{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-08023a05f250c09b", "name": "TODO/FIXME marker in shipping code \u2014 wasm/js/graphjin.js:17", "shortDescription": {"text": "TODO/FIXME marker in shipping code \u2014 wasm/js/graphjin.js:17"}, "fullDescription": {"text": "Track in /reviews or /issues, not as a code comment that rots.\n\nWhy: Drift control \u2014 shouldn't be the same as Quality TODO scanner.\nRule id: fq.todo-marker"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-a19e6b5f4fa8667e", "name": "Stray `console.log` in TS/JS \u2014 wasm/js/wasm_exec.js:22", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 wasm/js/wasm_exec.js:22"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f1e25de4d0409d8c", "name": "Stray `console.log` in TS/JS \u2014 benchmark/subs.js:50", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 benchmark/subs.js:50"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-734f32cf63e39aa2", "name": "Runtime dotenv file present in repo: serv/web/.env", "shortDescription": {"text": "Runtime dotenv file present in repo: serv/web/.env"}, "fullDescription": {"text": "`serv/web/.env` looks like a runtime dotenv file. No high-confidence secret value was matched, but runtime dotenv files often drift into live credentials. Move real values to a secret manager and keep only `.env.example` style templates in source control."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-7df433947bc824ee", "name": "Insecure pattern 'direct_innerhtml_assignment' in website/static/js/site.js:178", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in website/static/js/site.js:178"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-78abae03c269de34", "name": "Insecure pattern 'eval_used' in core/role_match.go:16", "shortDescription": {"text": "Insecure pattern 'eval_used' in core/role_match.go:16"}, "fullDescription": {"text": "Found a known-risky pattern (eval_used). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-a5a8b30e473e5493", "name": "Insecure pattern 'private_key_in_repo' in core/catalog_test.go:92", "shortDescription": {"text": "Insecure pattern 'private_key_in_repo' in core/catalog_test.go:92"}, "fullDescription": {"text": "Found a known-risky pattern (private_key_in_repo). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-af28433ec009694c", "name": "Insecure pattern 'eval_used' in core/role_match_test.go:79", "shortDescription": {"text": "Insecure pattern 'eval_used' in core/role_match_test.go:79"}, "fullDescription": {"text": "Found a known-risky pattern (eval_used). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-9e3858cae1419a7c", "name": "Insecure pattern 'private_key_in_repo' in serv/mcp_test.go:1903", "shortDescription": {"text": "Insecure pattern 'private_key_in_repo' in serv/mcp_test.go:1903"}, "fullDescription": {"text": "Found a known-risky pattern (private_key_in_repo). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-b91d056887af0f3a", "name": "Possible secret in serv/mcp_discover.go", "shortDescription": {"text": "Possible secret in serv/mcp_discover.go"}, "fullDescription": {"text": "Detected pattern matching password_literal. Rotate the credential and move to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-7a0e55c301adb0a7", "name": "Insecure pattern 'cors_wildcard' in serv/http.go:494", "shortDescription": {"text": "Insecure pattern 'cors_wildcard' in serv/http.go:494"}, "fullDescription": {"text": "Found a known-risky pattern (cors_wildcard). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-051b7cf0314dfcea", "name": "Possible secret in cmd/cmd_demo.go", "shortDescription": {"text": "Possible secret in cmd/cmd_demo.go"}, "fullDescription": {"text": "Detected pattern matching password_literal. Rotate the credential and move to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-3c7cd7d0b2a6954e", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v2 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5bc4cf5aa717df4c", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6ba9bfab5f283202", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-419c7fcdf11fc660", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-24a2353e77881d9e", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-cb639d9a10a47b23", "name": "package.json defines install-time lifecycle scripts", "shortDescription": {"text": "package.json defines install-time lifecycle scripts"}, "fullDescription": {"text": "preinstall/install/postinstall/prepare scripts execute during dependency installation. Review them carefully for network calls, obfuscation, shell execution, or credential access."