{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-aebe4543e25b7140", "name": "Possibly dead Python function: log_message", "shortDescription": {"text": "Possibly dead Python function: log_message"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a5e437d1953775c4", "name": "Possibly dead Python function: do_GET", "shortDescription": {"text": "Possibly dead Python function: do_GET"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e9a9336e6cdb2810", "name": "Possibly dead Python function: do_POST", "shortDescription": {"text": "Possibly dead Python function: do_POST"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-26641ee2831e57d9", "name": "Possibly dead Python function: auto_retire_loop", "shortDescription": {"text": "Possibly dead Python function: auto_retire_loop"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-bead75b0f9233e05", "name": "No API endpoints detected", "shortDescription": {"text": "No API endpoints detected"}, "fullDescription": {"text": "The scanner did not find FastAPI/Flask/Express/NestJS/GraphQL/gRPC routes. If this repo exposes APIs, the framework may be unsupported."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "info", "confidence": 1.0}}, {"id": "scanner-832bbbc134f6de01", "name": "Stray `console.log` in TS/JS \u2014 brand/generate-og.js:77", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 brand/generate-og.js:77"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-553c9fc8d4c2b111", "name": "Stray `console.log` in TS/JS \u2014 supabase/functions/send-email/index.ts:109", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 supabase/functions/send-email/index.ts:109"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a13df4168ea1e2f8", "name": "Stray `console.log` in TS/JS \u2014 supabase/functions/send-invite/index.ts:130", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 supabase/functions/send-invite/index.ts:130"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-836c5e26146337be", "name": "Stray `console.log` in TS/JS \u2014 supabase/functions/notify-new-signup/index.ts:137", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 supabase/functions/notify-new-signup/index.ts:137"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8d3e7d1b070dc3e9", "name": "Stray `console.log` in TS/JS \u2014 tools/qa/bug-sweep.js:216", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 tools/qa/bug-sweep.js:216"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ecf0b76df9685e2c", "name": "Stray `console.log` in TS/JS \u2014 tools/qa/verify-waterfall.js:80", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 tools/qa/verify-waterfall.js:80"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-27ef1b3dbdb1d8da", "name": "Stray `console.log` in TS/JS \u2014 tools/backlog/build-snapshot.js:211", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 tools/backlog/build-snapshot.js:211"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-494641c87bd0d15f", "name": "Icon-only button without accessible name \u2014 calculators/deal-read/read.js:976", "shortDescription": {"text": "Icon-only button without accessible name \u2014 calculators/deal-read/read.js:976"}, "fullDescription": {"text": "A `<button>` whose only child is a single glyph or symbol needs `title=` or `aria-label=` so screen readers (and tooltips on hover) work.\n\nWhy: P3 in CHECKLIST.md \u2014 icon-only buttons skipped a title.\nRule id: fq.button.no-label"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1c37241d1f364afc", "name": "Insecure pattern 'direct_innerhtml_assignment' in lp-backlog.html:396", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in lp-backlog.html:396"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-5dfb8d44a2beeb2c", "name": "Insecure pattern 'direct_innerhtml_assignment' in lp-panel.html:1213", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in lp-panel.html:1213"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8e4c2edafbd110e3", "name": "Insecure pattern 'direct_outerhtml_assignment' in lp-panel.html:3016", "shortDescription": {"text": "Insecure pattern 'direct_outerhtml_assignment' in lp-panel.html:3016"}, "fullDescription": {"text": "Found a known-risky pattern (direct_outerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-cdf8c71e3d279b7b", "name": "Insecure pattern 'direct_innerhtml_assignment' in index.html:2475", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in index.html:2475"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-324859bf0430ff7a", "name": "Insecure pattern 'direct_innerhtml_assignment' in lp-hire.html:1010", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in lp-hire.html:1010"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea9fdd68fbda217b", "name": "Insecure pattern 'local_storage_auth_token' in lp-hire.html:815", "shortDescription": {"text": "Insecure pattern 'local_storage_auth_token' in lp-hire.html:815"}, "fullDescription": {"text": "Found a known-risky pattern (local_storage_auth_token). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-195ea56b3b238fad", "name": "Insecure pattern 'direct_innerhtml_assignment' in data-health.html:272", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in data-health.html:272"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7f829b644ec72a6b", "name": "Insecure pattern 'direct_innerhtml_assignment' in profile.html:751", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in profile.html:751"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8182cbf204af69cd", "name": "Insecure pattern 'direct_innerhtml_assignment' in waterfall.html:9774", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in waterfall.html:9774"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a95f72064777550e", "name": "Insecure pattern 'direct_innerhtml_assignment' in legislation.html:728", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in legislation.html:728"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7178c6c8f7371ba0", "name": "Insecure pattern 'direct_outerhtml_assignment' in legislation.html:1369", "shortDescription": {"text": "Insecure pattern 'direct_outerhtml_assignment' in legislation.html:1369"}, "fullDescription": {"text": "Found a known-risky pattern (direct_outerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-07fa5c305de08043", "name": "Insecure pattern 'direct_innerhtml_assignment' in company-profile.html:247", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in company-profile.html:247"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f2d9c6a9c5a90579", "name": "Insecure pattern 'direct_innerhtml_assignment' in auth-callback.html:163", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in auth-callback.html:163"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a2c21d0cfd61dd21", "name": "Insecure pattern 'direct_innerhtml_assignment' in naics.html:936", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in naics.html:936"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8a9c05430372385c", "name": "Insecure pattern 'direct_innerhtml_assignment' in js/feedback-pulse.js:76", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/feedback-pulse.js:76"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-76e6557a711caacf", "name": "Insecure pattern 'direct_innerhtml_assignment' in js/completion-cue.js:84", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/completion-cue.js:84"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-94edf75bdb36e205", "name": "Insecure pattern 'direct_innerhtml_assignment' in js/doc-combine.js:182", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/doc-combine.js:182"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-331e4fcd256cbf8e", "name": "Insecure pattern 'direct_innerhtml_assignment' in js/deal-log-tour.js:132", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/deal-log-tour.js:132"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4b77a7e0a55168fd", "name": "Insecure pattern 'direct_innerhtml_assignment' in js/nudge.js:147", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/nudge.js:147"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-706d1d4974a79614", "name": "Insecure pattern 'direct_innerhtml_assignment' in js/bank-autofill.js:76", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/bank-autofill.js:76"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-63a14760e9d6765d", "name": "Insecure pattern 'insert_adjacent_html' in js/export-modal.js:241", "shortDescription": {"text": "Insecure pattern 'insert_adjacent_html' in js/export-modal.js:241"}, "fullDescription": {"text": "Found a known-risky pattern (insert_adjacent_html). