fingerprint": "1d6ff3c528b1e53d31d0444d208a1d18099b8072d136cea49cfc3859b83f51e8", "category": "quality", "severity": "info", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "stub-only-function", "owasp": null, "cwe_ids": ["CWE-1188"], "languages": ["python"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.348017+00:00", "triaged_in_corpus": 12, "observations_count": 633513, "ai_coder_pattern_id": 2}, "scanner": "repobility-threat-engine", "correlation_key": "fp|1d6ff3c528b1e53d31d0444d208a1d18099b8072d136cea49cfc3859b83f51e8"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Clients/Couch Heroes/scripts/build_hours_map.py"}, "region": {"startLine": 156}}}]}, {"ruleId": "COMP001", "level": "none", "message": {"text": "[COMP001] High cognitive complexity (and 9 more): Same pattern found in 9 additional files. Review if needed."}, "properties": {"repobilityId": 223940, "scanner": "repobility-threat-engine", "fingerprint": "29306b5028b90ab8087937c717cb745fd7e07ab4ccb4b2237f19cccb49788ca3", "category": "quality", "severity": "info", "confidence": 0.2, "triageState": "false_positive", "verdict": "likely_fp", "isResolved": true, "reason": "Deduplicated summary only: 9 additional occurrences found. The top occurrences remain visible as actionable findings.", "evidence": {"scanner": "repobility-threat-engine", "function": "format_table", "breakdown": {"if": 2, "for": 8, "ternary": 1, "nested_bonus": 12}, "aggregated": true, "complexity": 23, "correlation_key": "fp|29306b5028b90ab8087937c717cb745fd7e07ab4ccb4b2237f19cccb49788ca3", "aggregated_count": 9}}}, {"ruleId": "SEC085", "level": "none", "message": {"text": "[SEC085] JS: child_process.exec with non-literal (and 2 more): Same pattern found in 2 additional files. Review if needed."}, "properties": {"repobilityId": 223936, "scanner": "repobility-threat-engine", "fingerprint": "606792298c73b83412d8cf76624dd82fdf0a71ea3b779cecc6b4d4d439eccec4", "category": "quality", "severity": "info", "confidence": 0.2, "triageState": "false_positive", "verdict": "likely_fp", "isResolved": true, "reason": "Deduplicated summary only: 2 additional occurrences found. The top occurrences remain visible as actionable findings.", "evidence": {"reason": "Deduplicated summary only: 2 additional occurrences found. The top occurrences remain visible as actionable findings.", "rule_id": "SEC085", "scanner": "repobility-threat-engine", "confidence": 0.2, "correlation_key": "fp|606792298c73b83412d8cf76624dd82fdf0a71ea3b779cecc6b4d4d439eccec4"}}}, {"ruleId": "MINED044", "level": "none", "message": {"text": "[MINED044] Js Console Log Prod (and 41 more): Same pattern found in 41 additional files. Review if needed."}, "properties": {"repobilityId": 223930, "scanner": "repobility-threat-engine", "fingerprint": "8bc4370c715b908cdf9cb41d44d1c2e47f2f2c149c1b909cc0e9c5aa2ac6f97d", "category": "quality", "severity": "info", "confidence": 0.2, "triageState": "false_positive", "verdict": "likely_fp", "isResolved": true, "reason": "Deduplicated summary only: 41 additional occurrences found. The top occurrences remain visible as actionable findings.", "evidence": {"mined": true, "mining": {"slug": "js-console-log-prod", "owasp": null, "cwe_ids": ["CWE-532"], "languages": ["javascript", "typescript", "tsx", "jsx"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.348003+00:00", "triaged_in_corpus": 10, "observations_count": 1940833, "ai_coder_pattern_id": 102}, "scanner": "repobility-threat-engine", "aggregated": true, "correlation_key": "fp|8bc4370c715b908cdf9cb41d44d1c2e47f2f2c149c1b909cc0e9c5aa2ac6f97d", "aggregated_count": 41}}}, {"ruleId": "MINED044", "level": "none", "message": {"text": "[MINED044] Js Console Log Prod: console.log left in code. Should be replaced with logger or removed."}, "properties": {"repobilityId": 223929, "scanner": "repobility-threat-engine", "fingerprint": "c2abf9d673194f564988cb2d75f58ccd818dde7d8912d547b4ff20701513d4b4", "category": "quality", "severity": "info", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "js-console-log-prod", "owasp": null, "cwe_ids": ["CWE-532"], "languages": ["javascript", "typescript", "tsx", "jsx"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.348003+00:00", "triaged_in_corpus": 10, "observations_count": 1940833, "ai_coder_pattern_id": 102}, "scanner": "repobility-threat-engine", "correlation_key": "fp|c2abf9d673194f564988cb2d75f58ccd818dde7d8912d547b4ff20701513d4b4"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/brainstorming/scripts/server.cjs"}, "region": {"startLine": 229}}}]}, {"ruleId": "MINED044", "level": "none", "message": {"text": "[MINED044] Js Console Log Prod: console.log left in code. Should be replaced with logger or removed."}, "properties": {"repobilityId": 223928, "scanner": "repobility-threat-engine", "fingerprint": "8936f3ac819b2404ed7851aa442b3e42a77aa18550c730cef94ba8f9b9bd345c", "category": "quality", "severity": "info", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "js-console-log-prod", "owasp": null, "cwe_ids": ["CWE-532"], "languages": ["javascript", "typescript", "tsx", "jsx"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.348003+00:00", "triaged_in_corpus": 10, "observations_count": 1940833, "ai_coder_pattern_id": 102}, "scanner": "repobility-threat-engine", "correlation_key": "fp|8936f3ac819b2404ed7851aa442b3e42a77aa18550c730cef94ba8f9b9bd345c"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".agents/skills/writing-skills/render-graphs.js"}, "region": {"startLine": 78}}}]}, {"ruleId": "MINED044", "level": "none", "message": {"text": "[MINED044] Js Console Log Prod: console.log left in code. Should be replaced with logger or removed."}, "properties": {"repobilityId": 223927, "scanner": "repobility-threat-engine", "fingerprint": "b5a3e656a9e0db803fcf34cc60bdc919bde9b49557cac88d638dba4bf4ef2a89", "category": "quality", "severity": "info", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "js-console-log-prod", "owasp": null, "cwe_ids": ["CWE-532"], "languages": ["javascript", "typescript", "tsx", "jsx"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.348003+00:00", "triaged_in_corpus": 10, "observations_count": 1940833, "ai_coder_pattern_id": 102}, "scanner": "repobility-threat-engine", "correlation_key": "fp|b5a3e656a9e0db803fcf34cc60bdc919bde9b49557cac88d638dba4bf4ef2a89"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".agents/skills/brainstorming/scripts/server.cjs"}, "region": {"startLine": 229}}}]}, {"ruleId": "MINED043", "level": "none", "message": {"text": "[MINED043] Http Not Https: Hardcoded http:// (not localhost) for endpoints that handle credentials or data."}, "properties": {"repobilityId": 223926, "scanner": "repobility-threat-engine", "fingerprint": "ac34b06815d4b8ffe91603546551a89d9f495a82cec41fbc9082b148e091a8c8", "category": "quality", "severity": "info", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "http-not-https", "owasp": "A02:2021", "cwe_ids": ["CWE-319"], "precision": 0.917, "promoted_at": "2026-05-18T14:01:32.347999+00:00", "triaged_in_corpus": 12, "observations_count": 4113831, "ai_coder_pattern_id": 15}, "scanner": "repobility-threat-engine", "correlation_key": "fp|ac34b06815d4b8ffe91603546551a89d9f495a82cec41fbc9082b148e091a8c8"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/brainstorming/scripts/server.cjs"}, "region": {"startLine": 342}}}]}, {"ruleId": "MINED043", "level": "none", "message": {"text": "[MINED043] Http Not Https: Hardcoded http:// (not localhost) for endpoints that handle credentials or data."}, "properties": {"repobilityId": 223925, "scanner": "repobility-threat-engine", "fingerprint": "dcb584f499e0ef5ca3c2b15591b7c76511d5003fe9759b9c72d6444d3e118077", "category": "quality", "severity": "info", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "http-not-https", "owasp": "A02:2021", "cwe_ids": ["CWE-319"], "precision": 0.917, "promoted_at": "2026-05-18T14:01:32.347999+00:00", "triaged_in_corpus": 12, "observations_count": 4113831, "ai_coder_pattern_id": 15}, "scanner": "repobility-threat-engine", "correlation_key": "fp|dcb584f499e0ef5ca3c2b15591b7c76511d5003fe9759b9c72d6444d3e118077"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".agents/skills/brainstorming/scripts/server.cjs"}, "region": {"startLine": 342}}}]}, {"ruleId": "SEC132", "level": "none", "message": {"text": "[SEC132] String concat where the language has interpolation (AI style drift) (and 5 more): Same pattern found in 5 additional files. Review if needed."}, "properties": {"repobilityId": 223921, "scanner": "repobility-threat-engine", "fingerprint": "5b5429ce103e0212fe1464cb57739bff2520dbc1282d1a7ac9eefe5666813e21", "category": "quality", "severity": "info", "confidence": 0.2, "triageState": "false_positive", "verdict": "likely_fp", "isResolved": true, "reason": "Deduplicated summary only: 5 additional occurrences found. The top occurrences remain visible as actionable findings.", "evidence": {"reason": "Deduplicated summary only: 5 additional occurrences found. The top occurrences remain visible as actionable findings.", "rule_id": "SEC132", "scanner": "repobility-threat-engine", "confidence": 0.2, "correlation_key": "fp|5b5429ce103e0212fe1464cb57739bff2520dbc1282d1a7ac9eefe5666813e21"}}}, {"ruleId": "SEC128", "level": "none", "message": {"text": "[SEC128] Async function without await \u2014 fire-and-forget Promise (AI mistake) (and 6 more): Same pattern found in 6 additional files. Review if needed."