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-62be69fb73b4e01e", "name": "package.json defines install-time lifecycle scripts", "shortDescription": {"text": "package.json defines install-time lifecycle scripts"}, "fullDescription": {"text": "preinstall/install/postinstall/prepare scripts execute during dependency installation. Review them carefully for network calls, obfuscation, shell execution, or credential access."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-78a841ce2481a1e0", "name": "Very large file: tests/query_test.go (2623 lines)", "shortDescription": {"text": "Very large file: tests/query_test.go (2623 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7849572571dcf2fe", "name": "Very large file: tests/hostedemu/snowflake/internal/sfparser/snowflakeparser_listener.go (3255 lines)", "shortDescription": {"text": "Very large file: tests/hostedemu/snowflake/internal/sfparser/snowflakeparser_listener.go (3255 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3fef5aaaa2e69969", "name": "Very large file: tests/hostedemu/snowflake/internal/sfparser/snowflakeparser_base_listener.go (3451 lines)", "shortDescription": {"text": "Very large file: tests/hostedemu/snowflake/internal/sfparser/snowflakeparser_base_listener.go (3451 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0131a9a0588e6038", "name": "Very large file: tests/hostedemu/snowflake/internal/sfparser/snowflake_lexer.go (8776 lines)", "shortDescription": {"text": "Very large file: tests/hostedemu/snowflake/internal/sfparser/snowflake_lexer.go (8776 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a0acc8e65cd2bf0f", "name": "Very large file: tests/hostedemu/snowflake/internal/sfparser/snowflakeparser_visitor.go (1632 lines)", "shortDescription": {"text": "Very large file: tests/hostedemu/snowflake/internal/sfparser/snowflakeparser_visitor.go (1632 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-31f03c6cd57524d9", "name": "Very large file: tests/hostedemu/snowflake/internal/sfparser/snowflakeparser_base_visitor.go (2172 lines)", "shortDescription": {"text": "Very large file: tests/hostedemu/snowflake/internal/sfparser/snowflakeparser_base_visitor.go (2172 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4d876198f6c3733e", "name": "Very large file: core/schema_diff_test.go (2158 lines)", "shortDescription": {"text": "Very large file: core/schema_diff_test.go (2158 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-424fc2be27436b42", "name": "Very large file: core/schema_ddl.go (1878 lines)", "shortDescription": {"text": "Very large file: core/schema_ddl.go (1878 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b7f098150cbd9ece", "name": "Very large file: core/api.go (2999 lines)", "shortDescription": {"text": "Very large file: core/api.go (2999 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2df3239012254939", "name": "Very large file: core/config.go (1876 lines)", "shortDescription": {"text": "Very large file: core/config.go (1876 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0e7a9aa728f69af1", "name": "Very large file: core/internal/dialect/mongodb.go (4383 lines)", "shortDescription": {"text": "Very large file: core/internal/dialect/mongodb.go (4383 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d22b7b95c785cc6e", "name": "Very large file: core/internal/dialect/mariadb.go (2681 lines)", "shortDescription": {"text": "Very large file: core/internal/dialect/mariadb.go (2681 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-034210080ed70c7c", "name": "Very large file: core/internal/dialect/mssql.go (3824 lines)", "shortDescription": {"text": "Very large file: core/internal/dialect/mssql.go (3824 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6072cb8be3d8b89e", "name": "Very large file: core/internal/introspection/tables.go (1746 lines)", "shortDescription": {"text": "Very large file: core/internal/introspection/tables.go (1746 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-25a9f097adb62d70", "name": "Very large file: core/internal/catalog/build.go (1637 lines)", "shortDescription": {"text": "Very large file: core/internal/catalog/build.go (1637 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cbcc11dd907e7b9d", "name": "Very large file: serv/security_report.go (2260 lines)", "shortDescription": {"text": "Very large file: serv/security_report.go (2260 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8f8ee167a7228fb7", "name": "Very large file: serv/mcp_schema.go (1667 lines)", "shortDescription": {"text": "Very large file: serv/mcp_schema.go (1667 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ee341efe80cefc18", "name": "Very