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-333344ef5a9b2be6", "name": "Insecure pattern 'direct_innerhtml_assignment' in js/branding.js:148", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/branding.js:148"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-68a37865bef171f8", "name": "Insecure pattern 'direct_innerhtml_assignment' in js/save-gate.js:97", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/save-gate.js:97"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e352001c54000b4e", "name": "Insecure pattern 'direct_innerhtml_assignment' in js/tour.js:80", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/tour.js:80"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7cdcea541dd42210", "name": "Insecure pattern 'direct_innerhtml_assignment' in scratch/retired-auth-pages/pending.html:134", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in scratch/retired-auth-pages/pending.html:134"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3b05c08434c83eec", "name": "Insecure pattern 'cors_wildcard' in supabase/functions/get-quote/index.ts:9", "shortDescription": {"text": "Insecure pattern 'cors_wildcard' in supabase/functions/get-quote/index.ts:9"}, "fullDescription": {"text": "Found a known-risky pattern (cors_wildcard). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b5ab5dab85052c14", "name": "Insecure pattern 'cors_wildcard' in supabase/functions/send-email/index.ts:33", "shortDescription": {"text": "Insecure pattern 'cors_wildcard' in supabase/functions/send-email/index.ts:33"}, "fullDescription": {"text": "Found a known-risky pattern (cors_wildcard). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ecb7f604e2d5682c", "name": "Insecure pattern 'cors_wildcard' in supabase/functions/send-invite/index.ts:32", "shortDescription": {"text": "Insecure pattern 'cors_wildcard' in supabase/functions/send-invite/index.ts:32"}, "fullDescription": {"text": "Found a known-risky pattern (cors_wildcard). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f86410f7164a93ff", "name": "Insecure pattern 'direct_innerhtml_assignment' in game/index.html:1047", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in game/index.html:1047"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8bf3ad926da319f9", "name": "Insecure pattern 'eval_used' in tools/qa/verify-waterfall.js:28", "shortDescription": {"text": "Insecure pattern 'eval_used' in tools/qa/verify-waterfall.js:28"}, "fullDescription": {"text": "Found a known-risky pattern (eval_used). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-f80d7c31d6c7dd56", "name": "Insecure pattern 'direct_innerhtml_assignment' in tools/objections/index.html:526", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in tools/objections/index.html:526"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0647f43d8015e711", "name": "Insecure pattern 'direct_innerhtml_assignment' in q/index.html:495", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in q/index.html:495"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4c3fbf8d7d5f538a", "name": "Insecure pattern 'document_write' in calculators/AmoScheduleCalculator.html:52", "shortDescription": {"text": "Insecure pattern 'document_write' in calculators/AmoScheduleCalculator.html:52"}, "fullDescription": {"text": "Found a known-risky pattern (document_write). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-439a8f089f55e101", "name": "Insecure pattern 'direct_innerhtml_assignment' in calculators/AmoScheduleCalculator.html:1839", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in calculators/AmoScheduleCalculator.html:1839"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-10fa9195662009f1", "name": "Insecure pattern 'insert_adjacent_html' in calculators/AmoScheduleCalculator.html:2707", "shortDescription": {"text": "Insecure pattern 'insert_adjacent_html' in calculators/AmoScheduleCalculator.html:2707"}, "fullDescription": {"text": "Found a known-risky pattern (insert_adjacent_html). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-5d38c59406531711", "name": "Insecure pattern 'document_write' in calculators/SBAFeesCalculator.html:53", "shortDescription": {"text": "Insecure pattern 'document_write' in calculators/SBAFeesCalculator.html:53"}, "fullDescription": {"text": "Found a known-risky pattern (document_write). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-324787bed0067ea5", "name": "Insecure pattern 'direct_innerhtml_assignment' in calculators/SBAFeesCalculator.html:767", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in calculators/SBAFeesCalculator.html:767"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c223d63b7ea7b7f6", "name": "Insecure pattern 'insert_adjacent_html' in calculators/SBAFeesCalculator.html:996", "shortDescription": {"text": "Insecure pattern 'insert_adjacent_html' in calculators/SBAFeesCalculator.html:996"}, "fullDescription": {"text": "Found a known-risky pattern (insert_adjacent_html). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1beacb755c86398e", "name": "Insecure pattern 'document_write' in calculators/DSCRCalculator.html:59", "shortDescription": {"text": "Insecure pattern 'document_write' in calculators/DSCRCalculator.html:59"}, "fullDescription": {"text": "Found a known-risky pattern (document_write). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d15493c2556ba930", "name": "Insecure pattern 'direct_innerhtml_assignment' in calculators/DSCRCalculator.html:1030", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in calculators/DSCRCalculator.html:1030"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b5193f74e6109210", "name": "Insecure pattern 'document_write' in calculators/AffordabilityCalculator.html:49", "shortDescription": {"text": "Insecure pattern 'document_write' in calculators/AffordabilityCalculator.html:49"}, "fullDescription": {"text": "Found a known-risky pattern (document_write). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-489bb5d9013b4b96", "name": "Insecure pattern 'direct_innerhtml_assignment' in calculators/AffordabilityCalculator.html:1328", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in calculators/AffordabilityCalculator.html:1328"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3b2377123636d606", "name": "Insecure pattern 'document_write' in calculators/FundabilityCalculator.html:52", "shortDescription": {"text": "Insecure pattern 'document_write' in calculators/FundabilityCalculator.html:52"}, "fullDescription": {"text": "Found a known-risky pattern (document_write). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-347e9396c2f8ced2", "name": "Insecure pattern 'direct_innerhtml_assignment' in calculators/FundabilityCalculator.html:948", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in calculators/FundabilityCalculator.html:948"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-193531a3a9443f9e", "name": "Insecure pattern 'direct_innerhtml_assignment' in calculators/deal-read/plan.js:92", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in calculators/deal-read/plan.js:92"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-588f6ac2f588b07f", "name": "Insecure pattern 'document_write' in calculators/deal-read/index.html:1233", "shortDescription": {"text": "Insecure pattern 'document_write' in calculators/deal-read/index.html:1233"}, "fullDescription": {"text": "Found a known-risky pattern (document_write). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7f83974f2694c1d9", "name": "Insecure pattern 'direct_innerhtml_assignment' in calculators/deal-read/read.js:118", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in calculators/deal-read/read.js:118"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-251c7b90b8be047a", "name": "Insecure pattern 'direct_outerhtml_assignment' in calculators/deal-read/read.js:375", "shortDescription": {"text": "Insecure pattern 'direct_outerhtml_assignment' in calculators/deal-read/read.js:375"}, "fullDescription": {"text": "Found a known-risky pattern (direct_outerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a795d0d1dada627d", "name": "Insecure pattern 'direct_innerhtml_assignment' in public/assets/js/pdf-helper.js:102", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in public/assets/js/pdf-helper.js:102"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4314b1227c94e2e1", "name": "Insecure pattern 'direct_innerhtml_assignment' in public/assets/js/compliance.js:133", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in public/assets/js/compliance.js:133"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-fbb2bbc4d2e9c809", "name": "Insecure pattern 'direct_innerhtml_assignment' in quote-log/index.html:459", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in quote-log/index.html:459"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-792f07a3d2abe6df", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-bcb43f6ff44b78ff", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-34029707f9b54caa", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6e1c9b2d376ec981", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/upload-artifact@v7 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-294fa27397df8885", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/upload-artifact@v7 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-df1dcab3c22fd284", "name": "Very large file: calculators/deal-read/read.js (2135 lines)", "shortDescription": {"text": "Very large file: calculators/deal-read/read.js (2135 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9778fa30926197c0", "name": "Very large file: public/assets/js/pdf-helper.js (1285 lines)", "shortDescription": {"text": "Very large file: public/assets/js/pdf-helper.js (1285 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ea3b5e389d8c9c0f", "name": "Low test-to-source ratio", "shortDescription": {"text": "Low test-to-source ratio"}, "fullDescription": {"text": "7 tests / 55 src (ratio 0.13)."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-141b30a41e03817b", "name": "No license file detected", "shortDescription": {"text": "No license file detected"}, "fullDescription": {"text": "No LICENSE/COPYING/NOTICE file was found. Generated repositories often omit licensing, which blocks reuse and automated intake."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 126 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-72b2a6250083a784", "name": "Placeholder or mock-heavy implementation detected", "shortDescription": {"text": "Placeholder or mock-heavy implementation detected"}, "fullDescription": {"text": "Found 22 placeholder/mock markers across 5 source files. This often means the repo looks complete while core flows still use generated scaffolding or fake data."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-749d4bc1bd66df5f", "name": "Agent instructions exist but release-hardening basics are missing", "shortDescription": {"text": "Agent instructions exist but release-hardening basics are missing"}, "fullDescription": {"text": "AI-coder instruction files were found, but the repo is missing license. Treat this as a contract gap: the agent is guided, but the generated output is not yet guarded by the controls that make it repeatable."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-ddb35dba557b87a5", "name": "Network/subprocess call without timeout or try/except \u2014 scrapers/scrape_targeted.py:327", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 scrapers/scrape_targeted.py:327"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6de887459b0275d1", "name": "Commented-code block (7 lines) in js/feedback-pulse.js:3", "shortDescription": {"text": "Commented-code block (7 lines) in js/feedback-pulse.js:3"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-b186854dd956c011", "name": "Commented-code block (11 lines) in js/completion-cue.js:1", "shortDescription": {"text": "Commented-code block (11 lines) in js/completion-cue.js:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-d65e5df263a3c717", "name": "Legacy-named symbol `lp_tenant_v1` in js/quote-log.js:84", "shortDescription": {"text": "Legacy-named symbol `lp_tenant_v1` in js/quote-log.js:84"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a23b4bc2305fdeb1", "name": "Commented-code block (5 lines) in js/quote-log.js:1", "shortDescription": {"text": "Commented-code block (5 lines) in js/quote-log.js:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-0189d1876bc86e84", "name": "Commented-code block (8 lines) in js/doc-combine.js:260", "shortDescription": {"text": "Commented-code block (8 lines) in js/doc-combine.js:260"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-1d1b9dc11d1f1fdb", "name": "Legacy-named symbol `lp_nudge_v1` in js/nudge-config.js:13", "shortDescription": {"text": "Legacy-named symbol `lp_nudge_v1` in js/nudge-config.js:13"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8e67acff4c271fcc", "name": "Commented-code block (7 lines) in js/nudge-config.js:15", "shortDescription": {"text": "Commented-code block (7 lines) in js/nudge-config.js:15"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-d5abc320e8d6f919", "name": "Legacy-named symbol `lp_tenant_v1` in js/auth.js:117", "shortDescription": {"text": "Legacy-named symbol `lp_tenant_v1` in js/auth.js:117"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-19bcd41072e65213", "name": "Commented-code block (9 lines) in js/auth.js:3", "shortDescription": {"text": "Commented-code block (9 lines) in js/auth.js:3"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-4e236f744f7a0df7", "name": "Commented-code block (6 lines) in js/deal-log-tour.js:11", "shortDescription": {"text": "Commented-code block (6 lines) in js/deal-log-tour.js:11"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-ca487c17ab83b959", "name": "Legacy-named symbol `lp_tour_v1` in js/tour-config.js:8", "shortDescription": {"text": "Legacy-named symbol `lp_tour_v1` in js/tour-config.js:8"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6ad2535bb57262cb", "name": "Commented-code block (5 lines) in js/tour-config.js:90", "shortDescription": {"text": "Commented-code block (5 lines) in js/tour-config.js:90"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-6e4127a5b792cb6b", "name": "Legacy-named symbol `lp_tenant_v1` in js/branding.js:26", "shortDescription": {"text": "Legacy-named symbol `lp_tenant_v1` in js/branding.js:26"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ab5a2597f8e88610", "name": "Commented-code block (5 lines) in js/branding.js:29", "shortDescription": {"text": "Commented-code block (5 lines) in js/branding.js:29"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-a3259f5c276f1d28", "name": "Commented-code block (6 lines) in js/save-gate.js:3", "shortDescription": {"text": "Commented-code block (6 lines) in js/save-gate.js:3"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-305f84fa11273504", "name": "Commented-code block (5 lines) in js/tour.js:17", "shortDescription": {"text": "Commented-code block (5 lines) in js/tour.js:17"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-e1485fbd1190809b", "name": "Commented-code block (5 lines) in supabase/functions/send-email/index.ts:5", "shortDescription": {"text": "Commented-code block (5 lines) in supabase/functions/send-email/index.ts:5"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-4e44e5f7f11249fe", "name": "`fetch()` without try/.catch or AbortSignal \u2014 supabase/functions/send-email/index.ts:52", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 supabase/functions/send-email/index.ts:52"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-863a183a295ff5ff", "name": "Commented-code block (8 lines) in supabase/functions/send-invite/index.ts:4", "shortDescription": {"text": "Commented-code block (8 lines) in supabase/functions/send-invite/index.ts:4"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-e227c80d2f7e088d", "name": "`fetch()` without try/.catch or AbortSignal \u2014 supabase/functions/send-invite/index.ts:106", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 supabase/functions/send-invite/index.ts:106"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-55af85148f1d8d04", "name": "Commented-code block (5 lines) in supabase/functions/notify-new-signup/index.ts:3", "shortDescription": {"text": "Commented-code block (5 lines) in supabase/functions/notify-new-signup/index.ts:3"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-f7fad383eda5a692", "name": "`fetch()` without try/.catch or AbortSignal \u2014 supabase/functions/notify-new-signup/index.ts:116", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 