}, "properties": {"repobilityId": 223917, "scanner": "repobility-threat-engine", "fingerprint": "719f16a1467677730b367baa2144dabfe702dd229dc13e6f3e8747ec0afa970d", "category": "quality", "severity": "info", "confidence": 0.2, "triageState": "false_positive", "verdict": "likely_fp", "isResolved": true, "reason": "Deduplicated summary only: 6 additional occurrences found. The top occurrences remain visible as actionable findings.", "evidence": {"reason": "Deduplicated summary only: 6 additional occurrences found. The top occurrences remain visible as actionable findings.", "rule_id": "SEC128", "scanner": "repobility-threat-engine", "confidence": 0.2, "correlation_key": "fp|719f16a1467677730b367baa2144dabfe702dd229dc13e6f3e8747ec0afa970d"}}}, {"ruleId": "MINED098", "level": "none", "message": {"text": "[MINED098] Global Scope Pollution: Attaching libraries/objects directly to the global window scope (e.g., `window.axios = axios;`) makes the code harder to test and increases the risk of naming collisions."}, "properties": {"repobilityId": 223913, "scanner": "repobility-threat-engine", "fingerprint": "34f3ece2d159e9bfcc4d089de60c9858f1bc6b23b0c70be76b0c399b028fbaae", "category": "quality", "severity": "info", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "global-scope-pollution", "owasp": null, "cwe_ids": [], "languages": ["javascript"], "precision": 1.0, "promoted_at": "2026-05-18T15:01:13.611213+00:00", "triaged_in_corpus": 12, "observations_count": 173528, "ai_coder_pattern_id": 55}, "scanner": "repobility-threat-engine", "correlation_key": "fp|34f3ece2d159e9bfcc4d089de60c9858f1bc6b23b0c70be76b0c399b028fbaae"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/brainstorming/scripts/helper.js"}, "region": {"startLine": 65}}}]}, {"ruleId": "MINED098", "level": "none", "message": {"text": "[MINED098] Global Scope Pollution: Attaching libraries/objects directly to the global window scope (e.g., `window.axios = axios;`) makes the code harder to test and increases the risk of naming collisions."}, "properties": {"repobilityId": 223912, "scanner": "repobility-threat-engine", "fingerprint": "b229de2ed56e88f0d2e2fdf7049f0504a5119aafce03bf4cc028ed955ebe566b", "category": "quality", "severity": "info", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "global-scope-pollution", "owasp": null, "cwe_ids": [], "languages": ["javascript"], "precision": 1.0, "promoted_at": "2026-05-18T15:01:13.611213+00:00", "triaged_in_corpus": 12, "observations_count": 173528, "ai_coder_pattern_id": 55}, "scanner": "repobility-threat-engine", "correlation_key": "fp|b229de2ed56e88f0d2e2fdf7049f0504a5119aafce03bf4cc028ed955ebe566b"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".agents/skills/brainstorming/scripts/helper.js"}, "region": {"startLine": 65}}}]}, {"ruleId": "SEC006", "level": "none", "message": {"text": "[SEC006] XSS Risk (and 2 more): Same pattern found in 2 additional files. Review if needed."}, "properties": {"repobilityId": 223911, "scanner": "repobility-threat-engine", "fingerprint": "d62afa18f06a325cee859bfc8963ff1f72b12cc2df69d78422fa7b9f881be030", "category": "injection", "severity": "info", "confidence": 0.2, "triageState": "false_positive", "verdict": "likely_fp", "isResolved": true, "reason": "Deduplicated summary only: 2 additional occurrences found. The top occurrences remain visible as actionable findings.", "evidence": {"reason": "Deduplicated summary only: 2 additional occurrences found. The top occurrences remain visible as actionable findings.", "rule_id": "SEC006", "scanner": "repobility-threat-engine", "confidence": 0.2, "correlation_key": "fp|d62afa18f06a325cee859bfc8963ff1f72b12cc2df69d78422fa7b9f881be030"}}}, {"ruleId": "SEC001", "level": "none", "message": {"text": "[SEC001] Hardcoded Password: Hardcoded password found in source code."}, "properties": {"repobilityId": 223908, "scanner": "repobility-threat-engine", "fingerprint": "65f94f745c2f4b265c7a32d411dd25cdb7dce1579860e1c70d941cbabade1fcf", "category": "credential_exposure", "severity": "info", "confidence": 0.1, "triageState": "false_positive", "verdict": "likely_fp", "isResolved": true, "reason": "Safe context pattern detected Collapsed 1 duplicate scanner signal(s) for the same underlying issue.", "evidence": {"match": "PASSWORD='<redacted>'", "reason": "Safe context pattern detected", "rule_id": "SEC001", "scanner": "repobility-threat-engine", "confidence": 0.1, "correlation_key": "secret|. token|6|password redacted", "duplicate_count": 1, "duplicate_rule_ids": ["SEC001"], "duplicate_scanners": ["repobility-threat-engine"], "duplicate_fingerprints": ["65f94f745c2f4b265c7a32d411dd25cdb7dce1579860e1c70d941cbabade1fcf", "92e648041147487b7a0ff2c657c51a49232d5eae60eb7bfcad3066e38c807fa1"]}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".agents/skills/agent-browser/templates/authenticated-session.sh"}, "region": {"startLine": 70}}}]}, {"ruleId": "MINED134", "level": "error", "message": {"text": "[MINED134] Binary file `Clients/Couch Heroes/production/__pycache__/build_v12_clean.cpython-312.pyc` committed in source repo: `Clients/Couch Heroes/production/__pycache__/build_v12_clean.cpython-312.pyc` is a .pyc binary (82,580 bytes) committed to a repo that otherwise has 374 source files. Trojan binaries inside otherwise-normal source repos are a known supply-chain attack: a compromised dependency or PR slips in a binary that gets executed by build scripts."}, "properties": {"repobilityId": 224053, "scanner": "repobility-supply-chain", "fingerprint": "74c33f66ff93473f5445ee0359b411bdb7c2a22fef013f5a6f1211780cfc9dbb", "category": "dependency", "severity": "high", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "suspicious-binary-in-src", "owasp": null, "cwe_ids": ["CWE-506"], "languages": ["any"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|74c33f66ff93473f5445ee0359b411bdb7c2a22fef013f5a6f1211780cfc9dbb"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Clients/Couch Heroes/production/__pycache__/build_v12_clean.cpython-312.pyc"}, "region": {"startLine": 1}}}]}, {"ruleId": "MINED134", "level": "error", "message": {"text": "[MINED134] Binary file `Clients/Couch Heroes/build_inputs/__pycache__/classify.cpython-312.pyc` committed in source repo: `Clients/Couch Heroes/build_inputs/__pycache__/classify.cpython-312.pyc` is a .pyc binary (16,208 bytes) committed to a repo that otherwise has 374 source files. Trojan binaries inside otherwise-normal source repos are a known supply-chain attack: a compromised dependency or PR slips in a binary that gets executed by build scripts."}, "properties": {"repobilityId": 224052, "scanner": "repobility-supply-chain", "fingerprint": "58d6e2742f8c84c9ae7b7b5619b5ca98e26fc73126d3b0449fb066381fb48fb2", "category": "dependency", "severity": "high", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "suspicious-binary-in-src", "owasp": null, "cwe_ids": ["CWE-506"], "languages": ["any"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|58d6e2742f8c84c9ae7b7b5619b5ca98e26fc73126d3b0449fb066381fb48fb2"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Clients/Couch Heroes/build_inputs/__pycache__/classify.cpython-312.pyc"}, "region": {"startLine": 1}}}]}, {"ruleId": "MINED118", "level": "error", "message": {"text": "[MINED118] Dockerfile FROM `node:20-alpine` not pinned by digest: `FROM node:20-alpine` resolves the tag at build time. The registry CAN re-push a different image for the same tag, so every build is potentially different. Production images should pin to `image@sha256:...` for reproducibility + supply-chain integrity."}, "properties": {"repobilityId": 224051, "scanner": "repobility-supply-chain", "fingerprint": "08ba870d1187a6dc2817b3035a7eff6796c96ce68149a8cb43d9cb7025967248", "category": "dependency", "severity": "high", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "docker-from-unpinned", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["dockerfile"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|08ba870d1187a6dc2817b3035a7eff6796c96ce68149a8cb43d9cb7025967248"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "_archive/nbiai_app/app/Dockerfile"}, "region": {"startLine": 1}}}]}, {"ruleId": "MINED113", "level": "error", "message": {"text": "[MINED113] Express POST /api/expenses has no auth: Express route POST /api/expenses declared without an auth middleware in its handler chain. Destructive methods (POST/PUT/DELETE/PATCH) on unauthenticated routes are OWASP A01:2021 broken access control."}, "properties": {"repobilityId": 224048, "scanner": "repobility-route-auth", "fingerprint": "230186d1ff3ecc8a1e9c50f7e275e3c790d5e3baf12d964c0f0e06bad5e24001", "category": "quality", "severity": "high", "confidence": 0.8, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "express-destructive-unauth", "owasp": "A01:2021", "cwe_ids": ["CWE-306", "CWE-862"], "languages": ["python", "javascript"], "observations_count": 7836}, "scanner": "repobility-route-auth", "correlation_key": "fp|230186d1ff3ecc8a1e9c50f7e275e3c790d5e3baf12d964c0f0e06bad5e24001"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "dashboard-server/routes/expenses.js"}, "region": {"startLine": 147}}}]}, {"ruleId": "MINED113", "level": "error", "message": {"text": "[MINED113] Express DELETE /api/expenses/categories/:id has no auth: Express route DELETE /api/expenses/categories/:id declared without an auth middleware in its handler chain. Destructive methods (POST/PUT/DELETE/PATCH) on unauthenticated routes are OWASP A01:2021 broken access control."