large file: serv/mcp_catalog.go (1217 lines)", "shortDescription": {"text": "Very large file: serv/mcp_catalog.go (1217 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4c6071aa1c388cca", "name": "Very large file: serv/control_plane_graphql.go (1350 lines)", "shortDescription": {"text": "Very large file: serv/control_plane_graphql.go (1350 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-dfb9c9c5d2e4d88a", "name": "Very large file: serv/control_plane_graphql_test.go (2548 lines)", "shortDescription": {"text": "Very large file: serv/control_plane_graphql_test.go (2548 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-34b064909b39a561", "name": "Very large file: serv/mcp_config.go (3686 lines)", "shortDescription": {"text": "Very large file: serv/mcp_config.go (3686 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e913aa62824bd255", "name": "Very large file: serv/mcp_test.go (2092 lines)", "shortDescription": {"text": "Very large file: serv/mcp_test.go (2092 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2c089bfd5544a643", "name": "Node manifest has dependencies but no lockfile: wasm/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: wasm/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 7 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-72b2a6250083a784", "name": "Placeholder or mock-heavy implementation detected", "shortDescription": {"text": "Placeholder or mock-heavy implementation detected"}, "fullDescription": {"text": "Found 121 placeholder/mock markers across 46 source files. This often means the repo looks complete while core flows still use generated scaffolding or fake data."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9d79c4077342a7d0", "name": "Runtime service client appears to use placeholder configuration", "shortDescription": {"text": "Runtime service client appears to use placeholder configuration"}, "fullDescription": {"text": "A runtime source file appears to wire Supabase/Firebase/AI/payment-style clients to placeholder URLs, keys, or fallback values. In the Fable corpus this often means the UI/API shape is present while the backend service is not actually configured."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-749d4bc1bd66df5f", "name": "Agent instructions exist but release-hardening basics are missing", "shortDescription": {"text": "Agent instructions exist but release-hardening basics are missing"}, "fullDescription": {"text": "AI-coder instruction files were found, but the repo is missing lockfile. Treat this as a contract gap: the agent is guided, but the generated output is not yet guarded by the controls that make it repeatable."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b07feac733eaa250", "name": "Agent authority lacks a verifier contract: claude-plugins/graphjin-mcp/.mcp.json", "shortDescription": {"text": "Agent authority lacks a verifier contract: claude-plugins/graphjin-mcp/.mcp.json"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f7a1976f0c62effe", "name": "Agent authority lacks a verifier contract: skills/add-graphjin-database/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: skills/add-graphjin-database/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b6a2974dc8255407", "name": "Frontend route `/schema` has no Link/navigate to it \u2014 serv/web/src/App.jsx", "shortDescription": {"text": "Frontend route `/schema` has no Link/navigate to it \u2014 serv/web/src/App.jsx"}, "fullDescription": {"text": "The route is registered but no `<Link to=\u2026>` or `navigate(\u2026)` in the codebase navigates here. Either it's reachable only via direct URL (intentional), it's dead, or the link broke during a refactor."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-5cac15ac2b8616e2", "name": "Frontend route `/queries` has no Link/navigate to it \u2014 serv/web/src/App.jsx", "shortDescription": {"text": "Frontend route `/queries` has no Link/navigate to it \u2014 serv/web/src/App.jsx"}, "fullDescription": {"text": "The route is registered but no `<Link to=\u2026>` or `navigate(\u2026)` in the codebase navigates here. Either it's reachable only via direct URL (intentional), it's dead, or the link broke during a refactor."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6b574c861615ef9b", "name": "Frontend route `/databases` has no Link/navigate to it \u2014 serv/web/src/App.jsx", "shortDescription": {"text": "Frontend route `/databases` has no Link/navigate to it \u2014 serv/web/src/App.jsx"}, "fullDescription": {"text": "The route is registered but no `<Link to=\u2026>` or `navigate(\u2026)` in the codebase navigates here. Either it's reachable only via direct URL (intentional), it's dead, or the link broke during a refactor."