supabase/functions/notify-new-signup/index.ts:116"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9254d12339710dd5", "name": "Commented-code block (8 lines) in tools/qa/bug-sweep.js:3", "shortDescription": {"text": "Commented-code block (8 lines) in tools/qa/bug-sweep.js:3"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-7ec01ae55fb29c20", "name": "Commented-code block (5 lines) in tools/qa/tests/legislation.spec.js:3", "shortDescription": {"text": "Commented-code block (5 lines) in tools/qa/tests/legislation.spec.js:3"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-f59fe1bcecf6784e", "name": "Commented-code block (5 lines) in tools/qa/tests/golden.spec.js:4", "shortDescription": {"text": "Commented-code block (5 lines) in tools/qa/tests/golden.spec.js:4"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-bc814cf5407d3954", "name": "Legacy-named symbol `lp_cd_tour_v2` in tools/qa/lib/test.js:20", "shortDescription": {"text": "Legacy-named symbol `lp_cd_tour_v2` in tools/qa/lib/test.js:20"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0b1616eca8423d77", "name": "Commented-code block (5 lines) in tools/qa/lib/test.js:15", "shortDescription": {"text": "Commented-code block (5 lines) in tools/qa/lib/test.js:15"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-833e794a16a04347", "name": "Commented-code block (8 lines) in tools/backlog/build-snapshot.js:40", "shortDescription": {"text": "Commented-code block (8 lines) in tools/backlog/build-snapshot.js:40"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-61a38387e0861b0b", "name": "`fetch()` without try/.catch or AbortSignal \u2014 tools/backlog/build-snapshot.js:83", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 tools/backlog/build-snapshot.js:83"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e1a04a18304f4bdf", "name": "Stub function `log_message` (body is just `pass`/`return`) \u2014 tools/staging/launchpad.py:208", "shortDescription": {"text": "Stub function `log_message` (body is just `pass`/`return`) \u2014 tools/staging/launchpad.py:208"}, "fullDescription": {"text": "Likely an AI scaffold that was never filled in. Remove or implement."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-52baa85a3a65d376", "name": "Commented-code block (5 lines) in calculators/deal-read/talk.js:76", "shortDescription": {"text": "Commented-code block (5 lines) in calculators/deal-read/talk.js:76"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-2d163d69f1cbdbdd", "name": "Commented-code block (5 lines) in calculators/deal-read/data.js:1", "shortDescription": {"text": "Commented-code block (5 lines) in calculators/deal-read/data.js:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-43ef2f4a497781a9", "name": "Commented-code block (5 lines) in calculators/deal-read/deal.js:6", "shortDescription": {"text": "Commented-code block (5 lines) in calculators/deal-read/deal.js:6"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-980f2c31fc643f0c", "name": "Legacy-named symbol `lp_deal_read_v1` in calculators/deal-read/read.js:20", "shortDescription": {"text": "Legacy-named symbol `lp_deal_read_v1` in calculators/deal-read/read.js:20"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d6c666555283031e", "name": "Commented-code block (6 lines) in calculators/deal-read/read.js:387", "shortDescription": {"text": "Commented-code block (6 lines) in calculators/deal-read/read.js:387"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-2c04133e54348533", "name": "Near-duplicate function bodies in 2 places", "shortDescription": {"text": "Near-duplicate function bodies in 2 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nscrapers/normalize_lenders.py:normalize_name, scrapers/normalize_lenders.py:normalize\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/17984"}, "properties": {"repository": "ReggieRouter/lendpaper", "repoUrl": "https://github.com/ReggieRouter/lendpaper", "branch": "main"}, "results": [{"ruleId": "scanner-aebe4543e25b7140", "level": "note", "message": {"text": "Possibly dead Python function: log_message"}, "properties": {"repobilityId": "965f3150b4af5b2e", "scanner": "scanner-primary", "fingerprint": "aebe4543e25b7140", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/staging/launchpad.py:232"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a5e437d1953775c4", "level": "note", "message": {"text": "Possibly dead Python function: do_GET"}, "properties": {"repobilityId": "2d943bb45e4f13bd", "scanner": "scanner-primary", "fingerprint": "a5e437d1953775c4", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/staging/launchpad.py:243"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e9a9336e6cdb2810", "level": "note", "message": {"text": "Possibly dead Python function: do_POST"}, "properties": {"repobilityId": "53357410ca9379a9", "scanner": "scanner-primary", "fingerprint": "e9a9336e6cdb2810", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/staging/launchpad.py:275"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-26641ee2831e57d9", "level": "note", "message": {"text": "Possibly dead Python function: auto_retire_loop"}, "properties": {"repobilityId": "c9932db6993dea52", "scanner": "scanner-primary", "fingerprint": "26641ee2831e57d9", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/staging/launchpad.py:731"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-bead75b0f9233e05", "level": "none", "message": {"text": "No API endpoints detected"}, "properties": {"repobilityId": "0f8bb852027c38f8", "scanner": "scanner-primary", "fingerprint": "bead75b0f9233e05", "layer": "api", "severity": "info", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-832bbbc134f6de01", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 brand/generate-og.js:77"}, "properties": {"repobilityId": "5ae9d27166a7ec6f", "scanner": "scanner-primary", "fingerprint": "832bbbc134f6de01", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-553c9fc8d4c2b111", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 supabase/functions/send-email/index.ts:109"}, "properties": {"repobilityId": "6678deaa66491fad", "scanner": "scanner-primary", "fingerprint": "553c9fc8d4c2b111", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-a13df4168ea1e2f8", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 supabase/functions/send-invite/index.ts:130"}, "properties": {"repobilityId": "8b28600640830632", "scanner": "scanner-primary", "fingerprint": "a13df4168ea1e2f8", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-836c5e26146337be", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 supabase/functions/notify-new-signup/index.ts:137"}, "properties": {"repobilityId": "b428aef4f9cfeae0", "scanner": "scanner-primary", "fingerprint": "836c5e26146337be", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-8d3e7d1b070dc3e9", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 tools/qa/bug-sweep.js:216"}, "properties": {"repobilityId": "0827082fb0cc4186", "scanner": "scanner-primary", "fingerprint": "8d3e7d1b070dc3e9", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-ecf0b76df9685e2c", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 tools/qa/verify-waterfall.js:80"}, "properties": {"repobilityId": "a5a3674c28ea1b1d", "scanner": "scanner-primary", "fingerprint": "ecf0b76df9685e2c", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-27ef1b3dbdb1d8da", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 tools/backlog/build-snapshot.js:211"}, "properties": {"repobilityId": "79b33247d669fd4b", "scanner": "scanner-primary", "fingerprint": "27ef1b3dbdb1d8da", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-494641c87bd0d15f", "level": "note", "message": {"text": "Icon-only button without accessible name \u2014 calculators/deal-read/read.js:976"}, "properties": {"repobilityId": "220d84540cc4a993", "scanner": "scanner-primary", "fingerprint": "494641c87bd0d15f", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.button.no-label"]}}, {"ruleId": "scanner-1c37241d1f364afc", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in lp-backlog.html:396"}, "properties": {"repobilityId": "a7f7b23008efab7a", "scanner": "scanner-primary", "fingerprint": "1c37241d1f364afc", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "lp-backlog.html"}, "region": {"startLine": 396}}}]}, {"ruleId": "scanner-5dfb8d44a2beeb2c", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in