}, "properties": {"repobilityId": 224047, "scanner": "repobility-route-auth", "fingerprint": "507403d56920c9501b7a5756e932d95ffd1c1c641deb68f7746f005b5cb2208c", "category": "quality", "severity": "high", "confidence": 0.8, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "express-destructive-unauth", "owasp": "A01:2021", "cwe_ids": ["CWE-306", "CWE-862"], "languages": ["python", "javascript"], "observations_count": 7836}, "scanner": "repobility-route-auth", "correlation_key": "fp|507403d56920c9501b7a5756e932d95ffd1c1c641deb68f7746f005b5cb2208c"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "dashboard-server/routes/expenses.js"}, "region": {"startLine": 43}}}]}, {"ruleId": "MINED113", "level": "error", "message": {"text": "[MINED113] Express POST /api/expenses/categories has no auth: Express route POST /api/expenses/categories declared without an auth middleware in its handler chain. Destructive methods (POST/PUT/DELETE/PATCH) on unauthenticated routes are OWASP A01:2021 broken access control."}, "properties": {"repobilityId": 224046, "scanner": "repobility-route-auth", "fingerprint": "412963d1abe42f322546f093e2b914a0a702fcf91c034484620d84acf16a3f93", "category": "quality", "severity": "high", "confidence": 0.8, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "express-destructive-unauth", "owasp": "A01:2021", "cwe_ids": ["CWE-306", "CWE-862"], "languages": ["python", "javascript"], "observations_count": 7836}, "scanner": "repobility-route-auth", "correlation_key": "fp|412963d1abe42f322546f093e2b914a0a702fcf91c034484620d84acf16a3f93"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "dashboard-server/routes/expenses.js"}, "region": {"startLine": 34}}}]}, {"ruleId": "MINED113", "level": "error", "message": {"text": "[MINED113] Express POST /api/leads/:id/activities has no auth: Express route POST /api/leads/:id/activities declared without an auth middleware in its handler chain. Destructive methods (POST/PUT/DELETE/PATCH) on unauthenticated routes are OWASP A01:2021 broken access control."}, "properties": {"repobilityId": 224045, "scanner": "repobility-route-auth", "fingerprint": "9bcfa070e99e17e9d00134bf7d9c2f64afd9287c7442b1dd60ece7639968bd96", "category": "quality", "severity": "high", "confidence": 0.8, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "express-destructive-unauth", "owasp": "A01:2021", "cwe_ids": ["CWE-306", "CWE-862"], "languages": ["python", "javascript"], "observations_count": 7836}, "scanner": "repobility-route-auth", "correlation_key": "fp|9bcfa070e99e17e9d00134bf7d9c2f64afd9287c7442b1dd60ece7639968bd96"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "dashboard-server/routes/leads.js"}, "region": {"startLine": 604}}}]}, {"ruleId": "MINED113", "level": "error", "message": {"text": "[MINED113] Express PUT /api/leads/:id/resources has no auth: Express route PUT /api/leads/:id/resources declared without an auth middleware in its handler chain. Destructive methods (POST/PUT/DELETE/PATCH) on unauthenticated routes are OWASP A01:2021 broken access control."}, "properties": {"repobilityId": 224044, "scanner": "repobility-route-auth", "fingerprint": "74e61df791607bfc002f46c02da483b32864fcdce58279436a9bbf4cf5bfd5b9", "category": "quality", "severity": "high", "confidence": 0.8, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "express-destructive-unauth", "owasp": "A01:2021", "cwe_ids": ["CWE-306", "CWE-862"], "languages": ["python", "javascript"], "observations_count": 7836}, "scanner": "repobility-route-auth", "correlation_key": "fp|74e61df791607bfc002f46c02da483b32864fcdce58279436a9bbf4cf5bfd5b9"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "dashboard-server/routes/leads.js"}, "region": {"startLine": 565}}}]}, {"ruleId": "MINED113", "level": "error", "message": {"text": "[MINED113] Express DELETE /api/leads/:id has no auth: Express route DELETE /api/leads/:id declared without an auth middleware in its handler chain. Destructive methods (POST/PUT/DELETE/PATCH) on unauthenticated routes are OWASP A01:2021 broken access control."}, "properties": {"repobilityId": 224043, "scanner": "repobility-route-auth", "fingerprint": "139cc730391bc46fd6dfde1bbd1e4369047eaeb2b9f8897785ad0685e2d0dcc9", "category": "quality", "severity": "high", "confidence": 0.8, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "express-destructive-unauth", "owasp": "A01:2021", "cwe_ids": ["CWE-306", "CWE-862"], "languages": ["python", "javascript"], "observations_count": 7836}, "scanner": "repobility-route-auth", "correlation_key": "fp|139cc730391bc46fd6dfde1bbd1e4369047eaeb2b9f8897785ad0685e2d0dcc9"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "dashboard-server/routes/leads.js"}, "region": {"startLine": 550}}}]}, {"ruleId": "MINED113", "level": "error", "message": {"text": "[MINED113] Express PATCH /api/leads/:id has no auth: Express route PATCH /api/leads/:id declared without an auth middleware in its handler chain. Destructive methods (POST/PUT/DELETE/PATCH) on unauthenticated routes are OWASP A01:2021 broken access control."}, "properties": {"repobilityId": 224042, "scanner": "repobility-route-auth", "fingerprint": "60d944fb60a6f498247e8906f4b6cca16db9ff210257c3211f6cce0175164902", "category": "quality", "severity": "high", "confidence": 0.8, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "express-destructive-unauth", "owasp": "A01:2021", "cwe_ids": ["CWE-306", "CWE-862"], "languages": ["python", "javascript"], "observations_count": 7836}, "scanner": "repobility-route-auth", "correlation_key": "fp|60d944fb60a6f498247e8906f4b6cca16db9ff210257c3211f6cce0175164902"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "dashboard-server/routes/leads.js"}, "region": {"startLine": 442}}}]}, {"ruleId": "MINED113", "level": "error", "message": {"text": "[MINED113] Express POST /api/leads has no auth: Express route POST /api/leads declared without an auth middleware in its handler chain. Destructive methods (POST/PUT/DELETE/PATCH) on unauthenticated routes are OWASP A01:2021 broken access control."}, "properties": {"repobilityId": 224041, "scanner": "repobility-route-auth", "fingerprint": "5b28f7df39d9e3e26e7a32834c72e8af54a0e6edf80a73ca8ce2b65a8b32f4cb", "category": "quality", "severity": "high", "confidence": 0.8, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "express-destructive-unauth", "owasp": "A01:2021", "cwe_ids": ["CWE-306", "CWE-862"], "languages": ["python", "javascript"], "observations_count": 7836}, "scanner": "repobility-route-auth", "correlation_key": "fp|5b28f7df39d9e3e26e7a32834c72e8af54a0e6edf80a73ca8ce2b65a8b32f4cb"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "dashboard-server/routes/leads.js"}, "region": {"startLine": 363}}}]}, {"ruleId": "MINED113", "level": "error", "message": {"text": "[MINED113] Express DELETE /api/leads/field-options/:id has no auth: Express route DELETE /api/leads/field-options/:id declared without an auth middleware in its handler chain. Destructive methods (POST/PUT/DELETE/PATCH) on unauthenticated routes are OWASP A01:2021 broken access control."}, "properties": {"repobilityId": 224040, "scanner": "repobility-route-auth", "fingerprint": "606b0cb8da0965a223bd79723dc12c088019ed2e62d459202782b8a87ee1b1b3", "category": "quality", "severity": "high", "confidence": 0.8, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "express-destructive-unauth", "owasp": "A01:2021", "cwe_ids": ["CWE-306", "CWE-862"], "languages": ["python", "javascript"], "observations_count": 7836}, "scanner": "repobility-route-auth", "correlation_key": "fp|606b0cb8da0965a223bd79723dc12c088019ed2e62d459202782b8a87ee1b1b3"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "dashboard-server/routes/leads.js"}, "region": {"startLine": 134}}}]}, {"ruleId": "MINED113", "level": "error", "message": {"text": "[MINED113] Express PATCH /api/leads/field-options/:id has no auth: Express route PATCH /api/leads/field-options/:id declared without an auth middleware in its handler chain. Destructive methods (POST/PUT/DELETE/PATCH) on unauthenticated routes are OWASP A01:2021 broken access control."}, "properties": {"repobilityId": 224039, "scanner": "repobility-route-auth", "fingerprint": "b93dcbaa361d13b8abbdb36172bb53077053094942381c050fcf809f518eaddd", "category": "quality", "severity": "high", "confidence": 0.8, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "express-destructive-unauth", "owasp": "A01:2021", "cwe_ids": ["CWE-306", "CWE-862"], "languages": ["python", "javascript"], "observations_count": 7836}, "scanner": "repobility-route-auth", "correlation_key": "fp|b93dcbaa361d13b8abbdb36172bb53077053094942381c050fcf809f518eaddd"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "dashboard-server/routes/leads.js"}, "region": {"startLine": 124}}}]}, {"ruleId": "MINED113", "level": "error", "message": {"text": "[MINED113] Express POST /api/leads/field-options has no auth: Express route POST /api/leads/field-options declared without an auth middleware in its handler chain. Destructive methods (POST/PUT/DELETE/PATCH) on unauthenticated routes are OWASP A01:2021 broken access control."