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/25491"}, "properties": {"repository": "dosco/graphjin", "repoUrl": "https://github.com/dosco/graphjin", "branch": "main"}, "results": [{"ruleId": "scanner-08023a05f250c09b", "level": "none", "message": {"text": "TODO/FIXME marker in shipping code \u2014 wasm/js/graphjin.js:17"}, "properties": {"repobilityId": "eb352e319a53ab98", "scanner": "scanner-primary", "fingerprint": "08023a05f250c09b", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.todo-marker"]}}, {"ruleId": "scanner-a19e6b5f4fa8667e", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 wasm/js/wasm_exec.js:22"}, "properties": {"repobilityId": "c13862e7a11809ac", "scanner": "scanner-primary", "fingerprint": "a19e6b5f4fa8667e", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-f1e25de4d0409d8c", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 benchmark/subs.js:50"}, "properties": {"repobilityId": "514f41788f192dc8", "scanner": "scanner-primary", "fingerprint": "f1e25de4d0409d8c", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-734f32cf63e39aa2", "level": "error", "message": {"text": "Runtime dotenv file present in repo: serv/web/.env"}, "properties": {"repobilityId": "6de74c15a3e7e5fa", "scanner": "scanner-primary", "fingerprint": "734f32cf63e39aa2", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["secrets", "config", "env-file", "runtime-env"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "serv/web/.env"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-7df433947bc824ee", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in website/static/js/site.js:178"}, "properties": {"repobilityId": "70fd1dbe7c6919e6", "scanner": "scanner-primary", "fingerprint": "7df433947bc824ee", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "website/static/js/site.js"}, "region": {"startLine": 178}}}]}, {"ruleId": "scanner-78abae03c269de34", "level": "error", "message": {"text": "Insecure pattern 'eval_used' in core/role_match.go:16"}, "properties": {"repobilityId": "08aee5f23df87f7f", "scanner": "scanner-primary", "fingerprint": "78abae03c269de34", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "eval_used"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "core/role_match.go"}, "region": {"startLine": 16}}}]}, {"ruleId": "scanner-a5a8b30e473e5493", "level": "error", "message": {"text": "Insecure pattern 'private_key_in_repo' in core/catalog_test.go:92"}, "properties": {"repobilityId": "b41102b15d4e508a", "scanner": "scanner-primary", "fingerprint": "a5a8b30e473e5493", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["owasp", "private_key_in_repo"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "core/catalog_test.go"}, "region": {"startLine": 92}}}]}, {"ruleId": "scanner-af28433ec009694c", "level": "error", "message": {"text": "Insecure pattern 'eval_used' in core/role_match_test.go:79"}, "properties": {"repobilityId": "bcf0a7100f6a661e", "scanner": "scanner-primary", "fingerprint": "af28433ec009694c", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "eval_used"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "core/role_match_test.go"}, "region": {"startLine": 79}}}]}, {"ruleId": "scanner-9e3858cae1419a7c", "level": "error", "message": {"text": "Insecure pattern 'private_key_in_repo' in serv/mcp_test.go:1903"}, "properties": {"repobilityId": "91c2a3978edc36da", "scanner": "scanner-primary", "fingerprint": "9e3858cae1419a7c", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["owasp", "private_key_in_repo"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "serv/mcp_test.go"}, "region": {"startLine": 1903}}}]}, {"ruleId": "scanner-b91d056887af0f3a", "level": "error", "message": {"text": "Possible secret in serv/mcp_discover.go"}, "properties": {"repobilityId": "1bf6326e8ff85b18", "scanner": "scanner-primary", "fingerprint": "b91d056887af0f3a", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "serv/mcp_discover.go"}, "region": {"startLine": 1111}}}]}, {"ruleId": "scanner-b91d056887af0f3a", "level": "error", "message": {"text": "Possible secret in serv/mcp_discover.go"}, "properties": {"repobilityId": "1bf6326e8ff85b18", "scanner": "scanner-primary", "fingerprint": "b91d056887af0f3a", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "serv/mcp_discover.go"}, "region": {"startLine": 1127}}}]}, {"ruleId": "scanner-7a0e55c301adb0a7", "level": "warning", "message": {"text": "Insecure pattern 'cors_wildcard' in