lp-panel.html:1213"}, "properties": {"repobilityId": "bc75223301a1b0ae", "scanner": "scanner-primary", "fingerprint": "5dfb8d44a2beeb2c", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "lp-panel.html"}, "region": {"startLine": 1213}}}]}, {"ruleId": "scanner-8e4c2edafbd110e3", "level": "warning", "message": {"text": "Insecure pattern 'direct_outerhtml_assignment' in lp-panel.html:3016"}, "properties": {"repobilityId": "61164ccbf24be041", "scanner": "scanner-primary", "fingerprint": "8e4c2edafbd110e3", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_outerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "lp-panel.html"}, "region": {"startLine": 3016}}}]}, {"ruleId": "scanner-cdf8c71e3d279b7b", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in index.html:2475"}, "properties": {"repobilityId": "f91708437a3a5445", "scanner": "scanner-primary", "fingerprint": "cdf8c71e3d279b7b", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "index.html"}, "region": {"startLine": 2475}}}]}, {"ruleId": "scanner-324859bf0430ff7a", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in lp-hire.html:1010"}, "properties": {"repobilityId": "b20ac0b4a885d69f", "scanner": "scanner-primary", "fingerprint": "324859bf0430ff7a", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "lp-hire.html"}, "region": {"startLine": 1010}}}]}, {"ruleId": "scanner-ea9fdd68fbda217b", "level": "warning", "message": {"text": "Insecure pattern 'local_storage_auth_token' in lp-hire.html:815"}, "properties": {"repobilityId": "9349b40bd5274962", "scanner": "scanner-primary", "fingerprint": "ea9fdd68fbda217b", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "local_storage_auth_token"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "lp-hire.html"}, "region": {"startLine": 815}}}]}, {"ruleId": "scanner-195ea56b3b238fad", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in data-health.html:272"}, "properties": {"repobilityId": "c983d2018573a134", "scanner": "scanner-primary", "fingerprint": "195ea56b3b238fad", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "data-health.html"}, "region": {"startLine": 272}}}]}, {"ruleId": "scanner-7f829b644ec72a6b", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in profile.html:751"}, "properties": {"repobilityId": "310e2e909a7be4fa", "scanner": "scanner-primary", "fingerprint": "7f829b644ec72a6b", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "profile.html"}, "region": {"startLine": 751}}}]}, {"ruleId": "scanner-8182cbf204af69cd", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in waterfall.html:9774"}, "properties": {"repobilityId": "5d4597b58ccec092", "scanner": "scanner-primary", "fingerprint": "8182cbf204af69cd", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "waterfall.html"}, "region": {"startLine": 9774}}}]}, {"ruleId": "scanner-a95f72064777550e", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in legislation.html:728"}, "properties": {"repobilityId": "912eb665113d37f2", "scanner": "scanner-primary", "fingerprint": "a95f72064777550e", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "legislation.html"}, "region": {"startLine": 728}}}]}, {"ruleId": "scanner-7178c6c8f7371ba0", "level": "warning", "message": {"text": "Insecure pattern 'direct_outerhtml_assignment' in legislation.html:1369"}, "properties": {"repobilityId": "95fcdec47f67bc64", "scanner": "scanner-primary", "fingerprint": "7178c6c8f7371ba0", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_outerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "legislation.html"}, "region": {"startLine": 1369}}}]}, {"ruleId": "scanner-07fa5c305de08043", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in company-profile.html:247"}, "properties": {"repobilityId": "a7f477a73f29d035", "scanner": "scanner-primary", "fingerprint": "07fa5c305de08043", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "company-profile.html"}, "region": {"startLine": 247}}}]}, {"ruleId": "scanner-f2d9c6a9c5a90579", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in auth-callback.html:163"}, "properties": {"repobilityId": "b12e1448b91d0950", "scanner": "scanner-primary", "fingerprint": "f2d9c6a9c5a90579", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "auth-callback.html"}, "region": {"startLine": 163}}}]}, {"ruleId": "scanner-a2c21d0cfd61dd21", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in naics.html:936"}, "properties": {"repobilityId": "d1e75235ecdeda18", "scanner": "scanner-primary", "fingerprint": "a2c21d0cfd61dd21", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "naics.html"}, "region": {"startLine": 936}}}]}, {"ruleId": "scanner-8a9c05430372385c", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/feedback-pulse.js:76"}, "properties": {"repobilityId": "5b6299672c859c5c", "scanner": "scanner-primary", "fingerprint": "8a9c05430372385c", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "js/feedback-pulse.js"}, "region": {"startLine": 76}}}]}, {"ruleId": "scanner-76e6557a711caacf", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/completion-cue.js:84"}, "properties": {"repobilityId": "b5c6245b971510b9", "scanner": "scanner-primary", "fingerprint": "76e6557a711caacf", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "js/completion-cue.js"}, "region": {"startLine": 84}}}]}, {"ruleId": "scanner-94edf75bdb36e205", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/doc-combine.js:182"}, "properties": {"repobilityId": "29d2ed15f7a71ea7", "scanner": "scanner-primary", "fingerprint": "94edf75bdb36e205", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "js/doc-combine.js"}, "region": {"startLine": 182}}}]}, {"ruleId": "scanner-331e4fcd256cbf8e", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/deal-log-tour.js:132"}, "properties": {"repobilityId": "e53f2509068a4c34", "scanner": "scanner-primary", "fingerprint": "331e4fcd256cbf8e", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "js/deal-log-tour.js"}, "region": {"startLine": 132}}}]}, {"ruleId": "scanner-4b77a7e0a55168fd", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/nudge.js:147"}, "properties": {"repobilityId": "704603f6ef3af74e", "scanner": "scanner-primary", "fingerprint": "4b77a7e0a55168fd", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "js/nudge.js"}, "region": {"startLine": 147}}}]}, {"ruleId": "scanner-706d1d4974a79614", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/bank-autofill.js:76"}, "properties": {"repobilityId": "6a2d52f1ca4630c5", "scanner": "scanner-primary", "fingerprint": "706d1d4974a79614", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "js/bank-autofill.js"}, "region": {"startLine": 76}}}]}, {"ruleId": "scanner-63a14760e9d6765d", "level": "warning", "message": {"text": "Insecure pattern 'insert_adjacent_html' in js/export-modal.js:241"}, "properties": {"repobilityId": "6af85ecc58bc2f86", "scanner": "scanner-primary", "fingerprint": "63a14760e9d6765d", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "insert_adjacent_html"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "js/export-modal.js"}, "region": {"startLine": 241}}}]}, {"ruleId": "scanner-333344ef5a9b2be6", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/branding.js:148"}, "properties": {"repobilityId": "0499c374ad4e1b10", "scanner": "scanner-primary", "fingerprint": "333344ef5a9b2be6", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "js/branding.js"}, "region": {"startLine": 148}}}]}, {"ruleId": "scanner-68a37865bef171f8", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/save-gate.js:97"}, "properties": {"repobilityId": "2cba9fefe8a9795d", "scanner": "scanner-primary", "fingerprint": "68a37865bef171f8", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "js/save-gate.js"}, "region": {"startLine": 97}}}]}, {"ruleId": "scanner-e352001c54000b4e", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/tour.js:80"}, "properties": {"repobilityId": "0dfba552d10c2d7b", "scanner": "scanner-primary", "fingerprint": "e352001c54000b4e", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "js/tour.js"}, "region": {"startLine": 80}}}]}, {"ruleId": "scanner-7cdcea541dd42210", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in scratch/retired-auth-pages/pending.html:134"}, "properties": {"repobilityId": "f0dfccf2f9919ebd", "scanner": "scanner-primary", "fingerprint": "7cdcea541dd42210", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scratch/retired-auth-pages/pending.html"}, "region": {"startLine": 