}, "properties": {"repobilityId": 224038, "scanner": "repobility-route-auth", "fingerprint": "7c146da2ab48997e22dccb7c2bb80c6b600274b68f63f0eaa026b0278f807a91", "category": "quality", "severity": "high", "confidence": 0.8, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "express-destructive-unauth", "owasp": "A01:2021", "cwe_ids": ["CWE-306", "CWE-862"], "languages": ["python", "javascript"], "observations_count": 7836}, "scanner": "repobility-route-auth", "correlation_key": "fp|7c146da2ab48997e22dccb7c2bb80c6b600274b68f63f0eaa026b0278f807a91"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "dashboard-server/routes/leads.js"}, "region": {"startLine": 111}}}]}, {"ruleId": "MINED113", "level": "error", "message": {"text": "[MINED113] Express DELETE /api/leads/resource-types/:id has no auth: Express route DELETE /api/leads/resource-types/:id declared without an auth middleware in its handler chain. Destructive methods (POST/PUT/DELETE/PATCH) on unauthenticated routes are OWASP A01:2021 broken access control."}, "properties": {"repobilityId": 224037, "scanner": "repobility-route-auth", "fingerprint": "78b3fedc95b05ebe1aafbbba8aaa32eb7718218b26694ac6ea1e85aa498674c1", "category": "quality", "severity": "high", "confidence": 0.8, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "express-destructive-unauth", "owasp": "A01:2021", "cwe_ids": ["CWE-306", "CWE-862"], "languages": ["python", "javascript"], "observations_count": 7836}, "scanner": "repobility-route-auth", "correlation_key": "fp|78b3fedc95b05ebe1aafbbba8aaa32eb7718218b26694ac6ea1e85aa498674c1"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "dashboard-server/routes/leads.js"}, "region": {"startLine": 98}}}]}, {"ruleId": "MINED113", "level": "error", "message": {"text": "[MINED113] Express PATCH /api/leads/resource-types/:id has no auth: Express route PATCH /api/leads/resource-types/:id declared without an auth middleware in its handler chain. Destructive methods (POST/PUT/DELETE/PATCH) on unauthenticated routes are OWASP A01:2021 broken access control."}, "properties": {"repobilityId": 224036, "scanner": "repobility-route-auth", "fingerprint": "5afc90fd7ac3e25d20689c323ad8646ef1c671382908fb780d278f5a638221e0", "category": "quality", "severity": "high", "confidence": 0.8, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "express-destructive-unauth", "owasp": "A01:2021", "cwe_ids": ["CWE-306", "CWE-862"], "languages": ["python", "javascript"], "observations_count": 7836}, "scanner": "repobility-route-auth", "correlation_key": "fp|5afc90fd7ac3e25d20689c323ad8646ef1c671382908fb780d278f5a638221e0"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "dashboard-server/routes/leads.js"}, "region": {"startLine": 88}}}]}, {"ruleId": "MINED113", "level": "error", "message": {"text": "[MINED113] Express POST /api/leads/resource-types has no auth: Express route POST /api/leads/resource-types declared without an auth middleware in its handler chain. Destructive methods (POST/PUT/DELETE/PATCH) on unauthenticated routes are OWASP A01:2021 broken access control."}, "properties": {"repobilityId": 224035, "scanner": "repobility-route-auth", "fingerprint": "1d288854d0e5fb2cac1a16dccb2c9d9734f9d8cd7ad903ff6e5a201c57068ad2", "category": "quality", "severity": "high", "confidence": 0.8, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "express-destructive-unauth", "owasp": "A01:2021", "cwe_ids": ["CWE-306", "CWE-862"], "languages": ["python", "javascript"], "observations_count": 7836}, "scanner": "repobility-route-auth", "correlation_key": "fp|1d288854d0e5fb2cac1a16dccb2c9d9734f9d8cd7ad903ff6e5a201c57068ad2"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "dashboard-server/routes/leads.js"}, "region": {"startLine": 75}}}]}, {"ruleId": "MINED113", "level": "error", "message": {"text": "[MINED113] Express DELETE /api/leads/stages/:id has no auth: Express route DELETE /api/leads/stages/:id declared without an auth middleware in its handler chain. Destructive methods (POST/PUT/DELETE/PATCH) on unauthenticated routes are OWASP A01:2021 broken access control."}, "properties": {"repobilityId": 224034, "scanner": "repobility-route-auth", "fingerprint": "71263f7f373e29f1e18c4d7f10a9bf72e15505a1acafa4d258c236bc3922506d", "category": "quality", "severity": "high", "confidence": 0.8, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "express-destructive-unauth", "owasp": "A01:2021", "cwe_ids": ["CWE-306", "CWE-862"], "languages": ["python", "javascript"], "observations_count": 7836}, "scanner": "repobility-route-auth", "correlation_key": "fp|71263f7f373e29f1e18c4d7f10a9bf72e15505a1acafa4d258c236bc3922506d"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "dashboard-server/routes/leads.js"}, "region": {"startLine": 65}}}]}, {"ruleId": "MINED113", "level": "error", "message": {"text": "[MINED113] Express PATCH /api/leads/stages/:id has no auth: Express route PATCH /api/leads/stages/:id declared without an auth middleware in its handler chain. Destructive methods (POST/PUT/DELETE/PATCH) on unauthenticated routes are OWASP A01:2021 broken access control."}, "properties": {"repobilityId": 224033, "scanner": "repobility-route-auth", "fingerprint": "9e521f5f8b9d318b3a705ca82fb5fc56cdaba2ab3cf16340e2c1f914cd7919b5", "category": "quality", "severity": "high", "confidence": 0.8, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "express-destructive-unauth", "owasp": "A01:2021", "cwe_ids": ["CWE-306", "CWE-862"], "languages": ["python", "javascript"], "observations_count": 7836}, "scanner": "repobility-route-auth", "correlation_key": "fp|9e521f5f8b9d318b3a705ca82fb5fc56cdaba2ab3cf16340e2c1f914cd7919b5"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "dashboard-server/routes/leads.js"}, "region": {"startLine": 53}}}]}, {"ruleId": "MINED113", "level": "error", "message": {"text": "[MINED113] Express POST /api/leads/stages has no auth: Express route POST /api/leads/stages declared without an auth middleware in its handler chain. Destructive methods (POST/PUT/DELETE/PATCH) on unauthenticated routes are OWASP A01:2021 broken access control."}, "properties": {"repobilityId": 224032, "scanner": "repobility-route-auth", "fingerprint": "2a3fe58f46acd2bb502b3c41e6e556f3b095e1048e83825fc91fbde2921922ce", "category": "quality", "severity": "high", "confidence": 0.8, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "express-destructive-unauth", "owasp": "A01:2021", "cwe_ids": ["CWE-306", "CWE-862"], "languages": ["python", "javascript"], "observations_count": 7836}, "scanner": "repobility-route-auth", "correlation_key": "fp|2a3fe58f46acd2bb502b3c41e6e556f3b095e1048e83825fc91fbde2921922ce"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "dashboard-server/routes/leads.js"}, "region": {"startLine": 40}}}]}, {"ruleId": "MINED113", "level": "error", "message": {"text": "[MINED113] Express DELETE /api/teams/:id/members/:user_id has no auth: Express route DELETE /api/teams/:id/members/:user_id declared without an auth middleware in its handler chain. Destructive methods (POST/PUT/DELETE/PATCH) on unauthenticated routes are OWASP A01:2021 broken access control."}, "properties": {"repobilityId": 224031, "scanner": "repobility-route-auth", "fingerprint": "c2d95b89e0ffac304ec36a1d1d3397a604cb35dd978b4a1b568c43bd69f5f594", "category": "quality", "severity": "high", "confidence": 0.8, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "express-destructive-unauth", "owasp": "A01:2021", "cwe_ids": ["CWE-306", "CWE-862"], "languages": ["python", "javascript"], "observations_count": 7836}, "scanner": "repobility-route-auth", "correlation_key": "fp|c2d95b89e0ffac304ec36a1d1d3397a604cb35dd978b4a1b568c43bd69f5f594"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "dashboard-server/routes/teams.js"}, "region": {"startLine": 236}}}]}, {"ruleId": "MINED113", "level": "error", "message": {"text": "[MINED113] Express PATCH /api/teams/:id/members/:user_id has no auth: Express route PATCH /api/teams/:id/members/:user_id declared without an auth middleware in its handler chain. Destructive methods (POST/PUT/DELETE/PATCH) on unauthenticated routes are OWASP A01:2021 broken access control."}, "properties": {"repobilityId": 224030, "scanner": "repobility-route-auth", "fingerprint": "ed35371f15bded3709f0eee1c79f1e3cb148cde6d18d65d5cdcdadf577638073", "category": "quality", "severity": "high", "confidence": 0.8, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "express-destructive-unauth", "owasp": "A01:2021", "cwe_ids": ["CWE-306", "CWE-862"], "languages": ["python", "javascript"], "observations_count": 7836}, "scanner": "repobility-route-auth", "correlation_key": "fp|ed35371f15bded3709f0eee1c79f1e3cb148cde6d18d65d5cdcdadf577638073"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "dashboard-server/routes/teams.js"}, "region": {"startLine": 214}}}]}, {"ruleId": "MINED113", "level": "error", "message": {"text": "[MINED113] Express POST /api/teams/:id/members has no auth: Express route POST /api/teams/:id/members declared without an auth middleware in its handler chain. Destructive methods (POST/PUT/DELETE/PATCH) on unauthenticated routes are OWASP A01:2021 broken access control."}, "properties": {"repobilityId": 224029, "scanner": "repobility-route-auth", "fingerprint": "2c691cb753c12ad8abf36c737514290d611d2249b926976a70d6fb2c21a4e574", "category": "quality", "severity": "high", "confidence": 0.8, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "express-destructive-unauth", "owasp": "A01:2021", "cwe_ids": ["CWE-306", "CWE-862"], "languages": ["python", "javascript"], "observations_count": 7836}, "scanner": "repobility-route-auth", "correlation_key": "fp|2c691cb753c12ad8abf36c737514290d611d2249b926976a70d6fb2c21a4e574"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "dashboard-server/routes/teams.js"}, "region": {"startLine": 187}}}]}, {"ruleId": "MINED113", "level": "error", "message": {"text": "[MINED113] Express DELETE /api/teams/:id has no auth: Express route DELETE /api/teams/:id declared without an auth middleware in its handler chain. Destructive methods (POST/PUT/DELETE/PATCH) on unauthenticated routes are OWASP A01:2021 broken access control."