serv/http.go:494"}, "properties": {"repobilityId": "64eae0ebf35429b8", "scanner": "scanner-primary", "fingerprint": "7a0e55c301adb0a7", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "cors_wildcard"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "serv/http.go"}, "region": {"startLine": 494}}}]}, {"ruleId": "scanner-051b7cf0314dfcea", "level": "error", "message": {"text": "Possible secret in cmd/cmd_demo.go"}, "properties": {"repobilityId": "d385dde78ce82567", "scanner": "scanner-primary", "fingerprint": "051b7cf0314dfcea", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "cmd/cmd_demo.go"}, "region": {"startLine": 520}}}]}, {"ruleId": "scanner-051b7cf0314dfcea", "level": "error", "message": {"text": "Possible secret in cmd/cmd_demo.go"}, "properties": {"repobilityId": "d385dde78ce82567", "scanner": "scanner-primary", "fingerprint": "051b7cf0314dfcea", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "cmd/cmd_demo.go"}, "region": {"startLine": 577}}}]}, {"ruleId": "scanner-051b7cf0314dfcea", "level": "error", "message": {"text": "Possible secret in cmd/cmd_demo.go"}, "properties": {"repobilityId": "d385dde78ce82567", "scanner": "scanner-primary", "fingerprint": "051b7cf0314dfcea", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "cmd/cmd_demo.go"}, "region": {"startLine": 648}}}]}, {"ruleId": "scanner-051b7cf0314dfcea", "level": "error", "message": {"text": "Possible secret in cmd/cmd_demo.go"}, "properties": {"repobilityId": "d385dde78ce82567", "scanner": "scanner-primary", "fingerprint": "051b7cf0314dfcea", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "cmd/cmd_demo.go"}, "region": {"startLine": 761}}}]}, {"ruleId": "scanner-051b7cf0314dfcea", "level": "error", "message": {"text": "Possible secret in cmd/cmd_demo.go"}, "properties": {"repobilityId": "d385dde78ce82567", "scanner": "scanner-primary", "fingerprint": "051b7cf0314dfcea", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "cmd/cmd_demo.go"}, "region": {"startLine": 844}}}]}, {"ruleId": "scanner-3c7cd7d0b2a6954e", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "6f1c369d7004b602", "scanner": "scanner-primary", "fingerprint": "3c7cd7d0b2a6954e", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/codeql-analysis.yml"}, "region": {"startLine": 14}}}]}, {"ruleId": "scanner-3c7cd7d0b2a6954e", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "cf3fa7d2f28c3c21", "scanner": "scanner-primary", "fingerprint": "3c7cd7d0b2a6954e", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/codeql-analysis.yml"}, "region": {"startLine": 18}}}]}, {"ruleId": "scanner-3c7cd7d0b2a6954e", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "b6eebad6b067c26b", "scanner": "scanner-primary", "fingerprint": "3c7cd7d0b2a6954e", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/codeql-analysis.yml"}, "region": {"startLine": 26}}}]}, {"ruleId": "scanner-3c7cd7d0b2a6954e", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "0b85a12d7bf601e2", "scanner": "scanner-primary", "fingerprint": "3c7cd7d0b2a6954e", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/codeql-analysis.yml"}, "region": {"startLine": 40}}}]}, {"ruleId": "scanner-5bc4cf5aa717df4c", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "f66730990c41b8df", "scanner": "scanner-primary", "fingerprint": "5bc4cf5aa717df4c", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/auto-release.yml"}, "region": {"startLine": 22}}}]}, {"ruleId": "scanner-5bc4cf5aa717df4c", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "baac2afcfe8cce46", "scanner": "scanner-primary", "fingerprint": "5bc4cf5aa717df4c", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/auto-release.yml"}, "region": {"startLine": 29}}}]}, {"ruleId": "scanner-5bc4cf5aa717df4c", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "3b331fa28e29a7dd", "scanner": "scanner-primary", "fingerprint": "5bc4cf5aa717df4c", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/auto-release.yml"}, "region": {"startLine": 133}}}]}, {"ruleId": "scanner-5bc4cf5aa717df4c", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "17eff03cd40a87c5", "scanner": "scanner-primary", "fingerprint": "5bc4cf5aa717df4c", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/auto-release.yml"}, "region": {"startLine": 139}}}]}, {"ruleId": "scanner-5bc4cf5aa717df4c", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "c5153c401685e5e4", "scanner": "scanner-primary", "fingerprint": "5bc4cf5aa717df4c", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/auto-release.yml"}, "region": {"startLine": 