134}}}]}, {"ruleId": "scanner-3b05c08434c83eec", "level": "warning", "message": {"text": "Insecure pattern 'cors_wildcard' in supabase/functions/get-quote/index.ts:9"}, "properties": {"repobilityId": "7256939a04acf9e1", "scanner": "scanner-primary", "fingerprint": "3b05c08434c83eec", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "cors_wildcard"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "supabase/functions/get-quote/index.ts"}, "region": {"startLine": 9}}}]}, {"ruleId": "scanner-b5ab5dab85052c14", "level": "warning", "message": {"text": "Insecure pattern 'cors_wildcard' in supabase/functions/send-email/index.ts:33"}, "properties": {"repobilityId": "deaf722fb6438a69", "scanner": "scanner-primary", "fingerprint": "b5ab5dab85052c14", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "cors_wildcard"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "supabase/functions/send-email/index.ts"}, "region": {"startLine": 33}}}]}, {"ruleId": "scanner-ecb7f604e2d5682c", "level": "warning", "message": {"text": "Insecure pattern 'cors_wildcard' in supabase/functions/send-invite/index.ts:32"}, "properties": {"repobilityId": "e26c69282bfaa7c9", "scanner": "scanner-primary", "fingerprint": "ecb7f604e2d5682c", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "cors_wildcard"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "supabase/functions/send-invite/index.ts"}, "region": {"startLine": 32}}}]}, {"ruleId": "scanner-f86410f7164a93ff", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in game/index.html:1047"}, "properties": {"repobilityId": "bbab3f30657da2bf", "scanner": "scanner-primary", "fingerprint": "f86410f7164a93ff", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "game/index.html"}, "region": {"startLine": 1047}}}]}, {"ruleId": "scanner-8bf3ad926da319f9", "level": "error", "message": {"text": "Insecure pattern 'eval_used' in tools/qa/verify-waterfall.js:28"}, "properties": {"repobilityId": "07c0bbf9787b2a8f", "scanner": "scanner-primary", "fingerprint": "8bf3ad926da319f9", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "eval_used"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/qa/verify-waterfall.js"}, "region": {"startLine": 28}}}]}, {"ruleId": "scanner-f80d7c31d6c7dd56", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in tools/objections/index.html:526"}, "properties": {"repobilityId": "b9ab5bdd71970dde", "scanner": "scanner-primary", "fingerprint": "f80d7c31d6c7dd56", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/objections/index.html"}, "region": {"startLine": 526}}}]}, {"ruleId": "scanner-0647f43d8015e711", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in q/index.html:495"}, "properties": {"repobilityId": "6f9c95c09e16cec2", "scanner": "scanner-primary", "fingerprint": "0647f43d8015e711", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "q/index.html"}, "region": {"startLine": 495}}}]}, {"ruleId": "scanner-4c3fbf8d7d5f538a", "level": "note", "message": {"text": "Insecure pattern 'document_write' in calculators/AmoScheduleCalculator.html:52"}, "properties": {"repobilityId": "18471a2902cb38b8", "scanner": "scanner-primary", "fingerprint": "4c3fbf8d7d5f538a", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["owasp", "document_write"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "calculators/AmoScheduleCalculator.html"}, "region": {"startLine": 52}}}]}, {"ruleId": "scanner-439a8f089f55e101", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in calculators/AmoScheduleCalculator.html:1839"}, "properties": {"repobilityId": "54be7248fcdd7cd0", "scanner": "scanner-primary", "fingerprint": "439a8f089f55e101", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "calculators/AmoScheduleCalculator.html"}, "region": {"startLine": 1839}}}]}, {"ruleId": "scanner-10fa9195662009f1", "level": "warning", "message": {"text": "Insecure pattern 'insert_adjacent_html' in calculators/AmoScheduleCalculator.html:2707"}, "properties": {"repobilityId": "34494dbf15e13f01", "scanner": "scanner-primary", "fingerprint": "10fa9195662009f1", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "insert_adjacent_html"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "calculators/AmoScheduleCalculator.html"}, "region": {"startLine": 2707}}}]}, {"ruleId": "scanner-5d38c59406531711", "level": "note", "message": {"text": "Insecure pattern 'document_write' in calculators/SBAFeesCalculator.html:53"}, "properties": {"repobilityId": "f8add79010d6489e", "scanner": "scanner-primary", "fingerprint": "5d38c59406531711", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["owasp", "document_write"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "calculators/SBAFeesCalculator.html"}, "region": {"startLine": 53}}}]}, {"ruleId": "scanner-324787bed0067ea5", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in calculators/SBAFeesCalculator.html:767"}, "properties": {"repobilityId": "d6b368ce4bf27063", "scanner": "scanner-primary", "fingerprint": "324787bed0067ea5", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "calculators/SBAFeesCalculator.html"}, "region": {"startLine": 767}}}]}, {"ruleId": "scanner-c223d63b7ea7b7f6", "level": "warning", "message": {"text": "Insecure pattern 'insert_adjacent_html' in calculators/SBAFeesCalculator.html:996"}, "properties": {"repobilityId": "803edc49c067f889", "scanner": "scanner-primary", "fingerprint": "c223d63b7ea7b7f6", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "insert_adjacent_html"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "calculators/SBAFeesCalculator.html"}, "region": {"startLine": 996}}}]}, {"ruleId": "scanner-1beacb755c86398e", "level": "note", "message": {"text": "Insecure pattern 'document_write' in calculators/DSCRCalculator.html:59"}, "properties": {"repobilityId": "9d2a0c78d5b4ca85", "scanner": "scanner-primary", "fingerprint": "1beacb755c86398e", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["owasp", "document_write"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "calculators/DSCRCalculator.html"}, "region": {"startLine": 59}}}]}, {"ruleId": "scanner-d15493c2556ba930", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in calculators/DSCRCalculator.html:1030"}, "properties": {"repobilityId": "488b59c3dd9fdd68", "scanner": "scanner-primary", "fingerprint": "d15493c2556ba930", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "calculators/DSCRCalculator.html"}, "region": {"startLine": 1030}}}]}, {"ruleId": "scanner-b5193f74e6109210", "level": "note", "message": {"text": "Insecure pattern 'document_write' in calculators/AffordabilityCalculator.html:49"}, "properties": {"repobilityId": "a03912e4ceb1b66e", "scanner": "scanner-primary", "fingerprint": "b5193f74e6109210", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["owasp", "document_write"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "calculators/AffordabilityCalculator.html"}, "region": {"startLine": 49}}}]}, {"ruleId": "scanner-489bb5d9013b4b96", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in calculators/AffordabilityCalculator.html:1328"}, "properties": {"repobilityId": "7aff04a569a79b2f", "scanner": "scanner-primary", "fingerprint": "489bb5d9013b4b96", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "calculators/AffordabilityCalculator.html"}, "region": {"startLine": 1328}}}]}, {"ruleId": "scanner-3b2377123636d606", "level": "note", "message": {"text": "Insecure pattern 'document_write' in calculators/FundabilityCalculator.html:52"}, "properties": {"repobilityId": "f1f95c66e66348b2", "scanner": "scanner-primary", "fingerprint": "3b2377123636d606", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["owasp", "document_write"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "calculators/FundabilityCalculator.html"}, "region": {"startLine": 52}}}]}, {"ruleId": "scanner-347e9396c2f8ced2", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in calculators/FundabilityCalculator.html:948"}, "properties": {"repobilityId": "ec2d5f5a82d21094", "scanner": "scanner-primary", "fingerprint": "347e9396c2f8ced2", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "calculators/FundabilityCalculator.html"}, "region": {"startLine": 948}}}]}, {"ruleId": "scanner-193531a3a9443f9e", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in