}, "properties": {"repobilityId": 224028, "scanner": "repobility-route-auth", "fingerprint": "83fb3fcb189945e3b70dd279f47cf3dd1a316a4df982fbc303cc81192be9d349", "category": "quality", "severity": "high", "confidence": 0.8, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "express-destructive-unauth", "owasp": "A01:2021", "cwe_ids": ["CWE-306", "CWE-862"], "languages": ["python", "javascript"], "observations_count": 7836}, "scanner": "repobility-route-auth", "correlation_key": "fp|83fb3fcb189945e3b70dd279f47cf3dd1a316a4df982fbc303cc81192be9d349"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "dashboard-server/routes/teams.js"}, "region": {"startLine": 170}}}]}, {"ruleId": "MINED113", "level": "error", "message": {"text": "[MINED113] Express PATCH /api/teams/:id has no auth: Express route PATCH /api/teams/:id declared without an auth middleware in its handler chain. Destructive methods (POST/PUT/DELETE/PATCH) on unauthenticated routes are OWASP A01:2021 broken access control."}, "properties": {"repobilityId": 224027, "scanner": "repobility-route-auth", "fingerprint": "ea03b3493a0aba26e0c674191901728980d41481d8c4a7c26cca19bb0d16fd4d", "category": "quality", "severity": "high", "confidence": 0.8, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "express-destructive-unauth", "owasp": "A01:2021", "cwe_ids": ["CWE-306", "CWE-862"], "languages": ["python", "javascript"], "observations_count": 7836}, "scanner": "repobility-route-auth", "correlation_key": "fp|ea03b3493a0aba26e0c674191901728980d41481d8c4a7c26cca19bb0d16fd4d"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "dashboard-server/routes/teams.js"}, "region": {"startLine": 134}}}]}, {"ruleId": "MINED113", "level": "error", "message": {"text": "[MINED113] Express POST /api/teams has no auth: Express route POST /api/teams declared without an auth middleware in its handler chain. Destructive methods (POST/PUT/DELETE/PATCH) on unauthenticated routes are OWASP A01:2021 broken access control."}, "properties": {"repobilityId": 224026, "scanner": "repobility-route-auth", "fingerprint": "e7e9ffdefd6bb2556f98853377ae80b67978a757c2164fc1606cd329d9add1d2", "category": "quality", "severity": "high", "confidence": 0.8, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "express-destructive-unauth", "owasp": "A01:2021", "cwe_ids": ["CWE-306", "CWE-862"], "languages": ["python", "javascript"], "observations_count": 7836}, "scanner": "repobility-route-auth", "correlation_key": "fp|e7e9ffdefd6bb2556f98853377ae80b67978a757c2164fc1606cd329d9add1d2"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "dashboard-server/routes/teams.js"}, "region": {"startLine": 105}}}]}, {"ruleId": "MINED113", "level": "error", "message": {"text": "[MINED113] Express PUT /api/settings/:key has no auth: Express route PUT /api/settings/:key declared without an auth middleware in its handler chain. Destructive methods (POST/PUT/DELETE/PATCH) on unauthenticated routes are OWASP A01:2021 broken access control."}, "properties": {"repobilityId": 224025, "scanner": "repobility-route-auth", "fingerprint": "3376e3f61dd827f7d09386288b2e0418351a3ab8a9d7f94fac6cec6183953abf", "category": "quality", "severity": "high", "confidence": 0.8, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "express-destructive-unauth", "owasp": "A01:2021", "cwe_ids": ["CWE-306", "CWE-862"], "languages": ["python", "javascript"], "observations_count": 7836}, "scanner": "repobility-route-auth", "correlation_key": "fp|3376e3f61dd827f7d09386288b2e0418351a3ab8a9d7f94fac6cec6183953abf"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "dashboard-server/routes/settings.js"}, "region": {"startLine": 25}}}]}, {"ruleId": "MINED113", "level": "error", "message": {"text": "[MINED113] Express POST /api/internal/notifications has no auth: Express route POST /api/internal/notifications declared without an auth middleware in its handler chain. Destructive methods (POST/PUT/DELETE/PATCH) on unauthenticated routes are OWASP A01:2021 broken access control."}, "properties": {"repobilityId": 224024, "scanner": "repobility-route-auth", "fingerprint": "2d7127093cc396cdfd061f6d9d7bd7f81c30afe0c2ad88356a67847bbbfb4bfa", "category": "quality", "severity": "high", "confidence": 0.8, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "express-destructive-unauth", "owasp": "A01:2021", "cwe_ids": ["CWE-306", "CWE-862"], "languages": ["python", "javascript"], "observations_count": 7836}, "scanner": "repobility-route-auth", "correlation_key": "fp|2d7127093cc396cdfd061f6d9d7bd7f81c30afe0c2ad88356a67847bbbfb4bfa"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "dashboard-server/server.js"}, "region": {"startLine": 296}}}]}, {"ruleId": "JRN009", "level": "error", "message": {"text": "Secret-like setting is echoed into a password input value"}, "properties": {"repobilityId": 224022, "scanner": "repobility-journey-contract", "fingerprint": "abfa77bed5ae5322f57b9941ad87329622c778e1965b93993524108e852a6f2b", "category": "auth", "severity": "high", "confidence": 0.83, "triageState": "open", "verdict": "likely", "isResolved": false, "reason": "A password or secret-named input is populated from a secret-like variable instead of a masked placeholder.", "evidence": {"rule_id": "JRN009", "scanner": "repobility-journey-contract", "references": ["https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html"], "correlation_key": "code|auth|token|380|jrn009"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "_archive/nbiai_app/app/client/src/pages/SettingsPage.tsx"}, "region": {"startLine": 380}}}]}, {"ruleId": "DKR014", "level": "error", "message": {"text": "Dockerfile copies the entire context without .dockerignore"}, "properties": {"repobilityId": 224017, "scanner": "repobility-docker", "fingerprint": "923d939352bff12e8d01cbd918cd50ac77c8194e0629925096dc7c062fad4d6b", "category": "docker", "severity": "high", "confidence": 0.92, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Broad context copy and missing .dockerignore were found together.", "evidence": {"rule_id": "DKR014", "scanner": "repobility-docker", "references": ["https://docs.docker.com/develop/develop-images/dockerfile_best-practices/"], "correlation_key": "fp|923d939352bff12e8d01cbd918cd50ac77c8194e0629925096dc7c062fad4d6b"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "_archive/nbiai_app/app/Dockerfile"}, "region": {"startLine": 13}}}]}, {"ruleId": "SEC135", "level": "error", "message": {"text": "[SEC135] Auth/permission check missing on AI-generated endpoint: Mutating HTTP endpoint generated by an AI agent without an auth decorator or middleware. The number-one production-incident pattern we see in AI-generated SaaS code: the AI builds the route, builds the handler, and forgets to wire the auth check that the rest of the codebase uses. CWE-862 (missing authorization). High-severity because the route is fully functional, just unprotected \u2014 attackers can call it directly."}, "properties": {"repobilityId": 223971, "scanner": "repobility-threat-engine", "fingerprint": "9d2fb48b8936bf883f72486567aba35625c38b2fbef95d93f3f30eb4f84529a9", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": "router.post('/api/candidates/:id/comments', async (req, res) => {", "reason": "Pattern matched with no mitigating context found", "rule_id": "SEC135", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "fp|9d2fb48b8936bf883f72486567aba35625c38b2fbef95d93f3f30eb4f84529a9"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "dashboard-server/routes/candidate-comments.js"}, "region": {"startLine": 33}}}]}, {"ruleId": "SEC135", "level": "error", "message": {"text": "[SEC135] Auth/permission check missing on AI-generated endpoint: Mutating HTTP endpoint generated by an AI agent without an auth decorator or middleware. The number-one production-incident pattern we see in AI-generated SaaS code: the AI builds the route, builds the handler, and forgets to wire the auth check that the rest of the codebase uses. CWE-862 (missing authorization). High-severity because the route is fully functional, just unprotected \u2014 attackers can call it directly."}, "properties": {"repobilityId": 223970, "scanner": "repobility-threat-engine", "fingerprint": "fe6f76195c6842a2cc45db2a6417f9541b384f2323d58c5c7b7e185da441a4d7", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": "router.post('/api/auth/login', async (req, res) => {", "reason": "Pattern matched with no mitigating context found", "rule_id": "SEC135", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "fp|fe6f76195c6842a2cc45db2a6417f9541b384f2323d58c5c7b7e185da441a4d7"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "dashboard-server/routes/auth.js"}, "region": {"startLine": 18}}}]}, {"ruleId": "SEC135", "level": "error", "message": {"text": "[SEC135] Auth/permission check missing on AI-generated endpoint: Mutating HTTP endpoint generated by an AI agent without an auth decorator or middleware. The number-one production-incident pattern we see in AI-generated SaaS code: the AI builds the route, builds the handler, and forgets to wire the auth check that the rest of the codebase uses. CWE-862 (missing authorization). High-severity because the route is fully functional, just unprotected \u2014 attackers can call it directly."