233}}}]}, {"ruleId": "scanner-5bc4cf5aa717df4c", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "f9d16d2c8ee6cf02", "scanner": "scanner-primary", "fingerprint": "5bc4cf5aa717df4c", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/auto-release.yml"}, "region": {"startLine": 240}}}]}, {"ruleId": "scanner-5bc4cf5aa717df4c", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "6a1423f790206adf", "scanner": "scanner-primary", "fingerprint": "5bc4cf5aa717df4c", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/auto-release.yml"}, "region": {"startLine": 247}}}]}, {"ruleId": "scanner-6ba9bfab5f283202", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "1bf0fd1430c42e23", "scanner": "scanner-primary", "fingerprint": "6ba9bfab5f283202", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/build.yml"}, "region": {"startLine": 21}}}]}, {"ruleId": "scanner-6ba9bfab5f283202", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "f2650a38768ba4ad", "scanner": "scanner-primary", "fingerprint": "6ba9bfab5f283202", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/build.yml"}, "region": {"startLine": 24}}}]}, {"ruleId": "scanner-6ba9bfab5f283202", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "f0677daaa797d152", "scanner": "scanner-primary", "fingerprint": "6ba9bfab5f283202", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/build.yml"}, "region": {"startLine": 29}}}]}, {"ruleId": "scanner-419c7fcdf11fc660", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "8e324569080b97e1", "scanner": "scanner-primary", "fingerprint": "419c7fcdf11fc660", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/deploy-website.yml"}, "region": {"startLine": 26}}}]}, {"ruleId": "scanner-419c7fcdf11fc660", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "8abfa365d19b5718", "scanner": "scanner-primary", "fingerprint": "419c7fcdf11fc660", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/deploy-website.yml"}, "region": {"startLine": 29}}}]}, {"ruleId": "scanner-419c7fcdf11fc660", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "afaec00f91c8f7b9", "scanner": "scanner-primary", "fingerprint": "419c7fcdf11fc660", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/deploy-website.yml"}, "region": {"startLine": 36}}}]}, {"ruleId": "scanner-419c7fcdf11fc660", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "705b3c976cd18d35", "scanner": "scanner-primary", "fingerprint": "419c7fcdf11fc660", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/deploy-website.yml"}, "region": {"startLine": 42}}}]}, {"ruleId": "scanner-419c7fcdf11fc660", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "3c7cabd99ec0375b", "scanner": "scanner-primary", "fingerprint": "419c7fcdf11fc660", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/deploy-website.yml"}, "region": {"startLine": 57}}}]}, {"ruleId": "scanner-419c7fcdf11fc660", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "d373248c7fa6f108", "scanner": "scanner-primary", "fingerprint": "419c7fcdf11fc660", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/deploy-website.yml"}, "region": {"startLine": 71}}}]}, {"ruleId": "scanner-24a2353e77881d9e", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "f80a287fd6f6b355", "scanner": "scanner-primary", "fingerprint": "24a2353e77881d9e", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/deploy-website.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-cb639d9a10a47b23", "level": "note", "message": {"text": "package.json defines install-time lifecycle scripts"}, "properties": {"repobilityId": "edeab51902066991", "scanner": "scanner-primary", "fingerprint": "cb639d9a10a47b23", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "npm", "install-scripts"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-62be69fb73b4e01e", "level": "note", "message": {"text": "package.json defines install-time lifecycle scripts"}, "properties": {"repobilityId": "446cf564d7070631", "scanner": "scanner-primary", "fingerprint": "62be69fb73b4e01e", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "npm", "install-scripts"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "wasm/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-78a841ce2481a1e0", "level": "note", "message": {"text": "Very large file: tests/query_test.go (2623 lines)"}, "properties": {"repobilityId": "fecc6e4ae3d14afc", "scanner": "scanner-primary", "fingerprint": "78a841ce2481a1e0", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-7849572571dcf2fe", "level": "note", "message": {"text": "Very large file: tests/hostedemu/snowflake/internal/sfparser/snowflakeparser_listener.go (3255 lines)"}, "properties": {"repobilityId": "32bcce4e0a06e005", "scanner": "scanner-primary", "fingerprint": "7849572571dcf2fe", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-3fef5aaaa2e69969", "level": "note", "message": {"text": "Very