calculators/deal-read/plan.js:92"}, "properties": {"repobilityId": "6712859e35ae1f50", "scanner": "scanner-primary", "fingerprint": "193531a3a9443f9e", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "calculators/deal-read/plan.js"}, "region": {"startLine": 92}}}]}, {"ruleId": "scanner-588f6ac2f588b07f", "level": "note", "message": {"text": "Insecure pattern 'document_write' in calculators/deal-read/index.html:1233"}, "properties": {"repobilityId": "8944977be6d79a37", "scanner": "scanner-primary", "fingerprint": "588f6ac2f588b07f", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["owasp", "document_write"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "calculators/deal-read/index.html"}, "region": {"startLine": 1233}}}]}, {"ruleId": "scanner-7f83974f2694c1d9", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in calculators/deal-read/read.js:118"}, "properties": {"repobilityId": "bb2ae2432fde3200", "scanner": "scanner-primary", "fingerprint": "7f83974f2694c1d9", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "calculators/deal-read/read.js"}, "region": {"startLine": 118}}}]}, {"ruleId": "scanner-251c7b90b8be047a", "level": "warning", "message": {"text": "Insecure pattern 'direct_outerhtml_assignment' in calculators/deal-read/read.js:375"}, "properties": {"repobilityId": "c561945c35cd6a77", "scanner": "scanner-primary", "fingerprint": "251c7b90b8be047a", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_outerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "calculators/deal-read/read.js"}, "region": {"startLine": 375}}}]}, {"ruleId": "scanner-a795d0d1dada627d", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in public/assets/js/pdf-helper.js:102"}, "properties": {"repobilityId": "cf390500a06903ad", "scanner": "scanner-primary", "fingerprint": "a795d0d1dada627d", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "public/assets/js/pdf-helper.js"}, "region": {"startLine": 102}}}]}, {"ruleId": "scanner-4314b1227c94e2e1", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in public/assets/js/compliance.js:133"}, "properties": {"repobilityId": "7ed224ac96db019a", "scanner": "scanner-primary", "fingerprint": "4314b1227c94e2e1", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "public/assets/js/compliance.js"}, "region": {"startLine": 133}}}]}, {"ruleId": "scanner-fbb2bbc4d2e9c809", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in quote-log/index.html:459"}, "properties": {"repobilityId": "f3d222a87573e5f5", "scanner": "scanner-primary", "fingerprint": "fbb2bbc4d2e9c809", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "quote-log/index.html"}, "region": {"startLine": 459}}}]}, {"ruleId": "scanner-792f07a3d2abe6df", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "64172273f7f64307", "scanner": "scanner-primary", "fingerprint": "792f07a3d2abe6df", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/backlog-dashboard.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-bcb43f6ff44b78ff", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "6ea9bc3beea5bacb", "scanner": "scanner-primary", "fingerprint": "bcb43f6ff44b78ff", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/compliance-watch.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-34029707f9b54caa", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "68f9a95399f1dc0e", "scanner": "scanner-primary", "fingerprint": "34029707f9b54caa", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/sanitize-waterfall.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6e1c9b2d376ec981", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "a82762124240b0aa", "scanner": "scanner-primary", "fingerprint": "6e1c9b2d376ec981", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/compliance-source-verify.yml"}, "region": {"startLine": 47}}}]}, {"ruleId": "scanner-294fa27397df8885", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "8976ffadd4fc9f1b", "scanner": "scanner-primary", "fingerprint": "294fa27397df8885", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/bug-sweep.yml"}, "region": {"startLine": 57}}}]}, {"ruleId": "scanner-df1dcab3c22fd284", "level": "note", "message": {"text": "Very large file: calculators/deal-read/read.js (2135 lines)"}, "properties": {"repobilityId": "0ed6edba26780dab", "scanner": "scanner-primary", "fingerprint": "df1dcab3c22fd284", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-9778fa30926197c0", "level": "note", "message": {"text": "Very large file: public/assets/js/pdf-helper.js (1285 lines)"}, "properties": {"repobilityId": "6cdbad21939d7355", "scanner": "scanner-primary", "fingerprint": "9778fa30926197c0", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-ea3b5e389d8c9c0f", "level": "note", "message": {"text": "Low test-to-source ratio"}, "properties": {"repobilityId": "ef7b2552cc00a375", "scanner": "scanner-primary", "fingerprint": "ea3b5e389d8c9c0f", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["tests"]}}, {"ruleId": "scanner-141b30a41e03817b", "level": "note", "message": {"text": "No license file detected"}, "properties": {"repobilityId": "d05f92d064cf3439", "scanner": "scanner-primary", "fingerprint": "141b30a41e03817b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["license", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "92ec4fb47645f14b", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-72b2a6250083a784", "level": "warning", "message": {"text": "Placeholder or mock-heavy implementation detected"}, "properties": {"repobilityId": "1f8172f0068e2e9f", "scanner": "scanner-primary", "fingerprint": "72b2a6250083a784", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "incomplete", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "dc1d3e79e5e1ea0b", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-749d4bc1bd66df5f", "level": "warning", "message": {"text": "Agent instructions exist but release-hardening basics are missing"}, "properties": {"repobilityId": "320224b0a91f9171", "scanner": "scanner-primary", "fingerprint": "749d4bc1bd66df5f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "d820479968068af1", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "690686fd37005b66", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-ddb35dba557b87a5", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 scrapers/scrape_targeted.py:327"}, "properties": {"repobilityId": "a8cda31f4ac73285", "scanner": "scanner-primary", "fingerprint": "ddb35dba557b87a5", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-6de887459b0275d1", "level": "none", "message": {"text": "Commented-code block (7 lines) in js/feedback-pulse.js:3"}, "properties": {"repobilityId": "4b4a32f958523dfc", "scanner": "scanner-primary", "fingerprint": "6de887459b0275d1", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-b186854dd956c011", "level": "none", "message": {"text": "Commented-code block (11 lines) in js/completion-cue.js:1"}, "properties": {"repobilityId": "bfd5405482f29d88", "scanner": "scanner-primary", "fingerprint": "b186854dd956c011", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-d65e5df263a3c717", "level": "note", "message": {"text": "Legacy-named symbol `lp_tenant_v1` in js/quote-log.js:84"}, "properties": {"repobilityId": "16393b8c9667aa32", "scanner": "scanner-primary", "fingerprint": "d65e5df263a3c717", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-a23b4bc2305fdeb1", "level": "none", "message": {"text": "Commented-code block (5 lines) in js/quote-log.js:1"}, "properties": {"repobilityId": "0ff117de0c118aef", "scanner": "scanner-primary", "fingerprint": "a23b4bc2305fdeb1", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-0189d1876bc86e84", "level": "none", "message": {"text": "Commented-code block (8 lines) in js/doc-combine.js:260"}, "properties": {"repobilityId": "65dca6b2884ca5b7", "scanner": "scanner-primary", "fingerprint": "0189d1876bc86e84", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-1d1b9dc11d1f1fdb", "level": "note", "message": {"text": "Legacy-named symbol `lp_nudge_v1` in js/nudge-config.js:13"}, "properties": {"repobilityId": "f2f7afd09baf53a4", "scanner": "scanner-primary", "fingerprint": "1d1b9dc11d1f1fdb", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-8e67acff4c271fcc", "level": "none", "message": {"text": "Commented-code block (7 lines) in js/nudge-config.js:15"}, "properties": {"repobilityId": "9f6b712fd9140c35", "scanner": "scanner-primary", "fingerprint": "8e67acff4c271fcc", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-d5abc320e8d6f919", "level": "note", "message": {"text": "Legacy-named