}, "properties": {"repobilityId": 223969, "scanner": "repobility-threat-engine", "fingerprint": "937b83c4eabcb94ea0bdb5da44542646fea690e5388f35906f224888f9c8ed66", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": "router.delete('/api/attachments/:id', async (req, res) => {", "reason": "Pattern matched with no mitigating context found", "rule_id": "SEC135", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "fp|937b83c4eabcb94ea0bdb5da44542646fea690e5388f35906f224888f9c8ed66"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "dashboard-server/routes/attachments.js"}, "region": {"startLine": 134}}}]}, {"ruleId": "SEC114", "level": "error", "message": {"text": "[SEC114] path.join / Path() on user-controlled segment without containment check: filepath.Clean / path.Join on attacker-supplied segments does NOT prevent escape from the base directory. `../../../etc/passwd` resolves cleanly."}, "properties": {"repobilityId": 223968, "scanner": "repobility-threat-engine", "fingerprint": "21bd481354915f6bfd16ab87f21500a62559c8a9e8eb0b4e7fc6ea4a4c3cc7bb", "category": "path_traversal", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": "path.resolve(uploadDir, req.params.", "reason": "Pattern matched with no mitigating context found", "rule_id": "SEC114", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "code|path_traversal|token|98|sec114"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "dashboard-server/routes/attachments.js"}, "region": {"startLine": 98}}}]}, {"ruleId": "SEC029", "level": "error", "message": {"text": "[SEC029] Server-Side Request Forgery (SSRF) \u2014 outbound HTTP from user input: Outbound HTTP request to a user-controlled URL without allowlist validation. Attackers can probe internal services (169.254.169.254 metadata, internal Kubernetes endpoints, file:// URIs), exfiltrate data, or pivot through your network. SSRF is OWASP A10:2021 and a frequent foothold in cloud breaches."}, "properties": {"repobilityId": 223967, "scanner": "repobility-threat-engine", "fingerprint": "0909963fa135d6921b4e567dae2460b97b1885e7e5708e098d9aa8261e0b9c9d", "category": "ssrf", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": "new URL(i", "reason": "Pattern matched with no mitigating context found", "rule_id": "SEC029", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "fp|0909963fa135d6921b4e567dae2460b97b1885e7e5708e098d9aa8261e0b9c9d"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "projects/news-aggregator/src/ingest/canonical.ts"}, "region": {"startLine": 8}}}]}, {"ruleId": "SEC029", "level": "error", "message": {"text": "[SEC029] Server-Side Request Forgery (SSRF) \u2014 outbound HTTP from user input: Outbound HTTP request to a user-controlled URL without allowlist validation. Attackers can probe internal services (169.254.169.254 metadata, internal Kubernetes endpoints, file:// URIs), exfiltrate data, or pivot through your network. SSRF is OWASP A10:2021 and a frequent foothold in cloud breaches."}, "properties": {"repobilityId": 223966, "scanner": "repobility-threat-engine", "fingerprint": "8adec0d8acc11265fe9c4b729585a3d5f20e70cb2e3d273f9bf0860e7b7e6fa2", "category": "ssrf", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": "new URL(u", "reason": "Pattern matched with no mitigating context found", "rule_id": "SEC029", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "fp|8adec0d8acc11265fe9c4b729585a3d5f20e70cb2e3d273f9bf0860e7b7e6fa2"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "dashboard-server/routes/attachments.js"}, "region": {"startLine": 171}}}]}, {"ruleId": "SEC040", "level": "error", "message": {"text": "[SEC040] innerHTML XSS \u2014 template literal with server-supplied data: Setting .innerHTML with a template literal that interpolates server-supplied or user-supplied data is the canonical stored/reflected XSS vector. The browser parses the HTML and executes any <script> or event-handler attributes in the data. CWE-79. Especially dangerous when the data comes from a CV parser, profile field, or any user-input pipeline."}, "properties": {"repobilityId": 223965, "scanner": "repobility-threat-engine", "fingerprint": "b50b6d7c294ae71f905f92821ac0689b83905857e1e2ad004870b09fe449f733", "category": "xss", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": "map((tid, i) => `($1, $${i + 2}", "reason": "Pattern matched with no mitigating context found", "rule_id": "SEC040", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "fp|b50b6d7c294ae71f905f92821ac0689b83905857e1e2ad004870b09fe449f733"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "dashboard-server/routes/milestones.js"}, "region": {"startLine": 47}}}]}, {"ruleId": "SEC040", "level": "error", "message": {"text": "[SEC040] innerHTML XSS \u2014 template literal with server-supplied data: Setting .innerHTML with a template literal that interpolates server-supplied or user-supplied data is the canonical stored/reflected XSS vector. The browser parses the HTML and executes any <script> or event-handler attributes in the data. CWE-79. Especially dangerous when the data comes from a CV parser, profile field, or any user-input pipeline."}, "properties": {"repobilityId": 223964, "scanner": "repobility-threat-engine", "fingerprint": "13259fce78a050d7e7ce2764cb39c46e409b9c4aca70dd608e320940a1f5ae5a", "category": "xss", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": ".innerHTML = files.map(", "reason": "Pattern matched with no mitigating context found", "rule_id": "SEC040", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "fp|13259fce78a050d7e7ce2764cb39c46e409b9c4aca70dd608e320940a1f5ae5a"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "dashboard-server/public/js/views/nbi-folder-view.js"}, "region": {"startLine": 91}}}]}, {"ruleId": "MINED021", "level": "error", "message": {"text": "[MINED021] Path Traversal Os Join: os.path.join(user_dir, filename) where filename can contain \"../\" \u2014 directory escape."}, "properties": {"repobilityId": 223958, "scanner": "repobility-threat-engine", "fingerprint": "076b50145fa52f85a349ca8d5dabf2cc511f0ab68a0fc467612a4e2b6e56dbd8", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "path-traversal-os-join", "owasp": "A01:2021", "cwe_ids": ["CWE-22"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.347947+00:00", "triaged_in_corpus": 15, "observations_count": 45678, "ai_coder_pattern_id": 31}, "scanner": "repobility-threat-engine", "correlation_key": "fp|076b50145fa52f85a349ca8d5dabf2cc511f0ab68a0fc467612a4e2b6e56dbd8"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "_archive/nbiai_app/scripts/fix_dispatcher.py"}, "region": {"startLine": 5}}}]}, {"ruleId": "SEC078", "level": "error", "message": {"text": "[SEC078] Python: requests without timeout: requests.get/post without a timeout will hang indefinitely on a non-responsive server, causing thread exhaustion and ReDoS. Ported from bandit B113 (Apache-2.0). NOTE: this regex is heuristic; a real AST check is preferred for accuracy."}, "properties": {"repobilityId": 223952, "scanner": "repobility-threat-engine", "fingerprint": "01bbacaab61b7af06c52f3a6c5153d7d42962d306483a3a2288ed7506ef38bb9", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": "requests.post(", "reason": "Pattern matched with no mitigating context found", "rule_id": "SEC078", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "fp|01bbacaab61b7af06c52f3a6c5153d7d42962d306483a3a2288ed7506ef38bb9"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/fix_goals_worksage.py"}, "region": {"startLine": 5}}}]}, {"ruleId": "SEC078", "level": "error", "message": {"text": "[SEC078] Python: requests without timeout: requests.get/post without a timeout will hang indefinitely on a non-responsive server, causing thread exhaustion and ReDoS. Ported from bandit B113 (Apache-2.0). NOTE: this regex is heuristic; a real AST check is preferred for accuracy."}, "properties": {"repobilityId": 223951, "scanner": "repobility-threat-engine", "fingerprint": "7be0ab89e1c14c7bd0570ee99cdfb70e6c9558047c50b2f49d428a8c63235720", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": "requests.post(", "reason": "Pattern matched with no mitigating context found", "rule_id": "SEC078", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "fp|7be0ab89e1c14c7bd0570ee99cdfb70e6c9558047c50b2f49d428a8c63235720"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "fix_goals_acronyms.py"}, "region": {"startLine": 17}}}]}, {"ruleId": "SEC078", "level": "error", "message": {"text": "[SEC078] Python: requests without timeout: requests.get/post without a timeout will hang indefinitely on a non-responsive server, causing thread exhaustion and ReDoS. Ported from bandit B113 (Apache-2.0). NOTE: this regex is heuristic; a real AST check is preferred for accuracy."}, "properties": {"repobilityId": 223950, "scanner": "repobility-threat-engine", "fingerprint": "19082985dfd9855b7d899483faa6723442588f4e538e3e5cb7a1f81adb03ae6c", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": "requests.patch(", "reason": "Pattern matched with no mitigating context found", "rule_id": "SEC078", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "fp|19082985dfd9855b7d899483faa6723442588f4e538e3e5cb7a1f81adb03ae6c"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "_archive/nbiai_app/scripts/fix_dispatcher.py"}, "region": {"startLine": 13}}}]}, {"ruleId": "SEC020", "level": "error", "message": {"text": "[SEC020] Secret Printed to Logs: Debug or diagnostic code appears to print a credential-bearing value. This is a frequent AI-assisted coding failure: the helper exposes the exact value needed for troubleshooting."