large file: tests/hostedemu/snowflake/internal/sfparser/snowflakeparser_base_listener.go (3451 lines)"}, "properties": {"repobilityId": "e8e8c45fabdfde48", "scanner": "scanner-primary", "fingerprint": "3fef5aaaa2e69969", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-0131a9a0588e6038", "level": "note", "message": {"text": "Very large file: tests/hostedemu/snowflake/internal/sfparser/snowflake_lexer.go (8776 lines)"}, "properties": {"repobilityId": "6dde7d230b03133a", "scanner": "scanner-primary", "fingerprint": "0131a9a0588e6038", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-a0acc8e65cd2bf0f", "level": "note", "message": {"text": "Very large file: tests/hostedemu/snowflake/internal/sfparser/snowflakeparser_visitor.go (1632 lines)"}, "properties": {"repobilityId": "f26219d071586218", "scanner": "scanner-primary", "fingerprint": "a0acc8e65cd2bf0f", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-31f03c6cd57524d9", "level": "note", "message": {"text": "Very large file: tests/hostedemu/snowflake/internal/sfparser/snowflakeparser_base_visitor.go (2172 lines)"}, "properties": {"repobilityId": "d605e7c3e8f9e3d9", "scanner": "scanner-primary", "fingerprint": "31f03c6cd57524d9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-4d876198f6c3733e", "level": "note", "message": {"text": "Very large file: core/schema_diff_test.go (2158 lines)"}, "properties": {"repobilityId": "fa18d8a0b662bd23", "scanner": "scanner-primary", "fingerprint": "4d876198f6c3733e", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-424fc2be27436b42", "level": "note", "message": {"text": "Very large file: core/schema_ddl.go (1878 lines)"}, "properties": {"repobilityId": "d4309849a87dad79", "scanner": "scanner-primary", "fingerprint": "424fc2be27436b42", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-b7f098150cbd9ece", "level": "note", "message": {"text": "Very large file: core/api.go (2999 lines)"}, "properties": {"repobilityId": "bcc50f5c9a8db775", "scanner": "scanner-primary", "fingerprint": "b7f098150cbd9ece", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-2df3239012254939", "level": "note", "message": {"text": "Very large file: core/config.go (1876 lines)"}, "properties": {"repobilityId": "b6468b6feedfa9a6", "scanner": "scanner-primary", "fingerprint": "2df3239012254939", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-0e7a9aa728f69af1", "level": "note", "message": {"text": "Very large file: core/internal/dialect/mongodb.go (4383 lines)"}, "properties": {"repobilityId": "e66018d7a76ad58f", "scanner": "scanner-primary", "fingerprint": "0e7a9aa728f69af1", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-d22b7b95c785cc6e", "level": "note", "message": {"text": "Very large file: core/internal/dialect/mariadb.go (2681 lines)"}, "properties": {"repobilityId": "0ddb7772735d06bf", "scanner": "scanner-primary", "fingerprint": "d22b7b95c785cc6e", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-034210080ed70c7c", "level": "note", "message": {"text": "Very large file: core/internal/dialect/mssql.go (3824 lines)"}, "properties": {"repobilityId": "47fb69f6f7e36b04", "scanner": "scanner-primary", "fingerprint": "034210080ed70c7c", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-6072cb8be3d8b89e", "level": "note", "message": {"text": "Very large file: core/internal/introspection/tables.go (1746 lines)"}, "properties": {"repobilityId": "88f205347c26d902", "scanner": "scanner-primary", "fingerprint": "6072cb8be3d8b89e", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-25a9f097adb62d70", "level": "note", "message": {"text": "Very large file: core/internal/catalog/build.go (1637 lines)"}, "properties": {"repobilityId": "eb24974bcf23593e", "scanner": "scanner-primary", "fingerprint": "25a9f097adb62d70", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-cbcc11dd907e7b9d", "level": "note", "message": {"text": "Very large file: serv/security_report.go (2260 lines)"}, "properties": {"repobilityId": "568b2d84dd436f6e", "scanner": "scanner-primary", "fingerprint": "cbcc11dd907e7b9d", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-8f8ee167a7228fb7", "level": "note", "message": {"text": "Very large file: serv/mcp_schema.go (1667 lines)"}, "properties": {"repobilityId": "cd2a5ee3a39bfaa4", "scanner": "scanner-primary", "fingerprint": "8f8ee167a7228fb7", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-ee341efe80cefc18", "level": "note", "message": {"text": "Very large file: serv/mcp_catalog.go (1217 