symbol `lp_tenant_v1` in js/auth.js:117"}, "properties": {"repobilityId": "8965cd4108a3c63b", "scanner": "scanner-primary", "fingerprint": "d5abc320e8d6f919", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-19bcd41072e65213", "level": "none", "message": {"text": "Commented-code block (9 lines) in js/auth.js:3"}, "properties": {"repobilityId": "f57843a002ebc9e7", "scanner": "scanner-primary", "fingerprint": "19bcd41072e65213", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-4e236f744f7a0df7", "level": "none", "message": {"text": "Commented-code block (6 lines) in js/deal-log-tour.js:11"}, "properties": {"repobilityId": "555023cf5d410d47", "scanner": "scanner-primary", "fingerprint": "4e236f744f7a0df7", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-ca487c17ab83b959", "level": "note", "message": {"text": "Legacy-named symbol `lp_tour_v1` in js/tour-config.js:8"}, "properties": {"repobilityId": "ba720ac509504c74", "scanner": "scanner-primary", "fingerprint": "ca487c17ab83b959", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-6ad2535bb57262cb", "level": "none", "message": {"text": "Commented-code block (5 lines) in js/tour-config.js:90"}, "properties": {"repobilityId": "e197fbadda030a16", "scanner": "scanner-primary", "fingerprint": "6ad2535bb57262cb", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-6e4127a5b792cb6b", "level": "note", "message": {"text": "Legacy-named symbol `lp_tenant_v1` in js/branding.js:26"}, "properties": {"repobilityId": "ab9ad4dd2c6a72a0", "scanner": "scanner-primary", "fingerprint": "6e4127a5b792cb6b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-ab5a2597f8e88610", "level": "none", "message": {"text": "Commented-code block (5 lines) in js/branding.js:29"}, "properties": {"repobilityId": "68427775d1ad066f", "scanner": "scanner-primary", "fingerprint": "ab5a2597f8e88610", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-a3259f5c276f1d28", "level": "none", "message": {"text": "Commented-code block (6 lines) in js/save-gate.js:3"}, "properties": {"repobilityId": "a5f2c6c67bb45c65", "scanner": "scanner-primary", "fingerprint": "a3259f5c276f1d28", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-305f84fa11273504", "level": "none", "message": {"text": "Commented-code block (5 lines) in js/tour.js:17"}, "properties": {"repobilityId": "c085ee1c0cbb53b9", "scanner": "scanner-primary", "fingerprint": "305f84fa11273504", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-e1485fbd1190809b", "level": "none", "message": {"text": "Commented-code block (5 lines) in supabase/functions/send-email/index.ts:5"}, "properties": {"repobilityId": "64979f4a989e55e4", "scanner": "scanner-primary", "fingerprint": "e1485fbd1190809b", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-4e44e5f7f11249fe", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 supabase/functions/send-email/index.ts:52"}, "properties": {"repobilityId": "609388dc68e936ee", "scanner": "scanner-primary", "fingerprint": "4e44e5f7f11249fe", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-863a183a295ff5ff", "level": "none", "message": {"text": "Commented-code block (8 lines) in supabase/functions/send-invite/index.ts:4"}, "properties": {"repobilityId": "8aa643ef17b69f4f", "scanner": "scanner-primary", "fingerprint": "863a183a295ff5ff", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-e227c80d2f7e088d", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 supabase/functions/send-invite/index.ts:106"}, "properties": {"repobilityId": "b3eefd12ef85163c", "scanner": "scanner-primary", "fingerprint": "e227c80d2f7e088d", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-55af85148f1d8d04", "level": "none", "message": {"text": "Commented-code block (5 lines) in supabase/functions/notify-new-signup/index.ts:3"}, "properties": {"repobilityId": "75c3f34b79f06292", "scanner": "scanner-primary", "fingerprint": "55af85148f1d8d04", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-f7fad383eda5a692", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 supabase/functions/notify-new-signup/index.ts:116"}, "properties": {"repobilityId": "d08a17748f87515b", "scanner": "scanner-primary", "fingerprint": "f7fad383eda5a692", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-9254d12339710dd5", "level": "none", "message": {"text": "Commented-code block (8 lines) in tools/qa/bug-sweep.js:3"}, "properties": {"repobilityId": "090b2737660db04e", "scanner": "scanner-primary", "fingerprint": "9254d12339710dd5", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-7ec01ae55fb29c20", "level": "none", "message": {"text": "Commented-code block (5 lines) in tools/qa/tests/legislation.spec.js:3"}, "properties": {"repobilityId": "c0782591989533e6", "scanner": "scanner-primary", "fingerprint": "7ec01ae55fb29c20", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-f59fe1bcecf6784e", "level": "none", "message": {"text": "Commented-code block (5 lines) in tools/qa/tests/golden.spec.js:4"}, "properties": {"repobilityId": "d3935015f11dde67", "scanner": "scanner-primary", "fingerprint": "f59fe1bcecf6784e", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-bc814cf5407d3954", "level": "note", "message": {"text": "Legacy-named symbol `lp_cd_tour_v2` in tools/qa/lib/test.js:20"}, "properties": {"repobilityId": "8038708267e80939", "scanner": "scanner-primary", "fingerprint": "bc814cf5407d3954", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-0b1616eca8423d77", "level": "none", "message": {"text": "Commented-code block (5 lines) in tools/qa/lib/test.js:15"}, "properties": {"repobilityId": "23be83be0f756eea", "scanner": "scanner-primary", "fingerprint": "0b1616eca8423d77", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-833e794a16a04347", "level": "none", "message": {"text": "Commented-code block (8 lines) in tools/backlog/build-snapshot.js:40"}, "properties": {"repobilityId": "f85d5e99b403b8e4", "scanner": "scanner-primary", "fingerprint": "833e794a16a04347", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-61a38387e0861b0b", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 tools/backlog/build-snapshot.js:83"}, "properties": {"repobilityId": "e9cf92f4dbd5065b", "scanner": "scanner-primary", "fingerprint": "61a38387e0861b0b", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-e1a04a18304f4bdf", "level": "note", "message": {"text": "Stub function `log_message` (body is just `pass`/`return`) \u2014 tools/staging/launchpad.py:208"}, "properties": {"repobilityId": "565319cc699bc6bc", "scanner": "scanner-primary", "fingerprint": "e1a04a18304f4bdf", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "empty-handler", "dead-code"]}}, {"ruleId": "scanner-52baa85a3a65d376", "level": "none", "message": {"text": "Commented-code block (5 lines) in calculators/deal-read/talk.js:76"}, "properties": {"repobilityId": "39d351c234144c8e", "scanner": "scanner-primary", "fingerprint": "52baa85a3a65d376", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-2d163d69f1cbdbdd", "level": "none", "message": {"text": "Commented-code block (5 lines) in calculators/deal-read/data.js:1"}, "properties": {"repobilityId": "1260666ac9e24a12", "scanner": "scanner-primary", "fingerprint": "2d163d69f1cbdbdd", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-43ef2f4a497781a9", "level": "none", "message": {"text": "Commented-code block (5 lines) in calculators/deal-read/deal.js:6"}, "properties": {"repobilityId": "ec893e046e6edca6", "scanner": "scanner-primary", "fingerprint": "43ef2f4a497781a9", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-980f2c31fc643f0c", "level": "note", "message": {"text": "Legacy-named symbol `lp_deal_read_v1` in calculators/deal-read/read.js:20"}, "properties": {"repobilityId": "34f3bf7734ffc0b8", "scanner": "scanner-primary", "fingerprint": "980f2c31fc643f0c", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-d6c666555283031e", "level": "none", "message": {"text": "Commented-code block (6 lines) in calculators/deal-read/read.js:387"}, "properties": {"repobilityId": "b9ed0fdd4c2e7c96", "scanner": "scanner-primary", "fingerprint": "d6c666555283031e", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "91b995282d633398", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "e6ede64fe42ac88b", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "c12a53d8c6887135", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}]}]}