}, "properties": {"repobilityId": 223946, "scanner": "repobility-threat-engine", "fingerprint": "c1c130105434d7c3518f75893170fb26d871adc99b8fd9c40ae6ca98fd9c7f81", "category": "credential_exposure", "severity": "high", "confidence": 0.85, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Credential-bearing variable appears to be printed or logged", "evidence": {"match": "print(f\"Logged in. Token: <redacted>}...\")", "reason": "Credential-bearing variable appears to be printed or logged", "rule_id": "SEC020", "scanner": "repobility-threat-engine", "confidence": 0.85, "correlation_key": "secret|fix_goals_acronyms.py|2|print f logged in. token: redacted ..."}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "fix_goals_acronyms.py"}, "region": {"startLine": 21}}}]}, {"ruleId": "MINED001", "level": "error", "message": {"text": "[MINED001] Bare Except Pass: except: pass or except Exception: pass \u2014 silently swallows everything including KeyboardInterrupt and bugs."}, "properties": {"repobilityId": 223942, "scanner": "repobility-threat-engine", "fingerprint": "5dcb2afcdaf4b31df61077f1a661f170e5e3ff6e394c7db2efe476782003033d", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "bare-except-pass", "owasp": null, "cwe_ids": ["CWE-755"], "languages": ["python"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.347744+00:00", "triaged_in_corpus": 15, "observations_count": 1550824, "ai_coder_pattern_id": 6}, "scanner": "repobility-threat-engine", "correlation_key": "fp|5dcb2afcdaf4b31df61077f1a661f170e5e3ff6e394c7db2efe476782003033d"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Clients/Couch Heroes/scripts/build_hours_map.py"}, "region": {"startLine": 155}}}]}, {"ruleId": "SEC103", "level": "error", "message": {"text": "[SEC103] LDAP injection \u2014 non-constant search filter: User input concatenated into an LDAP search filter. Attackers inject `*)(uid=*` style payloads to bypass auth or enumerate accounts."}, "properties": {"repobilityId": 223941, "scanner": "repobility-threat-engine", "fingerprint": "bf63227dbe64e3901b86cf0d6880bf995842e28aa9a13a9a276a82b311486f14", "category": "injection", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": ".search(r'\\d+\\s*[dD](?:\\b|[)", "reason": "Pattern matched with no mitigating context found", "rule_id": "SEC103", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "code|injection|clients/couch token|56|sec103"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Clients/Couch Heroes/scripts/build_hours_map.py"}, "region": {"startLine": 56}}}]}, {"ruleId": "COMP001", "level": "error", "message": {"text": "[COMP001] High cognitive complexity: Function `main` has cognitive complexity 54 (SonarSource scale). Cognitive complexity measures how hard the function is for a human to understand \u2014 nested branches, boolean chains, and recursion all weigh in. Breakdown: and=1, break=2, continue=2, elif=1, else=1, for=7, if=14, nested_bonus=21, or=3, ternary=2."}, "properties": {"repobilityId": 223939, "scanner": "repobility-threat-engine", "fingerprint": "4973d0af4f581bb7f3c87972e7f703a1a7d1299658055678a09a46ef2de23b5b", "category": "quality", "severity": "high", "confidence": 0.95, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "AST-derived cognitive complexity score = 54 (severity threshold for high: 25+).", "evidence": {"scanner": "repobility-threat-engine", "function": "main", "breakdown": {"if": 14, "or": 3, "and": 1, "for": 7, "elif": 1, "else": 1, "break": 2, "ternary": 2, "continue": 2, "nested_bonus": 21}, "complexity": 54, "correlation_key": "fp|4973d0af4f581bb7f3c87972e7f703a1a7d1299658055678a09a46ef2de23b5b"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Clients/Couch Heroes/production/extract_v15_for_miro.py"}, "region": {"startLine": 98}}}]}, {"ruleId": "COMP001", "level": "error", "message": {"text": "[COMP001] High cognitive complexity: Function `build` has cognitive complexity 135 (SonarSource scale). Cognitive complexity measures how hard the function is for a human to understand \u2014 nested branches, boolean chains, and recursion all weigh in. Breakdown: continue=1, else=4, for=19, if=30, nested_bonus=81."}, "properties": {"repobilityId": 223938, "scanner": "repobility-threat-engine", "fingerprint": "be93aecdde7bb2c3c5e152d5c58446e6972591e83a817f92d9f363ed6ea10e90", "category": "quality", "severity": "high", "confidence": 0.95, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "AST-derived cognitive complexity score = 135 (severity threshold for high: 25+).", "evidence": {"scanner": "repobility-threat-engine", "function": "build", "breakdown": {"if": 30, "for": 19, "else": 4, "continue": 1, "nested_bonus": 81}, "complexity": 135, "correlation_key": "fp|be93aecdde7bb2c3c5e152d5c58446e6972591e83a817f92d9f363ed6ea10e90"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Clients/Couch Heroes/production/build_v12_exact.py"}, "region": {"startLine": 20}}}]}, {"ruleId": "SEC085", "level": "error", "message": {"text": "[SEC085] JS: child_process.exec with non-literal: child_process.exec with user-derived input enables command injection. Ported from eslint-plugin-security detect-child-process (Apache-2.0)."}, "properties": {"repobilityId": 223935, "scanner": "repobility-threat-engine", "fingerprint": "098b0cb15800fb8e46a138595a5e93938825b5eb84b35b9af1461097181b7420", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": "exec(open", "reason": "Pattern matched with no mitigating context found", "rule_id": "SEC085", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "fp|098b0cb15800fb8e46a138595a5e93938825b5eb84b35b9af1461097181b7420"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Clients/Couch Heroes/production/build_v12_exact.py"}, "region": {"startLine": 18}}}]}, {"ruleId": "SEC085", "level": "error", "message": {"text": "[SEC085] JS: child_process.exec with non-literal: child_process.exec with user-derived input enables command injection. Ported from eslint-plugin-security detect-child-process (Apache-2.0)."}, "properties": {"repobilityId": 223934, "scanner": "repobility-threat-engine", "fingerprint": "6041eb58d490e4b7a32494ad81008002a7771f115a7505190dfcec3577c53923", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": "exec(markdown", "reason": "Pattern matched with no mitigating context found", "rule_id": "SEC085", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "fp|6041eb58d490e4b7a32494ad81008002a7771f115a7505190dfcec3577c53923"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/writing-skills/render-graphs.js"}, "region": {"startLine": 25}}}]}, {"ruleId": "SEC085", "level": "error", "message": {"text": "[SEC085] JS: child_process.exec with non-literal: child_process.exec with user-derived input enables command injection. Ported from eslint-plugin-security detect-child-process (Apache-2.0)."}, "properties": {"repobilityId": 223933, "scanner": "repobility-threat-engine", "fingerprint": "92a9764830da3e16a96d64264e91c31c23ee4cd763eb0d5059bc7cf463bf82c4", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": "exec(markdown", "reason": "Pattern matched with no mitigating context found", "rule_id": "SEC085", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "fp|92a9764830da3e16a96d64264e91c31c23ee4cd763eb0d5059bc7cf463bf82c4"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".agents/skills/writing-skills/render-graphs.js"}, "region": {"startLine": 25}}}]}, {"ruleId": "MINED004", "level": "error", "message": {"text": "[MINED004] Weak Crypto: MD5/SHA1/DES/RC4 used for security context (not just checksums)."}, "properties": {"repobilityId": 223924, "scanner": "repobility-threat-engine", "fingerprint": "9d856b94ef2d01052fc2384376725ac6b014c190b6d9f9580dd3a915fb20db10", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "weak-crypto", "owasp": "A02:2021", "cwe_ids": ["CWE-327"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.347906+00:00", "triaged_in_corpus": 15, "observations_count": 303181, "ai_coder_pattern_id": 13}, "scanner": "repobility-threat-engine", "correlation_key": "fp|9d856b94ef2d01052fc2384376725ac6b014c190b6d9f9580dd3a915fb20db10"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "dashboard-server/cron/dreaming/index.js"}, "region": {"startLine": 6}}}]}, {"ruleId": "MINED004", "level": "error", "message": {"text": "[MINED004] Weak Crypto: MD5/SHA1/DES/RC4 used for security context (not just checksums)."}, "properties": {"repobilityId": 223923, "scanner": "repobility-threat-engine", "fingerprint": "3af6786c402eb48122e285be5162b4c9e6d93f63299f75ca1fed93c62e6e86ab", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "weak-crypto", "owasp": "A02:2021", "cwe_ids": ["CWE-327"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.347906+00:00", "triaged_in_corpus": 15, "observations_count": 303181, "ai_coder_pattern_id": 13}, "scanner": "repobility-threat-engine", "correlation_key": "fp|3af6786c402eb48122e285be5162b4c9e6d93f63299f75ca1fed93c62e6e86ab"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/brainstorming/scripts/server.cjs"}, "region": {"startLine": 12}}}]}, {"ruleId": "MINED004", "level": "error", "message": {"text": "[MINED004] Weak Crypto: MD5/SHA1/DES/RC4 used for security context (not just checksums)."