lines)"}, "properties": {"repobilityId": "d150d2272adb362a", "scanner": "scanner-primary", "fingerprint": "ee341efe80cefc18", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-4c6071aa1c388cca", "level": "note", "message": {"text": "Very large file: serv/control_plane_graphql.go (1350 lines)"}, "properties": {"repobilityId": "f281316b265f6e15", "scanner": "scanner-primary", "fingerprint": "4c6071aa1c388cca", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-dfb9c9c5d2e4d88a", "level": "note", "message": {"text": "Very large file: serv/control_plane_graphql_test.go (2548 lines)"}, "properties": {"repobilityId": "0cb23d954027bb46", "scanner": "scanner-primary", "fingerprint": "dfb9c9c5d2e4d88a", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-34b064909b39a561", "level": "note", "message": {"text": "Very large file: serv/mcp_config.go (3686 lines)"}, "properties": {"repobilityId": "dd55e706d75f7eab", "scanner": "scanner-primary", "fingerprint": "34b064909b39a561", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-e913aa62824bd255", "level": "note", "message": {"text": "Very large file: serv/mcp_test.go (2092 lines)"}, "properties": {"repobilityId": "83ba4e7358220a25", "scanner": "scanner-primary", "fingerprint": "e913aa62824bd255", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-2c089bfd5544a643", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: wasm/package.json"}, "properties": {"repobilityId": "7a10cc2257bb6fe3", "scanner": "scanner-primary", "fingerprint": "2c089bfd5544a643", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "wasm/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "6a048df4c7bccc63", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-72b2a6250083a784", "level": "warning", "message": {"text": "Placeholder or mock-heavy implementation detected"}, "properties": {"repobilityId": "98d2bd4d8d2694d2", "scanner": "scanner-primary", "fingerprint": "72b2a6250083a784", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "incomplete", "generated-repo-pattern"]}}, {"ruleId": "scanner-9d79c4077342a7d0", "level": "warning", "message": {"text": "Runtime service client appears to use placeholder configuration"}, "properties": {"repobilityId": "0c0db869bc105998", "scanner": "scanner-primary", "fingerprint": "9d79c4077342a7d0", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "runtime-config", "service-client", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "24c8481871f1bf16", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-749d4bc1bd66df5f", "level": "warning", "message": {"text": "Agent instructions exist but release-hardening basics are missing"}, "properties": {"repobilityId": "ed7c9ae60e29750e", "scanner": "scanner-primary", "fingerprint": "749d4bc1bd66df5f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-b07feac733eaa250", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: claude-plugins/graphjin-mcp/.mcp.json"}, "properties": {"repobilityId": "0c33af67ae9e8df3", "scanner": "scanner-primary", "fingerprint": "b07feac733eaa250", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "mcp_config"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "claude-plugins/graphjin-mcp/.mcp.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f7a1976f0c62effe", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: skills/add-graphjin-database/SKILL.md"}, "properties": {"repobilityId": "a6135d61a858417b", "scanner": "scanner-primary", "fingerprint": "f7a1976f0c62effe", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/add-graphjin-database/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b6a2974dc8255407", "level": "warning", "message": {"text": "Frontend route `/schema` has no Link/navigate to it \u2014 serv/web/src/App.jsx"}, "properties": {"repobilityId": "cabc79df9b6e3470", "scanner": "scanner-primary", "fingerprint": "b6a2974dc8255407", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "orphan-page", "wiring"]}}, {"ruleId": "scanner-5cac15ac2b8616e2", "level": "warning", "message": {"text": "Frontend route `/queries` has no Link/navigate to it \u2014 serv/web/src/App.jsx"}, "properties": {"repobilityId": "7c58be186fe0f59d", "scanner": "scanner-primary", "fingerprint": "5cac15ac2b8616e2", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "orphan-page", "wiring"]}}, {"ruleId": "scanner-6b574c861615ef9b", "level": "warning", "message": {"text": "Frontend route `/databases` has no Link/navigate to it \u2014 serv/web/src/App.jsx"}, "properties": {"repobilityId": "9efec3a43febe9f8", "scanner": "scanner-primary", "fingerprint": "6b574c861615ef9b", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "orphan-page", "wiring"]}}]}]}