}, "properties": {"repobilityId": 223922, "scanner": "repobility-threat-engine", "fingerprint": "b0146424e681f5b9f2ab94acc24d0d8a2c474af8bac222d202539c36b486382d", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "weak-crypto", "owasp": "A02:2021", "cwe_ids": ["CWE-327"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.347906+00:00", "triaged_in_corpus": 15, "observations_count": 303181, "ai_coder_pattern_id": 13}, "scanner": "repobility-threat-engine", "correlation_key": "fp|b0146424e681f5b9f2ab94acc24d0d8a2c474af8bac222d202539c36b486382d"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".agents/skills/brainstorming/scripts/server.cjs"}, "region": {"startLine": 12}}}]}, {"ruleId": "SEC128", "level": "error", "message": {"text": "[SEC128] Async function without await \u2014 fire-and-forget Promise (AI mistake): Async call invoked without `await` returns an unhandled Promise. The outer function resolves before the inner work completes \u2014 DB writes lost, emails not sent, race conditions. This is one of the top-3 errors AI coders make: they understand async-shape but drop the await keyword when chaining multiple ops. Surfaces as flaky tests or silently dropped data in production."}, "properties": {"repobilityId": 223916, "scanner": "repobility-threat-engine", "fingerprint": "d71c7b0d80996f8fea6742ea9e5947abeb64f1f35edd3a82ac54de383691e043", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": "wb.save(output)", "reason": "Pattern matched with no mitigating context found", "rule_id": "SEC128", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "fp|d71c7b0d80996f8fea6742ea9e5947abeb64f1f35edd3a82ac54de383691e043"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Clients/Couch Heroes/production/build_v12_exact.py"}, "region": {"startLine": 260}}}]}, {"ruleId": "SEC128", "level": "error", "message": {"text": "[SEC128] Async function without await \u2014 fire-and-forget Promise (AI mistake): Async call invoked without `await` returns an unhandled Promise. The outer function resolves before the inner work completes \u2014 DB writes lost, emails not sent, race conditions. This is one of the top-3 errors AI coders make: they understand async-shape but drop the await keyword when chaining multiple ops. Surfaces as flaky tests or silently dropped data in production."}, "properties": {"repobilityId": 223915, "scanner": "repobility-threat-engine", "fingerprint": "4f6549c52455fc5861b7b89d404fd663528bc835b77e67790ec79ea686ac3f77", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": "clients.delete(socket);", "reason": "Pattern matched with no mitigating context found", "rule_id": "SEC128", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "fp|4f6549c52455fc5861b7b89d404fd663528bc835b77e67790ec79ea686ac3f77"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/brainstorming/scripts/server.cjs"}, "region": {"startLine": 190}}}]}, {"ruleId": "SEC128", "level": "error", "message": {"text": "[SEC128] Async function without await \u2014 fire-and-forget Promise (AI mistake): Async call invoked without `await` returns an unhandled Promise. The outer function resolves before the inner work completes \u2014 DB writes lost, emails not sent, race conditions. This is one of the top-3 errors AI coders make: they understand async-shape but drop the await keyword when chaining multiple ops. Surfaces as flaky tests or silently dropped data in production."}, "properties": {"repobilityId": 223914, "scanner": "repobility-threat-engine", "fingerprint": "1a328567cae66b8fc1b3cd83075ff0e05e036745cda6126caf236db7923ca797", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": "clients.delete(socket);", "reason": "Pattern matched with no mitigating context found", "rule_id": "SEC128", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "fp|1a328567cae66b8fc1b3cd83075ff0e05e036745cda6126caf236db7923ca797"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".agents/skills/brainstorming/scripts/server.cjs"}, "region": {"startLine": 190}}}]}, {"ruleId": "MINED114", "level": "error", "message": {"text": "[MINED114] Admin endpoint without auth: POST /api/admin/granola-sync: Express route on /admin path (/api/admin/granola-sync) with no auth middleware."}, "properties": {"repobilityId": 224050, "scanner": "repobility-route-auth", "fingerprint": "74b14bc94b4fe61e9faf0627970e79b0f798a24b68c33f0387d26e53c957158a", "category": "quality", "severity": "critical", "confidence": 0.8, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "admin-handler-unauth", "owasp": "A01:2021", "cwe_ids": ["CWE-284", "CWE-862"], "languages": ["python", "javascript"], "observations_count": 6292}, "scanner": "repobility-route-auth", "correlation_key": "fp|74b14bc94b4fe61e9faf0627970e79b0f798a24b68c33f0387d26e53c957158a"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "dashboard-server/routes/admin.js"}, "region": {"startLine": 923}}}]}, {"ruleId": "MINED114", "level": "error", "message": {"text": "[MINED114] Admin endpoint without auth: POST /api/admin/cleanse: Express route on /admin path (/api/admin/cleanse) with no auth middleware."}, "properties": {"repobilityId": 224049, "scanner": "repobility-route-auth", "fingerprint": "370b0433a40c47bfc8287d0fcc8568bddf12171d6066b856cad2dd4c289f27b3", "category": "quality", "severity": "critical", "confidence": 0.8, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "admin-handler-unauth", "owasp": "A01:2021", "cwe_ids": ["CWE-284", "CWE-862"], "languages": ["python", "javascript"], "observations_count": 6292}, "scanner": "repobility-route-auth", "correlation_key": "fp|370b0433a40c47bfc8287d0fcc8568bddf12171d6066b856cad2dd4c289f27b3"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "dashboard-server/routes/admin.js"}, "region": {"startLine": 709}}}]}, {"ruleId": "MINED107", "level": "error", "message": {"text": "[MINED107] Missing import: `gc` used but not imported: The file uses `gc.something(...)` but never imports `gc`. This raises NameError at runtime the first time the line executes."}, "properties": {"repobilityId": 224023, "scanner": "repobility-ast-engine", "fingerprint": "bcec56ecf2a53281d59374da8be0d60f6d86ceaec902f0928c2879973a63af25", "category": "quality", "severity": "critical", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "missing-import-python", "owasp": "A06:2021", "cwe_ids": ["CWE-1075"], "languages": ["python"], "observations_count": 2192}, "scanner": "repobility-ast-engine", "correlation_key": "fp|bcec56ecf2a53281d59374da8be0d60f6d86ceaec902f0928c2879973a63af25"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Clients/Couch Heroes/production/consolidate_template_style.py"}, "region": {"startLine": 406}}}]}, {"ruleId": "SEC022", "level": "error", "message": {"text": "[SEC022] Database URL With Embedded Credential: A database connection URL contains an embedded username and password. These URLs are often copied into defaults, docs, and scripts, then leak working credentials."}, "properties": {"repobilityId": 223978, "scanner": "repobility-threat-engine", "fingerprint": "860e1477b1bb1c32f49f369154203793801e788876a54a4af83fe34140b0cd4f", "category": "credential_exposure", "severity": "critical", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": "postgresql://nbiai:NbiAi2026!SecureDb@", "reason": "Pattern matched with no mitigating context found", "rule_id": "SEC022", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "secret|prototypes/_fetch_data.js|1|token securedb"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "prototypes/_fetch_data.js"}, "region": {"startLine": 2}}}]}, {"ruleId": "MINED007", "level": "error", "message": {"text": "[MINED007] Sql String Concat: cursor.execute(f\"... {user_input} ...\") \u2014 SQL injection."}, "properties": {"repobilityId": 223977, "scanner": "repobility-threat-engine", "fingerprint": "27e5dc9753d3782d3d0a877902f266fe23beebaed57df5384456fa7134ad53f2", "category": "quality", "severity": "critical", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "sql-string-concat", "owasp": "A03:2021", "cwe_ids": ["CWE-89"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.347914+00:00", "triaged_in_corpus": 20, "observations_count": 210457, "ai_coder_pattern_id": 12}, "scanner": "repobility-threat-engine", "correlation_key": "fp|27e5dc9753d3782d3d0a877902f266fe23beebaed57df5384456fa7134ad53f2"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "projects/news-aggregator/src/llm/client.ts"}, "region": {"startLine": 126}}}]}, {"ruleId": "scanner-6372cebde0220094", "level": "warning", "message": {"text": "No auth library detected"}, "properties": {"repobilityId": "a5b6035a5bbf8054", "scanner": "scanner-primary", "fingerprint": "6372cebde0220094", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["coverage", "auth"]}}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "9677cf51ef29590a", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-bea357a6497a2d5d", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: CLAUDE.md"}, "properties": {"repobilityId": "aae72df3934829ac", "scanner": "scanner-primary", "fingerprint": "bea357a6497a2d5d", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "CLAUDE.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-08e3339d29ee1acd", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 fix_goals_acronyms.py:163"}, "properties": {"repobilityId": "1e116ab722f3aaf5", "scanner": "scanner-primary", "fingerprint": "08e3339d29ee1acd", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}]}]}